@portaidentity/server 1.7.0

package/dist/lib/super-admin-protection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"super-admin-protection.js","sourceRoot":"","sources":["../../src/lib/super-admin-protection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E;AAE/E,gEAAgE;AAChE,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;AAE7D;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,QAAQ;IACR,SAAS;IACT,MAAM;IACN,YAAY;IACZ,yBAAyB;IACzB,YAAY;CACJ,CAAC;AAIX,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E;AAE/E;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAc;IACnD,yEAAyE;IACzE,gFAAgF;IAChF,MAAM,gBAAgB,GAAG,MAAM,qBAAqB,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC;IAClF,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,gBAAgB,KAAK,MAAM,CAAC;AACrC,CAAC;AAED,+EAA+E;AAC/E,QAAQ;AACR,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAClD,oCAAoC;IAC3B,MAAM,GAAG,GAAG,CAAC;IACtB,uCAAuC;IAC9B,SAAS,CAAqB;IAEvC,YAAY,SAA6B;QACvC,KAAK,CAAC,UAAU,SAAS,uBAAuB,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;QACxC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;CACF;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAc,EACd,SAA6B;IAE7B,MAAM,WAAW,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,IAAI,yBAAyB,CAAC,SAAS,CAAC,CAAC;IACjD,CAAC;AACH,CAAC"}

package/dist/lib/system-config.d.ts

@@ -0,0 +1,79 @@
+/**
+ * System configuration service — reads runtime settings from the system_config table.
+ *
+ * Values are cached in-memory with a configurable TTL to minimize database queries.
+ * The cache is shared across all requests within the process.
+ *
+ * The system_config table stores values as JSONB. Duration-type values are stored
+ * as JSONB strings (e.g., '"3600"'), while booleans and numbers are stored as
+ * native JSONB types. The typed getters handle parsing and coercion for each type.
+ *
+ * @example
+ *   const ttl = await getSystemConfigNumber('access_token_ttl', 3600);
+ *   const secure = await getSystemConfigBoolean('cookie_secure', true);
+ *   const allTtls = await loadOidcTtlConfig();
+ */
+/** OIDC TTL configuration loaded from system_config table */
+export interface OidcTtlConfig {
+    /** Access token lifetime in seconds (default: 3600 = 1 hour) */
+    accessToken: number;
+    /** ID token lifetime in seconds (default: 3600 = 1 hour) */
+    idToken: number;
+    /** Refresh token lifetime in seconds (default: 2592000 = 30 days) */
+    refreshToken: number;
+    /** Authorization code lifetime in seconds (default: 600 = 10 minutes) */
+    authorizationCode: number;
+    /** Session lifetime in seconds (default: 86400 = 24 hours) */
+    session: number;
+    /** Interaction lifetime in seconds — hardcoded, not in system_config (default: 3600 = 1 hour) */
+    interaction: number;
+    /** Grant lifetime in seconds — same as refresh token (default: 2592000 = 30 days) */
+    grant: number;
+}
+/**
+ * Get a string config value from the system_config table.
+ *
+ * @param key - Config key (e.g., 'magic_link_length')
+ * @param fallback - Default value returned if key not found or value is not a string
+ * @returns The config value as a string, or the fallback
+ */
+export declare function getSystemConfigString(key: string, fallback: string): Promise<string>;
+/**
+ * Get a numeric config value from the system_config table.
+ *
+ * Handles two storage patterns:
+ * - Duration-type values stored as JSONB strings (e.g., '"3600"') → parsed to number
+ * - Number-type values stored as native JSONB numbers (e.g., 10) → returned directly
+ *
+ * @param key - Config key (e.g., 'access_token_ttl')
+ * @param fallback - Default value returned if key not found or not a valid number
+ * @returns The config value as a number, or the fallback
+ */
+export declare function getSystemConfigNumber(key: string, fallback: number): Promise<number>;
+/**
+ * Get a boolean config value from the system_config table.
+ *
+ * Handles native JSONB booleans (true/false) and string representations
+ * ('true'/'false') for maximum flexibility.
+ *
+ * @param key - Config key (e.g., 'cookie_secure')
+ * @param fallback - Default value returned if key not found or not a valid boolean
+ * @returns The config value as a boolean, or the fallback
+ */
+export declare function getSystemConfigBoolean(key: string, fallback: boolean): Promise<boolean>;
+/**
+ * Load all TTL config values needed by the OIDC provider.
+ *
+ * Reads each TTL key from system_config with hardcoded fallback defaults.
+ * Called once at provider initialization to build the TTL configuration.
+ * The interaction TTL is hardcoded (not stored in system_config).
+ *
+ * @returns Object with all OIDC TTL settings in seconds
+ */
+export declare function loadOidcTtlConfig(): Promise<OidcTtlConfig>;
+/**
+ * Clear the in-memory config cache.
+ * Useful for testing to ensure fresh reads from the database.
+ */
+export declare function clearSystemConfigCache(): void;
+//# sourceMappingURL=system-config.d.ts.map

package/dist/lib/system-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"system-config.d.ts","sourceRoot":"","sources":["../../src/lib/system-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAWH,6DAA6D;AAC7D,MAAM,WAAW,aAAa;IAC5B,gEAAgE;IAChE,WAAW,EAAE,MAAM,CAAC;IACpB,4DAA4D;IAC5D,OAAO,EAAE,MAAM,CAAC;IAChB,qEAAqE;IACrE,YAAY,EAAE,MAAM,CAAC;IACrB,yEAAyE;IACzE,iBAAiB,EAAE,MAAM,CAAC;IAC1B,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC;IAChB,iGAAiG;IACjG,WAAW,EAAE,MAAM,CAAC;IACpB,qFAAqF;IACrF,KAAK,EAAE,MAAM,CAAC;CACf;AA8CD;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAM1F;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAgB1F;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAe7F;AAED;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,aAAa,CAAC,CAoBhE;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,IAAI,IAAI,CAE7C"}

package/dist/lib/system-config.js

@@ -0,0 +1,159 @@
+/**
+ * System configuration service — reads runtime settings from the system_config table.
+ *
+ * Values are cached in-memory with a configurable TTL to minimize database queries.
+ * The cache is shared across all requests within the process.
+ *
+ * The system_config table stores values as JSONB. Duration-type values are stored
+ * as JSONB strings (e.g., '"3600"'), while booleans and numbers are stored as
+ * native JSONB types. The typed getters handle parsing and coercion for each type.
+ *
+ * @example
+ *   const ttl = await getSystemConfigNumber('access_token_ttl', 3600);
+ *   const secure = await getSystemConfigBoolean('cookie_secure', true);
+ *   const allTtls = await loadOidcTtlConfig();
+ */
+import { getPool } from './database.js';
+import { logger } from './logger.js';
+// In-memory cache with TTL (default: 60 seconds)
+const cache = new Map();
+const CACHE_TTL_MS = 60_000;
+/**
+ * Fetch a raw config value from the database by key.
+ * Returns undefined if the key does not exist.
+ * Results are cached for CACHE_TTL_MS milliseconds.
+ *
+ * @param key - Config key to look up (e.g., 'access_token_ttl')
+ * @returns The JSONB value from the database, or undefined if not found
+ */
+async function getRawConfigValue(key) {
+    const now = Date.now();
+    // Check cache first
+    const cached = cache.get(key);
+    if (cached && cached.expiresAt > now) {
+        return cached.value;
+    }
+    try {
+        const pool = getPool();
+        const result = await pool.query('SELECT value FROM system_config WHERE key = $1', [key]);
+        if (result.rows.length === 0) {
+            // Cache the miss to avoid repeated DB queries for unknown keys
+            cache.set(key, { value: undefined, expiresAt: now + CACHE_TTL_MS });
+            return undefined;
+        }
+        const value = result.rows[0].value;
+        cache.set(key, { value, expiresAt: now + CACHE_TTL_MS });
+        return value;
+    }
+    catch (error) {
+        // Log warning but don't fail — callers always provide fallback defaults
+        logger.warn({ key, error }, 'Failed to read system_config value, using fallback');
+        return undefined;
+    }
+}
+/**
+ * Get a string config value from the system_config table.
+ *
+ * @param key - Config key (e.g., 'magic_link_length')
+ * @param fallback - Default value returned if key not found or value is not a string
+ * @returns The config value as a string, or the fallback
+ */
+export async function getSystemConfigString(key, fallback) {
+    const raw = await getRawConfigValue(key);
+    if (raw === undefined || raw === null)
+        return fallback;
+    // JSONB values may be strings, numbers, or booleans — coerce to string
+    return String(raw);
+}
+/**
+ * Get a numeric config value from the system_config table.
+ *
+ * Handles two storage patterns:
+ * - Duration-type values stored as JSONB strings (e.g., '"3600"') → parsed to number
+ * - Number-type values stored as native JSONB numbers (e.g., 10) → returned directly
+ *
+ * @param key - Config key (e.g., 'access_token_ttl')
+ * @param fallback - Default value returned if key not found or not a valid number
+ * @returns The config value as a number, or the fallback
+ */
+export async function getSystemConfigNumber(key, fallback) {
+    const raw = await getRawConfigValue(key);
+    if (raw === undefined || raw === null)
+        return fallback;
+    // If already a number (native JSONB number), return directly
+    if (typeof raw === 'number' && !Number.isNaN(raw))
+        return raw;
+    // If it's a string (duration values stored as JSONB strings like '"3600"'),
+    // parse as number
+    if (typeof raw === 'string') {
+        const parsed = Number(raw);
+        if (!Number.isNaN(parsed))
+            return parsed;
+    }
+    logger.warn({ key, raw }, 'system_config value is not a valid number, using fallback');
+    return fallback;
+}
+/**
+ * Get a boolean config value from the system_config table.
+ *
+ * Handles native JSONB booleans (true/false) and string representations
+ * ('true'/'false') for maximum flexibility.
+ *
+ * @param key - Config key (e.g., 'cookie_secure')
+ * @param fallback - Default value returned if key not found or not a valid boolean
+ * @returns The config value as a boolean, or the fallback
+ */
+export async function getSystemConfigBoolean(key, fallback) {
+    const raw = await getRawConfigValue(key);
+    if (raw === undefined || raw === null)
+        return fallback;
+    // Native JSONB boolean
+    if (typeof raw === 'boolean')
+        return raw;
+    // String representation (from some JSONB encodings)
+    if (typeof raw === 'string') {
+        if (raw === 'true')
+            return true;
+        if (raw === 'false')
+            return false;
+    }
+    logger.warn({ key, raw }, 'system_config value is not a valid boolean, using fallback');
+    return fallback;
+}
+/**
+ * Load all TTL config values needed by the OIDC provider.
+ *
+ * Reads each TTL key from system_config with hardcoded fallback defaults.
+ * Called once at provider initialization to build the TTL configuration.
+ * The interaction TTL is hardcoded (not stored in system_config).
+ *
+ * @returns Object with all OIDC TTL settings in seconds
+ */
+export async function loadOidcTtlConfig() {
+    const [accessToken, idToken, refreshToken, authorizationCode, session] = await Promise.all([
+        getSystemConfigNumber('access_token_ttl', 3600),
+        getSystemConfigNumber('id_token_ttl', 3600),
+        getSystemConfigNumber('refresh_token_ttl', 2592000),
+        getSystemConfigNumber('authorization_code_ttl', 600),
+        getSystemConfigNumber('session_ttl', 86400),
+    ]);
+    return {
+        accessToken,
+        idToken,
+        refreshToken,
+        authorizationCode,
+        session,
+        // Interaction TTL is hardcoded — not configurable via system_config
+        interaction: 3600,
+        // Grant TTL matches refresh token TTL by default
+        grant: refreshToken,
+    };
+}
+/**
+ * Clear the in-memory config cache.
+ * Useful for testing to ensure fresh reads from the database.
+ */
+export function clearSystemConfigCache() {
+    cache.clear();
+}
+//# sourceMappingURL=system-config.js.map

package/dist/lib/system-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"system-config.js","sourceRoot":"","sources":["../../src/lib/system-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AA0BrC,iDAAiD;AACjD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;AAC5C,MAAM,YAAY,GAAG,MAAM,CAAC;AAE5B;;;;;;;GAOG;AACH,KAAK,UAAU,iBAAiB,CAAC,GAAW;IAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEvB,oBAAoB;IACpB,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;QACrC,OAAO,MAAM,CAAC,KAAK,CAAC;IACtB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,gDAAgD,EAChD,CAAC,GAAG,CAAC,CACN,CAAC;QAEF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,+DAA+D;YAC/D,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,GAAG,YAAY,EAAE,CAAC,CAAC;YACpE,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACnC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,GAAG,YAAY,EAAE,CAAC,CAAC;QACzD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,wEAAwE;QACxE,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,oDAAoD,CAAC,CAAC;QAClF,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,GAAW,EAAE,QAAgB;IACvE,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IAEvD,uEAAuE;IACvE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;AACrB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,GAAW,EAAE,QAAgB;IACvE,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IAEvD,6DAA6D;IAC7D,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IAE9D,4EAA4E;IAC5E,kBAAkB;IAClB,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC;IAC3C,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,2DAA2D,CAAC,CAAC;IACvF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,GAAW,EAAE,QAAiB;IACzE,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IAEvD,uBAAuB;IACvB,IAAI,OAAO,GAAG,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC;IAEzC,oDAAoD;IACpD,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,IAAI,GAAG,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;QAChC,IAAI,GAAG,KAAK,OAAO;YAAE,OAAO,KAAK,CAAC;IACpC,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,4DAA4D,CAAC,CAAC;IACxF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,MAAM,CAAC,WAAW,EAAE,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACzF,qBAAqB,CAAC,kBAAkB,EAAE,IAAI,CAAC;QAC/C,qBAAqB,CAAC,cAAc,EAAE,IAAI,CAAC;QAC3C,qBAAqB,CAAC,mBAAmB,EAAE,OAAO,CAAC;QACnD,qBAAqB,CAAC,wBAAwB,EAAE,GAAG,CAAC;QACpD,qBAAqB,CAAC,aAAa,EAAE,KAAK,CAAC;KAC5C,CAAC,CAAC;IAEH,OAAO;QACL,WAAW;QACX,OAAO;QACP,YAAY;QACZ,iBAAiB;QACjB,OAAO;QACP,oEAAoE;QACpE,WAAW,EAAE,IAAI;QACjB,iDAAiD;QACjD,KAAK,EAAE,YAAY;KACpB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB;IACpC,KAAK,CAAC,KAAK,EAAE,CAAC;AAChB,CAAC"}

package/dist/middleware/admin-auth.d.ts

@@ -0,0 +1,100 @@
+/**
+ * Admin API authentication and authorization middleware.
+ *
+ * Validates Bearer access tokens against Porta's own OIDC provider
+ * using opaque token lookup (provider.AccessToken.find()). Verifies
+ * the user belongs to the super-admin organization and has the
+ * porta-admin role. Sets ctx.state.adminUser for downstream handlers
+ * and audit logging.
+ *
+ * This middleware replaces the old requireSuperAdmin() that checked
+ * ctx.state.organization.isSuperAdmin (which required tenant-resolver
+ * context and was always undefined for /api/admin/* routes).
+ *
+ * Authentication flow:
+ *   1. Extract Bearer token from Authorization header
+ *   2. Validate opaque access token via OIDC provider lookup
+ *   3. Resolve super-admin organization
+ *   4. Look up user — must be active
+ *   5. Verify user belongs to the super-admin organization
+ *   6. Verify user has the porta-admin role
+ *   7. Set ctx.state.adminUser and proceed
+ *
+ * Response codes:
+ *   401 — Missing/invalid Bearer token, expired, revoked, unknown user
+ *   403 — Valid token but user not in admin org or lacks admin role
+ *   500 — System not initialized (provider not set, no super-admin org)
+ */
+import type { Middleware } from 'koa';
+import type { Organization } from '../organizations/types.js';
+/** Minimal opaque-token lookup boundary required from the OIDC provider. */
+export interface AdminAccessTokenProvider {
+    /** Provider model used to resolve one opaque access token. */
+    readonly AccessToken: {
+        /** Resolve a token without exposing its storage mechanism to middleware. */
+        find(token: string): Promise<{
+            accountId?: string;
+        } | undefined>;
+    };
+}
+/**
+ * Set the OIDC provider instance used for opaque access token validation.
+ * Must be called once at startup before any admin API requests are handled.
+ *
+ * The provider's AccessToken.find() method is used to look up opaque tokens
+ * from the token store (Redis for short-lived tokens).
+ */
+export declare function setAdminAuthProvider(provider: AdminAccessTokenProvider): void;
+/** Remove the process-owned OIDC provider reference during orderly teardown. */
+export declare function clearAdminAuthProvider(): void;
+/**
+ * Authenticated admin user identity.
+ *
+ * Populated by requireAdminAuth() middleware and available to all
+ * downstream route handlers via ctx.state.adminUser. Contains the
+ * user's ID, email, organization, and assigned role slugs.
+ */
+export interface AdminUser {
+    /** User UUID from access token accountId */
+    id: string;
+    /** User email address */
+    email: string;
+    /** Super-admin organization UUID */
+    organizationId: string;
+    /** Assigned role slugs (e.g., ['porta-super-admin', 'porta-org-admin']) */
+    roles: string[];
+    /** Resolved admin permissions from all assigned roles */
+    permissions: readonly string[];
+}
+/**
+ * Enforce super-admin organization membership through the shared public denial boundary.
+ *
+ * @returns `true` only when the authenticated account belongs to the required organization.
+ */
+export declare function requireAdminOrganizationMembership(ctx: Parameters<Middleware>[0], userOrganizationId: string, adminOrganizationId: string): boolean;
+/**
+ * Extend Koa's default state to include the adminUser property.
+ * This provides type safety for route handlers accessing ctx.state.adminUser.
+ */
+declare module 'koa' {
+    interface DefaultState {
+        /** Tenant organization — set by tenant-resolver middleware on /:orgSlug/* routes */
+        organization?: Organization;
+        /** Authenticated admin identity — set by requireAdminAuth middleware on /api/admin/* routes */
+        adminUser?: AdminUser;
+    }
+}
+/**
+ * Create middleware that requires admin authentication and authorization.
+ *
+ * Validates the Bearer access token in the Authorization header by looking
+ * it up via the OIDC provider's opaque token store, then verifies the user
+ * is an active member of the super-admin organization with the porta-admin role.
+ *
+ * On success, sets ctx.state.adminUser with the authenticated identity.
+ * On failure, responds with 401 (unauthenticated) or 403 (unauthorized).
+ *
+ * @returns Koa middleware
+ */
+export declare function requireAdminAuth(): Middleware;
+//# sourceMappingURL=admin-auth.d.ts.map

package/dist/middleware/admin-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-auth.d.ts","sourceRoot":"","sources":["../../src/middleware/admin-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,KAAK,CAAC;AACtC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAY9D,4EAA4E;AAC5E,MAAM,WAAW,wBAAwB;IACvC,8DAA8D;IAC9D,QAAQ,CAAC,WAAW,EAAE;QACpB,4EAA4E;QAC5E,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;YAAE,SAAS,CAAC,EAAE,MAAM,CAAA;SAAE,GAAG,SAAS,CAAC,CAAC;KAClE,CAAC;CACH;AAID;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,wBAAwB,GAAG,IAAI,CAE7E;AAED,gFAAgF;AAChF,wBAAgB,sBAAsB,IAAI,IAAI,CAE7C;AAMD;;;;;;GAMG;AACH,MAAM,WAAW,SAAS;IACxB,4CAA4C;IAC5C,EAAE,EAAE,MAAM,CAAC;IACX,yBAAyB;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,oCAAoC;IACpC,cAAc,EAAE,MAAM,CAAC;IACvB,2EAA2E;IAC3E,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,yDAAyD;IACzD,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;CAChC;AAED;;;;GAIG;AACH,wBAAgB,kCAAkC,CAChD,GAAG,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAC9B,kBAAkB,EAAE,MAAM,EAC1B,mBAAmB,EAAE,MAAM,GAC1B,OAAO,CAaT;AAMD;;;GAGG;AACH,OAAO,QAAQ,KAAK,CAAC;IACnB,UAAU,YAAY;QACpB,oFAAoF;QACpF,YAAY,CAAC,EAAE,YAAY,CAAC;QAC5B,+FAA+F;QAC/F,SAAS,CAAC,EAAE,SAAS,CAAC;KACvB;CACF;AAYD;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,IAAI,UAAU,CA+J7C"}

package/dist/middleware/admin-auth.js

@@ -0,0 +1,241 @@
+/**
+ * Admin API authentication and authorization middleware.
+ *
+ * Validates Bearer access tokens against Porta's own OIDC provider
+ * using opaque token lookup (provider.AccessToken.find()). Verifies
+ * the user belongs to the super-admin organization and has the
+ * porta-admin role. Sets ctx.state.adminUser for downstream handlers
+ * and audit logging.
+ *
+ * This middleware replaces the old requireSuperAdmin() that checked
+ * ctx.state.organization.isSuperAdmin (which required tenant-resolver
+ * context and was always undefined for /api/admin/* routes).
+ *
+ * Authentication flow:
+ *   1. Extract Bearer token from Authorization header
+ *   2. Validate opaque access token via OIDC provider lookup
+ *   3. Resolve super-admin organization
+ *   4. Look up user — must be active
+ *   5. Verify user belongs to the super-admin organization
+ *   6. Verify user has the porta-admin role
+ *   7. Set ctx.state.adminUser and proceed
+ *
+ * Response codes:
+ *   401 — Missing/invalid Bearer token, expired, revoked, unknown user
+ *   403 — Valid token but user not in admin org or lacks admin role
+ *   500 — System not initialized (provider not set, no super-admin org)
+ */
+import { findUserForOidc } from '../users/service.js';
+import { findSuperAdminOrganization } from '../organizations/repository.js';
+import { getUserRoles } from '../rbac/user-role-service.js';
+import { logger } from '../lib/logger.js';
+import { resolvePermissionsFromRoles } from '../lib/admin-permissions.js';
+import { recordSecurityDecision, recordSecurityReference } from '../security/decision-context.js';
+let _provider = null;
+/**
+ * Set the OIDC provider instance used for opaque access token validation.
+ * Must be called once at startup before any admin API requests are handled.
+ *
+ * The provider's AccessToken.find() method is used to look up opaque tokens
+ * from the token store (Redis for short-lived tokens).
+ */
+export function setAdminAuthProvider(provider) {
+    _provider = provider;
+}
+/** Remove the process-owned OIDC provider reference during orderly teardown. */
+export function clearAdminAuthProvider() {
+    _provider = null;
+}
+/**
+ * Enforce super-admin organization membership through the shared public denial boundary.
+ *
+ * @returns `true` only when the authenticated account belongs to the required organization.
+ */
+export function requireAdminOrganizationMembership(ctx, userOrganizationId, adminOrganizationId) {
+    if (userOrganizationId === adminOrganizationId)
+        return true;
+    recordSecurityDecision(ctx, {
+        decisionPoint: 'membership',
+        reasonCode: 'membership-required',
+        outcome: 'deny',
+    });
+    ctx.status = 403;
+    ctx.body = {
+        error: 'Forbidden',
+        message: 'Administrative access is not permitted',
+    };
+    return false;
+}
+// ---------------------------------------------------------------------------
+// Admin auth middleware factory
+// ---------------------------------------------------------------------------
+/**
+ * Admin role slug prefix — all admin roles start with 'porta-'.
+ * Legacy 'porta-admin' role is treated as super-admin for backward compatibility.
+ */
+const ADMIN_ROLE_PREFIX = 'porta-';
+/**
+ * Create middleware that requires admin authentication and authorization.
+ *
+ * Validates the Bearer access token in the Authorization header by looking
+ * it up via the OIDC provider's opaque token store, then verifies the user
+ * is an active member of the super-admin organization with the porta-admin role.
+ *
+ * On success, sets ctx.state.adminUser with the authenticated identity.
+ * On failure, responds with 401 (unauthenticated) or 403 (unauthorized).
+ *
+ * @returns Koa middleware
+ */
+export function requireAdminAuth() {
+    return async (ctx, next) => {
+        // -----------------------------------------------------------------
+        // Step 1: Extract Bearer token from Authorization header
+        // -----------------------------------------------------------------
+        const authHeader = ctx.get('Authorization');
+        if (!authHeader || !authHeader.startsWith('Bearer ')) {
+            recordSecurityDecision(ctx, {
+                decisionPoint: 'authentication',
+                reasonCode: 'authentication-required',
+                outcome: 'deny',
+            });
+            ctx.status = 401;
+            ctx.body = {
+                error: 'Authentication required',
+                message: 'Missing or invalid Authorization header',
+            };
+            return;
+        }
+        const token = authHeader.slice(7); // Remove 'Bearer ' prefix
+        // -----------------------------------------------------------------
+        // Step 2: Validate opaque access token via OIDC provider
+        // -----------------------------------------------------------------
+        // Timing analysis (Phase K audit):
+        // Token validation uses DB/Redis lookups via provider.AccessToken.find(),
+        // which have inherent timing variability from network I/O. All auth
+        // failure paths return the same 401 status and generic error message
+        // ("Token validation failed"), preventing error-message enumeration.
+        // Constant-time string comparison is not needed here because we never
+        // compare secret material directly — the opaque token is used as a
+        // lookup key, not compared against a stored value.
+        // -----------------------------------------------------------------
+        // The OIDC provider issues opaque access tokens (not JWTs). We look
+        // them up directly in the token store using provider.AccessToken.find().
+        // This handles expiry (Redis TTL), revocation, and format validation
+        // in a single call — no need for JWT signature verification or issuer
+        // checks since the provider is the authoritative token store.
+        if (!_provider) {
+            logger.error('Admin auth: OIDC provider not initialized');
+            recordSecurityDecision(ctx, {
+                decisionPoint: 'handler',
+                reasonCode: 'handler-failed',
+                outcome: 'error',
+            });
+            ctx.status = 500;
+            ctx.body = { error: 'Server configuration error' };
+            return;
+        }
+        let userId;
+        try {
+            const accessToken = await _provider.AccessToken.find(token);
+            if (!accessToken || !accessToken.accountId) {
+                logger.debug('Admin auth: access token not found or missing accountId');
+                recordSecurityDecision(ctx, {
+                    decisionPoint: 'authentication',
+                    reasonCode: 'authentication-required',
+                    outcome: 'deny',
+                });
+                ctx.status = 401;
+                ctx.body = { error: 'Invalid token', message: 'Token validation failed' };
+                return;
+            }
+            userId = accessToken.accountId;
+        }
+        catch {
+            // Intentionally vague error message — don't reveal internal details.
+            // Log the real error server-side for debugging.
+            logger.debug({ event: 'admin-token-lookup-rejected' }, 'Admin token lookup rejected');
+            recordSecurityDecision(ctx, {
+                decisionPoint: 'authentication',
+                reasonCode: 'authentication-required',
+                outcome: 'deny',
+            });
+            ctx.status = 401;
+            ctx.body = { error: 'Invalid token', message: 'Token validation failed' };
+            return;
+        }
+        // -----------------------------------------------------------------
+        // Step 3: Resolve super-admin organization
+        // -----------------------------------------------------------------
+        // Cached in-memory (60s TTL) so this is fast after first call.
+        const superAdminOrg = await findSuperAdminOrganization();
+        if (!superAdminOrg) {
+            // System not initialized — porta init has not been run
+            logger.error('Admin auth: super-admin organization not found — run porta init');
+            recordSecurityDecision(ctx, {
+                decisionPoint: 'handler',
+                reasonCode: 'handler-failed',
+                outcome: 'error',
+            });
+            ctx.status = 500;
+            ctx.body = { error: 'Server configuration error' };
+            return;
+        }
+        // -----------------------------------------------------------------
+        // Step 4: Look up user — must be active
+        // -----------------------------------------------------------------
+        // findUserForOidc returns null for non-existent or non-active users
+        const user = await findUserForOidc(userId);
+        if (!user) {
+            recordSecurityDecision(ctx, {
+                decisionPoint: 'authentication',
+                reasonCode: 'authentication-required',
+                outcome: 'deny',
+            });
+            ctx.status = 401;
+            ctx.body = { error: 'Invalid token', message: 'Token validation failed' };
+            return;
+        }
+        // -----------------------------------------------------------------
+        // Step 5: Verify user belongs to the super-admin organization
+        // -----------------------------------------------------------------
+        if (!requireAdminOrganizationMembership(ctx, user.organizationId, superAdminOrg.id))
+            return;
+        // -----------------------------------------------------------------
+        // Step 6: Verify user has an admin role (any porta-* role)
+        // -----------------------------------------------------------------
+        // Supports both legacy porta-admin and new granular roles:
+        // porta-super-admin, porta-org-admin, porta-user-admin, etc.
+        const userRoles = await getUserRoles(userId);
+        const adminRoleSlugs = userRoles
+            .map((role) => role.slug)
+            .filter((slug) => slug.startsWith(ADMIN_ROLE_PREFIX));
+        if (adminRoleSlugs.length === 0) {
+            recordSecurityDecision(ctx, {
+                decisionPoint: 'membership',
+                reasonCode: 'membership-required',
+                outcome: 'deny',
+            });
+            ctx.status = 403;
+            ctx.body = { error: 'Forbidden', message: 'Administrative access is not permitted' };
+            return;
+        }
+        // -----------------------------------------------------------------
+        // Step 7: Resolve permissions from all admin roles
+        // -----------------------------------------------------------------
+        const permissions = resolvePermissionsFromRoles(adminRoleSlugs);
+        // -----------------------------------------------------------------
+        // Step 8: Set admin user context and proceed to route handler
+        // -----------------------------------------------------------------
+        ctx.state.adminUser = {
+            id: userId,
+            email: user.email,
+            organizationId: user.organizationId,
+            roles: adminRoleSlugs,
+            permissions,
+        };
+        recordSecurityReference(ctx, 'actor', userId);
+        recordSecurityReference(ctx, 'tenant', user.organizationId);
+        await next();
+    };
+}
+//# sourceMappingURL=admin-auth.js.map

package/dist/middleware/admin-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-auth.js","sourceRoot":"","sources":["../../src/middleware/admin-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAIH,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,0BAA0B,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC5D,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAelG,IAAI,SAAS,GAAoC,IAAI,CAAC;AAEtD;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAkC;IACrE,SAAS,GAAG,QAAQ,CAAC;AACvB,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,sBAAsB;IACpC,SAAS,GAAG,IAAI,CAAC;AACnB,CAAC;AA0BD;;;;GAIG;AACH,MAAM,UAAU,kCAAkC,CAChD,GAA8B,EAC9B,kBAA0B,EAC1B,mBAA2B;IAE3B,IAAI,kBAAkB,KAAK,mBAAmB;QAAE,OAAO,IAAI,CAAC;IAC5D,sBAAsB,CAAC,GAAG,EAAE;QAC1B,aAAa,EAAE,YAAY;QAC3B,UAAU,EAAE,qBAAqB;QACjC,OAAO,EAAE,MAAM;KAChB,CAAC,CAAC;IACH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;IACjB,GAAG,CAAC,IAAI,GAAG;QACT,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,wCAAwC;KAClD,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC;AAmBD,8EAA8E;AAC9E,gCAAgC;AAChC,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,iBAAiB,GAAG,QAAQ,CAAC;AAEnC;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,oEAAoE;QACpE,yDAAyD;QACzD,oEAAoE;QACpE,MAAM,UAAU,GAAG,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC5C,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACrD,sBAAsB,CAAC,GAAG,EAAE;gBAC1B,aAAa,EAAE,gBAAgB;gBAC/B,UAAU,EAAE,yBAAyB;gBACrC,OAAO,EAAE,MAAM;aAChB,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG;gBACT,KAAK,EAAE,yBAAyB;gBAChC,OAAO,EAAE,yCAAyC;aACnD,CAAC;YACF,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,0BAA0B;QAE7D,oEAAoE;QACpE,yDAAyD;QACzD,oEAAoE;QACpE,mCAAmC;QACnC,0EAA0E;QAC1E,oEAAoE;QACpE,qEAAqE;QACrE,qEAAqE;QACrE,sEAAsE;QACtE,mEAAmE;QACnE,mDAAmD;QACnD,oEAAoE;QACpE,oEAAoE;QACpE,yEAAyE;QACzE,qEAAqE;QACrE,sEAAsE;QACtE,8DAA8D;QAC9D,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;YAC1D,sBAAsB,CAAC,GAAG,EAAE;gBAC1B,aAAa,EAAE,SAAS;gBACxB,UAAU,EAAE,gBAAgB;gBAC5B,OAAO,EAAE,OAAO;aACjB,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;YACnD,OAAO;QACT,CAAC;QAED,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC5D,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC;gBAC3C,MAAM,CAAC,KAAK,CAAC,yDAAyD,CAAC,CAAC;gBACxE,sBAAsB,CAAC,GAAG,EAAE;oBAC1B,aAAa,EAAE,gBAAgB;oBAC/B,UAAU,EAAE,yBAAyB;oBACrC,OAAO,EAAE,MAAM;iBAChB,CAAC,CAAC;gBACH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;gBACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC;gBAC1E,OAAO;YACT,CAAC;YACD,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;YACrE,gDAAgD;YAChD,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,EAAE,6BAA6B,CAAC,CAAC;YACtF,sBAAsB,CAAC,GAAG,EAAE;gBAC1B,aAAa,EAAE,gBAAgB;gBAC/B,UAAU,EAAE,yBAAyB;gBACrC,OAAO,EAAE,MAAM;aAChB,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC;YAC1E,OAAO;QACT,CAAC;QAED,oEAAoE;QACpE,2CAA2C;QAC3C,oEAAoE;QACpE,+DAA+D;QAC/D,MAAM,aAAa,GAAG,MAAM,0BAA0B,EAAE,CAAC;QACzD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,uDAAuD;YACvD,MAAM,CAAC,KAAK,CAAC,iEAAiE,CAAC,CAAC;YAChF,sBAAsB,CAAC,GAAG,EAAE;gBAC1B,aAAa,EAAE,SAAS;gBACxB,UAAU,EAAE,gBAAgB;gBAC5B,OAAO,EAAE,OAAO;aACjB,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;YACnD,OAAO;QACT,CAAC;QAED,oEAAoE;QACpE,wCAAwC;QACxC,oEAAoE;QACpE,oEAAoE;QACpE,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,sBAAsB,CAAC,GAAG,EAAE;gBAC1B,aAAa,EAAE,gBAAgB;gBAC/B,UAAU,EAAE,yBAAyB;gBACrC,OAAO,EAAE,MAAM;aAChB,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC;YAC1E,OAAO;QACT,CAAC;QAED,oEAAoE;QACpE,8DAA8D;QAC9D,oEAAoE;QACpE,IAAI,CAAC,kCAAkC,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,aAAa,CAAC,EAAE,CAAC;YAAE,OAAO;QAE5F,oEAAoE;QACpE,2DAA2D;QAC3D,oEAAoE;QACpE,2DAA2D;QAC3D,6DAA6D;QAC7D,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,cAAc,GAAG,SAAS;aAC7B,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;aACxB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAExD,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,sBAAsB,CAAC,GAAG,EAAE;gBAC1B,aAAa,EAAE,YAAY;gBAC3B,UAAU,EAAE,qBAAqB;gBACjC,OAAO,EAAE,MAAM;aAChB,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,wCAAwC,EAAE,CAAC;YACrF,OAAO;QACT,CAAC;QAED,oEAAoE;QACpE,mDAAmD;QACnD,oEAAoE;QACpE,MAAM,WAAW,GAAG,2BAA2B,CAAC,cAAc,CAAC,CAAC;QAEhE,oEAAoE;QACpE,8DAA8D;QAC9D,oEAAoE;QACpE,GAAG,CAAC,KAAK,CAAC,SAAS,GAAG;YACpB,EAAE,EAAE,MAAM;YACV,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,KAAK,EAAE,cAAc;YACrB,WAAW;SACQ,CAAC;QACtB,uBAAuB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC9C,uBAAuB,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QAE5D,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/admin-cors.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Admin API CORS allow-list middleware.
+ *
+ * Implements a strict CORS policy for `/api/admin/*` endpoints.
+ * By default (empty `adminCorsOrigins` config), **no CORS headers are
+ * emitted** — all cross-origin requests are blocked by the browser.
+ *
+ * When `ADMIN_CORS_ORIGINS` is configured with one or more origin URLs,
+ * only those exact origins receive CORS headers.  This is intended for
+ * operators who deploy a web-based admin dashboard on a different origin.
+ *
+ * Non-browser clients (CLI, same-origin requests) never send an `Origin`
+ * header, so they pass through this middleware untouched.
+ *
+ * Placement: mount after the admin metadata router and before
+ * `setAdminAuthProvider()` — preflight `OPTIONS` requests don't carry
+ * an `Authorization` header, so CORS must respond before auth runs.
+ *
+ * @module middleware/admin-cors
+ */
+import type { Middleware } from 'koa';
+import type { AppConfig } from '../config/schema.js';
+/** HTTP methods allowed for cross-origin admin API requests. */
+export declare const CORS_ALLOWED_METHODS = "GET, POST, PUT, PATCH, DELETE, OPTIONS";
+/** HTTP headers allowed in cross-origin admin API requests. */
+export declare const CORS_ALLOWED_HEADERS = "Authorization, Content-Type";
+/** Preflight cache duration in seconds (24 hours). */
+export declare const CORS_MAX_AGE = "86400";
+/**
+ * Create admin CORS middleware with the given application config.
+ *
+ * Uses a `Set` for O(1) origin lookup.  The `Vary: Origin` header is
+ * required by the CORS specification when `Access-Control-Allow-Origin`
+ * is not the wildcard `*` — it tells caches that the response varies by
+ * the request's `Origin` header.
+ *
+ * @param config - Application config (reads `adminCorsOrigins`)
+ * @returns Koa middleware that handles CORS for `/api/admin/*` routes
+ */
+export declare function adminCors(config: AppConfig): Middleware;
+//# sourceMappingURL=admin-cors.d.ts.map

package/dist/middleware/admin-cors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-cors.d.ts","sourceRoot":"","sources":["../../src/middleware/admin-cors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,KAAK,CAAC;AACtC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAMrD,gEAAgE;AAChE,eAAO,MAAM,oBAAoB,2CAA2C,CAAC;AAE7E,+DAA+D;AAC/D,eAAO,MAAM,oBAAoB,gCAAgC,CAAC;AAElE,sDAAsD;AACtD,eAAO,MAAM,YAAY,UAAU,CAAC;AAMpC;;;;;;;;;;GAUG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,SAAS,GAAG,UAAU,CA4CvD"}