@omnitron-dev/omnitron 0.3.0 → 0.3.2

package/dist/services/audit.service.js

@@ -45,12 +45,15 @@
  * console reads too) reads either convention, including the older one of
  * naming the failure in the action (`node.upgrade.failed`).
  *
- * Best-effort by design: the action has already happened — or already failed
+ * Best-effort by default: the action has already happened — or already failed
  * — when this is called, and failing it afterwards would turn an unrecorded
  * change into a broken one. A write that fails is reported at error with the
  * action it could not record, which is the state an operator needs to know
  * about.
+ * Actions that require an audit record BEFORE execution pass `required: true`.
+ * Those callers fail closed when the database is absent or the insert fails.
  */
+import { redactDiagnosticText } from '@omnitron-dev/titan/diagnostics';
 import { redactTokens } from '../release/publish.js';
 import { getCurrentAuth, getRequestContext } from './auth-context.js';
 /**
@@ -67,21 +70,43 @@ export const ACTOR_TYPES = ['user', 'service', 'system'];
  */
 export const MAX_AUDIT_PAGE = 500;
 /** Keys whose VALUE is a credential, whatever the caller meant by them. */
-const SECRET_KEY = /password|passphrase|secret|token|credential|privatekey|apikey/i;
-/** `details`, with anything that looks like a credential removed. */
+const SECRET_KEY = /password|passphrase|secret|token|credential|private[_-]?key|api[_-]?key|authorization|cookie|mnemonic|seed/i;
+/** Preserve structured facts, with bounded recursion and redaction at every level.
+ * Applied at write AND read so historical array payloads cannot expose credentials. */
 export function scrubDetails(details) {
     if (!details)
         return null;
-    const out = {};
-    for (const [key, value] of Object.entries(details)) {
-        if (SECRET_KEY.test(key)) {
-            out[key] = '[redacted]';
-            continue;
+    const active = new WeakSet();
+    let remaining = 1000;
+    const visit = (value, depth) => {
+        if (--remaining < 0 || depth > 8)
+            return '[truncated]';
+        if (typeof value === 'string')
+            return redactDiagnosticText(value);
+        if (value === null || typeof value === 'number' || typeof value === 'boolean')
+            return value;
+        if (typeof value !== 'object')
+            return '[unsupported]';
+        if (active.has(value))
+            return '[circular]';
+        active.add(value);
+        try {
+            if (Array.isArray(value)) {
+                const items = value.slice(0, 100).map(item => visit(item, depth + 1));
+                if (value.length > 100)
+                    items.push('[truncated]');
+                return items;
+            }
+            const entries = Object.entries(value).slice(0, 100).map(([key, item]) => [key, SECRET_KEY.test(key) ? '[redacted]' : visit(item, depth + 1)]);
+            if (Object.keys(value).length > 100)
+                entries.push(['[truncated]', true]);
+            return Object.fromEntries(entries);
         }
-        // One level. A nested object is a payload, and this table takes facts.
-        out[key] = value && typeof value === 'object' && !Array.isArray(value) ? '[object]' : value;
-    }
-    return out;
+        finally {
+            active.delete(value);
+        }
+    };
+    return visit(details, 0);
 }
 /** The longest failure a row keeps. The whole error is in the daemon log. */
 const MAX_FAILURE_TEXT = 300;
@@ -116,8 +141,8 @@ export function currentActor() {
         return { actorId: null, actorType: 'system' };
     const roles = auth.roles ?? [];
     // A master reaching a node carries `service_role` and no human behind it.
-    if (roles.includes('service_role') && !auth.userId) {
-        return { actorId: null, actorType: 'service' };
+    if (roles.includes('service_role')) {
+        return { actorId: auth.userId || null, actorType: 'service' };
     }
     return { actorId: auth.userId ?? null, actorType: auth.userId ? 'user' : 'system' };
 }
@@ -134,9 +159,16 @@ export class AuditService {
     get available() {
         return this.db !== null;
     }
-    async record(entry) {
-        if (!this.db)
+    /** Include the audit row in the caller's transaction; rollback both on failure. */
+    inTransaction(db) {
+        return new AuditService(this.logger, db);
+    }
+    async record(entry, required = false) {
+        if (!this.db) {
+            if (required)
+                throw new Error('Audit storage is required for this operation');
             return;
+        }
         const { actorId, actorType } = currentActor();
         const ipAddress = getRequestContext()?.ipAddress ?? null;
         // After the scrub, so neither can be mistaken for something to redact;
@@ -164,7 +196,9 @@ export class AuditService {
                 .execute();
         }
         catch (err) {
-            this.logger.error({ action: entry.action, resource: `${entry.resourceType}:${entry.resourceId ?? '-'}`, error: err.message }, 'Could not record this action in the audit log — it happened and nothing recorded it');
+            this.logger.error({ action: entry.action, resource: `${entry.resourceType}:${entry.resourceId ?? '-'}`, error: err.message }, required ? 'Required audit write failed; operation refused' : 'Could not record this action in the audit log — it happened and nothing recorded it');
+            if (required)
+                throw new Error('Audit storage is unavailable; operation refused', { cause: err });
         }
     }
     async list(query = {}) {
@@ -179,6 +213,10 @@ export class AuditService {
             throw new Error(`limit is a number of entries, 1 to ${MAX_AUDIT_PAGE} — not "${String(query.limit)}"`);
         }
         const limit = Math.min(MAX_AUDIT_PAGE, Math.max(1, Math.floor(asked)));
+        if (query.before && query.beforeId)
+            throw new Error('Use before or beforeId, not both');
+        if (query.beforeId && !/^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i.test(query.beforeId))
+            throw new Error('beforeId must be an audit entry UUID');
         const before = query.before ? new Date(query.before) : null;
         if (before && Number.isNaN(before.getTime())) {
             throw new Error(`before is an ISO timestamp such as 2026-09-22T21:20:37Z — not "${String(query.before)}"`);
@@ -187,6 +225,7 @@ export class AuditService {
             .selectFrom('omnitron_audit_log')
             .selectAll()
             .orderBy('createdAt', 'desc')
+            .orderBy('id', 'desc')
             .limit(limit);
         if (query.action)
             q = q.where('action', '=', query.action);
@@ -198,7 +237,21 @@ export class AuditService {
             q = q.where('actorType', '=', query.actorType);
         if (before)
             q = q.where('createdAt', '<', before);
+        if (query.beforeId) {
+            const id = query.beforeId;
+            // Keep PostgreSQL microseconds inside SQL: converting the anchor to Date loses precision.
+            const anchor = this.db.selectFrom('omnitron_audit_log as cursor').select('cursor.createdAt').where('cursor.id', '=', id);
+            q = q.where(eb => eb.or([
+                eb('createdAt', '<', anchor),
+                eb.and([eb('createdAt', '=', anchor), eb('id', '<', id)]),
+            ]));
+        }
         const rows = await q.execute();
+        if (query.beforeId && rows.length === 0) {
+            const exists = await this.db.selectFrom('omnitron_audit_log').select('id').where('id', '=', query.beforeId).executeTakeFirst();
+            if (!exists)
+                throw new Error('Audit page cursor is no longer available; refresh the query');
+        }
         return rows.map(toAuditRow);
     }
     /**
@@ -222,6 +275,7 @@ export class AuditService {
             .where('resourceId', 'is not', null)
             .orderBy('resourceId')
             .orderBy('createdAt', 'desc')
+            .orderBy('id', 'desc')
             .execute();
         return rows.map(toAuditRow);
     }
@@ -234,7 +288,7 @@ function toAuditRow(r) {
         actorType: r.actorType,
         resourceType: r.resourceType,
         resourceId: r.resourceId ?? null,
-        details: r.details ?? null,
+        details: scrubDetails(r.details ?? null),
         ipAddress: r.ipAddress ?? null,
         createdAt: r.createdAt instanceof Date ? r.createdAt.toISOString() : String(r.createdAt),
     };

package/dist/services/audit.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit.service.js","sourceRoot":"","sources":["../../src/services/audit.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAMH,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAErD,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AA4BtE;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAU,CAAC;AAgClE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,CAAC;AAElC,2EAA2E;AAC3E,MAAM,UAAU,GAAG,gEAAgE,CAAC;AAEpF,qEAAqE;AACrE,MAAM,UAAU,YAAY,CAC1B,OAAmD;IAEnD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,GAAG,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC;YACxB,SAAS;QACX,CAAC;QACD,uEAAuE;QACvE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC;IAC9F,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,6EAA6E;AAC7E,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAE7B;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,GAAY;IAC1C,sEAAsE;IACtE,MAAM,OAAO,GACX,GAAG,YAAY,KAAK;QAClB,CAAC,CAAC,GAAG,CAAC,OAAO;QACb,CAAC,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAQ,GAA6B,CAAC,OAAO,KAAK,QAAQ;YAC5F,CAAC,CAAE,GAA2B,CAAC,OAAO;YACtC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACpB,MAAM,KAAK,GACT,OAAO;SACJ,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,0BAA0B,CAAC;IACnE,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IAClC,OAAO,KAAK,CAAC,MAAM,GAAG,gBAAgB,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;AAC9F,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,YAAY;IAC1B,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;IAC9B,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;IAEzD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;IAC/B,0EAA0E;IAC1E,IAAI,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IACjD,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AACtF,CAAC;AAED,MAAM,OAAO,YAAY;IAEJ,MAAM;IAEN,EAAE;IAHrB,YACmB,MAAe;IAChC,qFAAqF;IACpE,EAAmC;sBAFnC,MAAM;kBAEN,EAAE;IAClB,CAAC;IAEJ,sDAAsD;IACtD,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAiB;QAC5B,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO;QACrB,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,YAAY,EAAE,CAAC;QAC9C,MAAM,SAAS,GAAG,iBAAiB,EAAE,EAAE,SAAS,IAAI,IAAI,CAAC;QAEzD,uEAAuE;QACvE,uDAAuD;QACvD,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO;YAC3B,CAAC,CAAC;gBACE,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;gBACnB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5G;YACH,CAAC,CAAC,QAAQ,CAAC;QAEb,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,EAAE;iBACV,UAAU,CAAC,oBAAoB,CAAC;iBAChC,MAAM,CAAC;gBACN,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,OAAO;gBACP,SAAS;gBACT,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;gBACpC,OAAO,EAAE,OAAgB;gBACzB,SAAS;aACD,CAAC;iBACV,OAAO,EAAE,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,UAAU,IAAI,GAAG,EAAE,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,EACrH,qFAAqF,CACtF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAK,GAAe,EAAE;QAC/B,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO,EAAE,CAAC;QACxB,yEAAyE;QACzE,sEAAsE;QACtE,yEAAyE;QACzE,sEAAsE;QACtE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC9D,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,sCAAsC,cAAc,WAAW,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzG,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5D,IAAI,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,kEAAkE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7G,CAAC;QAED,IAAI,CAAC,GAAG,IAAI,CAAC,EAAE;aACZ,UAAU,CAAC,oBAAoB,CAAC;aAChC,SAAS,EAAE;aACX,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC;aAC5B,KAAK,CAAC,KAAK,CAAC,CAAC;QAEhB,IAAI,KAAK,CAAC,MAAM;YAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3D,IAAI,KAAK,CAAC,YAAY;YAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,cAAc,EAAE,GAAG,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QAC7E,IAAI,KAAK,CAAC,OAAO;YAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9D,IAAI,KAAK,CAAC,SAAS;YAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QACpE,IAAI,MAAM;YAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,MAAe,CAAC,CAAC;QAE3D,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,iBAAiB,CAAC,MAAc;QACpC,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,UAAU,CAAC,oBAAoB,CAAC;aAChC,UAAU,CAAC,YAAY,CAAC;aACxB,SAAS,EAAE;aACX,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC;aAC5B,KAAK,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC;aACnC,OAAO,CAAC,YAAY,CAAC;aACrB,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC;aAC5B,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC9B,CAAC;CACF;AAED,SAAS,UAAU,CAAC,CAUnB;IACC,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAChB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,IAAI;QAC1B,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,IAAI;QAChC,OAAO,EAAG,CAAC,CAAC,OAA0C,IAAI,IAAI;QAC9D,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI;QAC9B,SAAS,EAAE,CAAC,CAAC,SAAS,YAAY,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;KACzF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"audit.service.js","sourceRoot":"","sources":["../../src/services/audit.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAIH,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAGvE,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAErD,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AA4BtE;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAU,CAAC;AAMlE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,CAAC;AAElC,2EAA2E;AAC3E,MAAM,UAAU,GAAG,6GAA6G,CAAC;AAEjI;uFACuF;AACvF,MAAM,UAAU,YAAY,CAAC,OAAmD;IAC9E,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,MAAM,GAAG,IAAI,OAAO,EAAU,CAAC;IACrC,IAAI,SAAS,GAAG,IAAI,CAAC;IACrB,MAAM,KAAK,GAAG,CAAC,KAAc,EAAE,KAAa,EAAW,EAAE;QACvD,IAAI,EAAE,SAAS,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,aAAa,CAAC;QACvD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAClE,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAC5F,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,eAAe,CAAC;QACtD,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,YAAY,CAAC;QAC3C,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;gBACtE,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;oBAAE,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;gBAClD,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CACtE,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAU,CAAC,CAAC;YAChF,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,GAAG;gBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC;YACzE,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACrC,CAAC;gBAAS,CAAC;YAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC,CAAC;IACF,OAAO,KAAK,CAAC,OAAO,EAAE,CAAC,CAA4B,CAAC;AACtD,CAAC;AAED,6EAA6E;AAC7E,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAE7B;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,GAAY;IAC1C,sEAAsE;IACtE,MAAM,OAAO,GACX,GAAG,YAAY,KAAK;QAClB,CAAC,CAAC,GAAG,CAAC,OAAO;QACb,CAAC,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAQ,GAA6B,CAAC,OAAO,KAAK,QAAQ;YAC5F,CAAC,CAAE,GAA2B,CAAC,OAAO;YACtC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACpB,MAAM,KAAK,GACT,OAAO;SACJ,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,0BAA0B,CAAC;IACnE,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IAClC,OAAO,KAAK,CAAC,MAAM,GAAG,gBAAgB,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;AAC9F,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,YAAY;IAC1B,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;IAC9B,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;IAEzD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;IAC/B,0EAA0E;IAC1E,IAAI,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IAChE,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AACtF,CAAC;AAED,MAAM,OAAO,YAAY;IAEJ,MAAM;IAEN,EAAE;IAHrB,YACmB,MAAe;IAChC,qFAAqF;IACpE,EAAmC;sBAFnC,MAAM;kBAEN,EAAE;IAClB,CAAC;IAEJ,sDAAsD;IACtD,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC;IAC1B,CAAC;IAED,mFAAmF;IACnF,aAAa,CAAC,EAA4B;QACxC,OAAO,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAiB,EAAE,QAAQ,GAAG,KAAK;QAC9C,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,IAAI,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;YAC9E,OAAO;QACT,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,YAAY,EAAE,CAAC;QAC9C,MAAM,SAAS,GAAG,iBAAiB,EAAE,EAAE,SAAS,IAAI,IAAI,CAAC;QAEzD,uEAAuE;QACvE,uDAAuD;QACvD,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO;YAC3B,CAAC,CAAC;gBACE,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;gBACnB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5G;YACH,CAAC,CAAC,QAAQ,CAAC;QAEb,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,EAAE;iBACV,UAAU,CAAC,oBAAoB,CAAC;iBAChC,MAAM,CAAC;gBACN,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,OAAO;gBACP,SAAS;gBACT,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;gBACpC,OAAO,EAAE,OAAgB;gBACzB,SAAS;aACD,CAAC;iBACV,OAAO,EAAE,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,UAAU,IAAI,GAAG,EAAE,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,EACrH,QAAQ,CAAC,CAAC,CAAC,gDAAgD,CAAC,CAAC,CAAC,qFAAqF,CACpJ,CAAC;YACF,IAAI,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACnG,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAK,GAAe,EAAE;QAC/B,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO,EAAE,CAAC;QACxB,yEAAyE;QACzE,sEAAsE;QACtE,yEAAyE;QACzE,sEAAsE;QACtE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC9D,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,sCAAsC,cAAc,WAAW,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzG,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACvE,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACxF,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,gDAAgD,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QACtJ,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5D,IAAI,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,kEAAkE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7G,CAAC;QAED,IAAI,CAAC,GAAG,IAAI,CAAC,EAAE;aACZ,UAAU,CAAC,oBAAoB,CAAC;aAChC,SAAS,EAAE;aACX,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC;aAC5B,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;aACrB,KAAK,CAAC,KAAK,CAAC,CAAC;QAEhB,IAAI,KAAK,CAAC,MAAM;YAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3D,IAAI,KAAK,CAAC,YAAY;YAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,cAAc,EAAE,GAAG,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QAC7E,IAAI,KAAK,CAAC,OAAO;YAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9D,IAAI,KAAK,CAAC,SAAS;YAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QACpE,IAAI,MAAM;YAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,MAAe,CAAC,CAAC;QAC3D,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACnB,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC;YAC1B,0FAA0F;YAC1F,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,8BAA8B,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YACzH,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;gBACtB,EAAE,CAAC,WAAW,EAAE,GAAG,EAAE,MAAM,CAAC;gBAC5B,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;aAC1D,CAAC,CAAC,CAAC;QACN,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;QAC/B,IAAI,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,gBAAgB,EAAE,CAAC;YAC/H,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QAC9F,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,iBAAiB,CAAC,MAAc;QACpC,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,UAAU,CAAC,oBAAoB,CAAC;aAChC,UAAU,CAAC,YAAY,CAAC;aACxB,SAAS,EAAE;aACX,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC;aAC5B,KAAK,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC;aACnC,OAAO,CAAC,YAAY,CAAC;aACrB,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC;aAC5B,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;aACrB,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC9B,CAAC;CACF;AAED,SAAS,UAAU,CAAC,CAUnB;IACC,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAChB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,IAAI;QAC1B,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,IAAI;QAChC,OAAO,EAAE,YAAY,CAAE,CAAC,CAAC,OAA0C,IAAI,IAAI,CAAC;QAC5E,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI;QAC9B,SAAS,EAAE,CAAC,CAAC,SAAS,YAAY,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;KACzF,CAAC;AACJ,CAAC"}

package/dist/services/auth-context.d.ts

@@ -55,5 +55,7 @@ export declare function runWithAuth<T>(authContext: AuthContext, fn: () => T | P
  */
 export declare function createAuthContextWrapper(options?: {
     trustProxy?: boolean;
+    assertReady?: () => void;
+    validatePrincipal?: (context: AuthContext) => Promise<void>;
 }): (metadata: Map<string, unknown>, fn: () => Promise<unknown>) => Promise<unknown>;
 //# sourceMappingURL=auth-context.d.ts.map

package/dist/services/auth-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-context.d.ts","sourceRoot":"","sources":["../../src/services/auth-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAEnE;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAID,wEAAwE;AACxE,wBAAgB,iBAAiB,IAAI,cAAc,GAAG,IAAI,CAEzD;AAYD;;;GAGG;AACH,wBAAgB,cAAc,IAAI,WAAW,GAAG,IAAI,CAEnD;AAED;;GAEG;AACH,wBAAgB,WAAW,IAAI,WAAW,CAMzC;AAED;;GAEG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAEjG;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,GAAE;IAAE,UAAU,CAAC,EAAE,OAAO,CAAA;CAAO,cACrD,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,MAAM,OAAO,CAAC,OAAO,CAAC,KAAG,OAAO,CAAC,OAAO,CAAC,CAY5F"}
+{"version":3,"file":"auth-context.d.ts","sourceRoot":"","sources":["../../src/services/auth-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAEnE;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAID,wEAAwE;AACxE,wBAAgB,iBAAiB,IAAI,cAAc,GAAG,IAAI,CAEzD;AAYD;;;GAGG;AACH,wBAAgB,cAAc,IAAI,WAAW,GAAG,IAAI,CAEnD;AAED;;GAEG;AACH,wBAAgB,WAAW,IAAI,WAAW,CAMzC;AAED;;GAEG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAEjG;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,GAAE;IAChD,UAAU,CAAC,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,IAAI,CAAC;IAAC,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACxG,cACoB,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,MAAM,OAAO,CAAC,OAAO,CAAC,KAAG,OAAO,CAAC,OAAO,CAAC,CAc5F"}

package/dist/services/auth-context.js

@@ -61,7 +61,10 @@ export function runWithAuth(authContext, fn) {
  */
 export function createAuthContextWrapper(options = {}) {
     return async (metadata, fn) => {
+        options.assertReady?.();
         const authCtx = metadata.get('authContext');
+        if (authCtx)
+            await options.validatePrincipal?.(authCtx);
         const requestCtx = {};
         const ip = resolveClientIp(metadata, options.trustProxy === true);
         if (ip)
@@ -69,7 +72,7 @@ export function createAuthContextWrapper(options = {}) {
         const peerId = metadata.get('peerId');
         if (typeof peerId === 'string' && peerId.length > 0)
             requestCtx.peerId = peerId;
-        const run = () => (authCtx ? runWithAuth(authCtx, fn) : fn());
+        const run = () => authContextStorage.run(authCtx, fn);
         return requestContextStorage.run(requestCtx, run);
     };
 }

package/dist/services/auth-context.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-context.js","sourceRoot":"","sources":["../../src/services/auth-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAoBrD,MAAM,qBAAqB,GAAG,IAAI,iBAAiB,EAAkB,CAAC;AAEtE,wEAAwE;AACxE,MAAM,UAAU,iBAAiB;IAC/B,OAAO,qBAAqB,CAAC,QAAQ,EAAE,IAAI,IAAI,CAAC;AAClD,CAAC;AAED,8EAA8E;AAC9E,yCAAyC;AACzC,8EAA8E;AAE9E,MAAM,kBAAkB,GAAG,IAAI,iBAAiB,EAAe,CAAC;AAEhE,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,kBAAkB,CAAC,QAAQ,EAAE,IAAI,IAAI,CAAC;AAC/C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW;IACzB,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;IAC7B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa;IAC3B,OAAO,WAAW,EAAE,CAAC,MAAM,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAI,WAAwB,EAAE,EAAwB;IAC/E,OAAO,kBAAkB,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAO,GAA6B,EAAE;IAC7E,OAAO,KAAK,EAAE,QAA8B,EAAE,EAA0B,EAAoB,EAAE;QAC5F,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,aAAa,CAA4B,CAAC;QACvE,MAAM,UAAU,GAAmB,EAAE,CAAC;QAEtC,MAAM,EAAE,GAAG,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC;QAClE,IAAI,EAAE;YAAE,UAAU,CAAC,SAAS,GAAG,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,UAAU,CAAC,MAAM,GAAG,MAAM,CAAC;QAEhF,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9D,OAAO,qBAAqB,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IACpD,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,SAAS,eAAe,CAAC,QAA8B,EAAE,UAAmB;IAC1E,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAElC,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACnF,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1D,gEAAgE;QAChE,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QAC9C,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IAC1B,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACpE,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9E,CAAC"}
+{"version":3,"file":"auth-context.js","sourceRoot":"","sources":["../../src/services/auth-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAoBrD,MAAM,qBAAqB,GAAG,IAAI,iBAAiB,EAAkB,CAAC;AAEtE,wEAAwE;AACxE,MAAM,UAAU,iBAAiB;IAC/B,OAAO,qBAAqB,CAAC,QAAQ,EAAE,IAAI,IAAI,CAAC;AAClD,CAAC;AAED,8EAA8E;AAC9E,yCAAyC;AACzC,8EAA8E;AAE9E,MAAM,kBAAkB,GAAG,IAAI,iBAAiB,EAA2B,CAAC;AAE5E,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,kBAAkB,CAAC,QAAQ,EAAE,IAAI,IAAI,CAAC;AAC/C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW;IACzB,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;IAC7B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa;IAC3B,OAAO,WAAW,EAAE,CAAC,MAAM,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAI,WAAwB,EAAE,EAAwB;IAC/E,OAAO,kBAAkB,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAO,GAE5C,EAAE;IACJ,OAAO,KAAK,EAAE,QAA8B,EAAE,EAA0B,EAAoB,EAAE;QAC5F,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,aAAa,CAA4B,CAAC;QACvE,IAAI,OAAO;YAAE,MAAM,OAAO,CAAC,iBAAiB,EAAE,CAAC,OAAO,CAAC,CAAC;QACxD,MAAM,UAAU,GAAmB,EAAE,CAAC;QAEtC,MAAM,EAAE,GAAG,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC;QAClE,IAAI,EAAE;YAAE,UAAU,CAAC,SAAS,GAAG,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,UAAU,CAAC,MAAM,GAAG,MAAM,CAAC;QAEhF,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACtD,OAAO,qBAAqB,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IACpD,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,SAAS,eAAe,CAAC,QAA8B,EAAE,UAAmB;IAC1E,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAElC,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACnF,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1D,gEAAgE;QAChE,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QAC9C,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IAC1B,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACpE,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9E,CAAC"}

package/dist/services/auth.rpc-service.d.ts

@@ -13,10 +13,12 @@
  * @Public({ auth: true }) = auth required (role-based access possible)
  * @Public() = default (follows configureAuth rules)
  */
+import type { Netron } from '@omnitron-dev/titan/netron';
 import type { AuthService, OmnitronSignInResult, OmnitronAuthUser, OmnitronActiveSession } from './auth.service.js';
 export declare class AuthRpcService {
     private readonly authService;
-    constructor(authService: AuthService);
+    private readonly netron?;
+    constructor(authService: AuthService, netron?: Netron | undefined);
     signIn(data: {
         username: string;
         password: string;

package/dist/services/auth.rpc-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.rpc-service.d.ts","sourceRoot":"","sources":["../../src/services/auth.rpc-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAMH,OAAO,KAAK,EACV,WAAW,EACX,oBAAoB,EACpB,gBAAgB,EAChB,qBAAqB,EACtB,MAAM,mBAAmB,CAAC;AAE3B,qBACa,cAAc;IACb,OAAO,CAAC,QAAQ,CAAC,WAAW;IAAxC,YAA6B,WAAW,EAAE,WAAW,EAAI;IAOnD,MAAM,CAAC,IAAI,EAAE;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAWhC;IAGK,aAAa,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QACpD,KAAK,EAAE,OAAO,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC,CAKD;IAGK,eAAe,CAAC,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAC1D,KAAK,EAAE,OAAO,CAAC;QACf,IAAI,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;QACpC,OAAO,CAAC,EAAE;YAAE,SAAS,EAAE,MAAM,CAAA;SAAE,GAAG,SAAS,CAAC;KAC7C,CAAC,CAMD;IAGK,cAAc,CAAC,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QACzD,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,CAAC,EAAE,oBAAoB,CAAC;KAC/B,CAAC,CAKD;IAGK,OAAO,CAAC,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAaxE;IAOK,iBAAiB,IAAI,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAI1D;IAGK,cAAc,CAAC,IAAI,EAAE;QACzB,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;KACrB,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAKhC;CACF"}
+{"version":3,"file":"auth.rpc-service.d.ts","sourceRoot":"","sources":["../../src/services/auth.rpc-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAOH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,KAAK,EACV,WAAW,EACX,oBAAoB,EACpB,gBAAgB,EAChB,qBAAqB,EACtB,MAAM,mBAAmB,CAAC;AAE3B,qBACa,cAAc;IACb,OAAO,CAAC,QAAQ,CAAC,WAAW;IAAe,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAA/E,YAA6B,WAAW,EAAE,WAAW,EAAmB,MAAM,CAAC,EAAE,MAAM,YAAA,EAAI;IAOrF,MAAM,CAAC,IAAI,EAAE;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAWhC;IAGK,aAAa,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QACpD,KAAK,EAAE,OAAO,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC,CAKD;IAGK,eAAe,CAAC,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAC1D,KAAK,EAAE,OAAO,CAAC;QACf,IAAI,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;QACpC,OAAO,CAAC,EAAE;YAAE,SAAS,EAAE,MAAM,CAAA;SAAE,GAAG,SAAS,CAAC;KAC7C,CAAC,CAMD;IAGK,cAAc,CAAC,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QACzD,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,CAAC,EAAE,oBAAoB,CAAC;KAC/B,CAAC,CAKD;IAGK,OAAO,CAAC,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAcxE;IAOK,iBAAiB,IAAI,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAI1D;IAGK,cAAc,CAAC,IAAI,EAAE;QACzB,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;KACrB,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAShC;CACF"}

package/dist/services/auth.rpc-service.js

@@ -26,10 +26,13 @@ import { Service, Public } from '@omnitron-dev/titan/decorators';
 import { Errors } from '@omnitron-dev/titan/errors';
 import { requirePayload, requireString } from './anonymous-input.js';
 import { getCurrentAuth, requireAuth, getRequestContext } from './auth-context.js';
+import { revokeDaemonAuthority } from './daemon-principal.js';
 let AuthRpcService = class AuthRpcService {
     authService;
-    constructor(authService) {
+    netron;
+    constructor(authService, netron) {
         this.authService = authService;
+        this.netron = netron;
     }
     // ===========================================================================
     // Public (anonymous) endpoints — no token required
@@ -71,13 +74,15 @@ let AuthRpcService = class AuthRpcService {
         const sessionId = requireString(requirePayload(data, 'signOut'), 'sessionId', 'signOut');
         // If authenticated, verify session ownership
         const auth = getCurrentAuth();
+        const sessionOwner = await this.authService.validateSession(sessionId);
         if (auth) {
-            const sessionOwner = await this.authService.validateSession(sessionId);
             if (sessionOwner && sessionOwner.id !== auth.userId) {
                 throw Errors.forbidden('Cannot revoke another user\'s session');
             }
         }
         await this.authService.signOut(sessionId);
+        if (sessionOwner && this.netron)
+            revokeDaemonAuthority(this.netron, sessionOwner.id, { only: sessionId });
         return { success: true };
     }
     // ===========================================================================
@@ -90,8 +95,13 @@ let AuthRpcService = class AuthRpcService {
     }
     async changePassword(data) {
         const auth = requireAuth();
+        const payload = requirePayload(data, 'changePassword');
+        requireString(payload, 'oldPassword', 'changePassword');
+        requireString(payload, 'newPassword', 'changePassword');
         const sessionId = auth.metadata?.sessionId;
         await this.authService.changePassword(auth.userId, data.oldPassword, data.newPassword, sessionId);
+        if (this.netron)
+            revokeDaemonAuthority(this.netron, auth.userId, { except: sessionId });
         return { success: true };
     }
 };
@@ -139,7 +149,7 @@ __decorate([
 ], AuthRpcService.prototype, "changePassword", null);
 AuthRpcService = __decorate([
     Service({ name: 'OmnitronAuth' }),
-    __metadata("design:paramtypes", [Function])
+    __metadata("design:paramtypes", [Function, Function])
 ], AuthRpcService);
 export { AuthRpcService };
 //# sourceMappingURL=auth.rpc-service.js.map

package/dist/services/auth.rpc-service.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.rpc-service.js","sourceRoot":"","sources":["../../src/services/auth.rpc-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;;;;;;;;;;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAS5E,IAAM,cAAc,GAApB,MAAM,cAAc;IACI,WAAW;IAAxC,YAA6B,WAAwB;2BAAxB,WAAW;IAAgB,CAAC;IAEzD,8EAA8E;IAC9E,mDAAmD;IACnD,8EAA8E;IAGxE,AAAN,KAAK,CAAC,MAAM,CAAC,IAIZ;QACC,sEAAsE;QACtE,kEAAkE;QAClE,yEAAyE;QACzE,uDAAuD;QACvD,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC/C,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC7C,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;QAE7C,MAAM,SAAS,GAAG,iBAAiB,EAAE,EAAE,SAAS,CAAC;QACjD,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACvE,CAAC;IAGK,AAAN,KAAK,CAAC,aAAa,CAAC,IAAuB;QAKzC,MAAM,KAAK,GAAG,aAAa,CAAC,cAAc,CAAC,IAAI,EAAE,eAAe,CAAC,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC;QAC7F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QACrC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;IAC7E,CAAC;IAGK,AAAN,KAAK,CAAC,eAAe,CAAC,IAA2B;QAK/C,MAAM,SAAS,GAAG,aAAa,CAAC,cAAc,CAAC,IAAI,EAAE,iBAAiB,CAAC,EAAE,WAAW,EAAE,iBAAiB,CAAC,CAAC;QACzG,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QACjE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IAC9G,CAAC;IAGK,AAAN,KAAK,CAAC,cAAc,CAAC,IAA2B;QAI9C,MAAM,SAAS,GAAG,aAAa,CAAC,cAAc,CAAC,IAAI,EAAE,gBAAgB,CAAC,EAAE,WAAW,EAAE,gBAAgB,CAAC,CAAC;QACvG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACnC,CAAC;IAGK,AAAN,KAAK,CAAC,OAAO,CAAC,IAA2B;QACvC,MAAM,SAAS,GAAG,aAAa,CAAC,cAAc,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;QAEzF,6CAA6C;QAC7C,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;QAC9B,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;YACvE,IAAI,YAAY,IAAI,YAAY,CAAC,EAAE,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;gBACpD,MAAM,MAAM,CAAC,SAAS,CAAC,uCAAuC,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;QACD,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC1C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,8EAA8E;IAC9E,+DAA+D;IAC/D,8EAA8E;IAGxE,AAAN,KAAK,CAAC,iBAAiB;QACrB,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAI,IAAI,CAAC,QAAgB,EAAE,SAAS,CAAC;QACpD,OAAO,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACpE,CAAC;IAGK,AAAN,KAAK,CAAC,cAAc,CAAC,IAGpB;QACC,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAI,IAAI,CAAC,QAAgB,EAAE,SAAS,CAAC;QACpD,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAClG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;CACF,CAAA;AA1FO;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,CAAC;;;;4CAgB1C;AAGK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,CAAC;;;;mDAU1C;AAGK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,CAAC;;;;qDAW1C;AAGK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,CAAC;;;;oDAS1C;AAGK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,CAAC;;;;6CAc1C;AAOK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;;;;uDAKtB;AAGK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;;;;oDAStB;AAjGU,cAAc;IAD1B,OAAO,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;;GACrB,cAAc,CAkG1B"}
+{"version":3,"file":"auth.rpc-service.js","sourceRoot":"","sources":["../../src/services/auth.rpc-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;;;;;;;;;;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACnF,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAUvD,IAAM,cAAc,GAApB,MAAM,cAAc;IACI,WAAW;IAAgC,MAAM;IAA9E,YAA6B,WAAwB,EAAmB,MAAe;2BAA1D,WAAW;sBAAgC,MAAM;IAAY,CAAC;IAE3F,8EAA8E;IAC9E,mDAAmD;IACnD,8EAA8E;IAGxE,AAAN,KAAK,CAAC,MAAM,CAAC,IAIZ;QACC,sEAAsE;QACtE,kEAAkE;QAClE,yEAAyE;QACzE,uDAAuD;QACvD,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC/C,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC7C,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;QAE7C,MAAM,SAAS,GAAG,iBAAiB,EAAE,EAAE,SAAS,CAAC;QACjD,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACvE,CAAC;IAGK,AAAN,KAAK,CAAC,aAAa,CAAC,IAAuB;QAKzC,MAAM,KAAK,GAAG,aAAa,CAAC,cAAc,CAAC,IAAI,EAAE,eAAe,CAAC,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC;QAC7F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QACrC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;IAC7E,CAAC;IAGK,AAAN,KAAK,CAAC,eAAe,CAAC,IAA2B;QAK/C,MAAM,SAAS,GAAG,aAAa,CAAC,cAAc,CAAC,IAAI,EAAE,iBAAiB,CAAC,EAAE,WAAW,EAAE,iBAAiB,CAAC,CAAC;QACzG,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QACjE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IAC9G,CAAC;IAGK,AAAN,KAAK,CAAC,cAAc,CAAC,IAA2B;QAI9C,MAAM,SAAS,GAAG,aAAa,CAAC,cAAc,CAAC,IAAI,EAAE,gBAAgB,CAAC,EAAE,WAAW,EAAE,gBAAgB,CAAC,CAAC;QACvG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACnC,CAAC;IAGK,AAAN,KAAK,CAAC,OAAO,CAAC,IAA2B;QACvC,MAAM,SAAS,GAAG,aAAa,CAAC,cAAc,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;QAEzF,6CAA6C;QAC7C,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;QAC9B,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QACvE,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,YAAY,IAAI,YAAY,CAAC,EAAE,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;gBACpD,MAAM,MAAM,CAAC,SAAS,CAAC,uCAAuC,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;QACD,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,YAAY,IAAI,IAAI,CAAC,MAAM;YAAE,qBAAqB,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAC1G,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,8EAA8E;IAC9E,+DAA+D;IAC/D,8EAA8E;IAGxE,AAAN,KAAK,CAAC,iBAAiB;QACrB,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAI,IAAI,CAAC,QAAgB,EAAE,SAAS,CAAC;QACpD,OAAO,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACpE,CAAC;IAGK,AAAN,KAAK,CAAC,cAAc,CAAC,IAGpB;QACC,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QACvD,aAAa,CAAC,OAAO,EAAE,aAAa,EAAE,gBAAgB,CAAC,CAAC;QACxD,aAAa,CAAC,OAAO,EAAE,aAAa,EAAE,gBAAgB,CAAC,CAAC;QACxD,MAAM,SAAS,GAAI,IAAI,CAAC,QAAgB,EAAE,SAAS,CAAC;QACpD,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAClG,IAAI,IAAI,CAAC,MAAM;YAAE,qBAAqB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QACxF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;CACF,CAAA;AA/FO;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,CAAC;;;;4CAgB1C;AAGK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,CAAC;;;;mDAU1C;AAGK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,CAAC;;;;qDAW1C;AAGK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,CAAC;;;;oDAS1C;AAGK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,CAAC;;;;6CAe1C;AAOK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;;;;uDAKtB;AAGK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;;;;oDAatB;AAtGU,cAAc;IAD1B,OAAO,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;;GACrB,cAAc,CAuG1B"}

package/dist/services/auth.service.d.ts

@@ -29,15 +29,6 @@ export declare class AuthService {
     signIn(request: OmnitronSignInRequest, origin?: {
         ipAddress?: string;
     }): Promise<OmnitronSignInResult>;
-    /**
-     * Record a failed sign-in and lock the account once the streak crosses the
-     * threshold. The lockout grows exponentially with each additional failure
-     * past the threshold, capped at LOCKOUT_MAX_MS.
-     *
-     * State is persisted rather than held in memory: a daemon restart — which
-     * an attacker may be able to provoke — must not hand back a clean slate.
-     */
-    private registerFailedAttempt;
     /**
      * A scrypt hash of a random secret, computed once per process.
      *
@@ -56,24 +47,23 @@ export declare class AuthService {
     validateToken(token: string): Promise<{
         userId: string;
         sessionId: string;
+        role: string;
+    } | null>;
+    /** One indexed join per admitted call. Store failure is unavailable, never a false revocation. */
+    validateSessionAuthority(userId: string, sessionId: string): Promise<{
+        userId: string;
+        sessionId: string;
+        role: string;
     } | null>;
     getActiveSessions(userId: string, currentSessionId?: string): Promise<OmnitronActiveSession[]>;
     refreshSession(sessionId: string): Promise<OmnitronSignInResult | null>;
     changePassword(userId: string, oldPassword: string, newPassword: string, currentSessionId?: string): Promise<void>;
     hashPassword(password: string): Promise<string>;
     /**
-     * Is the seeded `admin` account still using the password it shipped with?
-     *
-     * Migration 001 seeds `admin` / `admin` and its comment says the password
-     * "MUST be changed on first login". Nothing enforced that — no flag, no
-     * gate, no check anywhere in this daemon. A comment is not a control.
-     *
-     * The daemon binds loopback by default and the console does too, so this
-     * only matters where an operator has deliberately published one of them.
-     * That is exactly the moment to ask, which is what the caller does.
-     *
-     * Answers false when the account is gone or renamed: the question is about
-     * a shipped credential, not about weak passwords in general.
+     * Is the shipped password still accepted by any Console account? Renaming
+     * or demoting the seeded account must not bypass publication admission.
+     * Keyset paging bounds memory; this check runs before external publication,
+     * not on every login or RPC. New credentials already require 15 characters.
      */
     isUsingSeededAdminPassword(): Promise<boolean>;
     verifyPassword(password: string, hash: string): Promise<boolean>;

package/dist/services/auth.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.service.d.ts","sourceRoot":"","sources":["../../src/services/auth.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAG9D,OAAO,KAAK,EACV,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,qBAAqB,EACtB,MAAM,uBAAuB,CAAC;AAQ/B,YAAY,EACV,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAuB/B,qBACa,WAAW;IAYO,OAAO,CAAC,QAAQ,CAAC,EAAE;IAXhD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAa;IACvC,sDAAsD;IACtD,OAAO,CAAC,gBAAgB,CAAgC;IAQxD,YAC8C,EAAE,EAAE,MAAM,CAAC,gBAAgB,CAAC,EAC9C,SAAS,EAAE,MAAM,EAW5C;IAMD;;;;;;;OAOG;IACG,MAAM,CACV,OAAO,EAAE,qBAAqB,EAC9B,MAAM,GAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAO,GAClC,OAAO,CAAC,oBAAoB,CAAC,CAoE/B;IAMD;;;;;;;OAOG;YACW,qBAAqB;IAWnC;;;;;OAKG;YACW,SAAS;IASjB,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAK9C;IAMK,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAmCzE;IAED;;OAEG;IACG,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC,CAS3E;IAMK,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAgDxF;IAMK,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAiBnG;IAMK,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CA8C5E;IAMK,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BvH;IAMK,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAIpD;IAED;;;;;;;;;;;;;OAaG;IACG,0BAA0B,IAAI,OAAO,CAAC,OAAO,CAAC,CASnD;IAEK,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CASrE;YAMa,UAAU;IAcxB,sDAAsD;IAChD,sBAAsB,IAAI,OAAO,CAAC,MAAM,CAAC,CAO9C;CACF"}
+{"version":3,"file":"auth.service.d.ts","sourceRoot":"","sources":["../../src/services/auth.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAQH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAG9D,OAAO,KAAK,EACV,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,qBAAqB,EACtB,MAAM,uBAAuB,CAAC;AAQ/B,YAAY,EACV,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AA2B/B,qBACa,WAAW;IAYO,OAAO,CAAC,QAAQ,CAAC,EAAE;IAXhD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAa;IACvC,sDAAsD;IACtD,OAAO,CAAC,gBAAgB,CAAgC;IAQxD,YAC8C,EAAE,EAAE,MAAM,CAAC,gBAAgB,CAAC,EAC9C,SAAS,EAAE,MAAM,EAW5C;IAMD;;;;;;;OAOG;IACG,MAAM,CACV,OAAO,EAAE,qBAAqB,EAC9B,MAAM,GAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAO,GAClC,OAAO,CAAC,oBAAoB,CAAC,CAyE/B;IAED;;;;;OAKG;YACW,SAAS;IASjB,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAK9C;IAMK,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAmCzE;IAED;;OAEG;IACG,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC,CAS3E;IAMK,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAmBtG;IAED,kGAAkG;IAC5F,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAarI;IAMK,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAiBnG;IAMK,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CA8C5E;IAMK,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAoCvH;IAMK,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAIpD;IAED;;;;;OAKG;IACG,0BAA0B,IAAI,OAAO,CAAC,OAAO,CAAC,CAYnD;IAEK,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CASrE;YAMa,UAAU;IAcxB,sDAAsD;IAChD,sBAAsB,IAAI,OAAO,CAAC,MAAM,CAAC,CAO9C;CACF"}