@openlup/platform 0.0.0 → 0.16.0

package/dist/identity/managedPrivacy.js

@@ -0,0 +1,39 @@
+import { PrivacyRefusal } from "./privacyPorts.js";
+/** Reads only committed service projections. No managed write or provider delete is composed. */
+export function createManagedPrivacyStore() {
+    const refuse = async () => { throw new PrivacyRefusal("MANAGED_PRIVACY_ERASURE_UNAVAILABLE"); };
+    return {
+        erasureSupported: false, prepareErasure: refuse, authorizeErasure: refuse, eraseIdentity: refuse, saveReceipt: refuse,
+        async findReceipt() { return null; },
+        async resolve(client, ref) {
+            const query = client.from("clients").select("id, email, auth_user_id, first_name, last_name, phone");
+            const { data: contact, error } = await query.eq(ref.kind === "contact" ? "id" : "auth_user_id", ref.kind === "contact" ? ref.contactId : ref.principalId).maybeSingle();
+            if (error)
+                throw new PrivacyRefusal("PRIVACY_ASSESSMENT_UNAVAILABLE");
+            const principalId = ref.kind === "principal" ? ref.principalId : contact?.auth_user_id ?? null;
+            let principal = null;
+            let membership = null;
+            if (principalId) {
+                const result = await client.auth.admin.getUserById(principalId);
+                if (result.error) {
+                    const failure = result.error;
+                    if (!contact && (failure.status === 404 || failure.code === "user_not_found"))
+                        return null;
+                    throw new PrivacyRefusal("PRIVACY_ASSESSMENT_UNAVAILABLE");
+                }
+                if (result.data.user)
+                    principal = { principal_id: result.data.user.id, email: result.data.user.email ?? null, email_confirmed_at: result.data.user.email_confirmed_at ?? null };
+                const read = await client.from("admin_users").select("id, membership_state, role, is_machine_actor").eq("id", principalId).maybeSingle();
+                if (read.error)
+                    throw new PrivacyRefusal("PRIVACY_ASSESSMENT_UNAVAILABLE");
+                membership = read.data ? JSON.parse(JSON.stringify(read.data)) : null;
+            }
+            if (!contact && !principal)
+                return null;
+            return { contactId: contact?.id ?? null, principalId, identity: {
+                    contact: contact ? JSON.parse(JSON.stringify(contact)) : null, principal, membership,
+                    unavailable: ["contact.country", "identity.audit-history", "identity.invitation-history", "identity.erasure-receipts"],
+                } };
+        },
+    };
+}

package/dist/identity/messages.d.ts

@@ -0,0 +1,29 @@
+type Role = "admin" | "distributor";
+declare const en: {
+    unauthorized: string;
+    invalidToken: string;
+    inviteForbidden: string;
+    emailRequired: string;
+    invalidRole: string;
+    alreadyAdded: string;
+    addFailed: (detail: string) => string;
+    notificationFailed: (detail: string) => string;
+    roleAddedDisabled: (email: string, role: Role) => string;
+    roleAddedSuppressed: (email: string, role: Role) => string;
+    roleAdded: (email: string, role: Role) => string;
+    inviteFailed: (detail: string) => string;
+    roleInsertFailed: (detail: string) => string;
+    invited: (email: string, role: Role) => string;
+    removeForbidden: string;
+    userIdRequired: string;
+    selfRemoveForbidden: string;
+    lastAdmin: string;
+    selfRevoke: string;
+    machineRevoke: string;
+    adminNotFound: string;
+    adminRequired: string;
+    revokeFailed: (detail: string) => string;
+};
+export type IdentityMessages = typeof en;
+export declare const identityMessages: Readonly<Record<"en" | "pl", IdentityMessages>>;
+export {};

package/dist/identity/messages.js

@@ -0,0 +1,39 @@
+const roleName = (role) => role === "admin" ? "Admin" : "Dystrybutor";
+const en = {
+    unauthorized: "Unauthorized", invalidToken: "Invalid token",
+    inviteForbidden: "Only admins may invite users", emailRequired: "Email required",
+    invalidRole: "Invalid role", alreadyAdded: "This user is already added",
+    addFailed: (detail) => `Adding user failed: ${detail}`,
+    notificationFailed: (detail) => `Role added, but notification failed: ${detail}`,
+    roleAddedDisabled: (email, role) => `User ${email} already had an account; added role ${role}, but notification was disabled and not sent.`,
+    roleAddedSuppressed: (email, role) => `User ${email} already had an account; added role ${role}, but notification was suppressed and not sent.`,
+    roleAdded: (email, role) => `User ${email} already had an account; added role ${role} and sent a notification.`,
+    inviteFailed: (detail) => `Invitation failed: ${detail}`,
+    roleInsertFailed: (detail) => `Account created, but adding role failed: ${detail}`,
+    invited: (email, role) => `Invitation with role ${role} sent to ${email}`,
+    removeForbidden: "Only admins may revoke user access", userIdRequired: "User ID required",
+    selfRemoveForbidden: "You cannot revoke your own access",
+    lastAdmin: "At least one active human admin must remain.",
+    selfRevoke: "You cannot revoke your own access.",
+    machineRevoke: "Machine actors cannot be revoked through this route.",
+    adminNotFound: "Admin user not found.", adminRequired: "Admin role required.",
+    revokeFailed: (detail) => `Admin access revoke failed: ${detail}`,
+};
+export const identityMessages = {
+    en,
+    pl: {
+        ...en,
+        inviteForbidden: "Tylko admini mogą zapraszać użytkowników", emailRequired: "Brak emaila",
+        invalidRole: "Nieprawidłowa rola", alreadyAdded: "Ten użytkownik jest już dodany",
+        addFailed: (detail) => `Błąd dodawania: ${detail}`,
+        notificationFailed: (detail) => `Rola dodana, ale nie udało się wysłać powiadomienia: ${detail}`,
+        roleAddedDisabled: (email, role) => `Użytkownik ${email} już miał konto — dodano rolę ${roleName(role)}, ale powiadomienie było wyłączone i nie zostało wysłane.`,
+        roleAddedSuppressed: (email, role) => `Użytkownik ${email} już miał konto — dodano rolę ${roleName(role)}, ale wysłanie powiadomienia zostało zablokowane i nie zostało wysłane.`,
+        roleAdded: (email, role) => `Użytkownik ${email} już miał konto — dodano rolę ${roleName(role)} i wysłano powiadomienie.`,
+        inviteFailed: (detail) => `Błąd zaproszenia: ${detail}`,
+        roleInsertFailed: (detail) => `Konto utworzone, ale błąd dodawania roli: ${detail}`,
+        invited: (email, role) => `Zaproszenie z rolą ${roleName(role)} wysłane na ${email}`,
+        removeForbidden: "Tylko administratorzy mogą odbierać dostęp użytkownikom",
+        userIdRequired: "Brak ID użytkownika", selfRemoveForbidden: "Nie możesz odebrać sobie dostępu",
+    },
+};

package/dist/identity/oidcIdentityVerifier.d.ts

@@ -0,0 +1,45 @@
+import type { IdentityJwtLibraryLoader } from "./jwtLibrary.js";
+import type { IdentityVerifierPort, VerifiedPrincipal } from "./ports.js";
+import type { OidcFailureCode } from "./contracts/oidc.js";
+export interface OidcIdentityVerifierConfig {
+    issuer: string;
+    audience: string;
+    algorithms: readonly ("RS256" | "ES256")[];
+    maxTokenLifetimeSeconds: number;
+    requireSingleAudience?: boolean;
+    /** Conformance only: literal loopback addresses, never arbitrary HTTP hosts. */
+    allowLoopbackHttp?: boolean;
+}
+export type OidcVerificationResult = {
+    ok: true;
+    principal: VerifiedPrincipal;
+    expiresAt: string;
+} | {
+    ok: false;
+    code: OidcFailureCode;
+};
+export interface OidcReadinessReport {
+    state: "ready" | "unknown" | "unsatisfied";
+    discovery: {
+        reachable: boolean;
+        valid: boolean;
+        checkedAt: string | null;
+        expiresAt: string | null;
+    };
+    jwks: {
+        loaded: boolean;
+        checkedAt: string | null;
+        expiresAt: string | null;
+    };
+    code?: OidcFailureCode;
+}
+export interface OidcIdentityVerifier extends IdentityVerifierPort {
+    verifyToken(token: string): Promise<OidcVerificationResult>;
+    readiness(): Promise<OidcReadinessReport>;
+}
+/** One binding per host/configuration. Imports and construction perform no I/O or JWT loading. */
+export declare function createOidcIdentityVerifier(config: OidcIdentityVerifierConfig, dependencies: {
+    loadJwt: IdentityJwtLibraryLoader;
+    fetch?: typeof globalThis.fetch;
+    now?: () => number;
+}): OidcIdentityVerifier;

package/dist/identity/oidcIdentityVerifier.js

@@ -0,0 +1,309 @@
+import { deriveOidcPrincipalId } from "./oidcPrincipal.js";
+class Refusal extends Error {
+    code;
+    constructor(code) {
+        super(code);
+        this.code = code;
+    }
+}
+const refuse = (code) => { throw new Refusal(code); };
+const record = (value) => !!value && typeof value === "object" && !Array.isArray(value);
+const bounded = (value, max) => typeof value === "string" && value.length > 0 && Buffer.byteLength(value) <= max && !Array.from(value).some(character => character.charCodeAt(0) <= 0x20 || character.charCodeAt(0) === 0x7f);
+const stamp = (value) => value === null ? null : new Date(value).toISOString();
+const unavailable = (code) => code.endsWith("_UNAVAILABLE") || code === "OIDC_JWKS_REFRESH_RATE_LIMITED";
+/** One binding per host/configuration. Imports and construction perform no I/O or JWT loading. */
+export function createOidcIdentityVerifier(config, dependencies) {
+    const settings = { ...config, algorithms: [...config.algorithms] };
+    const now = dependencies.now ?? Date.now;
+    const transport = dependencies.fetch ?? globalThis.fetch;
+    function validUrl(value) {
+        const url = new URL(value);
+        if (url.username || url.password || url.search || url.hash || (url.protocol !== "https:"
+            && !(settings.allowLoopbackHttp && url.protocol === "http:" && ["127.0.0.1", "[::1]"].includes(url.hostname))))
+            throw new Error();
+        return url;
+    }
+    let origin = "", configurationValid = true;
+    try {
+        if (!bounded(settings.issuer, 2048) || !bounded(settings.audience, 256)
+            || !settings.algorithms.length || settings.algorithms.some(alg => alg !== "RS256" && alg !== "ES256")
+            || !Number.isInteger(settings.maxTokenLifetimeSeconds) || settings.maxTokenLifetimeSeconds < 1 || settings.maxTokenLifetimeSeconds > 3600)
+            throw new Error();
+        origin = validUrl(settings.issuer).origin;
+    }
+    catch {
+        configurationValid = false;
+    }
+    let library;
+    const jwt = () => library ??= Promise.resolve().then(dependencies.loadJwt).catch(() => { library = undefined; return refuse("OIDC_JWT_LIBRARY_UNAVAILABLE"); });
+    let discovery;
+    let keys;
+    let discoveryCheck = null, keyCheck = null, lastKeyAttempt = -Infinity;
+    let reachable = false, discoveryValid = false;
+    let discoveryFlight;
+    let keyFlight;
+    let keyFailure;
+    async function document(url, kind, maxAge) {
+        const controller = new AbortController();
+        let reader;
+        let timer;
+        const deadline = new Promise((_, reject) => {
+            timer = setTimeout(() => {
+                controller.abort();
+                void reader?.cancel().catch(() => { });
+                reject(new Refusal(`OIDC_${kind}_UNAVAILABLE`));
+            }, 3000);
+        });
+        try {
+            return await Promise.race([deadline, (async () => {
+                    const response = await transport(url, { redirect: "error", signal: controller.signal, headers: { accept: "application/json" } });
+                    if (kind === "DISCOVERY")
+                        reachable = true;
+                    if (!response.ok)
+                        return refuse(`OIDC_${kind}_UNAVAILABLE`);
+                    if (response.redirected || (response.url && response.url !== url))
+                        return refuse(`OIDC_${kind}_INVALID`);
+                    const length = response.headers.get("content-length");
+                    if (length && (!/^\d+$/.test(length) || Number(length) > 65536))
+                        return refuse(`OIDC_${kind}_INVALID`);
+                    if (!response.body)
+                        return refuse(`OIDC_${kind}_INVALID`);
+                    reader = response.body.getReader();
+                    const chunks = [];
+                    let size = 0;
+                    for (;;) {
+                        const part = await reader.read();
+                        if (part.done)
+                            break;
+                        size += part.value.byteLength;
+                        if (size > 65536) {
+                            void reader.cancel().catch(() => { });
+                            return refuse(`OIDC_${kind}_INVALID`);
+                        }
+                        chunks.push(part.value);
+                    }
+                    let value;
+                    try {
+                        value = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+                    }
+                    catch {
+                        return refuse(`OIDC_${kind}_INVALID`);
+                    }
+                    const control = response.headers.get("cache-control") ?? "";
+                    const ages = [...control.matchAll(/(?:^|,)\s*max-age\s*=\s*"?(\d+)"?/gi)].map(match => Number(match[1]));
+                    const age = Number(response.headers.get("age") ?? "0");
+                    // Revalidate no-cache documents at the next permitted JWKS refresh.
+                    const cacheBound = /(?:^|,)\s*no-cache(?:\s|,|$)/i.test(control) ? 30 : maxAge;
+                    const seconds = /(?:^|,)\s*no-store(?:\s|,|$)/i.test(control) ? 0
+                        : Math.max(0, Math.min(maxAge, cacheBound, ...ages) - (Number.isFinite(age) && age >= 0 ? age : maxAge));
+                    return { value, expires: now() + seconds * 1000 };
+                })()]);
+        }
+        catch (error) {
+            if (error instanceof Refusal)
+                throw error;
+            return refuse(`OIDC_${kind}_UNAVAILABLE`);
+        }
+        finally {
+            clearTimeout(timer);
+            controller.abort();
+        }
+    }
+    async function metadata() {
+        if (!configurationValid)
+            return refuse("OIDC_CONFIGURATION_INVALID");
+        if (discovery && discovery.expires > now())
+            return discovery;
+        if (discoveryFlight)
+            return discoveryFlight;
+        discoveryFlight = (async () => {
+            discoveryCheck = now();
+            reachable = false;
+            discoveryValid = false;
+            const fetched = await document(`${settings.issuer.replace(/\/$/, "")}/.well-known/openid-configuration`, "DISCOVERY", 3600);
+            if (!record(fetched.value) || fetched.value.issuer !== settings.issuer || typeof fetched.value.jwks_uri !== "string")
+                return refuse("OIDC_DISCOVERY_INVALID");
+            try {
+                if (validUrl(fetched.value.jwks_uri).origin !== origin)
+                    throw new Error();
+            }
+            catch {
+                return refuse("OIDC_DISCOVERY_INVALID");
+            }
+            if (discovery?.jwksUrl !== fetched.value.jwks_uri)
+                keys = undefined;
+            discoveryValid = true;
+            return discovery = { jwksUrl: fetched.value.jwks_uri, expires: fetched.expires };
+        })();
+        try {
+            return await discoveryFlight;
+        }
+        finally {
+            discoveryFlight = undefined;
+        }
+    }
+    async function keySet(force = false) {
+        const meta = await metadata();
+        if (!force && keys && keys.expires > now())
+            return keys;
+        if (keyFlight)
+            return keyFlight;
+        if (now() - lastKeyAttempt < 30000)
+            return refuse("OIDC_JWKS_REFRESH_RATE_LIMITED");
+        lastKeyAttempt = now();
+        keyCheck = now();
+        keyFlight = (async () => {
+            const fetched = await document(meta.jwksUrl, "JWKS", 300);
+            const value = fetched.value;
+            if (!record(value) || !Array.isArray(value.keys) || !value.keys.length || value.keys.length > 64)
+                return refuse("OIDC_JWKS_INVALID");
+            const eligible = [];
+            for (const key of value.keys) {
+                if (!record(key) || ["d", "p", "q", "dp", "dq", "qi", "oth", "k"].some(field => field in key))
+                    return refuse("OIDC_JWKS_INVALID");
+                if ((key.use !== undefined && key.use !== "sig") || (key.key_ops !== undefined && (!Array.isArray(key.key_ops) || !key.key_ops.length || !key.key_ops.every(operation => operation === "verify"))))
+                    continue;
+                const alg = key.alg === undefined ? (key.kty === "RSA" ? "RS256" : key.kty === "EC" && key.crv === "P-256" ? "ES256" : "") : key.alg;
+                if (!settings.algorithms.includes(alg)
+                    || (alg === "RS256" ? key.kty !== "RSA" : key.kty !== "EC" || key.crv !== "P-256"))
+                    continue;
+                if (!bounded(key.kid, 128) || (alg === "RS256" ? !bounded(key.n, 2048) || !bounded(key.e, 16)
+                    : !bounded(key.x, 128) || !bounded(key.y, 128)))
+                    return refuse("OIDC_JWKS_INVALID");
+                eligible.push({ ...key, alg: String(alg) });
+            }
+            if (!eligible.length || new Set(eligible.map(key => key.kid)).size !== eligible.length)
+                return refuse("OIDC_JWKS_INVALID");
+            const lib = await jwt();
+            try {
+                await Promise.all(eligible.map(key => lib.importJWK(key, key.alg)));
+            }
+            catch {
+                return refuse("OIDC_JWKS_INVALID");
+            }
+            keyFailure = undefined;
+            return keys = { values: eligible, expires: fetched.expires };
+        })();
+        try {
+            return await keyFlight;
+        }
+        catch (error) {
+            keyFailure = error instanceof Refusal ? error.code : "OIDC_JWKS_UNAVAILABLE";
+            throw error;
+        }
+        finally {
+            keyFlight = undefined;
+        }
+    }
+    async function verifyToken(token) {
+        try {
+            if (!configurationValid)
+                return refuse("OIDC_CONFIGURATION_INVALID");
+            if (typeof token !== "string" || Buffer.byteLength(token) > 16384 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(token))
+                return refuse("OIDC_TOKEN_INVALID");
+            let header, unverifiedPayload;
+            try {
+                const parts = token.split(".").map(part => {
+                    const bytes = Buffer.from(part, "base64url");
+                    if (bytes.toString("base64url") !== part)
+                        return refuse("OIDC_TOKEN_INVALID");
+                    return bytes;
+                });
+                const decoder = new TextDecoder("utf-8", { fatal: true });
+                header = JSON.parse(decoder.decode(parts[0]));
+                unverifiedPayload = JSON.parse(decoder.decode(parts[1]));
+            }
+            catch {
+                return refuse("OIDC_TOKEN_INVALID");
+            }
+            if (!record(header) || !record(unverifiedPayload) || !bounded(header.kid, 128)
+                || !settings.algorithms.includes(header.alg))
+                return refuse("OIDC_TOKEN_INVALID");
+            // Unverified claims may refuse before I/O; only verified claims can admit.
+            if (unverifiedPayload.iss !== settings.issuer)
+                return refuse("OIDC_ISSUER_MISMATCH");
+            let set = await keySet();
+            const select = () => set.values.find(key => key.kid === header.kid && key.alg === header.alg);
+            if (!select()) {
+                set = await keySet(true);
+                if (!select())
+                    return refuse("OIDC_KID_UNKNOWN");
+            }
+            const lib = await jwt();
+            const selected = select();
+            let payload;
+            try {
+                const key = await lib.importJWK(selected, String(header.alg));
+                ({ payload } = await lib.jwtVerify(token, async (protectedHeader) => {
+                    if (protectedHeader.alg !== header.alg || protectedHeader.kid !== header.kid)
+                        return refuse("OIDC_TOKEN_INVALID");
+                    return key;
+                }, { algorithms: settings.algorithms, audience: settings.audience, issuer: settings.issuer, currentDate: new Date(now()), clockTolerance: 0 }));
+            }
+            catch (error) {
+                if (record(error)) {
+                    if (error.code === "ERR_JWT_EXPIRED")
+                        return refuse("OIDC_TOKEN_EXPIRED");
+                    if (error.code === "ERR_JWT_CLAIM_VALIDATION_FAILED") {
+                        if (error.claim === "iss")
+                            return refuse("OIDC_ISSUER_MISMATCH");
+                        if (error.claim === "aud")
+                            return refuse("OIDC_AUDIENCE_MISMATCH");
+                        if (error.claim === "nbf")
+                            return refuse("OIDC_TOKEN_NOT_ACTIVE");
+                    }
+                }
+                return refuse("OIDC_TOKEN_INVALID");
+            }
+            if (payload.iss !== settings.issuer)
+                return refuse("OIDC_ISSUER_MISMATCH");
+            if (settings.requireSingleAudience ? payload.aud !== settings.audience
+                : !(payload.aud === settings.audience || (Array.isArray(payload.aud) && payload.aud.every(aud => typeof aud === "string") && payload.aud.includes(settings.audience))))
+                return refuse("OIDC_AUDIENCE_MISMATCH");
+            const seconds = now() / 1000;
+            if (!Number.isSafeInteger(payload.iat) || !Number.isSafeInteger(payload.exp) || payload.exp <= payload.iat
+                || payload.exp - payload.iat > settings.maxTokenLifetimeSeconds || payload.iat > seconds)
+                return refuse("OIDC_TOKEN_LIFETIME_INVALID");
+            if (payload.exp <= seconds)
+                return refuse("OIDC_TOKEN_EXPIRED");
+            if (payload.nbf !== undefined && (!Number.isSafeInteger(payload.nbf) || payload.nbf > seconds))
+                return refuse("OIDC_TOKEN_NOT_ACTIVE");
+            if (!bounded(payload.sub, 1024))
+                return refuse("OIDC_SUBJECT_INVALID");
+            if (!bounded(payload.email, 254) || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(payload.email))
+                return refuse("OIDC_EMAIL_INVALID");
+            if (payload.email_verified !== true)
+                return refuse("OIDC_EMAIL_UNVERIFIED");
+            return { ok: true, principal: { principalId: deriveOidcPrincipalId(settings.issuer, payload.sub), email: payload.email.trim().toLowerCase(), emailVerified: true }, expiresAt: stamp(payload.exp * 1000) };
+        }
+        catch (error) {
+            return { ok: false, code: error instanceof Refusal ? error.code : "OIDC_TOKEN_INVALID" };
+        }
+    }
+    return {
+        verifyToken,
+        async verifyAccessToken(token) {
+            const result = await verifyToken(token);
+            if (result.ok)
+                return result.principal;
+            if (unavailable(result.code))
+                throw new Error("OIDC identity verification unavailable");
+            return null;
+        },
+        async readiness() {
+            let code;
+            try {
+                await keySet();
+            }
+            catch (error) {
+                code = error instanceof Refusal ? error.code : "OIDC_JWKS_UNAVAILABLE";
+            }
+            if (code === "OIDC_JWKS_REFRESH_RATE_LIMITED" && keyFailure)
+                code = keyFailure;
+            const fresh = !!keys && keys.expires > now();
+            return { state: code ? unavailable(code) ? "unknown" : "unsatisfied" : fresh ? "ready" : "unsatisfied",
+                discovery: { reachable, valid: discoveryValid && !!discovery && discovery.expires > now(), checkedAt: stamp(discoveryCheck), expiresAt: stamp(discovery?.expires ?? null) },
+                jwks: { loaded: fresh, checkedAt: stamp(keyCheck), expiresAt: stamp(keys?.expires ?? null) }, ...(code ? { code } : {}) };
+        },
+    };
+}

package/dist/identity/oidcPrincipal.d.ts

@@ -0,0 +1,2 @@
+/** Frozen UTF-8, domain-separated SHA-256 UUIDv8 mapping of the exact issuer/subject pair. */
+export declare function deriveOidcPrincipalId(issuer: string, subject: string): string;

package/dist/identity/oidcPrincipal.js

@@ -0,0 +1,10 @@
+import { createHash } from "node:crypto";
+/** Frozen UTF-8, domain-separated SHA-256 UUIDv8 mapping of the exact issuer/subject pair. */
+export function deriveOidcPrincipalId(issuer, subject) {
+    const bytes = createHash("sha256").update("openlup:oidc-principal:v1\0", "utf8")
+        .update(JSON.stringify([issuer, subject]), "utf8").digest().subarray(0, 16);
+    bytes[6] = (bytes[6] & 0x0f) | 0x80;
+    bytes[8] = (bytes[8] & 0x3f) | 0x80;
+    const hex = bytes.toString("hex");
+    return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}

package/dist/identity/operatorAdminAuth.d.ts

@@ -0,0 +1,6 @@
+import type { AdminAuthPort, IdentityVerifierPort } from "./ports.js";
+import type { OperatorIdentityStore } from "./operatorPorts.js";
+export declare function createOperatorAdminAuth(options: {
+    verifier: IdentityVerifierPort;
+    authority: Pick<OperatorIdentityStore, "findMembership">;
+}): AdminAuthPort;

package/dist/identity/operatorAdminAuth.js

@@ -0,0 +1,13 @@
+export function createOperatorAdminAuth(options) {
+    return { async authorize(token, restrictions) {
+            const principal = token ? await options.verifier.verifyAccessToken(token) : null;
+            if (!principal)
+                return { ok: false, code: "UNAUTHORIZED", message: "Operator authentication required" };
+            const member = await options.authority.findMembership(principal.principalId);
+            if (!member || member.membershipState !== "active" || (member.role !== "admin" && member.role !== "distributor")
+                || (restrictions?.allowedRoles && !restrictions.allowedRoles.includes(member.role))) {
+                return { ok: false, code: "FORBIDDEN", message: "Operator access denied" };
+            }
+            return { ok: true, principalId: principal.principalId, role: member.role, isMachineActor: false };
+        } };
+}

package/dist/identity/operatorAuthHandlers.d.ts

@@ -0,0 +1,18 @@
+import { type IdentityResponseOptions } from "./response.js";
+import type { HttpRequest, HttpResponse } from "../http/index.js";
+import type { createOperatorSessionService } from "./operatorSession.js";
+export interface OperatorAuthMessages {
+    invalidRequest: string;
+    forbidden: string;
+    unauthorized: string;
+    unavailable: string;
+}
+export declare function createOperatorAuthHandlers(options: IdentityResponseOptions & {
+    sessions: ReturnType<typeof createOperatorSessionService>;
+    origin: string;
+    messages: OperatorAuthMessages;
+    padResponseTime(startedAt: number, minimumMs: number): Promise<void>;
+}): {
+    requestChallenge(req: HttpRequest, res: HttpResponse): Promise<void>;
+    verifyChallenge(req: HttpRequest, res: HttpResponse): Promise<void>;
+};

package/dist/identity/operatorAuthHandlers.js

@@ -0,0 +1,71 @@
+import { operatorChallengeRequestSchema, operatorChallengeVerificationSchema, operatorSessionSchema } from "./contracts/operatorAuth.js";
+import { createMagicLinkOriginResolver } from "./authVerifyUrl.js";
+import { createIdentityResponder } from "./response.js";
+export function createOperatorAuthHandlers(options) {
+    const responder = createIdentityResponder(options);
+    const origin = createMagicLinkOriginResolver([options.origin]);
+    function admitted(req, res) {
+        if (req.method !== "POST") {
+            responder.sendMethodNotAllowed(res, ["POST"]);
+            return false;
+        }
+        const configured = origin(req);
+        if (!configured) {
+            responder.sendBffError(res, "UPSTREAM_UNAVAILABLE", options.messages.unavailable);
+            return false;
+        }
+        const supplied = req.headers.origin;
+        const contentType = req.headers["content-type"];
+        if (supplied !== configured || typeof contentType !== "string" || !/^application\/json(?:;|$)/i.test(contentType)) {
+            responder.sendBffError(res, "FORBIDDEN", options.messages.forbidden);
+            return false;
+        }
+        return true;
+    }
+    return {
+        async requestChallenge(req, res) {
+            if (!admitted(req, res))
+                return;
+            const parsed = operatorChallengeRequestSchema.safeParse(req.body);
+            if (!parsed.success) {
+                responder.sendBffError(res, "BAD_REQUEST", options.messages.invalidRequest);
+                return;
+            }
+            const started = Date.now();
+            try {
+                await options.sessions.requestChallenge(parsed.data.email, async () => {
+                    await options.padResponseTime(started, 400);
+                    responder.sendBffSuccess(res, { accepted: true });
+                });
+            }
+            catch {
+                responder.sendBffError(res, "UPSTREAM_UNAVAILABLE", options.messages.unavailable);
+            }
+        },
+        async verifyChallenge(req, res) {
+            if (!admitted(req, res))
+                return;
+            // A token-shaped refusal is authentication failure; an invalid envelope is a bad request.
+            if (!req.body || typeof req.body !== "object" || Object.keys(req.body).length !== 1 || typeof req.body.token !== "string") {
+                responder.sendBffError(res, "BAD_REQUEST", options.messages.invalidRequest);
+                return;
+            }
+            const parsed = operatorChallengeVerificationSchema.safeParse(req.body);
+            if (!parsed.success) {
+                responder.sendBffError(res, "UNAUTHORIZED", options.messages.unauthorized);
+                return;
+            }
+            try {
+                const session = await options.sessions.verifyChallenge(parsed.data.token);
+                if (!session) {
+                    responder.sendBffError(res, "UNAUTHORIZED", options.messages.unauthorized);
+                    return;
+                }
+                responder.sendBffSuccess(res, operatorSessionSchema.parse(session));
+            }
+            catch {
+                responder.sendBffError(res, "UPSTREAM_UNAVAILABLE", options.messages.unavailable);
+            }
+        },
+    };
+}

package/dist/identity/operatorIdentityVerifier.d.ts

@@ -0,0 +1,8 @@
+import type { IdentityJwtLibraryLoader } from "./jwtLibrary.js";
+import type { IdentityVerifierPort } from "./ports.js";
+export declare function createOperatorIdentityVerifier(config: {
+    issuer: string;
+    audience: string;
+    customerAudience: string;
+    jwks: string;
+}, loadJwt: IdentityJwtLibraryLoader): IdentityVerifierPort;

package/dist/identity/operatorIdentityVerifier.js

@@ -0,0 +1,19 @@
+import { createCustomerIdentityVerifier } from "./customerIdentityVerifier.js";
+export function createOperatorIdentityVerifier(config, loadJwt) {
+    if (!config.customerAudience.trim() || config.audience === config.customerAudience)
+        throw new Error("operator_audience_must_be_distinct");
+    // Inspect the payload returned by the same cryptographic verification, never an unverified decode.
+    return createCustomerIdentityVerifier(config, async () => {
+        const library = await loadJwt();
+        return { ...library, async jwtVerify(token, key, options) {
+                const verified = await library.jwtVerify(token, key, options);
+                const payload = verified.payload;
+                const { iat, exp } = payload;
+                if (payload.aud !== config.audience || typeof iat !== "number" || typeof exp !== "number"
+                    || !Number.isInteger(iat) || !Number.isInteger(exp) || exp <= iat || exp - iat > 900
+                    || iat > Math.floor(Date.now() / 1000) || exp <= Math.floor(Date.now() / 1000))
+                    throw new Error("operator_token_profile_invalid");
+                return verified;
+            } };
+    });
+}

package/dist/identity/operatorInvitationLifecycle.d.ts

@@ -0,0 +1,7 @@
+export declare function assertOperatorInvitationTtl(value: number): void;
+export declare function invitationFailure(identityCode: string, bffCode?: string): Error & {
+    identityCode: string;
+    bffCode: string;
+};
+/** Pure parser; direct hosts call it before effects and pass the number to identity. */
+export declare function parseOperatorInvitationTtl(raw?: string): number;

package/dist/identity/operatorInvitationLifecycle.js

@@ -0,0 +1,15 @@
+export function assertOperatorInvitationTtl(value) {
+    if (!Number.isInteger(value) || value < 60 || value > 2592000)
+        throw new Error("operator_invitation_ttl_invalid");
+}
+export function invitationFailure(identityCode, bffCode = "CONFLICT") {
+    return Object.assign(new Error(identityCode), { identityCode, bffCode });
+}
+/** Pure parser; direct hosts call it before effects and pass the number to identity. */
+export function parseOperatorInvitationTtl(raw) {
+    if (raw !== undefined && !/^\d+$/.test(raw))
+        throw new Error("operator_invitation_ttl_invalid");
+    const value = raw === undefined ? 604800 : Number(raw);
+    assertOperatorInvitationTtl(value);
+    return value;
+}