@portaidentity/server 1.7.0

package/dist/lib/runtime-paths.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Returns the absolute directory containing the server's SQL migrations.
+ * The path is derived from this module rather than the caller's working directory.
+ *
+ * @example
+ * ```ts
+ * const migrationsDirectory = getMigrationsDirectory();
+ * ```
+ */
+export declare function getMigrationsDirectory(): string;
+/**
+ * Returns the absolute path to the bundled seed migration.
+ *
+ * @example
+ * ```ts
+ * const seedSqlPath = getSeedSqlPath();
+ * ```
+ */
+export declare function getSeedSqlPath(): string;
+/**
+ * Returns the absolute directory containing page and email templates.
+ *
+ * @example
+ * ```ts
+ * const templatesDirectory = getTemplatesDirectory();
+ * ```
+ */
+export declare function getTemplatesDirectory(): string;
+/**
+ * Returns the absolute directory containing bundled translations.
+ *
+ * @example
+ * ```ts
+ * const localesDirectory = getLocalesDirectory();
+ * ```
+ */
+export declare function getLocalesDirectory(): string;
+//# sourceMappingURL=runtime-paths.d.ts.map

package/dist/lib/runtime-paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-paths.d.ts","sourceRoot":"","sources":["../../src/lib/runtime-paths.ts"],"names":[],"mappings":"AAMA;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,CAE9C;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C"}

package/dist/lib/runtime-paths.js

@@ -0,0 +1,50 @@
+import { fileURLToPath } from 'node:url';
+import { join } from 'node:path';
+// Both src/lib and dist/lib are two levels below the server package root.
+const serverPackageRoot = fileURLToPath(new URL('../..', import.meta.url));
+/**
+ * Returns the absolute directory containing the server's SQL migrations.
+ * The path is derived from this module rather than the caller's working directory.
+ *
+ * @example
+ * ```ts
+ * const migrationsDirectory = getMigrationsDirectory();
+ * ```
+ */
+export function getMigrationsDirectory() {
+    return join(serverPackageRoot, 'migrations');
+}
+/**
+ * Returns the absolute path to the bundled seed migration.
+ *
+ * @example
+ * ```ts
+ * const seedSqlPath = getSeedSqlPath();
+ * ```
+ */
+export function getSeedSqlPath() {
+    return join(getMigrationsDirectory(), '011_seed.sql');
+}
+/**
+ * Returns the absolute directory containing page and email templates.
+ *
+ * @example
+ * ```ts
+ * const templatesDirectory = getTemplatesDirectory();
+ * ```
+ */
+export function getTemplatesDirectory() {
+    return join(serverPackageRoot, 'templates');
+}
+/**
+ * Returns the absolute directory containing bundled translations.
+ *
+ * @example
+ * ```ts
+ * const localesDirectory = getLocalesDirectory();
+ * ```
+ */
+export function getLocalesDirectory() {
+    return join(serverPackageRoot, 'locales');
+}
+//# sourceMappingURL=runtime-paths.js.map

package/dist/lib/runtime-paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-paths.js","sourceRoot":"","sources":["../../src/lib/runtime-paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,0EAA0E;AAC1E,MAAM,iBAAiB,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE3E;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB;IACpC,OAAO,IAAI,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,IAAI,CAAC,sBAAsB,EAAE,EAAE,cAAc,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB;IACnC,OAAO,IAAI,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,IAAI,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC;AAC5C,CAAC"}

package/dist/lib/session-tracking.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Session tracking repository.
+ *
+ * PostgreSQL mirror of Redis OIDC sessions for admin listing, filtering,
+ * and revocation. All operations are fire-and-forget — tracking failures
+ * must NEVER break the OIDC flow.
+ *
+ * The Redis adapter calls these hooks when modelName === 'Session'.
+ *
+ * @module session-tracking
+ * @see 05-dashboard-sessions-history.md
+ */
+/** Input for creating/upserting a session tracking record */
+export interface SessionTrackingInput {
+    sessionId: string;
+    userId?: string;
+    clientId?: string;
+    organizationId?: string;
+    grantId?: string;
+    ipAddress?: string;
+    userAgent?: string;
+    expiresAt: Date;
+}
+/** A tracked session record */
+export interface TrackedSession {
+    sessionId: string;
+    userId: string | null;
+    clientId: string | null;
+    organizationId: string | null;
+    grantId: string | null;
+    ipAddress: string | null;
+    userAgent: string | null;
+    createdAt: Date;
+    expiresAt: Date;
+    lastActivityAt: Date;
+    revokedAt: Date | null;
+}
+/** Options for listing sessions */
+export interface ListSessionsOptions {
+    userId?: string;
+    organizationId?: string;
+    clientId?: string;
+    activeOnly?: boolean;
+    page?: number;
+    pageSize?: number;
+}
+/**
+ * Upsert a session tracking record (called on session create/update).
+ * Fire-and-forget — errors are logged but never thrown.
+ */
+export declare function upsertSession(input: SessionTrackingInput): Promise<void>;
+/**
+ * Mark a session as revoked (called on session destroy).
+ * Fire-and-forget — errors are logged but never thrown.
+ */
+export declare function revokeSession(sessionId: string): Promise<void>;
+/**
+ * Revoke all active sessions for a user.
+ * Returns the number of sessions revoked.
+ */
+export declare function revokeUserSessions(userId: string): Promise<number>;
+/**
+ * Get a single tracked session by ID.
+ */
+export declare function getSession(sessionId: string): Promise<TrackedSession | null>;
+/**
+ * List tracked sessions with filtering and pagination.
+ */
+export declare function listSessions(options?: ListSessionsOptions): Promise<{
+    data: TrackedSession[];
+    total: number;
+    page: number;
+    pageSize: number;
+}>;
+/**
+ * Clean up expired session tracking records older than 7 days.
+ * Keeps revoked sessions for audit purposes for 7 days.
+ * Fire-and-forget — designed to be called periodically.
+ */
+export declare function purgeExpiredSessions(): Promise<number>;
+//# sourceMappingURL=session-tracking.d.ts.map

package/dist/lib/session-tracking.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-tracking.d.ts","sourceRoot":"","sources":["../../src/lib/session-tracking.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AASH,6DAA6D;AAC7D,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,+BAA+B;AAC/B,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,cAAc,EAAE,IAAI,CAAC;IACrB,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;CACxB;AAED,mCAAmC;AACnC,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAMD;;;GAGG;AACH,wBAAsB,aAAa,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CA0B9E;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAUpE;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAOxE;AAED;;GAEG;AACH,wBAAsB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAYlF;AAED;;GAEG;AACH,wBAAsB,YAAY,CAAC,OAAO,GAAE,mBAAwB,GAAG,OAAO,CAAC;IAC7E,IAAI,EAAE,cAAc,EAAE,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC,CAmDD;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC,CAW5D"}

package/dist/lib/session-tracking.js

@@ -0,0 +1,145 @@
+/**
+ * Session tracking repository.
+ *
+ * PostgreSQL mirror of Redis OIDC sessions for admin listing, filtering,
+ * and revocation. All operations are fire-and-forget — tracking failures
+ * must NEVER break the OIDC flow.
+ *
+ * The Redis adapter calls these hooks when modelName === 'Session'.
+ *
+ * @module session-tracking
+ * @see 05-dashboard-sessions-history.md
+ */
+import { getPool } from './database.js';
+import { logger } from './logger.js';
+// ============================================================================
+// Repository functions
+// ============================================================================
+/**
+ * Upsert a session tracking record (called on session create/update).
+ * Fire-and-forget — errors are logged but never thrown.
+ */
+export async function upsertSession(input) {
+    try {
+        const pool = getPool();
+        await pool.query(`INSERT INTO admin_sessions (session_id, user_id, client_id, organization_id, grant_id, ip_address, user_agent, expires_at, last_activity_at)
+       VALUES ($1, $2, $3, $4, $5, $6, $7, $8, NOW())
+       ON CONFLICT (session_id) DO UPDATE SET
+         user_id = COALESCE(EXCLUDED.user_id, admin_sessions.user_id),
+         client_id = COALESCE(EXCLUDED.client_id, admin_sessions.client_id),
+         organization_id = COALESCE(EXCLUDED.organization_id, admin_sessions.organization_id),
+         grant_id = COALESCE(EXCLUDED.grant_id, admin_sessions.grant_id),
+         last_activity_at = NOW()`, [
+            input.sessionId,
+            input.userId ?? null,
+            input.clientId ?? null,
+            input.organizationId ?? null,
+            input.grantId ?? null,
+            input.ipAddress ?? null,
+            input.userAgent ?? null,
+            input.expiresAt,
+        ]);
+    }
+    catch (err) {
+        logger.warn({ err, sessionId: input.sessionId }, 'Failed to upsert session tracking record');
+    }
+}
+/**
+ * Mark a session as revoked (called on session destroy).
+ * Fire-and-forget — errors are logged but never thrown.
+ */
+export async function revokeSession(sessionId) {
+    try {
+        const pool = getPool();
+        await pool.query(`UPDATE admin_sessions SET revoked_at = NOW() WHERE session_id = $1 AND revoked_at IS NULL`, [sessionId]);
+    }
+    catch (err) {
+        logger.warn({ err, sessionId }, 'Failed to revoke session tracking record');
+    }
+}
+/**
+ * Revoke all active sessions for a user.
+ * Returns the number of sessions revoked.
+ */
+export async function revokeUserSessions(userId) {
+    const pool = getPool();
+    const { rowCount } = await pool.query(`UPDATE admin_sessions SET revoked_at = NOW() WHERE user_id = $1 AND revoked_at IS NULL`, [userId]);
+    return rowCount ?? 0;
+}
+/**
+ * Get a single tracked session by ID.
+ */
+export async function getSession(sessionId) {
+    const pool = getPool();
+    const { rows } = await pool.query(`SELECT session_id AS "sessionId", user_id AS "userId", client_id AS "clientId",
+            organization_id AS "organizationId", grant_id AS "grantId",
+            ip_address AS "ipAddress", user_agent AS "userAgent",
+            created_at AS "createdAt", expires_at AS "expiresAt",
+            last_activity_at AS "lastActivityAt", revoked_at AS "revokedAt"
+     FROM admin_sessions WHERE session_id = $1`, [sessionId]);
+    return rows[0] ?? null;
+}
+/**
+ * List tracked sessions with filtering and pagination.
+ */
+export async function listSessions(options = {}) {
+    const pool = getPool();
+    const page = Math.max(options.page ?? 1, 1);
+    const pageSize = Math.min(Math.max(options.pageSize ?? 20, 1), 100);
+    const offset = (page - 1) * pageSize;
+    const conditions = [];
+    const params = [];
+    let paramIndex = 1;
+    if (options.userId) {
+        conditions.push(`user_id = $${paramIndex++}`);
+        params.push(options.userId);
+    }
+    if (options.organizationId) {
+        conditions.push(`organization_id = $${paramIndex++}`);
+        params.push(options.organizationId);
+    }
+    if (options.clientId) {
+        conditions.push(`client_id = $${paramIndex++}`);
+        params.push(options.clientId);
+    }
+    if (options.activeOnly !== false) {
+        // Default: only active sessions
+        conditions.push('revoked_at IS NULL');
+        conditions.push(`expires_at > NOW()`);
+    }
+    const where = conditions.length ? `WHERE ${conditions.join(' AND ')}` : '';
+    const [countResult, dataResult] = await Promise.all([
+        pool.query(`SELECT COUNT(*)::text AS count FROM admin_sessions ${where}`, params),
+        pool.query(`SELECT session_id AS "sessionId", user_id AS "userId", client_id AS "clientId",
+              organization_id AS "organizationId", grant_id AS "grantId",
+              ip_address AS "ipAddress", user_agent AS "userAgent",
+              created_at AS "createdAt", expires_at AS "expiresAt",
+              last_activity_at AS "lastActivityAt", revoked_at AS "revokedAt"
+       FROM admin_sessions ${where}
+       ORDER BY last_activity_at DESC
+       LIMIT $${paramIndex} OFFSET $${paramIndex + 1}`, [...params, pageSize, offset]),
+    ]);
+    return {
+        data: dataResult.rows,
+        total: parseInt(countResult.rows[0].count, 10),
+        page,
+        pageSize,
+    };
+}
+/**
+ * Clean up expired session tracking records older than 7 days.
+ * Keeps revoked sessions for audit purposes for 7 days.
+ * Fire-and-forget — designed to be called periodically.
+ */
+export async function purgeExpiredSessions() {
+    try {
+        const pool = getPool();
+        const { rowCount } = await pool.query(`DELETE FROM admin_sessions WHERE expires_at < NOW() - INTERVAL '7 days'`);
+        return rowCount ?? 0;
+    }
+    catch (err) {
+        logger.warn({ err }, 'Failed to purge expired session tracking records');
+        return 0;
+    }
+}
+//# sourceMappingURL=session-tracking.js.map

package/dist/lib/session-tracking.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-tracking.js","sourceRoot":"","sources":["../../src/lib/session-tracking.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AA2CrC,+EAA+E;AAC/E,uBAAuB;AACvB,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAA2B;IAC7D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QACvB,MAAM,IAAI,CAAC,KAAK,CACd;;;;;;;kCAO4B,EAC5B;YACE,KAAK,CAAC,SAAS;YACf,KAAK,CAAC,MAAM,IAAI,IAAI;YACpB,KAAK,CAAC,QAAQ,IAAI,IAAI;YACtB,KAAK,CAAC,cAAc,IAAI,IAAI;YAC5B,KAAK,CAAC,OAAO,IAAI,IAAI;YACrB,KAAK,CAAC,SAAS,IAAI,IAAI;YACvB,KAAK,CAAC,SAAS,IAAI,IAAI;YACvB,KAAK,CAAC,SAAS;SAChB,CACF,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,EAAE,0CAA0C,CAAC,CAAC;IAC/F,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAiB;IACnD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QACvB,MAAM,IAAI,CAAC,KAAK,CACd,2FAA2F,EAC3F,CAAC,SAAS,CAAC,CACZ,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,0CAA0C,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAAc;IACrD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CACnC,wFAAwF,EACxF,CAAC,MAAM,CAAC,CACT,CAAC;IACF,OAAO,QAAQ,IAAI,CAAC,CAAC;AACvB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,SAAiB;IAChD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAC/B;;;;;+CAK2C,EAC3C,CAAC,SAAS,CAAC,CACZ,CAAC;IACF,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACzB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAO,GAAwB,EAAE;IAMlE,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC;IAErC,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,MAAM,GAAc,EAAE,CAAC;IAC7B,IAAI,UAAU,GAAG,CAAC,CAAC;IAEnB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,UAAU,CAAC,IAAI,CAAC,cAAc,UAAU,EAAE,EAAE,CAAC,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IACD,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;QAC3B,UAAU,CAAC,IAAI,CAAC,sBAAsB,UAAU,EAAE,EAAE,CAAC,CAAC;QACtD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,UAAU,CAAC,IAAI,CAAC,gBAAgB,UAAU,EAAE,EAAE,CAAC,CAAC;QAChD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,KAAK,KAAK,EAAE,CAAC;QACjC,gCAAgC;QAChC,UAAU,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACtC,UAAU,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACxC,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAE3E,MAAM,CAAC,WAAW,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAClD,IAAI,CAAC,KAAK,CAAoB,sDAAsD,KAAK,EAAE,EAAE,MAAM,CAAC;QACpG,IAAI,CAAC,KAAK,CACR;;;;;6BAKuB,KAAK;;gBAElB,UAAU,YAAY,UAAU,GAAG,CAAC,EAAE,EAChD,CAAC,GAAG,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAC9B;KACF,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,KAAK,EAAE,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QAC9C,IAAI;QACJ,QAAQ;KACT,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACxC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QACvB,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CACnC,yEAAyE,CAC1E,CAAC;QACF,OAAO,QAAQ,IAAI,CAAC,CAAC;IACvB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,kDAAkD,CAAC,CAAC;QACzE,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC"}

package/dist/lib/signing-key-crypto.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Signing key encryption utilities.
+ *
+ * Provides AES-256-GCM encryption and decryption for ES256 signing key
+ * private keys stored in the database. Private keys must be encrypted at
+ * rest because they are the root of trust for all JWT tokens — compromise
+ * would allow an attacker to forge tokens for any tenant.
+ *
+ * The encryption key comes from the SIGNING_KEY_ENCRYPTION_KEY env var
+ * (32 bytes, hex-encoded = 64 characters). A random 12-byte IV is
+ * generated per encryption operation. The GCM auth tag provides
+ * authenticated encryption (tamper detection).
+ *
+ * This module follows the same pattern as src/two-factor/crypto.ts but
+ * uses a separate error class for domain separation.
+ */
+/**
+ * Error thrown when signing key encryption or decryption fails.
+ *
+ * Separate from TwoFactorCryptoError to maintain domain boundaries —
+ * signing key crypto errors should not be conflated with 2FA errors.
+ */
+export declare class SigningKeyCryptoError extends Error {
+    constructor(message: string);
+}
+/**
+ * Encrypt a PEM-encoded private key with AES-256-GCM.
+ *
+ * Generates a random IV for each encryption operation to ensure
+ * the same plaintext never produces the same ciphertext.
+ *
+ * @param pemPrivateKey - PEM-encoded private key to encrypt
+ * @param encryptionKey - 32-byte hex-encoded encryption key (64 hex chars)
+ * @returns Object containing encrypted data, IV, and auth tag (all hex-encoded)
+ * @throws SigningKeyCryptoError if the encryption key is invalid
+ */
+export declare function encryptPrivateKey(pemPrivateKey: string, encryptionKey: string): {
+    encrypted: string;
+    iv: string;
+    tag: string;
+};
+/**
+ * Decrypt a PEM-encoded private key from its AES-256-GCM encrypted form.
+ *
+ * @param encrypted - Hex-encoded encrypted data
+ * @param iv - Hex-encoded initialization vector
+ * @param tag - Hex-encoded GCM authentication tag
+ * @param encryptionKey - 32-byte hex-encoded encryption key (64 hex chars)
+ * @returns The decrypted PEM-encoded private key
+ * @throws SigningKeyCryptoError if decryption fails (wrong key, tampered data, etc.)
+ */
+export declare function decryptPrivateKey(encrypted: string, iv: string, tag: string, encryptionKey: string): string;
+//# sourceMappingURL=signing-key-crypto.d.ts.map

package/dist/lib/signing-key-crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signing-key-crypto.d.ts","sourceRoot":"","sources":["../../src/lib/signing-key-crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AASH;;;;;GAKG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,aAAa,EAAE,MAAM,EACrB,aAAa,EAAE,MAAM,GACpB;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAyBhD;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,EACjB,EAAE,EAAE,MAAM,EACV,GAAG,EAAE,MAAM,EACX,aAAa,EAAE,MAAM,GACpB,MAAM,CA0BR"}

package/dist/lib/signing-key-crypto.js

@@ -0,0 +1,108 @@
+/**
+ * Signing key encryption utilities.
+ *
+ * Provides AES-256-GCM encryption and decryption for ES256 signing key
+ * private keys stored in the database. Private keys must be encrypted at
+ * rest because they are the root of trust for all JWT tokens — compromise
+ * would allow an attacker to forge tokens for any tenant.
+ *
+ * The encryption key comes from the SIGNING_KEY_ENCRYPTION_KEY env var
+ * (32 bytes, hex-encoded = 64 characters). A random 12-byte IV is
+ * generated per encryption operation. The GCM auth tag provides
+ * authenticated encryption (tamper detection).
+ *
+ * This module follows the same pattern as src/two-factor/crypto.ts but
+ * uses a separate error class for domain separation.
+ */
+import { createCipheriv, createDecipheriv, randomBytes } from 'node:crypto';
+/** AES-256-GCM cipher parameters */
+const ALGORITHM = 'aes-256-gcm';
+const IV_LENGTH = 12; // 96-bit IV recommended for GCM
+const TAG_LENGTH = 16; // 128-bit authentication tag
+/**
+ * Error thrown when signing key encryption or decryption fails.
+ *
+ * Separate from TwoFactorCryptoError to maintain domain boundaries —
+ * signing key crypto errors should not be conflated with 2FA errors.
+ */
+export class SigningKeyCryptoError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'SigningKeyCryptoError';
+    }
+}
+/**
+ * Encrypt a PEM-encoded private key with AES-256-GCM.
+ *
+ * Generates a random IV for each encryption operation to ensure
+ * the same plaintext never produces the same ciphertext.
+ *
+ * @param pemPrivateKey - PEM-encoded private key to encrypt
+ * @param encryptionKey - 32-byte hex-encoded encryption key (64 hex chars)
+ * @returns Object containing encrypted data, IV, and auth tag (all hex-encoded)
+ * @throws SigningKeyCryptoError if the encryption key is invalid
+ */
+export function encryptPrivateKey(pemPrivateKey, encryptionKey) {
+    // Validate the encryption key is a valid 32-byte hex string
+    const keyBuffer = parseEncryptionKey(encryptionKey);
+    // Generate a random 12-byte IV — unique per encryption operation
+    const iv = randomBytes(IV_LENGTH);
+    const cipher = createCipheriv(ALGORITHM, keyBuffer, iv, {
+        authTagLength: TAG_LENGTH,
+    });
+    // Encrypt the PEM-encoded private key
+    const encrypted = Buffer.concat([
+        cipher.update(pemPrivateKey, 'utf8'),
+        cipher.final(),
+    ]);
+    // Get the GCM authentication tag (provides tamper detection)
+    const tag = cipher.getAuthTag();
+    return {
+        encrypted: encrypted.toString('hex'),
+        iv: iv.toString('hex'),
+        tag: tag.toString('hex'),
+    };
+}
+/**
+ * Decrypt a PEM-encoded private key from its AES-256-GCM encrypted form.
+ *
+ * @param encrypted - Hex-encoded encrypted data
+ * @param iv - Hex-encoded initialization vector
+ * @param tag - Hex-encoded GCM authentication tag
+ * @param encryptionKey - 32-byte hex-encoded encryption key (64 hex chars)
+ * @returns The decrypted PEM-encoded private key
+ * @throws SigningKeyCryptoError if decryption fails (wrong key, tampered data, etc.)
+ */
+export function decryptPrivateKey(encrypted, iv, tag, encryptionKey) {
+    const keyBuffer = parseEncryptionKey(encryptionKey);
+    try {
+        const decipher = createDecipheriv(ALGORITHM, keyBuffer, Buffer.from(iv, 'hex'), { authTagLength: TAG_LENGTH });
+        // Set the auth tag before decryption — GCM verifies integrity
+        decipher.setAuthTag(Buffer.from(tag, 'hex'));
+        const decrypted = Buffer.concat([
+            decipher.update(Buffer.from(encrypted, 'hex')),
+            decipher.final(),
+        ]);
+        return decrypted.toString('utf8');
+    }
+    catch (error) {
+        // Re-throw as a domain error — the underlying error may be
+        // "Unsupported state or unable to authenticate data" (wrong key/tag)
+        const message = error instanceof Error ? error.message : 'Unknown decryption error';
+        throw new SigningKeyCryptoError(`Decryption failed: ${message}`);
+    }
+}
+/**
+ * Parse and validate a hex-encoded encryption key.
+ *
+ * @param hexKey - 64 hex characters representing 32 bytes
+ * @returns Buffer containing the 32-byte key
+ * @throws SigningKeyCryptoError if the key is not a valid 32-byte hex string
+ */
+function parseEncryptionKey(hexKey) {
+    if (!hexKey || hexKey.length !== 64 || !/^[0-9a-f]+$/i.test(hexKey)) {
+        throw new SigningKeyCryptoError('Invalid encryption key: must be 64 hex characters (32 bytes)');
+    }
+    return Buffer.from(hexKey, 'hex');
+}
+//# sourceMappingURL=signing-key-crypto.js.map

package/dist/lib/signing-key-crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signing-key-crypto.js","sourceRoot":"","sources":["../../src/lib/signing-key-crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE5E,oCAAoC;AACpC,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,SAAS,GAAG,EAAE,CAAC,CAAC,gCAAgC;AACtD,MAAM,UAAU,GAAG,EAAE,CAAC,CAAC,6BAA6B;AAEpD;;;;;GAKG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAC/B,aAAqB,EACrB,aAAqB;IAErB,4DAA4D;IAC5D,MAAM,SAAS,GAAG,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAEpD,iEAAiE;IACjE,MAAM,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IAElC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE;QACtD,aAAa,EAAE,UAAU;KAC1B,CAAC,CAAC;IAEH,sCAAsC;IACtC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC;QACpC,MAAM,CAAC,KAAK,EAAE;KACf,CAAC,CAAC;IAEH,6DAA6D;IAC7D,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAEhC,OAAO;QACL,SAAS,EAAE,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;QACpC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;QACtB,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;KACzB,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAC/B,SAAiB,EACjB,EAAU,EACV,GAAW,EACX,aAAqB;IAErB,MAAM,SAAS,GAAG,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAEpD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,gBAAgB,CAC/B,SAAS,EACT,SAAS,EACT,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,EACtB,EAAE,aAAa,EAAE,UAAU,EAAE,CAC9B,CAAC;QAEF,8DAA8D;QAC9D,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;QAE7C,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;YAC9B,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YAC9C,QAAQ,CAAC,KAAK,EAAE;SACjB,CAAC,CAAC;QAEH,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,2DAA2D;QAC3D,qEAAqE;QACrE,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B,CAAC;QACpF,MAAM,IAAI,qBAAqB,CAAC,sBAAsB,OAAO,EAAE,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,MAAc;IACxC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,qBAAqB,CAC7B,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AACpC,CAAC"}

package/dist/lib/signing-keys.d.ts

@@ -0,0 +1,141 @@
+/**
+ * Signing key management for the OIDC provider.
+ *
+ * Handles loading ES256 key pairs from the database, converting between
+ * PEM and JWK formats, and generating new key pairs for bootstrapping
+ * and rotation.
+ *
+ * Key format:
+ *   - Database stores PEM-encoded keys (public_key, private_key columns)
+ *   - node-oidc-provider requires JWK format (jwks.keys configuration)
+ *   - Node.js crypto module handles PEM ↔ JWK conversion
+ *
+ * Key lifecycle:
+ *   active   → Used for signing new tokens, published in JWKS
+ *   retired  → Not used for signing, still published in JWKS for verification
+ *   revoked  → Not loaded, not published
+ */
+/**
+ * Get the active JWK set (public + private keys) for JWT verification.
+ *
+ * Loads signing keys from the database on first call, then serves from
+ * an in-memory cache for 60 seconds. Used by the admin auth middleware
+ * to verify Bearer tokens without a DB query on every request.
+ *
+ * @returns JWK key set containing all active and retired keys
+ */
+export declare function getActiveJwks(): Promise<{
+    keys: JwkKeyPair[];
+}>;
+/**
+ * Clear the cached JWK set — useful for testing and after key rotation.
+ */
+export declare function clearJwksCache(): void;
+/** Represents a signing key record loaded from the database */
+export interface SigningKeyRecord {
+    /** UUID primary key */
+    id: string;
+    /** Key ID — published in JWKS for token verification */
+    kid: string;
+    /** Signing algorithm (e.g., 'ES256') */
+    algorithm: string;
+    /** PEM-encoded public key */
+    publicKey: string;
+    /** PEM-encoded private key */
+    privateKey: string;
+    /** Key lifecycle status */
+    status: 'active' | 'retired' | 'revoked';
+    /** When the key was activated */
+    activatedAt: Date;
+    /** When the key was retired (null if still active) */
+    retiredAt: Date | null;
+    /** Grace period expiry — retired keys past this date are not loaded */
+    expiresAt: Date | null;
+}
+/** JWK representation suitable for node-oidc-provider's jwks.keys configuration */
+export interface JwkKeyPair {
+    /** Key type — always 'EC' for ES256 */
+    kty: string;
+    /** Elliptic curve — always 'P-256' for ES256 */
+    crv: string;
+    /** Key ID — matches the kid in the signing_keys table */
+    kid: string;
+    /** Key usage — always 'sig' (signing) */
+    use: string;
+    /** Algorithm — always 'ES256' */
+    alg: string;
+    /** Public key X coordinate (base64url-encoded) */
+    x: string;
+    /** Public key Y coordinate (base64url-encoded) */
+    y: string;
+    /** Private key D value (base64url-encoded) — only present in private JWK */
+    d?: string;
+    [key: string]: unknown;
+}
+/**
+ * Generate a new ES256 (ECDSA P-256) key pair.
+ *
+ * Creates a cryptographically secure key pair suitable for JWT signing.
+ * Returns PEM-encoded keys for database storage and a deterministic kid
+ * derived from the public key hash.
+ *
+ * @returns Object containing PEM keys, kid, and algorithm identifier
+ */
+export declare function generateES256KeyPair(): {
+    kid: string;
+    algorithm: string;
+    publicKeyPem: string;
+    privateKeyPem: string;
+};
+/**
+ * Convert a PEM-encoded private key to JWK format for node-oidc-provider.
+ *
+ * Uses Node.js crypto module to parse PEM and export as JWK. The resulting
+ * JWK includes the private key (d parameter) which is needed by the provider
+ * for token signing.
+ *
+ * @param privatePem - PEM-encoded private key (PKCS#8 format)
+ * @param kid - Key ID to include in the JWK
+ * @returns JWK object with both public and private key parameters
+ */
+export declare function pemToJwk(privatePem: string, kid: string): JwkKeyPair;
+/**
+ * Convert signing key records from the database into JWK format
+ * suitable for node-oidc-provider's jwks.keys configuration.
+ *
+ * All active and retired keys are included — the provider uses the first key
+ * for signing and all keys for verification (supporting rotation).
+ *
+ * @param records - Array of signing key records from the database
+ * @returns JWK key set with keys array
+ */
+export declare function signingKeysToJwks(records: SigningKeyRecord[]): {
+    keys: JwkKeyPair[];
+};
+/**
+ * Load signing keys from the database.
+ *
+ * Queries the signing_keys table for active and retired keys that
+ * haven't expired. Returns them sorted by activated_at DESC (newest first)
+ * so the provider uses the newest active key for signing.
+ *
+ * @returns Array of signing key records, newest first
+ */
+export declare function loadSigningKeysFromDb(): Promise<SigningKeyRecord[]>;
+/**
+ * Ensure at least one active signing key exists in the database.
+ *
+ * Called at application startup. If no active keys are found:
+ * 1. Generate a new ES256 key pair
+ * 2. Insert it into the signing_keys table with status='active'
+ * 3. Log a warning that a key was auto-generated
+ *
+ * This guarantees the OIDC provider can always start, even on a fresh database
+ * that has no signing keys yet (e.g., first run after migrations).
+ *
+ * @returns The JWK key set containing all active and retired keys
+ */
+export declare function ensureSigningKeys(): Promise<{
+    keys: JwkKeyPair[];
+}>;
+//# sourceMappingURL=signing-keys.d.ts.map

package/dist/lib/signing-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signing-keys.d.ts","sourceRoot":"","sources":["../../src/lib/signing-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAmBH;;;;;;;;GAQG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC;IAAE,IAAI,EAAE,UAAU,EAAE,CAAA;CAAE,CAAC,CAUrE;AAED;;GAEG;AACH,wBAAgB,cAAc,IAAI,IAAI,CAGrC;AAED,+DAA+D;AAC/D,MAAM,WAAW,gBAAgB;IAC/B,uBAAuB;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,wDAAwD;IACxD,GAAG,EAAE,MAAM,CAAC;IACZ,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,6BAA6B;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,8BAA8B;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,2BAA2B;IAC3B,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;IACzC,iCAAiC;IACjC,WAAW,EAAE,IAAI,CAAC;IAClB,sDAAsD;IACtD,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,uEAAuE;IACvE,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;CACxB;AAED,mFAAmF;AACnF,MAAM,WAAW,UAAU;IACzB,uCAAuC;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,gDAAgD;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,yDAAyD;IACzD,GAAG,EAAE,MAAM,CAAC;IACZ,yCAAyC;IACzC,GAAG,EAAE,MAAM,CAAC;IACZ,iCAAiC;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,kDAAkD;IAClD,CAAC,EAAE,MAAM,CAAC;IACV,kDAAkD;IAClD,CAAC,EAAE,MAAM,CAAC;IACV,4EAA4E;IAC5E,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,IAAI;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;CACvB,CAoBA;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,UAAU,CAapE;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,gBAAgB,EAAE,GAAG;IAAE,IAAI,EAAE,UAAU,EAAE,CAAA;CAAE,CAcrF;AAED;;;;;;;;GAQG;AACH,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAuDzE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC;IAAE,IAAI,EAAE,UAAU,EAAE,CAAA;CAAE,CAAC,CAgCzE"}