@openlup/platform 0.15.0 → 0.17.0

package/dist/http/webhookSignature.js

@@ -0,0 +1,86 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+/** Hard cap on raw webhook body bytes — the payment provider events are well under 256 KiB. */
+export const MAX_WEBHOOK_BODY_BYTES = 1_048_576;
+/** Thrown by readRawBody when the streamed body exceeds MAX_WEBHOOK_BODY_BYTES. */
+export class WebhookBodyTooLargeError extends Error {
+    constructor() {
+        super("Webhook body exceeds maximum size");
+        this.name = "WebhookBodyTooLargeError";
+    }
+}
+/**
+ * Reads the exact raw request body bytes for provider webhook signature
+ * verification.
+ *
+ * `@vercel/node` (v3, the builder for `/api` functions in this Vite project)
+ * auto-parses `application/json` request bodies into `req.body` and IGNORES the
+ * `export const config = { api: { bodyParser: false } }` opt-out — that opt-out
+ * is a Next.js Pages Router convention, not a vanilla `@vercel/node` one
+ * (verified empirically against the hidden-preview deploy: a JSON payload posted
+ * with `Content-Type: application/json` arrives parsed, the same bytes posted as
+ * `text/plain` arrive raw). Re-serializing the parsed object with
+ * `JSON.stringify` does NOT reproduce the provider's exact bytes — the payment provider signs
+ * pretty-printed JSON, so a compacted re-serialization breaks HMAC verification.
+ *
+ * Reading the underlying request stream FIRST — before touching `req.body`,
+ * whose getter triggers the parse that consumes the stream — preserves the exact
+ * bytes when the platform parses lazily. When `req` is not a stream (unit tests
+ * pass a plain `{ body }` object) or the stream yields nothing (already
+ * consumed), we fall back to `req.body`.
+ */
+export async function readRawBody(req) {
+    if (isAsyncIterable(req)) {
+        const chunks = [];
+        let total = 0;
+        for await (const chunk of req) {
+            const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+            total += buf.byteLength;
+            // Enforce the cap mid-stream so an oversized body is rejected before it is
+            // fully buffered into memory, not after.
+            if (total > MAX_WEBHOOK_BODY_BYTES)
+                throw new WebhookBodyTooLargeError();
+            chunks.push(buf);
+        }
+        if (chunks.length > 0)
+            return Buffer.concat(chunks).toString("utf8");
+    }
+    if (typeof req.body === "string")
+        return capBody(req.body);
+    if (Buffer.isBuffer(req.body))
+        return capBody(req.body.toString("utf8"));
+    if (req.body && typeof req.body === "object")
+        return capBody(JSON.stringify(req.body));
+    return "";
+}
+function capBody(body) {
+    if (Buffer.byteLength(body, "utf8") > MAX_WEBHOOK_BODY_BYTES) {
+        throw new WebhookBodyTooLargeError();
+    }
+    return body;
+}
+function isAsyncIterable(value) {
+    return (value != null &&
+        typeof value[Symbol.asyncIterator] ===
+            "function");
+}
+export function verifyHmacSignature(input) {
+    if (!input.signatureHeader || !input.secret)
+        return false;
+    return timingSafeStringEqual(input.signatureHeader, hmac(input.rawBody, input.secret));
+}
+function hmac(value, secret) {
+    return createHmac("sha256", secret).update(value).digest("hex");
+}
+/**
+ * Constant-time comparison of two shared-secret strings.
+ *
+ * Exported because it is not payment-specific: any route holding a shared token has to compare it
+ * the same way, and a second hand-rolled copy of a security primitive is how one of them quietly
+ * stops being constant-time. The length check comes first because `timingSafeEqual` THROWS on a
+ * length mismatch rather than returning false, and the length of a shared token is not the secret.
+ */
+export function timingSafeStringEqual(left, right) {
+    const leftBuffer = Buffer.from(left);
+    const rightBuffer = Buffer.from(right);
+    return leftBuffer.length === rightBuffer.length && timingSafeEqual(leftBuffer, rightBuffer);
+}

package/dist/identity/adminAuthBinding.d.ts

@@ -0,0 +1,28 @@
+import type { AdminAuthPort } from "./ports.js";
+import type { AdminAuthBinding } from "./adminPreflight.js";
+type Env = Record<string, string | undefined>;
+export interface PlatformOperatorChecker {
+    isOperatorAllowed(principalId: string): Promise<boolean>;
+    close(): Promise<void>;
+}
+export type PlatformOperatorCheckerFactory = (env: Env) => PlatformOperatorChecker | Promise<PlatformOperatorChecker>;
+export type AdminAuthBindingResolution = {
+    readonly binding: AdminAuthBinding;
+    readonly error?: undefined;
+} | {
+    readonly binding?: undefined;
+    readonly error: "managed_admin_auth_env_required" | "direct_admin_auth_config_invalid";
+};
+export interface AdminAuthBindingOptions {
+    humanAuthFactory?: (env: Env) => AdminAuthPort & {
+        close(): Promise<void>;
+    };
+    checkerFactory?: PlatformOperatorCheckerFactory;
+    managedAuthFactory?: (env: {
+        url: string;
+        anonKey: string;
+    }, accessToken: string | null) => AdminAuthPort;
+}
+/** Bind the admin authorizer selected by PLATFORM_BUNDLE. */
+export declare function createAdminAuthBindingResolver(defaults: Required<Pick<AdminAuthBindingOptions, "checkerFactory" | "managedAuthFactory">> & Pick<AdminAuthBindingOptions, "humanAuthFactory">): (env: Env, options?: AdminAuthBindingOptions) => AdminAuthBindingResolution;
+export {};

package/dist/identity/adminAuthBinding.js

@@ -0,0 +1,66 @@
+import { createOperatorTokenAdminAuth, resolvePlatformOperatorAuthConfig } from "./operatorTokenAdminAuth.js";
+import { resolveBundleId } from "../kernel/index.js";
+function managedAuthEnv(env) {
+    const url = env.SUPABASE_URL ?? env.VITE_SUPABASE_URL;
+    const anonKey = env.VITE_SUPABASE_PUBLISHABLE_KEY ?? env.VITE_SUPABASE_ANON_KEY ?? env.SUPABASE_ANON_KEY;
+    return url && anonKey ? { url, anonKey } : null;
+}
+/** Bind the admin authorizer selected by PLATFORM_BUNDLE. */
+export function createAdminAuthBindingResolver(defaults) {
+    return function resolveAdminAuthBinding(env, options = {}) {
+        const bundleId = resolveBundleId(env);
+        if (bundleId === "node-postgres") {
+            const config = resolvePlatformOperatorAuthConfig(env);
+            const humanFactory = options.humanAuthFactory ?? defaults.humanAuthFactory;
+            const humanEnabled = !!env.OPERATOR_IDENTITY_AUDIENCE && !!humanFactory;
+            if (!config.config && !humanEnabled)
+                return { error: "direct_admin_auth_config_invalid" };
+            const checkerFactory = options.checkerFactory ?? defaults.checkerFactory;
+            return {
+                binding: {
+                    identity: bundleId,
+                    async run(accessToken, work) {
+                        const scope = {};
+                        const machine = config.config ? createOperatorTokenAdminAuth(config.config, async (principalId) => {
+                            scope.checker ??= await checkerFactory(env);
+                            return scope.checker.isOperatorAllowed(principalId);
+                        }) : null;
+                        let human;
+                        const auth = { async authorize(token, restrictions) {
+                                // Only a credential mismatch may select human verification; machine
+                                // revocation and database errors retain their existing result.
+                                const result = machine ? await machine.authorize(token, restrictions) : null;
+                                if (result && (result.ok || result.code !== "UNAUTHORIZED"))
+                                    return result;
+                                if (!humanEnabled || !token)
+                                    return result ?? { ok: false, code: "UNAUTHORIZED", message: "Operator authentication required" };
+                                human ??= humanFactory(env);
+                                return human.authorize(token, restrictions);
+                            } };
+                        try {
+                            return await work(auth);
+                        }
+                        finally {
+                            try {
+                                await scope.checker?.close();
+                            }
+                            finally {
+                                await human?.close();
+                            }
+                        }
+                    },
+                },
+            };
+        }
+        const authEnv = managedAuthEnv(env);
+        if (!authEnv)
+            return { error: "managed_admin_auth_env_required" };
+        const managedAuthFactory = options.managedAuthFactory ?? defaults.managedAuthFactory;
+        return {
+            binding: {
+                identity: bundleId,
+                run: (accessToken, work) => work(managedAuthFactory(authEnv, accessToken)),
+            },
+        };
+    };
+}

package/dist/identity/adminAuthorization.d.ts

@@ -0,0 +1,34 @@
+import type { HttpResponse, HttpRequest } from "../http/index.js";
+import { type IdentityResponseOptions } from "./response.js";
+export type AdminRole = "admin" | "distributor";
+/** Authorization outcome: a resolved admin `userId`, or a typed denial. */
+export type AdminAuthorization = {
+    ok: true;
+    userId: string;
+    role: AdminRole;
+    isMachineActor: boolean;
+} | {
+    ok: false;
+    code: "UNAUTHORIZED" | "FORBIDDEN";
+    message: string;
+    identityCode?: string;
+};
+/** A request-bound thunk that resolves the calling admin (or a denial). */
+export type AuthorizeAdmin = () => Promise<AdminAuthorization>;
+export declare function authorizeAdminWithUser(rawClient: unknown, accessToken: string | null, options?: {
+    allowedRoles?: readonly AdminRole[];
+}): Promise<AdminAuthorization>;
+export declare function authorizeCommerceAdminWithUser(client: unknown, accessToken: string | null): Promise<AdminAuthorization>;
+export declare function authorizeAdminBooleanWithUser(client: unknown, accessToken: string | null, options?: {
+    allowedRoles?: readonly AdminRole[];
+}): Promise<boolean>;
+/**
+ * Shared authz gate: returns the resolved admin (`userId` + DB-derived
+ * `isMachineActor`) or sends the error envelope and returns null.
+ */
+export declare function resolveAdmin(authorizeAdmin: AuthorizeAdmin, res: HttpResponse, options?: IdentityResponseOptions): Promise<{
+    userId: string;
+    role: AdminRole;
+    isMachineActor: boolean;
+} | null>;
+export declare function readBearerToken(req: HttpRequest): string | null;

package/dist/identity/adminAuthorization.js

@@ -0,0 +1,72 @@
+import { createIdentityResponder } from "./response.js";
+export async function authorizeAdminWithUser(rawClient, accessToken, options = {}) {
+    const client = rawClient;
+    if (!accessToken) {
+        return { ok: false, code: "UNAUTHORIZED", message: "Admin session required" };
+    }
+    const { data: userData, error: userError } = await client.auth.getUser(accessToken);
+    if (userError || !userData.user) {
+        return { ok: false, code: "UNAUTHORIZED", message: "Admin session required" };
+    }
+    const { data, error } = await client
+        .from("admin_users")
+        .select("id, role, is_machine_actor")
+        .eq("id", userData.user.id)
+        .eq("membership_state", "active")
+        .maybeSingle();
+    if (error)
+        throw error;
+    if (!data) {
+        return { ok: false, code: "FORBIDDEN", message: "Admin role required" };
+    }
+    const role = normalizeAdminRole(data.role);
+    if (role === null || (options.allowedRoles && !options.allowedRoles.includes(role))) {
+        return { ok: false, code: "FORBIDDEN", message: "Admin role required" };
+    }
+    // Fail closed: mirror the activate RPC's `COALESCE(is_machine_actor, true)` — only an
+    // explicit `false` is a human actor; anything else is treated as a machine. The DB row
+    // (`admin_users.is_machine_actor`, re-derived here and in every write RPC) is the single
+    // source of truth for actor kind — never trusted from the caller.
+    return {
+        ok: true,
+        userId: userData.user.id,
+        role,
+        isMachineActor: data.is_machine_actor !== false,
+    };
+}
+export function authorizeCommerceAdminWithUser(client, accessToken) {
+    return authorizeAdminWithUser(client, accessToken, { allowedRoles: ["admin"] });
+}
+export async function authorizeAdminBooleanWithUser(client, accessToken, options = {}) {
+    const authorization = await authorizeAdminWithUser(client, accessToken, options);
+    return authorization.ok;
+}
+/**
+ * Shared authz gate: returns the resolved admin (`userId` + DB-derived
+ * `isMachineActor`) or sends the error envelope and returns null.
+ */
+export async function resolveAdmin(authorizeAdmin, res, options = {}) {
+    const { sendBffError } = createIdentityResponder(options);
+    let authz;
+    try {
+        authz = await authorizeAdmin();
+    }
+    catch {
+        sendBffError(res, "UPSTREAM_UNAVAILABLE", "Admin authorization failed");
+        return null;
+    }
+    if (authz.ok === false) {
+        sendBffError(res, authz.code, authz.message);
+        return null;
+    }
+    return { userId: authz.userId, role: authz.role, isMachineActor: authz.isMachineActor };
+}
+function normalizeAdminRole(role) {
+    return role === "admin" || role === "distributor" ? role : null;
+}
+export function readBearerToken(req) {
+    const raw = req.headers.authorization;
+    const value = Array.isArray(raw) ? raw[0] : raw;
+    const match = value?.match(/^Bearer\s+(.+)$/i);
+    return match?.[1]?.trim() || null;
+}

package/dist/identity/adminContracts.d.ts

@@ -0,0 +1,70 @@
+import { z } from "zod";
+export declare const adminUserRoleSchema: z.ZodEnum<{
+    admin: "admin";
+    distributor: "distributor";
+}>;
+export declare const adminPlatformMeRequestSchema: z.ZodObject<{}, z.core.$strict>;
+export declare const adminPlatformMeResponseSchema: z.ZodObject<{
+    isAdmin: z.ZodBoolean;
+    role: z.ZodNullable<z.ZodEnum<{
+        admin: "admin";
+        distributor: "distributor";
+    }>>;
+}, z.core.$strip>;
+export declare const adminUserRoleUpdateRequestSchema: z.ZodObject<{
+    userId: z.ZodString;
+    role: z.ZodEnum<{
+        admin: "admin";
+        distributor: "distributor";
+    }>;
+}, z.core.$strip>;
+export declare const adminUserRoleUpdateResponseSchema: z.ZodObject<{
+    userId: z.ZodString;
+    role: z.ZodEnum<{
+        admin: "admin";
+        distributor: "distributor";
+    }>;
+    saved: z.ZodLiteral<true>;
+}, z.core.$strip>;
+export declare const adminUserInviteRequestSchema: z.ZodObject<{
+    email: z.ZodString;
+    role: z.ZodEnum<{
+        admin: "admin";
+        distributor: "distributor";
+    }>;
+}, z.core.$strip>;
+export declare const adminUserInviteResponseSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    principalId: z.ZodString;
+    invitationId: z.ZodString;
+    membershipState: z.ZodLiteral<"invited">;
+    role: z.ZodEnum<{
+        admin: "admin";
+        distributor: "distributor";
+    }>;
+    invitedAt: z.ZodISODateTime;
+    expiresAt: z.ZodISODateTime;
+    code: z.ZodEnum<{
+        INVITATION_CREATED: "INVITATION_CREATED";
+        ALREADY_INVITED: "ALREADY_INVITED";
+        INVITATION_REISSUED: "INVITATION_REISSUED";
+    }>;
+    message: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    principalId: z.ZodString;
+    membershipState: z.ZodLiteral<"active">;
+    role: z.ZodEnum<{
+        admin: "admin";
+        distributor: "distributor";
+    }>;
+    code: z.ZodEnum<{
+        MEMBERSHIP_CREATED: "MEMBERSHIP_CREATED";
+        ALREADY_ACTIVE: "ALREADY_ACTIVE";
+    }>;
+    message: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>], "membershipState">;
+export declare const adminUserRemoveRequestSchema: z.ZodObject<{
+    userId: z.ZodString;
+}, z.core.$strip>;
+export declare const adminUserRemoveResponseSchema: z.ZodObject<{
+    revoked: z.ZodLiteral<true>;
+}, z.core.$strip>;

package/dist/identity/adminContracts.js

@@ -0,0 +1,43 @@
+import { z } from "zod";
+z.config({ jitless: true });
+export const adminUserRoleSchema = z.enum(["admin", "distributor"]);
+export const adminPlatformMeRequestSchema = z.object({}).strict();
+export const adminPlatformMeResponseSchema = z.object({
+    isAdmin: z.boolean(),
+    role: adminUserRoleSchema.nullable(),
+});
+export const adminUserRoleUpdateRequestSchema = z.object({
+    userId: z.string().min(1),
+    role: adminUserRoleSchema,
+});
+export const adminUserRoleUpdateResponseSchema = z.object({
+    userId: z.string().min(1),
+    role: adminUserRoleSchema,
+    saved: z.literal(true),
+});
+export const adminUserInviteRequestSchema = z.object({
+    email: z.string().trim().email().toLowerCase(),
+    role: adminUserRoleSchema,
+});
+export const adminUserInviteResponseSchema = z.discriminatedUnion("membershipState", [z.object({
+        principalId: z.string().min(1),
+        invitationId: z.string().min(1),
+        membershipState: z.literal("invited"),
+        role: adminUserRoleSchema,
+        invitedAt: z.iso.datetime(),
+        expiresAt: z.iso.datetime(),
+        code: z.enum(["INVITATION_CREATED", "ALREADY_INVITED", "INVITATION_REISSUED"]),
+        message: z.string().optional(),
+    }), z.object({
+        principalId: z.string().min(1),
+        membershipState: z.literal("active"),
+        role: adminUserRoleSchema,
+        code: z.enum(["MEMBERSHIP_CREATED", "ALREADY_ACTIVE"]),
+        message: z.string().optional(),
+    })]);
+export const adminUserRemoveRequestSchema = z.object({
+    userId: z.string().min(1),
+});
+export const adminUserRemoveResponseSchema = z.object({
+    revoked: z.literal(true),
+});

package/dist/identity/adminMagicLinkHandler.d.ts

@@ -0,0 +1,39 @@
+import { type IdentityResponseOptions } from "./response.js";
+import type { z } from "zod";
+import type { HttpRequest, HttpResponse } from "../http/index.js";
+import type { MagicLinkAuthClient, MagicLinkRateLimitClient, MagicLinkDecision } from "./magicLinkPorts.js";
+export interface AdminMagicLinkHandlerOptions extends IdentityResponseOptions {
+    requestSchema: z.ZodType<{
+        email: string;
+    }>;
+    responseSchema: z.ZodType<{
+        accepted: true;
+    }>;
+    readEnvironment: () => {
+        url: string;
+        anonKey: string;
+        serviceRoleKey: string;
+    } | null;
+    createRuntime: (env: {
+        url: string;
+        anonKey: string;
+        serviceRoleKey: string;
+    }) => {
+        authClient: MagicLinkAuthClient;
+        rateLimitClient: MagicLinkRateLimitClient;
+        platformPort: {
+            checkAdminMagicLinkEligibility(email: string): Promise<string>;
+        };
+    };
+    checkAttempt: (input: {
+        client: MagicLinkRateLimitClient;
+        ip: string;
+        email: string;
+    }) => Promise<MagicLinkDecision>;
+    extractClientIp: (headers: HttpRequest["headers"]) => string;
+    padResponseTime: (startedAt: number, floor: number) => Promise<void>;
+    redirectOrigins?: readonly string[];
+    resolveOrigin?: (req: HttpRequest) => string | null;
+    callbackPath: string;
+}
+export declare function createAdminMagicLinkHandler(options: AdminMagicLinkHandlerOptions): (req: HttpRequest, res: HttpResponse) => Promise<void>;

package/dist/identity/adminMagicLinkHandler.js

@@ -0,0 +1,94 @@
+import { createMagicLinkOriginResolver } from "./authVerifyUrl.js";
+import { createIdentityResponder } from "./response.js";
+const ADMIN_MAGIC_LINK_RESPONSE_FLOOR_MS = 400;
+export function createAdminMagicLinkHandler(options) {
+    const { sendBffError, sendBffSuccess, sendMethodNotAllowed } = createIdentityResponder(options);
+    const readRequestOrigin = options.resolveOrigin ?? createMagicLinkOriginResolver(options.redirectOrigins ?? []);
+    const { requestSchema: adminMagicLinkRequestSchema, responseSchema: adminMagicLinkResponseSchema, readEnvironment: readSupabaseAdminServiceEnv, createRuntime: createAdminMagicLinkRuntime, checkAttempt: checkAndRecordAdminMagicLinkAttempt, extractClientIp, padResponseTime } = options;
+    return async (req, res) => {
+        if (req.method !== "POST") {
+            sendMethodNotAllowed(res, ["POST"]);
+            return;
+        }
+        const request = adminMagicLinkRequestSchema.safeParse(req.body);
+        if (!request.success) {
+            sendBffError(res, "BAD_REQUEST", "Invalid admin magic-link request", {
+                details: request.error.flatten(),
+            });
+            return;
+        }
+        const startedAt = Date.now();
+        const origin = readRequestOrigin(req);
+        if (!origin) {
+            await padResponseTime(startedAt, ADMIN_MAGIC_LINK_RESPONSE_FLOOR_MS);
+            sendBffError(res, "UPSTREAM_UNAVAILABLE", "Magic link origin is not configured", {
+                details: { reason: "magic_link_origin_not_configured" },
+            });
+            return;
+        }
+        const env = readSupabaseAdminServiceEnv();
+        if (!env) {
+            sendBffError(res, "UPSTREAM_UNAVAILABLE", "Admin auth is not configured", {
+                details: { feature: "admin_auth", requiredEnv: "SUPABASE_SERVICE_ROLE_KEY" },
+            });
+            return;
+        }
+        const runtime = createAdminMagicLinkRuntime(env);
+        const decision = await checkAndRecordAdminMagicLinkAttempt({
+            client: runtime.rateLimitClient,
+            ip: extractClientIp(req.headers),
+            email: request.data.email,
+        });
+        if (!decision.allowed && decision.reason === "rpc_error") {
+            console.warn("admin_magic_link_rate_limit_unavailable", JSON.stringify({ reason: decision.reason }));
+            await padResponseTime(startedAt, ADMIN_MAGIC_LINK_RESPONSE_FLOOR_MS);
+            sendBffError(res, "UPSTREAM_UNAVAILABLE", "Magic link service temporarily unavailable");
+            return;
+        }
+        if (decision.allowed) {
+            let eligibility;
+            try {
+                eligibility = await runtime.platformPort.checkAdminMagicLinkEligibility(request.data.email);
+            }
+            catch {
+                console.warn("admin_magic_link_lookup_failed", JSON.stringify({ outcome: "lookup_error" }));
+                await padResponseTime(startedAt, ADMIN_MAGIC_LINK_RESPONSE_FLOOR_MS);
+                sendBffError(res, "UPSTREAM_UNAVAILABLE", "Magic link service temporarily unavailable");
+                return;
+            }
+            if (eligibility === "eligible") {
+                const outcome = await sendMagicLink(runtime.authClient, request.data.email, origin);
+                console.info("admin_magic_link_outcome", JSON.stringify({ outcome: outcome.status, code: outcome.code ?? null }));
+            }
+            else {
+                console.warn("admin_magic_link_outcome", JSON.stringify({ outcome: eligibility }));
+            }
+        }
+        else {
+            console.warn("admin_magic_link_outcome", JSON.stringify({ outcome: "rate_limited", reason: decision.reason ?? "unknown" }));
+        }
+        await padResponseTime(startedAt, ADMIN_MAGIC_LINK_RESPONSE_FLOOR_MS);
+        sendBffSuccess(res, adminMagicLinkResponseSchema.parse({ accepted: true }));
+    };
+    async function sendMagicLink(client, email, origin) {
+        try {
+            const { error } = await client.auth.signInWithOtp({
+                email,
+                options: {
+                    shouldCreateUser: false,
+                    emailRedirectTo: `${origin}${options.callbackPath}`,
+                },
+            });
+            if (error) {
+                console.warn("admin_magic_link_send_failed", JSON.stringify({ code: error.name ?? "AuthError" }));
+                return { status: "auth_error", code: error.name ?? "AuthError" };
+            }
+            return { status: "sent" };
+        }
+        catch (error) {
+            const code = error instanceof Error ? error.name : "unknown";
+            console.warn("admin_magic_link_send_threw", JSON.stringify({ error: code }));
+            return { status: "threw", code };
+        }
+    }
+}

package/dist/identity/adminMeHandler.d.ts

@@ -0,0 +1,15 @@
+import type { OperatorInvitationStore } from "./operatorInvitationPorts.js";
+import { type IdentityResponseOptions } from "./response.js";
+import type { HttpRequest, HttpResponse } from "../http/index.js";
+import type { PlatformUserAuthenticationResult } from "./platformAdminAuth.js";
+export interface AdminPlatformMeDeps extends IdentityResponseOptions {
+    invitationStore?: Pick<OperatorInvitationStore, "acceptOperatorInvitation">;
+    platformPort: {
+        getAdminMe(userId: string): Promise<{
+            isAdmin: boolean;
+            role: "admin" | "distributor" | null;
+        }>;
+    };
+    authenticateUser: (req: HttpRequest) => Promise<PlatformUserAuthenticationResult>;
+}
+export declare function createAdminPlatformMeHandler({ platformPort, invitationStore, authenticateUser, responseRequestId, }: AdminPlatformMeDeps): (req: HttpRequest, res: HttpResponse) => Promise<void>;

package/dist/identity/adminMeHandler.js

@@ -0,0 +1,49 @@
+import { createIdentityResponder } from "./response.js";
+import { adminPlatformMeRequestSchema, adminPlatformMeResponseSchema } from "./adminContracts.js";
+export function createAdminPlatformMeHandler({ platformPort, invitationStore, authenticateUser, responseRequestId, }) {
+    const { sendBffError, sendBffSuccess, sendMethodNotAllowed } = createIdentityResponder({ responseRequestId });
+    return async function handler(req, res) {
+        if (req.method !== "GET") {
+            sendMethodNotAllowed(res, ["GET"]);
+            return;
+        }
+        let authentication;
+        try {
+            authentication = await authenticateUser(req);
+        }
+        catch {
+            sendBffError(res, "UPSTREAM_UNAVAILABLE", "Platform user authentication failed");
+            return;
+        }
+        if (authentication.ok === false) {
+            sendBffError(res, authentication.code, authentication.message);
+            return;
+        }
+        const request = adminPlatformMeRequestSchema.safeParse(req.query);
+        if (!request.success) {
+            sendBffError(res, "BAD_REQUEST", "Invalid platform me request", {
+                details: request.error.flatten(),
+            });
+            return;
+        }
+        try {
+            if (invitationStore) {
+                const outcome = await invitationStore.acceptOperatorInvitation(authentication.userId);
+                if (outcome.code === "INVITATION_EXPIRED" || outcome.code === "INVITATION_REVOKED") {
+                    sendBffError(res, "FORBIDDEN", outcome.code, { details: { identityCode: outcome.code } });
+                    return;
+                }
+            }
+            const result = await platformPort.getAdminMe(authentication.userId);
+            const response = adminPlatformMeResponseSchema.safeParse(result);
+            if (!response.success) {
+                sendBffError(res, "INVALID_RESPONSE", "Platform me returned invalid response");
+                return;
+            }
+            sendBffSuccess(res, response.data);
+        }
+        catch {
+            sendBffError(res, "UPSTREAM_UNAVAILABLE", "Platform me read failed");
+        }
+    };
+}

package/dist/identity/adminPreflight.d.ts

@@ -0,0 +1,16 @@
+import { type IdentityResponseOptions } from "./response.js";
+import type { HttpRequest, HttpResponse } from "../http/index.js";
+import type { AdminAuthPort, AdminPrincipalRole } from "./ports.js";
+export interface AdminAuthBinding {
+    readonly identity: string;
+    run<T>(accessToken: string | null, work: (auth: AdminAuthPort) => Promise<T>): Promise<T>;
+}
+export declare function createAdminBffPreflight(options: IdentityResponseOptions & {
+    allowedRoles: (route: string) => readonly AdminPrincipalRole[] | null;
+    resolveBinding: () => {
+        binding?: AdminAuthBinding;
+        error?: string;
+    };
+    machineWriteRoutes?: readonly string[];
+    managedEnvironmentMessage?: string;
+}): (req: HttpRequest, res: HttpResponse, route: string) => Promise<boolean>;

package/dist/identity/adminPreflight.js

@@ -0,0 +1,38 @@
+import { createIdentityResponder } from "./response.js";
+import { readBearerToken } from "./adminAuthorization.js";
+import { refusesMachineActorRequest, sendMachineActorWriteRefused } from "./machineActorWriteFence.js";
+export function createAdminBffPreflight(options) {
+    const { sendBffError, sendBffSuccess, sendMethodNotAllowed } = createIdentityResponder(options);
+    return async (req, res, route) => {
+        const allowedRoles = options.allowedRoles(route);
+        if (!allowedRoles)
+            return true;
+        const resolved = options.resolveBinding();
+        if (!resolved.binding) {
+            if (resolved.error === "managed_admin_auth_env_required") {
+                sendBffError(res, "INTERNAL", options.managedEnvironmentMessage ?? "Identity environment is not configured");
+            }
+            else
+                sendBffError(res, "UPSTREAM_UNAVAILABLE", "Admin authorization failed");
+            return false;
+        }
+        const accessToken = readBearerToken(req);
+        try {
+            const authz = await resolved.binding.run(accessToken, (auth) => auth.authorize(accessToken, { allowedRoles }));
+            if (authz.ok === false) {
+                sendBffError(res, authz.code, authz.message);
+                return false;
+            }
+            if (resolved.binding.identity !== "node-postgres"
+                && refusesMachineActorRequest(route, req.method, authz.isMachineActor, options.machineWriteRoutes)) {
+                sendMachineActorWriteRefused(res, options);
+                return false;
+            }
+            return true;
+        }
+        catch {
+            sendBffError(res, "UPSTREAM_UNAVAILABLE", "Admin authorization failed");
+            return false;
+        }
+    };
+}