@portaidentity/server 1.7.0

package/dist/lib/signing-keys.js

@@ -0,0 +1,206 @@
+/**
+ * Signing key management for the OIDC provider.
+ *
+ * Handles loading ES256 key pairs from the database, converting between
+ * PEM and JWK formats, and generating new key pairs for bootstrapping
+ * and rotation.
+ *
+ * Key format:
+ *   - Database stores PEM-encoded keys (public_key, private_key columns)
+ *   - node-oidc-provider requires JWK format (jwks.keys configuration)
+ *   - Node.js crypto module handles PEM ↔ JWK conversion
+ *
+ * Key lifecycle:
+ *   active   → Used for signing new tokens, published in JWKS
+ *   retired  → Not used for signing, still published in JWKS for verification
+ *   revoked  → Not loaded, not published
+ */
+import { createPrivateKey, generateKeyPairSync, createHash } from 'node:crypto';
+import { config } from '../config/index.js';
+import { getPool } from './database.js';
+import { logger } from './logger.js';
+import { encryptPrivateKey, decryptPrivateKey } from './signing-key-crypto.js';
+// ---------------------------------------------------------------------------
+// Cached JWKS for JWT verification (admin auth middleware, etc.)
+// ---------------------------------------------------------------------------
+/** In-memory cache for the active JWK set — avoids a DB round-trip per request */
+let cachedJwks = null;
+let jwksCacheTimestamp = 0;
+/** Cache TTL for the active JWK set — 60 seconds matches system-config cache */
+const JWKS_CACHE_TTL_MS = 60_000;
+/**
+ * Get the active JWK set (public + private keys) for JWT verification.
+ *
+ * Loads signing keys from the database on first call, then serves from
+ * an in-memory cache for 60 seconds. Used by the admin auth middleware
+ * to verify Bearer tokens without a DB query on every request.
+ *
+ * @returns JWK key set containing all active and retired keys
+ */
+export async function getActiveJwks() {
+    const now = Date.now();
+    if (cachedJwks && now - jwksCacheTimestamp < JWKS_CACHE_TTL_MS) {
+        return cachedJwks;
+    }
+    const records = await loadSigningKeysFromDb();
+    cachedJwks = signingKeysToJwks(records);
+    jwksCacheTimestamp = now;
+    return cachedJwks;
+}
+/**
+ * Clear the cached JWK set — useful for testing and after key rotation.
+ */
+export function clearJwksCache() {
+    cachedJwks = null;
+    jwksCacheTimestamp = 0;
+}
+/**
+ * Generate a new ES256 (ECDSA P-256) key pair.
+ *
+ * Creates a cryptographically secure key pair suitable for JWT signing.
+ * Returns PEM-encoded keys for database storage and a deterministic kid
+ * derived from the public key hash.
+ *
+ * @returns Object containing PEM keys, kid, and algorithm identifier
+ */
+export function generateES256KeyPair() {
+    // Generate ECDSA P-256 key pair using Node.js crypto
+    const { publicKey, privateKey } = generateKeyPairSync('ec', {
+        namedCurve: 'P-256',
+    });
+    // Export as PEM format for database storage
+    const publicKeyPem = publicKey.export({ type: 'spki', format: 'pem' });
+    const privateKeyPem = privateKey.export({ type: 'pkcs8', format: 'pem' });
+    // Generate deterministic kid from public key hash (first 16 hex chars of SHA-256).
+    // This ensures uniqueness while keeping the kid short enough for JWKS headers.
+    const kid = createHash('sha256').update(publicKeyPem).digest('hex').substring(0, 16);
+    return {
+        kid,
+        algorithm: 'ES256',
+        publicKeyPem,
+        privateKeyPem,
+    };
+}
+/**
+ * Convert a PEM-encoded private key to JWK format for node-oidc-provider.
+ *
+ * Uses Node.js crypto module to parse PEM and export as JWK. The resulting
+ * JWK includes the private key (d parameter) which is needed by the provider
+ * for token signing.
+ *
+ * @param privatePem - PEM-encoded private key (PKCS#8 format)
+ * @param kid - Key ID to include in the JWK
+ * @returns JWK object with both public and private key parameters
+ */
+export function pemToJwk(privatePem, kid) {
+    // Parse PEM into a Node.js KeyObject
+    const keyObject = createPrivateKey(privatePem);
+    // Export as JWK — includes both public (x, y) and private (d) parameters
+    const jwk = keyObject.export({ format: 'jwk' });
+    return {
+        ...jwk,
+        kid,
+        use: 'sig',
+        alg: 'ES256',
+    };
+}
+/**
+ * Convert signing key records from the database into JWK format
+ * suitable for node-oidc-provider's jwks.keys configuration.
+ *
+ * All active and retired keys are included — the provider uses the first key
+ * for signing and all keys for verification (supporting rotation).
+ *
+ * @param records - Array of signing key records from the database
+ * @returns JWK key set with keys array
+ */
+export function signingKeysToJwks(records) {
+    const keys = [];
+    for (const record of records) {
+        try {
+            keys.push(pemToJwk(record.privateKey, record.kid));
+        }
+        catch (error) {
+            // Skip invalid PEM keys rather than crashing — log error and continue
+            // with remaining keys so the provider can still start
+            logger.error({ kid: record.kid, error }, 'Failed to convert signing key PEM to JWK, skipping');
+        }
+    }
+    return { keys };
+}
+/**
+ * Load signing keys from the database.
+ *
+ * Queries the signing_keys table for active and retired keys that
+ * haven't expired. Returns them sorted by activated_at DESC (newest first)
+ * so the provider uses the newest active key for signing.
+ *
+ * @returns Array of signing key records, newest first
+ */
+export async function loadSigningKeysFromDb() {
+    const pool = getPool();
+    const result = await pool.query(`SELECT id, kid, algorithm, public_key, private_key,
+            private_key_iv, private_key_tag, encrypted,
+            status, activated_at, retired_at, expires_at
+     FROM signing_keys
+     WHERE status IN ('active', 'retired')
+       AND (expires_at IS NULL OR expires_at > NOW())
+     ORDER BY activated_at DESC`);
+    // Map snake_case DB columns to camelCase TypeScript interface.
+    // Decrypt private keys that are stored encrypted; pass through plaintext legacy keys.
+    return result.rows.map((row) => {
+        let privateKey;
+        if (row.encrypted && row.private_key_iv && row.private_key_tag) {
+            // Encrypted key — decrypt with AES-256-GCM
+            privateKey = decryptPrivateKey(row.private_key, row.private_key_iv, row.private_key_tag, config.signingKeyEncryptionKey);
+        }
+        else {
+            // Legacy plaintext key — use as-is
+            privateKey = row.private_key;
+        }
+        return {
+            id: row.id,
+            kid: row.kid,
+            algorithm: row.algorithm,
+            publicKey: row.public_key,
+            privateKey,
+            status: row.status,
+            activatedAt: row.activated_at,
+            retiredAt: row.retired_at,
+            expiresAt: row.expires_at,
+        };
+    });
+}
+/**
+ * Ensure at least one active signing key exists in the database.
+ *
+ * Called at application startup. If no active keys are found:
+ * 1. Generate a new ES256 key pair
+ * 2. Insert it into the signing_keys table with status='active'
+ * 3. Log a warning that a key was auto-generated
+ *
+ * This guarantees the OIDC provider can always start, even on a fresh database
+ * that has no signing keys yet (e.g., first run after migrations).
+ *
+ * @returns The JWK key set containing all active and retired keys
+ */
+export async function ensureSigningKeys() {
+    let records = await loadSigningKeysFromDb();
+    // Check if there are any active keys
+    const hasActiveKey = records.some((r) => r.status === 'active');
+    if (!hasActiveKey) {
+        logger.warn('No active signing keys found — auto-generating a new ES256 key pair');
+        const keyPair = generateES256KeyPair();
+        const pool = getPool();
+        // Encrypt the private key before storage (AES-256-GCM)
+        const { encrypted, iv, tag } = encryptPrivateKey(keyPair.privateKeyPem, config.signingKeyEncryptionKey);
+        // Insert the new key with encrypted private key
+        await pool.query(`INSERT INTO signing_keys (kid, algorithm, public_key, private_key, private_key_iv, private_key_tag, encrypted, status, activated_at)
+       VALUES ($1, $2, $3, $4, $5, $6, true, 'active', NOW())`, [keyPair.kid, keyPair.algorithm, keyPair.publicKeyPem, encrypted, iv, tag]);
+        logger.info({ kid: keyPair.kid }, 'Auto-generated signing key inserted into database');
+        // Reload keys from DB to get the full record including generated UUID
+        records = await loadSigningKeysFromDb();
+    }
+    return signingKeysToJwks(records);
+}
+//# sourceMappingURL=signing-keys.js.map

package/dist/lib/signing-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signing-keys.js","sourceRoot":"","sources":["../../src/lib/signing-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAChF,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE/E,8EAA8E;AAC9E,iEAAiE;AACjE,8EAA8E;AAE9E,kFAAkF;AAClF,IAAI,UAAU,GAAkC,IAAI,CAAC;AACrD,IAAI,kBAAkB,GAAG,CAAC,CAAC;AAE3B,gFAAgF;AAChF,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAEjC;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,UAAU,IAAI,GAAG,GAAG,kBAAkB,GAAG,iBAAiB,EAAE,CAAC;QAC/D,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,qBAAqB,EAAE,CAAC;IAC9C,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACxC,kBAAkB,GAAG,GAAG,CAAC;IACzB,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc;IAC5B,UAAU,GAAG,IAAI,CAAC;IAClB,kBAAkB,GAAG,CAAC,CAAC;AACzB,CAAC;AA6CD;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB;IAMlC,qDAAqD;IACrD,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,IAAI,EAAE;QAC1D,UAAU,EAAE,OAAO;KACpB,CAAC,CAAC;IAEH,4CAA4C;IAC5C,MAAM,YAAY,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAW,CAAC;IACjF,MAAM,aAAa,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAW,CAAC;IAEpF,mFAAmF;IACnF,+EAA+E;IAC/E,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAErF,OAAO;QACL,GAAG;QACH,SAAS,EAAE,OAAO;QAClB,YAAY;QACZ,aAAa;KACd,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,QAAQ,CAAC,UAAkB,EAAE,GAAW;IACtD,qCAAqC;IACrC,MAAM,SAAS,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAE/C,yEAAyE;IACzE,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAEhD,OAAO;QACL,GAAG,GAAG;QACN,GAAG;QACH,GAAG,EAAE,KAAK;QACV,GAAG,EAAE,OAAO;KACC,CAAC;AAClB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAA2B;IAC3D,MAAM,IAAI,GAAiB,EAAE,CAAC;IAE9B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACrD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,sEAAsE;YACtE,sDAAsD;YACtD,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,oDAAoD,CAAC,CAAC;QACjG,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,CAAC;AAClB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB;IACzC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAc7B;;;;;;gCAM4B,CAC7B,CAAC;IAEF,+DAA+D;IAC/D,sFAAsF;IACtF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QAC7B,IAAI,UAAkB,CAAC;QACvB,IAAI,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,cAAc,IAAI,GAAG,CAAC,eAAe,EAAE,CAAC;YAC/D,2CAA2C;YAC3C,UAAU,GAAG,iBAAiB,CAC5B,GAAG,CAAC,WAAW,EACf,GAAG,CAAC,cAAc,EAClB,GAAG,CAAC,eAAe,EACnB,MAAM,CAAC,uBAAuB,CAC/B,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,mCAAmC;YACnC,UAAU,GAAG,GAAG,CAAC,WAAW,CAAC;QAC/B,CAAC;QAED,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,UAAU;YACV,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,WAAW,EAAE,GAAG,CAAC,YAAY;YAC7B,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,SAAS,EAAE,GAAG,CAAC,UAAU;SAC1B,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,IAAI,OAAO,GAAG,MAAM,qBAAqB,EAAE,CAAC;IAE5C,qCAAqC;IACrC,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;IAEhE,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAC;QAEnF,MAAM,OAAO,GAAG,oBAAoB,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QAEvB,uDAAuD;QACvD,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,iBAAiB,CAC9C,OAAO,CAAC,aAAa,EACrB,MAAM,CAAC,uBAAuB,CAC/B,CAAC;QAEF,gDAAgD;QAChD,MAAM,IAAI,CAAC,KAAK,CACd;8DACwD,EACxD,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,YAAY,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,CAAC,CAC3E,CAAC;QAEF,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,mDAAmD,CAAC,CAAC;QAEvF,sEAAsE;QACtE,OAAO,GAAG,MAAM,qBAAqB,EAAE,CAAC;IAC1C,CAAC;IAED,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAC;AACpC,CAAC"}

package/dist/lib/stats.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Dashboard statistics service.
+ *
+ * Provides system-wide and per-organization statistics for the admin
+ * dashboard. All functions are standalone (no class), use parameterized
+ * SQL queries, and return typed result objects.
+ *
+ * Login activity metrics are derived from the `audit_log` table using
+ * event type filters. Entity counts use `GROUP BY status` for efficient
+ * aggregation.
+ *
+ * @module stats
+ * @see 05-dashboard-sessions-history.md
+ */
+/** Count breakdown by entity status */
+export interface StatusCounts {
+    total: number;
+    [status: string]: number;
+}
+/** Login activity for a time window */
+export interface LoginActivity {
+    successful: number;
+    failed: number;
+}
+/** System health check results */
+export interface SystemHealth {
+    database: boolean;
+    redis: boolean;
+}
+/** Full stats overview response */
+export interface StatsOverview {
+    organizations: StatusCounts;
+    users: StatusCounts & {
+        newLast7d: number;
+        newLast30d: number;
+        activeLast30d: number;
+    };
+    applications: StatusCounts;
+    clients: StatusCounts;
+    loginActivity: {
+        last24h: LoginActivity;
+        last7d: LoginActivity;
+        last30d: LoginActivity;
+    };
+    systemHealth: SystemHealth;
+    generatedAt: string;
+}
+/** Per-org stats response (scoped to a single organization) */
+export interface OrgStats {
+    organizationId: string;
+    users: StatusCounts & {
+        newLast7d: number;
+        newLast30d: number;
+        activeLast30d: number;
+    };
+    clients: StatusCounts;
+    loginActivity: {
+        last24h: LoginActivity;
+        last7d: LoginActivity;
+        last30d: LoginActivity;
+    };
+    generatedAt: string;
+}
+/**
+ * Get system-wide dashboard statistics.
+ *
+ * Aggregates counts across all organizations, user activity metrics,
+ * login event history from the audit log, and system health checks.
+ *
+ * @returns Full stats overview
+ */
+export declare function getStatsOverview(): Promise<StatsOverview>;
+/**
+ * Get per-organization dashboard statistics.
+ *
+ * All counts are scoped to the specified organization. Login activity
+ * is filtered by `organization_id` in the audit log.
+ *
+ * @param orgId - Organization UUID to scope statistics to
+ * @returns Per-org stats
+ */
+export declare function getOrgStats(orgId: string): Promise<OrgStats>;
+//# sourceMappingURL=stats.d.ts.map

package/dist/lib/stats.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stats.d.ts","sourceRoot":"","sources":["../../src/lib/stats.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAQH,uCAAuC;AACvC,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;CAC1B;AAED,uCAAuC;AACvC,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,kCAAkC;AAClC,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,OAAO,CAAC;IAClB,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,mCAAmC;AACnC,MAAM,WAAW,aAAa;IAC5B,aAAa,EAAE,YAAY,CAAC;IAC5B,KAAK,EAAE,YAAY,GAAG;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;IACvF,YAAY,EAAE,YAAY,CAAC;IAC3B,OAAO,EAAE,YAAY,CAAC;IACtB,aAAa,EAAE;QACb,OAAO,EAAE,aAAa,CAAC;QACvB,MAAM,EAAE,aAAa,CAAC;QACtB,OAAO,EAAE,aAAa,CAAC;KACxB,CAAC;IACF,YAAY,EAAE,YAAY,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,+DAA+D;AAC/D,MAAM,WAAW,QAAQ;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,YAAY,GAAG;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;IACvF,OAAO,EAAE,YAAY,CAAC;IACtB,aAAa,EAAE;QACb,OAAO,EAAE,aAAa,CAAC;QACvB,MAAM,EAAE,aAAa,CAAC;QACtB,OAAO,EAAE,aAAa,CAAC;KACxB,CAAC;IACF,WAAW,EAAE,MAAM,CAAC;CACrB;AAgHD;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,aAAa,CAAC,CAkD/D;AAED;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAqClE"}

package/dist/lib/stats.js

@@ -0,0 +1,187 @@
+/**
+ * Dashboard statistics service.
+ *
+ * Provides system-wide and per-organization statistics for the admin
+ * dashboard. All functions are standalone (no class), use parameterized
+ * SQL queries, and return typed result objects.
+ *
+ * Login activity metrics are derived from the `audit_log` table using
+ * event type filters. Entity counts use `GROUP BY status` for efficient
+ * aggregation.
+ *
+ * @module stats
+ * @see 05-dashboard-sessions-history.md
+ */
+import { getPool } from './database.js';
+// ============================================================================
+// Internal helpers
+// ============================================================================
+/**
+ * Count rows grouped by status for an entity table.
+ * Returns { total, active, suspended, ... } with all statuses found.
+ */
+async function countByStatus(table, orgFilter) {
+    const pool = getPool();
+    const conditions = orgFilter ? `WHERE ${orgFilter.column} = $1` : '';
+    const params = orgFilter ? [orgFilter.value] : [];
+    const { rows } = await pool.query(`SELECT status, COUNT(*)::text AS count FROM ${table} ${conditions} GROUP BY status`, params);
+    const result = { total: 0 };
+    for (const row of rows) {
+        const count = parseInt(row.count, 10);
+        result[row.status] = count;
+        result.total += count;
+    }
+    return result;
+}
+/**
+ * Count new users created within a given interval.
+ */
+async function countNewUsers(interval, orgId) {
+    const pool = getPool();
+    const orgFilter = orgId ? ' AND organization_id = $1' : '';
+    const params = orgId ? [orgId] : [];
+    const { rows } = await pool.query(`SELECT COUNT(*)::text AS count FROM users WHERE created_at > NOW() - $${orgId ? '2' : '1'}::interval${orgFilter}`, [...params, interval]);
+    return parseInt(rows[0].count, 10);
+}
+/**
+ * Count users active (logged in) within a given interval.
+ */
+async function countActiveUsers(interval, orgId) {
+    const pool = getPool();
+    const orgFilter = orgId ? ' AND organization_id = $1' : '';
+    const params = orgId ? [orgId] : [];
+    const { rows } = await pool.query(`SELECT COUNT(*)::text AS count FROM users WHERE last_login_at > NOW() - $${orgId ? '2' : '1'}::interval${orgFilter}`, [...params, interval]);
+    return parseInt(rows[0].count, 10);
+}
+/**
+ * Count login events from audit_log for a time window.
+ * Successful: event_type LIKE 'user.login.%' AND NOT LIKE '%.failed'
+ * Failed: event_type LIKE 'user.login.%.failed'
+ */
+async function countLoginActivity(interval, orgId) {
+    const pool = getPool();
+    const orgFilter = orgId ? ' AND organization_id = $1' : '';
+    const baseParams = orgId ? [orgId] : [];
+    const intervalParam = `$${orgId ? '2' : '1'}`;
+    const { rows } = await pool.query(`SELECT
+       CASE
+         WHEN event_type LIKE '%.failed' THEN 'failed'
+         ELSE 'successful'
+       END AS category,
+       COUNT(*)::text AS count
+     FROM audit_log
+     WHERE event_type LIKE 'user.login.%'
+       AND created_at > NOW() - ${intervalParam}::interval
+       ${orgFilter}
+     GROUP BY category`, [...baseParams, interval]);
+    const result = { successful: 0, failed: 0 };
+    for (const row of rows) {
+        if (row.category === 'successful')
+            result.successful = parseInt(row.count, 10);
+        if (row.category === 'failed')
+            result.failed = parseInt(row.count, 10);
+    }
+    return result;
+}
+/**
+ * Check system health (database connectivity).
+ * Redis health is checked separately since it may not be available
+ * from a pure database context.
+ */
+async function checkDatabaseHealth() {
+    try {
+        const pool = getPool();
+        await pool.query('SELECT 1');
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+// ============================================================================
+// Public API
+// ============================================================================
+/**
+ * Get system-wide dashboard statistics.
+ *
+ * Aggregates counts across all organizations, user activity metrics,
+ * login event history from the audit log, and system health checks.
+ *
+ * @returns Full stats overview
+ */
+export async function getStatsOverview() {
+    const [organizations, usersBase, applications, clients, newUsers7d, newUsers30d, activeUsers30d, loginLast24h, loginLast7d, loginLast30d, dbHealth,] = await Promise.all([
+        countByStatus('organizations'),
+        countByStatus('users'),
+        countByStatus('applications'),
+        countByStatus('clients'),
+        countNewUsers('7 days'),
+        countNewUsers('30 days'),
+        countActiveUsers('30 days'),
+        countLoginActivity('24 hours'),
+        countLoginActivity('7 days'),
+        countLoginActivity('30 days'),
+        checkDatabaseHealth(),
+    ]);
+    return {
+        organizations,
+        users: {
+            ...usersBase,
+            newLast7d: newUsers7d,
+            newLast30d: newUsers30d,
+            activeLast30d: activeUsers30d,
+        },
+        applications,
+        clients,
+        loginActivity: {
+            last24h: loginLast24h,
+            last7d: loginLast7d,
+            last30d: loginLast30d,
+        },
+        systemHealth: {
+            database: dbHealth,
+            // Redis health is checked via the health endpoint; we report true here
+            // since if we got this far the DB is reachable. Full health check is at GET /health.
+            redis: true,
+        },
+        generatedAt: new Date().toISOString(),
+    };
+}
+/**
+ * Get per-organization dashboard statistics.
+ *
+ * All counts are scoped to the specified organization. Login activity
+ * is filtered by `organization_id` in the audit log.
+ *
+ * @param orgId - Organization UUID to scope statistics to
+ * @returns Per-org stats
+ */
+export async function getOrgStats(orgId) {
+    const [usersBase, clientsCounts, newUsers7d, newUsers30d, activeUsers30d, loginLast24h, loginLast7d, loginLast30d,] = await Promise.all([
+        countByStatus('users', { column: 'organization_id', value: orgId }),
+        countByStatus('clients', { column: 'organization_id', value: orgId }),
+        countNewUsers('7 days', orgId),
+        countNewUsers('30 days', orgId),
+        countActiveUsers('30 days', orgId),
+        countLoginActivity('24 hours', orgId),
+        countLoginActivity('7 days', orgId),
+        countLoginActivity('30 days', orgId),
+    ]);
+    return {
+        organizationId: orgId,
+        users: {
+            ...usersBase,
+            newLast7d: newUsers7d,
+            newLast30d: newUsers30d,
+            activeLast30d: activeUsers30d,
+        },
+        clients: clientsCounts,
+        loginActivity: {
+            last24h: loginLast24h,
+            last7d: loginLast7d,
+            last30d: loginLast30d,
+        },
+        generatedAt: new Date().toISOString(),
+    };
+}
+//# sourceMappingURL=stats.js.map

package/dist/lib/stats.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stats.js","sourceRoot":"","sources":["../../src/lib/stats.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAoDxC,+EAA+E;AAC/E,mBAAmB;AACnB,+EAA+E;AAE/E;;;GAGG;AACH,KAAK,UAAU,aAAa,CAAC,KAAa,EAAE,SAA6C;IACvF,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,SAAS,CAAC,MAAM,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAElD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAC/B,+CAA+C,KAAK,IAAI,UAAU,kBAAkB,EACpF,MAAM,CACP,CAAC;IAEF,MAAM,MAAM,GAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IAC1C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACtC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC;QAC3B,MAAM,CAAC,KAAK,IAAI,KAAK,CAAC;IACxB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,aAAa,CAAC,QAAgB,EAAE,KAAc;IAC3D,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3D,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAEpC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAC/B,yEAAyE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,aAAa,SAAS,EAAE,EAClH,CAAC,GAAG,MAAM,EAAE,QAAQ,CAAC,CACtB,CAAC;IACF,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACrC,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,gBAAgB,CAAC,QAAgB,EAAE,KAAc;IAC9D,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3D,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAEpC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAC/B,4EAA4E,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,aAAa,SAAS,EAAE,EACrH,CAAC,GAAG,MAAM,EAAE,QAAQ,CAAC,CACtB,CAAC;IACF,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,kBAAkB,CAAC,QAAgB,EAAE,KAAc;IAChE,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3D,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxC,MAAM,aAAa,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IAE9C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAC/B;;;;;;;;kCAQ8B,aAAa;SACtC,SAAS;uBACK,EACnB,CAAC,GAAG,UAAU,EAAE,QAAQ,CAAC,CAC1B,CAAC;IAEF,MAAM,MAAM,GAAkB,EAAE,UAAU,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IAC3D,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY;YAAE,MAAM,CAAC,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC/E,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;YAAE,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,mBAAmB;IAChC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QACvB,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,aAAa;AACb,+EAA+E;AAE/E;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,MAAM,CACJ,aAAa,EACb,SAAS,EACT,YAAY,EACZ,OAAO,EACP,UAAU,EACV,WAAW,EACX,cAAc,EACd,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,QAAQ,EACT,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACpB,aAAa,CAAC,eAAe,CAAC;QAC9B,aAAa,CAAC,OAAO,CAAC;QACtB,aAAa,CAAC,cAAc,CAAC;QAC7B,aAAa,CAAC,SAAS,CAAC;QACxB,aAAa,CAAC,QAAQ,CAAC;QACvB,aAAa,CAAC,SAAS,CAAC;QACxB,gBAAgB,CAAC,SAAS,CAAC;QAC3B,kBAAkB,CAAC,UAAU,CAAC;QAC9B,kBAAkB,CAAC,QAAQ,CAAC;QAC5B,kBAAkB,CAAC,SAAS,CAAC;QAC7B,mBAAmB,EAAE;KACtB,CAAC,CAAC;IAEH,OAAO;QACL,aAAa;QACb,KAAK,EAAE;YACL,GAAG,SAAS;YACZ,SAAS,EAAE,UAAU;YACrB,UAAU,EAAE,WAAW;YACvB,aAAa,EAAE,cAAc;SAC9B;QACD,YAAY;QACZ,OAAO;QACP,aAAa,EAAE;YACb,OAAO,EAAE,YAAY;YACrB,MAAM,EAAE,WAAW;YACnB,OAAO,EAAE,YAAY;SACtB;QACD,YAAY,EAAE;YACZ,QAAQ,EAAE,QAAQ;YAClB,uEAAuE;YACvE,qFAAqF;YACrF,KAAK,EAAE,IAAI;SACZ;QACD,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACtC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAa;IAC7C,MAAM,CACJ,SAAS,EACT,aAAa,EACb,UAAU,EACV,WAAW,EACX,cAAc,EACd,YAAY,EACZ,WAAW,EACX,YAAY,EACb,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACpB,aAAa,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QACnE,aAAa,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QACrE,aAAa,CAAC,QAAQ,EAAE,KAAK,CAAC;QAC9B,aAAa,CAAC,SAAS,EAAE,KAAK,CAAC;QAC/B,gBAAgB,CAAC,SAAS,EAAE,KAAK,CAAC;QAClC,kBAAkB,CAAC,UAAU,EAAE,KAAK,CAAC;QACrC,kBAAkB,CAAC,QAAQ,EAAE,KAAK,CAAC;QACnC,kBAAkB,CAAC,SAAS,EAAE,KAAK,CAAC;KACrC,CAAC,CAAC;IAEH,OAAO;QACL,cAAc,EAAE,KAAK;QACrB,KAAK,EAAE;YACL,GAAG,SAAS;YACZ,SAAS,EAAE,UAAU;YACrB,UAAU,EAAE,WAAW;YACvB,aAAa,EAAE,cAAc;SAC9B;QACD,OAAO,EAAE,aAAa;QACtB,aAAa,EAAE;YACb,OAAO,EAAE,YAAY;YACrB,MAAM,EAAE,WAAW;YACnB,OAAO,EAAE,YAAY;SACtB;QACD,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACtC,CAAC;AACJ,CAAC"}

package/dist/lib/super-admin-protection.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Super-admin user protection module.
+ *
+ * The super-admin user (created during `porta init`) is the system bootstrap
+ * user and cannot be subjected to destructive operations. This module provides
+ * detection and guard functions to enforce this protection.
+ *
+ * The super-admin user ID is stored in `system_config` under the key
+ * `super_admin_user_id` during `porta init`. This is the single source
+ * of truth for super-admin detection.
+ *
+ * Protected operations (all throw 403 Forbidden):
+ *   - Delete
+ *   - Suspend
+ *   - Lock
+ *   - Deactivate
+ *   - Remove porta-super-admin role
+ *   - Manage 2FA (disable, reset, regenerate recovery codes)
+ *
+ * @module lib/super-admin-protection
+ */
+/** System config key where the super-admin user ID is stored */
+export declare const SUPER_ADMIN_USER_ID_KEY = "super_admin_user_id";
+/**
+ * Operations that are forbidden on the super-admin user.
+ * Used in error messages to clearly communicate what was attempted.
+ */
+export declare const PROTECTED_OPERATIONS: readonly ['delete', 'suspend', 'lock', 'deactivate', 'remove-super-admin-role', 'manage-2fa'];
+export type ProtectedOperation = (typeof PROTECTED_OPERATIONS)[number];
+/**
+ * Check if a user is the protected super-admin user.
+ *
+ * Queries `system_config` for the `super_admin_user_id` key (with 60s cache)
+ * and compares it to the given user ID. Returns false if no super-admin user
+ * has been configured (i.e., before `porta init` has been run).
+ *
+ * @param userId - The user ID to check
+ * @returns true if the user is the super-admin
+ */
+export declare function isSuperAdminUser(userId: string): Promise<boolean>;
+/**
+ * Error thrown when a protected operation is attempted on the super-admin user.
+ * Carries a 403 status code for HTTP responses.
+ */
+export declare class SuperAdminProtectionError extends Error {
+    /** HTTP status code (always 403) */
+    readonly status = 403;
+    /** The operation that was attempted */
+    readonly operation: ProtectedOperation;
+    constructor(operation: ProtectedOperation);
+}
+/**
+ * Guard function — throws 403 if attempting a forbidden action on the super-admin user.
+ *
+ * Call this before executing any destructive operation on a user:
+ * ```typescript
+ * await guardSuperAdmin(userId, 'suspend');
+ * // ... proceed with suspend logic
+ * ```
+ *
+ * If the user is not the super-admin, this function is a no-op.
+ * If the user IS the super-admin, it throws a `SuperAdminProtectionError`.
+ *
+ * @param userId - The user ID being acted upon
+ * @param operation - The operation being attempted
+ * @throws SuperAdminProtectionError if the user is the super-admin
+ */
+export declare function guardSuperAdmin(userId: string, operation: ProtectedOperation): Promise<void>;
+//# sourceMappingURL=super-admin-protection.d.ts.map

package/dist/lib/super-admin-protection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"super-admin-protection.d.ts","sourceRoot":"","sources":["../../src/lib/super-admin-protection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAQH,gEAAgE;AAChE,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAE7D;;;GAGG;AACH,eAAO,MAAM,oBAAoB,YAC/B,QAAQ,EACR,SAAS,EACT,MAAM,EACN,YAAY,EACZ,yBAAyB,EACzB,YAAY,CACJ,CAAC;AAEX,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAMvE;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQvE;AAMD;;;GAGG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,oCAAoC;IACpC,QAAQ,CAAC,MAAM,OAAO;IACtB,uCAAuC;IACvC,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAC;IAEvC,YAAY,SAAS,EAAE,kBAAkB,EAIxC;CACF;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,kBAAkB,GAC5B,OAAO,CAAC,IAAI,CAAC,CAKf"}

package/dist/lib/super-admin-protection.js

@@ -0,0 +1,102 @@
+/**
+ * Super-admin user protection module.
+ *
+ * The super-admin user (created during `porta init`) is the system bootstrap
+ * user and cannot be subjected to destructive operations. This module provides
+ * detection and guard functions to enforce this protection.
+ *
+ * The super-admin user ID is stored in `system_config` under the key
+ * `super_admin_user_id` during `porta init`. This is the single source
+ * of truth for super-admin detection.
+ *
+ * Protected operations (all throw 403 Forbidden):
+ *   - Delete
+ *   - Suspend
+ *   - Lock
+ *   - Deactivate
+ *   - Remove porta-super-admin role
+ *   - Manage 2FA (disable, reset, regenerate recovery codes)
+ *
+ * @module lib/super-admin-protection
+ */
+import { getSystemConfigString } from './system-config.js';
+// ============================================================================
+// Constants
+// ============================================================================
+/** System config key where the super-admin user ID is stored */
+export const SUPER_ADMIN_USER_ID_KEY = 'super_admin_user_id';
+/**
+ * Operations that are forbidden on the super-admin user.
+ * Used in error messages to clearly communicate what was attempted.
+ */
+export const PROTECTED_OPERATIONS = [
+    'delete',
+    'suspend',
+    'lock',
+    'deactivate',
+    'remove-super-admin-role',
+    'manage-2fa',
+];
+// ============================================================================
+// Detection
+// ============================================================================
+/**
+ * Check if a user is the protected super-admin user.
+ *
+ * Queries `system_config` for the `super_admin_user_id` key (with 60s cache)
+ * and compares it to the given user ID. Returns false if no super-admin user
+ * has been configured (i.e., before `porta init` has been run).
+ *
+ * @param userId - The user ID to check
+ * @returns true if the user is the super-admin
+ */
+export async function isSuperAdminUser(userId) {
+    // getSystemConfigString returns the fallback when the key doesn't exist.
+    // Empty string fallback means: if no super-admin is configured, nobody matches.
+    const superAdminUserId = await getSystemConfigString(SUPER_ADMIN_USER_ID_KEY, '');
+    if (!superAdminUserId) {
+        return false;
+    }
+    return superAdminUserId === userId;
+}
+// ============================================================================
+// Guard
+// ============================================================================
+/**
+ * Error thrown when a protected operation is attempted on the super-admin user.
+ * Carries a 403 status code for HTTP responses.
+ */
+export class SuperAdminProtectionError extends Error {
+    /** HTTP status code (always 403) */
+    status = 403;
+    /** The operation that was attempted */
+    operation;
+    constructor(operation) {
+        super(`Cannot ${operation} the super-admin user`);
+        this.name = 'SuperAdminProtectionError';
+        this.operation = operation;
+    }
+}
+/**
+ * Guard function — throws 403 if attempting a forbidden action on the super-admin user.
+ *
+ * Call this before executing any destructive operation on a user:
+ * ```typescript
+ * await guardSuperAdmin(userId, 'suspend');
+ * // ... proceed with suspend logic
+ * ```
+ *
+ * If the user is not the super-admin, this function is a no-op.
+ * If the user IS the super-admin, it throws a `SuperAdminProtectionError`.
+ *
+ * @param userId - The user ID being acted upon
+ * @param operation - The operation being attempted
+ * @throws SuperAdminProtectionError if the user is the super-admin
+ */
+export async function guardSuperAdmin(userId, operation) {
+    const isProtected = await isSuperAdminUser(userId);
+    if (isProtected) {
+        throw new SuperAdminProtectionError(operation);
+    }
+}
+//# sourceMappingURL=super-admin-protection.js.map