@oimlsmart/platform-server 0.1.0

package/migrations/0012_strong_auth.sql

@@ -0,0 +1,109 @@
+-- Migration 0012 — the strong-authentication wave (TODO.identity-sso/02
+-- passkeys + /03 the factor registry): passkeys (WebAuthn credentials),
+-- TOTP authenticator apps, recovery codes, the one-time ceremony state
+-- (WebAuthn challenges + the pending second-factor sign-in row), and the
+-- authentication provenance (amr, RFC 8176) riding sessions → codes →
+-- access tokens into the ID token.
+-- schema.sql carries the same end state for fresh databases —
+-- src/__tests__/d1-store.test.ts pins the UNION of every migration to
+-- schema.sql's CREATE set.
+
+-- The sign-in provenance (the session's amr list, a JSON array of RFC
+-- 8176 values — 'pwd', 'otp', 'webauthn', 'hwk', plus the OP-private
+-- 'recovery' for a recovery-code entry). NULL = no OP-side credential
+-- event recorded (an upstream-provider sign-in).
+ALTER TABLE sessions ADD COLUMN amr TEXT;
+-- The consenting session's provenance, stamped on the one-time code so
+-- the token endpoint emits the ID token's amr; carried onto the access
+-- token so userinfo answers the same truth.
+ALTER TABLE oidc_codes ADD COLUMN amr TEXT;
+ALTER TABLE oidc_access_tokens ADD COLUMN amr TEXT;
+
+-- The passkeys (wave 02). credential_id is the authenticator's own
+-- (base64url); public_key is the COSE key bytes (base64url) as the
+-- attestation carried them; sign_count is the authenticator's signature
+-- counter (a REGRESSED count on assertion is the clone signal — the
+-- advance is a guarded UPDATE, the regression refuses + audits);
+-- aaguid + transports record what the browser declared (attestation is
+-- 'none' at this assurance level — display hints, never proof).
+CREATE TABLE IF NOT EXISTS webauthn_credentials (
+  credential_id TEXT PRIMARY KEY,
+  user_id TEXT NOT NULL REFERENCES users(id),
+  name TEXT NOT NULL,
+  public_key TEXT NOT NULL,
+  sign_count INTEGER NOT NULL DEFAULT 0,
+  aaguid TEXT,
+  transports TEXT,
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  last_used_at TEXT,
+  last_ip TEXT
+);
+CREATE INDEX IF NOT EXISTS idx_webauthn_credentials_user ON webauthn_credentials (user_id);
+
+-- The TOTP authenticator apps (RFC 6238, 30 s step, 6 digits, HMAC-SHA-1).
+-- verified_at NULL = the PENDING enrollment: it activates ONLY on the
+-- first valid code, and the enrollment verify carries a hard throttle
+-- (fail_count + last_failure_at — the six-digit window invites brute
+-- force). The secret is base32 and never leaves the server after the
+-- enrollment answer.
+CREATE TABLE IF NOT EXISTS totp_secrets (
+  id TEXT PRIMARY KEY,
+  user_id TEXT NOT NULL REFERENCES users(id),
+  name TEXT NOT NULL,
+  secret TEXT NOT NULL,
+  fail_count INTEGER NOT NULL DEFAULT 0,
+  last_failure_at TEXT,
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  verified_at TEXT,
+  last_used_at TEXT,
+  last_ip TEXT
+);
+CREATE INDEX IF NOT EXISTS idx_totp_secrets_user ON totp_secrets (user_id);
+
+-- The recovery codes: generated at the first factor's enrollment, shown
+-- once, stored HASHED (SHA-256 of the normalized code — 80 bits of
+-- random per code, so an unsalted hash resists the offline attack), one
+-- time each (consumed_at flips atomically). Regeneration REPLACES the
+-- account's set (batch marks the generation; the old set is deleted with
+-- the audit event).
+CREATE TABLE IF NOT EXISTS recovery_codes (
+  id TEXT PRIMARY KEY,
+  user_id TEXT NOT NULL REFERENCES users(id),
+  batch TEXT NOT NULL,
+  code_hash TEXT NOT NULL,
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  consumed_at TEXT
+);
+CREATE INDEX IF NOT EXISTS idx_recovery_codes_user ON recovery_codes (user_id);
+
+-- The one-time WebAuthn ceremony challenges (the database-is-the-proof
+-- doctrine, the sso_states/enrollment_tokens pattern): short TTL,
+-- consumed atomically. user_id binds the registration + the second-factor
+-- assertion to the account; the PASSWORDLESS assertion's row carries NULL
+-- (the asserted credential id resolves the account).
+CREATE TABLE IF NOT EXISTS webauthn_challenges (
+  challenge TEXT PRIMARY KEY,
+  user_id TEXT REFERENCES users(id),
+  kind TEXT NOT NULL,
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  expires_at TEXT NOT NULL,
+  consumed_at TEXT
+);
+CREATE INDEX IF NOT EXISTS idx_webauthn_challenges_user ON webauthn_challenges (user_id);
+
+-- The pending second-factor sign-in: the password verified, the account
+-- holds factors, the session waits on the factor. One-time (consumed at
+-- completion), short TTL, and the per-account throttle rides the row:
+-- fail_count + last_failure_at give the backoff ladder, and the cap
+-- burns the attempt (audit + the account's lockout email).
+CREATE TABLE IF NOT EXISTS mfa_pending (
+  token TEXT PRIMARY KEY,
+  user_id TEXT NOT NULL REFERENCES users(id),
+  amr TEXT NOT NULL,
+  fail_count INTEGER NOT NULL DEFAULT 0,
+  last_failure_at TEXT,
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  expires_at TEXT NOT NULL,
+  consumed_at TEXT
+);
+CREATE INDEX IF NOT EXISTS idx_mfa_pending_user ON mfa_pending (user_id);

package/migrations/0013_org_registry.sql

@@ -0,0 +1,53 @@
+-- Migration 0013 — the organization registry (TODO.identity-features/05:
+-- organizations as first-class citizens of the identity plane). One row
+-- per organization: the stable SLUG id (for a participant org the OIML
+-- code IS the id — the platform resolves the org claim against its own
+-- participant registry directly, the mapping is identity, never a lookup
+-- table), the display data, the OPTIONAL participant_ref annotation (the
+-- link's documentation, never a key), and the lifecycle state.
+--
+-- Removal is DISABLE honestly (the route's act: the org's active
+-- memberships disable, its members' per-org roles stop carrying; the
+-- audit trail keeps the history); the erasure-adjacent hard delete
+-- exists only for an org that never held a membership (the route
+-- refuses it while a membership or a join request references the org).
+--
+-- The membership graph (org_memberships, migration 0011) references the
+-- org by id WITHOUT a foreign key, deliberately: the scheme-side
+-- participants register and this identity-side registry never merge
+-- (the spec's §4), and a membership row's honesty (its lifecycle state)
+-- never depends on a join.
+--
+-- No backfill, honestly: the production registry starts EMPTY and the
+-- identity administrator adds the organizations deliberately (the wave's
+-- whole point); the memberships reference org ids as plain strings, so
+-- nothing breaks at the SQL level, and every read degrades to the raw
+-- id until the admin curates the row. The dev/e2e posture seeds the
+-- demonstration register's rows (server/seed-org-register.ts).
+-- schema.sql carries the same end state for fresh databases —
+-- src/__tests__/d1-store.test.ts pins the UNION of every migration to
+-- schema.sql's CREATE set.
+
+CREATE TABLE IF NOT EXISTS org_registry (
+  id TEXT PRIMARY KEY,
+  name TEXT NOT NULL,
+  short_name TEXT,
+  -- The participant kind (the OIML-CS program's four); NULL = a
+  -- non-participant org (the estate operator's own org, a consumer).
+  kind TEXT,
+  country TEXT,
+  -- The contacts (a JSON array of { name, email }; a malformed entry is
+  -- skipped on read, never trusted).
+  contacts TEXT NOT NULL DEFAULT '[]',
+  -- The participant-link annotation (which participant record the org
+  -- mirrors); documentation only.
+  participant_ref TEXT,
+  state TEXT NOT NULL DEFAULT 'active',
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  created_by TEXT,
+  updated_at TEXT,
+  updated_by TEXT,
+  disabled_at TEXT,
+  disabled_by TEXT
+);
+CREATE INDEX IF NOT EXISTS idx_org_registry_state ON org_registry (state);

package/migrations/0014_notify_inbox.sql

@@ -0,0 +1,34 @@
+-- TODO.notify/03 — the inbox state (migration 0014 in the shared
+-- numbering; 0013 is the org registry's, identity-features/05 merged
+-- via #194 while this wave was in flight — the D1 migrations journal
+-- keys on the FILE NAME, so the rename is the renumber). The
+-- notification system's per-user per-event read markers
+-- (TODO.notify/00's contract: "the inbox state
+-- (D1): per-user per-event state (read / done / saved) written lazily at
+-- read; the feed itself is COMPUTED at read"). One row per (user, event),
+-- created at the first act on the row:
+--
+--   read_at  the mark-read stamp (NULL = unread; the unread filter and
+--            the unread count read it);
+--   done_at  the done stamp (NULL = in the inbox; done is the archive —
+--            the row leaves the feed, the marker keeps the state honest).
+--
+-- 'saved' joins with wave 05 (the GitHub polish). The rows name the
+-- user + the event WITHOUT foreign keys, deliberately: the demo reset
+-- (and wave 04's retention sweep) deletes events while the user's
+-- markers stay — the subscriptions store's own posture (the user's
+-- state is their own, never the workflow's); a marker on a wiped event
+-- simply never joins. The write path's guard is the integrity (a marker
+-- lands only on an event that exists, is visible and is the caller's —
+-- server/notify-inbox.ts's inboxEventVisibleTo), and the dev-reset's
+-- OIDC-user wipe never blocks on a marker either. The d1-store suite's
+-- drift tripwire pins this migration set's end state to schema.sql.
+CREATE TABLE IF NOT EXISTS notify_inbox_state (
+  user_id TEXT NOT NULL,
+  event_id TEXT NOT NULL,
+  read_at TEXT,
+  done_at TEXT,
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  PRIMARY KEY (user_id, event_id)
+);
+CREATE INDEX IF NOT EXISTS idx_notify_inbox_state_user ON notify_inbox_state (user_id);

package/migrations/0015_certificate_holder_attribution.sql

@@ -0,0 +1,63 @@
+-- Migration 0015 — the register's holder-org attribution (TODO.register/02:
+-- "my organization's certificates"). The certificate's holder becomes the
+-- OP-minted ORG id end to end: the application binds the applicant account's
+-- active org (applicant_org_id), the issued certificate carries it as the
+-- holder-org descriptor (json_data.holder_org — additive entity content, no
+-- schema change), the federation registration package transports it, and the
+-- HUB stores the descriptor on the registered certificate as an ATTRIBUTION
+-- ROW here — the hub's own record, never a write into the sender's imported
+-- artifact.
+--
+-- THE NUMBERING: 0013_org_registry is merged; the notify-03 inbox wave holds
+-- 0014; THIS wave (TODO.register/02) holds 0015; the serial-registration wave
+-- (TODO.register/03) takes 0016. Expand-only: two new tables, no alterations.
+-- The identity repo (oimlsmart/identity) mirrors this migration set
+-- byte-identical (552's precedent) — the coordinator carries the mirror.
+--
+-- certificate_holder_orgs: ONE row per certificate (the primary key) — the
+-- first attribution wins; the claim act's confirmation is the only other
+-- writer (a claimed row is deliberate, never silently overwritten). The org
+-- display name is DENORMALIZED at attribution time: the register reads
+-- correctly even when the org later renames (the register's permanence rule).
+--
+-- certificate_holder_claims: the legacy-row CLAIM act's state machine. A
+-- certificate registered before this program (or arriving via records mode /
+-- CSV) carries a free-text holder and no descriptor; the manufacturer org's
+-- administrator claims the row by holder-name match (the matched name is
+-- snapshotted as the claim's evidence), an estate admin confirms or refuses
+-- (atomic on 'pending'), and the audit chain (auditEvents) carries both acts.
+-- A refused claim never blocks a fresh claim; a confirmed claim is terminal.
+
+CREATE TABLE IF NOT EXISTS certificate_holder_orgs (
+  certificate_id TEXT PRIMARY KEY,
+  org_id TEXT NOT NULL,
+  -- The org's display name at attribution time (denormalized — the
+  -- register's permanence; never a join).
+  org_name TEXT NOT NULL,
+  -- 'registration' (the chain's carried descriptor, extracted by the
+  -- registrar's act) | 'claim' (the confirmed legacy-row claim).
+  source TEXT NOT NULL,
+  attributed_at TEXT NOT NULL,
+  attributed_by TEXT,
+  -- The confirming claim (source 'claim' only).
+  claim_id TEXT
+);
+CREATE INDEX IF NOT EXISTS idx_certificate_holder_orgs_org ON certificate_holder_orgs (org_id);
+
+CREATE TABLE IF NOT EXISTS certificate_holder_claims (
+  id TEXT PRIMARY KEY,
+  certificate_id TEXT NOT NULL,
+  claimant_org_id TEXT NOT NULL,
+  claimant_org_name TEXT NOT NULL,
+  -- The certificate's free-text holder name the claim matched (snapshot).
+  matched_holder_name TEXT NOT NULL,
+  claimed_by TEXT NOT NULL,
+  state TEXT NOT NULL DEFAULT 'pending',
+  decided_by TEXT,
+  decided_at TEXT,
+  refusal_reason TEXT,
+  created_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS idx_certificate_holder_claims_cert ON certificate_holder_claims (certificate_id);
+CREATE INDEX IF NOT EXISTS idx_certificate_holder_claims_state ON certificate_holder_claims (state);
+CREATE INDEX IF NOT EXISTS idx_certificate_holder_claims_org ON certificate_holder_claims (claimant_org_id);

package/migrations/0016_instrument_registrations.sql

@@ -0,0 +1,78 @@
+-- Migration 0016 — the instrument register (TODO.register/03: the
+-- serial-number registration interface). One row per REGISTERED
+-- instrument: the serial number riding under a type certificate, the
+-- holder organization (the manufacturer), the Recommendation the
+-- certificate belongs to, the manufacture date, the per-serial
+-- designations (the concrete scope parameters the scope check evaluated
+-- — accuracy class, capacity, …), the scope verdict recorded AT
+-- REGISTRATION (in_scope, or scope_unverified when the certificate's
+-- scope block is not structured — the records-mode honest-degradation
+-- posture), and the lifecycle (registered / out_of_service / withdrawn).
+--
+-- The scope REFUSAL never lands a row: an out-of-scope declaration is
+-- refused with the reason by the route (the executing-scope doctrine at
+-- the instrument level), so every row here is a registration that stood.
+-- The batch import's per-row verdicts are answered to the caller, never
+-- persisted; the committed rows are the valid ones (never a partial
+-- SILENT import — the refusal report is the caller's record).
+--
+-- Uniqueness: one serial number per certificate (the register's whole
+-- point — the same physical unit never registers twice under one type
+-- certificate). The route turns the conflict into the honest 409.
+--
+-- NOT mirrored into the identity service's migration set: the byte-
+-- identity rule covers the OP's tables, and the instrument register is
+-- platform-side (the identity deploy never shares it — TODO.register/03
+-- §The model). The holder_org_id references the identity plane's
+-- organization by id WITHOUT a foreign key, deliberately — the same
+-- posture org_memberships practices (migration 0011): the identity-side
+-- registry and this platform-side register never merge, and a
+-- registration row's honesty never depends on a join.
+--
+-- No backfill: the register starts empty and fills through the
+-- registration acts (the UI, the CSV batch, the API). schema.sql
+-- carries the same end state for fresh databases —
+-- src/__tests__/d1-store.test.ts pins the UNION of every migration to
+-- schema.sql's CREATE set.
+
+CREATE TABLE IF NOT EXISTS instrument_registrations (
+  id TEXT PRIMARY KEY,
+  -- The certificate the serial rides under (the entity store's
+  -- certificates row id — a platform reference, never a key into the
+  -- identity plane).
+  certificate_id TEXT NOT NULL,
+  -- The holder organization (the manufacturer org id; the identity
+  -- plane's org, referenced by id without a foreign key).
+  holder_org_id TEXT NOT NULL,
+  -- The Recommendation the certificate belongs to (the kind of
+  -- measuring instrument — certificates.standard_id).
+  standard_id TEXT NOT NULL,
+  serial_number TEXT NOT NULL,
+  -- The manufacture date (ISO date text; NULL when the declaration
+  -- did not carry it).
+  manufacture_date TEXT,
+  -- The per-serial designations the scope check evaluated (a JSON
+  -- object; e.g. { "accuracy_class": "C", "e_max": { "value": 2.2,
+  -- "unit": "t" } }).
+  designations TEXT NOT NULL DEFAULT '{}',
+  -- The scope verdict AT REGISTRATION: 'in_scope' (the structured
+  -- scope block covered the designations) or 'scope_unverified' (the
+  -- certificate carries no structured scope block — the records-mode
+  -- honest degradation; the IA's oversight surface sees exactly this
+  -- mark). The refused declaration never lands a row.
+  scope_status TEXT NOT NULL,
+  -- The verdict's record: the matched classification label (in_scope)
+  -- or the unverified note (scope_unverified).
+  scope_detail TEXT,
+  lifecycle TEXT NOT NULL DEFAULT 'registered',
+  -- The lifecycle act's provenance (the last act's actor + moment; the
+  -- registration itself stamps registered_at/by).
+  registered_at TEXT NOT NULL DEFAULT (datetime('now')),
+  registered_by TEXT,
+  updated_at TEXT,
+  updated_by TEXT,
+  UNIQUE (certificate_id, serial_number)
+);
+CREATE INDEX IF NOT EXISTS idx_instrument_registrations_certificate ON instrument_registrations (certificate_id);
+CREATE INDEX IF NOT EXISTS idx_instrument_registrations_holder ON instrument_registrations (holder_org_id);
+CREATE INDEX IF NOT EXISTS idx_instrument_registrations_lifecycle ON instrument_registrations (lifecycle);

package/package.json

@@ -0,0 +1,52 @@
+{
+  "name": "@oimlsmart/platform-server",
+  "version": "0.1.0",
+  "description": "The OIML SMART platform server kernel: the store seam (ServerStore + the D1 and SQLite implementations), the canonical D1 migration set both deployments apply, the instance profile, the mailer, the RBAC map, the OIDC/OAuth client cones, and the shared role/permission vocabulary. Consumed by the smart monorepo (browser/) and the identity service.",
+  "type": "module",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/oimlsmart/platform-server.git"
+  },
+  "exports": {
+    "./store": "./src/store.ts",
+    "./store/d1": "./src/store/d1.ts",
+    "./store/sqlite": "./src/store/sqlite.ts",
+    "./profile": "./src/profile.ts",
+    "./profile/node": "./src/profile/node.ts",
+    "./mailer": "./src/mailer.ts",
+    "./rbac": "./src/rbac.ts",
+    "./rbac/node": "./src/rbac/node.ts",
+    "./oidc": "./src/oidc.ts",
+    "./github": "./src/github.ts",
+    "./session": "./src/session.ts",
+    "./client-info": "./src/client-info.ts",
+    "./vocab": "./src/vocab/index.ts",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "src",
+    "migrations",
+    "README.md"
+  ],
+  "scripts": {
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit"
+  },
+  "dependencies": {
+    "@cloudflare/workers-types": "^5.20260813.1",
+    "@types/better-sqlite3": "^7.6.13",
+    "@types/js-yaml": "^4.0.9",
+    "@types/node": "^24.12.2",
+    "bcryptjs": "^3.0.3",
+    "better-sqlite3": "^12.10.0",
+    "hono": "^4.12.23",
+    "js-yaml": "^4.1.1"
+  },
+  "devDependencies": {
+    "typescript": "~6.0.2",
+    "vitest": "^4.1.5"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/src/client-info.ts

@@ -0,0 +1,25 @@
+// ═══════════════════════════════════════════════════════════════════
+// The request's client context (TODO.identity/06) — the user agent and
+// the client IP, stamped on the session row at creation so the account
+// console's sessions section can name every sign-in. The IP resolves
+// from the platform's proxy headers (the Worker's cf-connecting-ip
+// first, then the first x-forwarded-for hop, the rate-limit.ts rule);
+// a request that carries neither records NULL, and the console says
+// "not recorded" — never a guessed value.
+//
+// WORKER-SAFE: headers only, no node built-ins.
+// ═══════════════════════════════════════════════════════════════════
+
+import type { KernelContext } from './context'
+
+export interface ClientInfo {
+  userAgent: string | null
+  ip: string | null
+}
+
+export function clientInfo(c: KernelContext): ClientInfo {
+  const ua = c.req.header('user-agent') ?? null
+  const forwarded = c.req.header('x-forwarded-for')?.split(',')[0]?.trim()
+  const ip = c.req.header('cf-connecting-ip') ?? (forwarded || null)
+  return { userAgent: ua || null, ip }
+}

package/src/context.ts

@@ -0,0 +1,31 @@
+// ═══════════════════════════════════════════════════════════════════
+// The kernel's request-context type (TODO.identity-extract/01).
+//
+// The kernel is consumed through a file: link in the monorepo and from
+// npm by the identity service; in BOTH shapes its sources resolve hono
+// from a DIFFERENT module instance than the consuming app's. hono's
+// Context/HonoRequest carry a `unique symbol` brand (GET_MATCH_RESULT),
+// so the two instances' Context types are nominally incompatible — a
+// kernel helper typed on hono's Context would reject the app's contexts
+// at the seam (and a tsconfig-paths type alias is not an answer: tsx
+// applies tsconfig paths at RUNTIME and would resolve the value import
+// to a .d.ts).
+//
+// So the kernel never names hono's Context in a public signature. It
+// names THIS: the structural slice it actually touches (the request's
+// header read + the env slot). hono's Context satisfies it structurally
+// (HonoRequest.header has the `header(name: string)` overload); the
+// hono boundary inside each helper holds one documented cast.
+// ═══════════════════════════════════════════════════════════════════
+
+export interface KernelContext {
+  req: {
+    header(name: string): string | undefined
+    /** hono's HonoRequest.raw — the cookie helper reads the Cookie
+     *  header off the raw request. */
+    raw: Request
+  }
+  /** hono's Context.env (process.env on node, the bindings on the
+   *  Worker) — read through hono/adapter's env() at the seam. */
+  env?: unknown
+}