@portaidentity/server 1.7.0

package/dist/middleware/ready.js

@@ -0,0 +1,60 @@
+/**
+ * Readiness probe handler — GET /ready.
+ *
+ * Separate from /health (liveness): /health confirms the server process
+ * is alive; /ready confirms the server can actually serve requests by
+ * checking that both PostgreSQL and Redis are reachable within a timeout.
+ *
+ * Kubernetes / ECS maps:
+ *   - livenessProbe  → GET /health
+ *   - readinessProbe → GET /ready
+ *
+ * Returns 200 + { status: 'ready', checks } when both backends are healthy,
+ * or 503 + { status: 'not_ready', checks } when either is degraded.
+ */
+import { getPool } from '../lib/database.js';
+import { getRedis } from '../lib/redis.js';
+import { logger } from '../lib/logger.js';
+/** Maximum time (ms) to wait for each backend check before failing. */
+const TIMEOUT_MS = 2000;
+/**
+ * Race a promise against a timeout. Rejects with a descriptive error
+ * if the promise doesn't resolve within `TIMEOUT_MS`.
+ */
+function withTimeout(promise, label) {
+    return Promise.race([
+        promise,
+        new Promise((_, reject) => setTimeout(() => reject(new Error(`${label} timeout after ${TIMEOUT_MS}ms`)), TIMEOUT_MS)),
+    ]);
+}
+/**
+ * Create the readiness probe middleware.
+ *
+ * Both DB and Redis are checked concurrently with individual timeouts.
+ * A single failure makes the overall probe return 503.
+ */
+export function readyHandler() {
+    return async (ctx) => {
+        const checks = {};
+        // Run both checks concurrently — one failure doesn't block the other
+        const [dbResult, redisResult] = await Promise.allSettled([
+            withTimeout(getPool().query('SELECT 1'), 'db'),
+            withTimeout(getRedis().ping(), 'redis'),
+        ]);
+        checks.db =
+            dbResult.status === 'fulfilled'
+                ? { ok: true }
+                : { ok: false, error: String(dbResult.reason) };
+        checks.redis =
+            redisResult.status === 'fulfilled'
+                ? { ok: true }
+                : { ok: false, error: String(redisResult.reason) };
+        const ready = checks.db.ok && checks.redis.ok;
+        if (!ready) {
+            logger.warn({ event: 'ready.degraded', checks }, 'readiness probe failed');
+        }
+        ctx.status = ready ? 200 : 503;
+        ctx.body = { status: ready ? 'ready' : 'not_ready', checks };
+    };
+}
+//# sourceMappingURL=ready.js.map

package/dist/middleware/ready.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ready.js","sourceRoot":"","sources":["../../src/middleware/ready.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C,uEAAuE;AACvE,MAAM,UAAU,GAAG,IAAI,CAAC;AAExB;;;GAGG;AACH,SAAS,WAAW,CAAI,OAAmB,EAAE,KAAa;IACxD,OAAO,OAAO,CAAC,IAAI,CAAC;QAClB,OAAO;QACP,IAAI,OAAO,CAAI,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAC3B,UAAU,CACR,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,KAAK,kBAAkB,UAAU,IAAI,CAAC,CAAC,EACjE,UAAU,CACX,CACF;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,MAAM,MAAM,GAAoD,EAAE,CAAC;QAEnE,qEAAqE;QACrE,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC;YACvD,WAAW,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC;YAC9C,WAAW,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC;SACxC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE;YACP,QAAQ,CAAC,MAAM,KAAK,WAAW;gBAC7B,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE;gBACd,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAEpD,MAAM,CAAC,KAAK;YACV,WAAW,CAAC,MAAM,KAAK,WAAW;gBAChC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE;gBACd,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;QAEvD,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAE9C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,EAAE,wBAAwB,CAAC,CAAC;QAC7E,CAAC;QAED,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QAC/B,GAAG,CAAC,IAAI,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC;IAC/D,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/request-logger.d.ts

@@ -0,0 +1,27 @@
+import type { Middleware } from 'koa';
+import { type SecurityDecisionSink } from '../security/decision-context.js';
+/** Closed request-completion record exposed to owner-controlled operational sinks. */
+export interface OperationalRequestRecord {
+    /** Server-created request correlation identifier. */
+    readonly requestId: string;
+    /** Public HTTP method. */
+    readonly method: string;
+    /** Registered route template or closed unmatched fallback. */
+    readonly routeTemplate: string;
+    /** Final public status. */
+    readonly status: number;
+    /** Bounded request duration in milliseconds. */
+    readonly duration: number;
+}
+/** Sink for a normalized request-completion record. */
+export type OperationalRequestSink = (record: OperationalRequestRecord) => void;
+/**
+ * Replace bearer and interaction path segments before they reach structured or rendered logs.
+ *
+ * @param path - Public request path before operational logging.
+ * @returns A stable route-shaped path without bearer or interaction values.
+ */
+export declare function sanitizeRequestPath(path: string): string;
+/** Create request-correlation middleware that emits only sanitized route-shaped paths. */
+export declare function requestLogger(decisionSink?: SecurityDecisionSink, operationalSink?: OperationalRequestSink): Middleware;
+//# sourceMappingURL=request-logger.d.ts.map

package/dist/middleware/request-logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-logger.d.ts","sourceRoot":"","sources":["../../src/middleware/request-logger.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,KAAK,CAAC;AAItC,OAAO,EAIL,KAAK,oBAAoB,EAC1B,MAAM,iCAAiC,CAAC;AAEzC,sFAAsF;AACtF,MAAM,WAAW,wBAAwB;IACvC,qDAAqD;IACrD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,0BAA0B;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,8DAA8D;IAC9D,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,2BAA2B;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,gDAAgD;IAChD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,uDAAuD;AACvD,MAAM,MAAM,sBAAsB,GAAG,CAAC,MAAM,EAAE,wBAAwB,KAAK,IAAI,CAAC;AAOhF;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAOxD;AAED,0FAA0F;AAC1F,wBAAgB,aAAa,CAC3B,YAAY,CAAC,EAAE,oBAAoB,EACnC,eAAe,GAAE,sBAA8C,GAC9D,UAAU,CAwBZ"}

package/dist/middleware/request-logger.js

@@ -0,0 +1,46 @@
+import { randomUUID } from 'crypto';
+import { logger } from '../lib/logger.js';
+import { registerProtocolRequestCorrelation } from '../oidc/protocol-security-observer.js';
+import { finalizeSecurityDecision, initializeSecurityDecision, normalizedRouteTemplate, } from '../security/decision-context.js';
+/** Emit one request-completion record through the production logger. */
+const logOperationalRequest = (record) => {
+    logger.info(record, 'HTTP request completed');
+};
+/**
+ * Replace bearer and interaction path segments before they reach structured or rendered logs.
+ *
+ * @param path - Public request path before operational logging.
+ * @returns A stable route-shaped path without bearer or interaction values.
+ */
+export function sanitizeRequestPath(path) {
+    return path
+        .replace(/^\/[^/]+\/auth\/magic-link\/[^/]+(?=\/|$)/, '/:organization/auth/magic-link/:artifact')
+        .replace(/^\/interaction\/[^/]+(?=\/|$)/, '/interaction/:interaction');
+}
+/** Create request-correlation middleware that emits only sanitized route-shaped paths. */
+export function requestLogger(decisionSink, operationalSink = logOperationalRequest) {
+    return async (ctx, next) => {
+        const requestId = randomUUID();
+        ctx.state.requestId = requestId;
+        initializeSecurityDecision(ctx, requestId);
+        ctx.set('X-Request-Id', requestId);
+        registerProtocolRequestCorrelation(ctx.req, requestId);
+        const start = Date.now();
+        try {
+            await next();
+        }
+        finally {
+            const duration = Date.now() - start;
+            const routeTemplate = normalizedRouteTemplate(ctx);
+            operationalSink({
+                requestId,
+                method: ctx.method,
+                routeTemplate,
+                status: ctx.status,
+                duration,
+            });
+            await finalizeSecurityDecision(ctx, decisionSink);
+        }
+    };
+}
+//# sourceMappingURL=request-logger.js.map

package/dist/middleware/request-logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-logger.js","sourceRoot":"","sources":["../../src/middleware/request-logger.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,kCAAkC,EAAE,MAAM,uCAAuC,CAAC;AAC3F,OAAO,EACL,wBAAwB,EACxB,0BAA0B,EAC1B,uBAAuB,GAExB,MAAM,iCAAiC,CAAC;AAmBzC,wEAAwE;AACxE,MAAM,qBAAqB,GAA2B,CAAC,MAAM,EAAE,EAAE;IAC/D,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;AAChD,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,IAAI;SACR,OAAO,CACN,2CAA2C,EAC3C,0CAA0C,CAC3C;SACA,OAAO,CAAC,+BAA+B,EAAE,2BAA2B,CAAC,CAAC;AAC3E,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,aAAa,CAC3B,YAAmC,EACnC,eAAe,GAA2B,qBAAqB;IAE/D,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;QAC/B,GAAG,CAAC,KAAK,CAAC,SAAS,GAAG,SAAS,CAAC;QAChC,0BAA0B,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC3C,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;QACnC,kCAAkC,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAEvD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,IAAI,EAAE,CAAC;QACf,CAAC;gBAAS,CAAC;YACT,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;YACpC,MAAM,aAAa,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;YACnD,eAAe,CAAC;gBACd,SAAS;gBACT,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,aAAa;gBACb,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,QAAQ;aACT,CAAC,CAAC;YACH,MAAM,wBAAwB,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QACpD,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/require-permission.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Permission-based authorization middleware for admin API routes.
+ *
+ * Works downstream of requireAdminAuth() — checks that ctx.state.adminUser
+ * has the required permission(s) before allowing the request to proceed.
+ *
+ * Usage:
+ * ```typescript
+ * import { requirePermission } from '../middleware/require-permission.js';
+ *
+ * router.post('/organizations', requirePermission('org:create'), createOrgHandler);
+ * router.get('/organizations', requirePermission('org:read'), listOrgsHandler);
+ * ```
+ *
+ * @module middleware/require-permission
+ */
+import type { Middleware } from 'koa';
+/**
+ * Create middleware that requires specific admin permission(s).
+ *
+ * Must be used after requireAdminAuth() in the middleware chain.
+ * Checks ctx.state.adminUser.permissions for the required permission(s).
+ *
+ * @param requiredPermissions - One or more permission slugs (e.g., 'org:create')
+ * @returns Koa middleware that checks for the required permission(s)
+ */
+export declare function requirePermission(...requiredPermissions: string[]): Middleware;
+//# sourceMappingURL=require-permission.d.ts.map

package/dist/middleware/require-permission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-permission.d.ts","sourceRoot":"","sources":["../../src/middleware/require-permission.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,KAAK,CAAC;AAItC;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,mBAAmB,EAAE,MAAM,EAAE,GAAG,UAAU,CAqC9E"}

package/dist/middleware/require-permission.js

@@ -0,0 +1,63 @@
+/**
+ * Permission-based authorization middleware for admin API routes.
+ *
+ * Works downstream of requireAdminAuth() — checks that ctx.state.adminUser
+ * has the required permission(s) before allowing the request to proceed.
+ *
+ * Usage:
+ * ```typescript
+ * import { requirePermission } from '../middleware/require-permission.js';
+ *
+ * router.post('/organizations', requirePermission('org:create'), createOrgHandler);
+ * router.get('/organizations', requirePermission('org:read'), listOrgsHandler);
+ * ```
+ *
+ * @module middleware/require-permission
+ */
+import { hasPermissions } from '../lib/admin-permissions.js';
+import { recordSecurityDecision } from '../security/decision-context.js';
+/**
+ * Create middleware that requires specific admin permission(s).
+ *
+ * Must be used after requireAdminAuth() in the middleware chain.
+ * Checks ctx.state.adminUser.permissions for the required permission(s).
+ *
+ * @param requiredPermissions - One or more permission slugs (e.g., 'org:create')
+ * @returns Koa middleware that checks for the required permission(s)
+ */
+export function requirePermission(...requiredPermissions) {
+    return async (ctx, next) => {
+        const adminUser = ctx.state.adminUser;
+        // Safety check: requireAdminAuth() must have run first
+        if (!adminUser) {
+            recordSecurityDecision(ctx, {
+                decisionPoint: 'authentication',
+                reasonCode: 'authentication-required',
+                outcome: 'deny',
+            });
+            ctx.status = 401;
+            ctx.body = {
+                error: 'Authentication required',
+                message: 'Admin authentication middleware must be applied first',
+            };
+            return;
+        }
+        // Check if the user has all required permissions
+        if (!hasPermissions([...adminUser.permissions], requiredPermissions)) {
+            recordSecurityDecision(ctx, {
+                decisionPoint: 'permission',
+                reasonCode: 'permission-required',
+                outcome: 'deny',
+                detail: { permissions: requiredPermissions },
+            });
+            ctx.status = 403;
+            ctx.body = {
+                error: 'Forbidden',
+                message: 'The requested operation is not permitted',
+            };
+            return;
+        }
+        await next();
+    };
+}
+//# sourceMappingURL=require-permission.js.map

package/dist/middleware/require-permission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-permission.js","sourceRoot":"","sources":["../../src/middleware/require-permission.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAEzE;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAG,mBAA6B;IAChE,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;QAEtC,uDAAuD;QACvD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,sBAAsB,CAAC,GAAG,EAAE;gBAC1B,aAAa,EAAE,gBAAgB;gBAC/B,UAAU,EAAE,yBAAyB;gBACrC,OAAO,EAAE,MAAM;aAChB,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG;gBACT,KAAK,EAAE,yBAAyB;gBAChC,OAAO,EAAE,uDAAuD;aACjE,CAAC;YACF,OAAO;QACT,CAAC;QAED,iDAAiD;QACjD,IAAI,CAAC,cAAc,CAAC,CAAC,GAAG,SAAS,CAAC,WAAW,CAAC,EAAE,mBAAmB,CAAC,EAAE,CAAC;YACrE,sBAAsB,CAAC,GAAG,EAAE;gBAC1B,aAAa,EAAE,YAAY;gBAC3B,UAAU,EAAE,qBAAqB;gBACjC,OAAO,EAAE,MAAM;gBACf,MAAM,EAAE,EAAE,WAAW,EAAE,mBAAmB,EAAE;aAC7C,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG;gBACT,KAAK,EAAE,WAAW;gBAClB,OAAO,EAAE,0CAA0C;aACpD,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/require-user-organization.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Organization-membership guard for user-specific administrative routes.
+ *
+ * This middleware must run after authentication and permission checks. Returning the same 404 for
+ * an absent user, an invalid identifier, and a user owned by another organization prevents the
+ * organization-prefixed API from becoming a cross-tenant object lookup or membership oracle.
+ */
+import type { Middleware } from 'koa';
+/**
+ * Requires the route's user to belong to the organization named in the same path.
+ *
+ * Place this middleware after `requirePermission(...)`. Callers without the operation's permission
+ * must receive the permission denial before Porta performs or reveals a tenant-membership lookup.
+ *
+ * @returns Koa middleware that continues only for a matching organization and user.
+ */
+export declare function requireUserOrganization(): Middleware;
+//# sourceMappingURL=require-user-organization.d.ts.map

package/dist/middleware/require-user-organization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-user-organization.d.ts","sourceRoot":"","sources":["../../src/middleware/require-user-organization.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,KAAK,CAAC;AAWtC;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,IAAI,UAAU,CAgCpD"}

package/dist/middleware/require-user-organization.js

@@ -0,0 +1,53 @@
+/**
+ * Organization-membership guard for user-specific administrative routes.
+ *
+ * This middleware must run after authentication and permission checks. Returning the same 404 for
+ * an absent user, an invalid identifier, and a user owned by another organization prevents the
+ * organization-prefixed API from becoming a cross-tenant object lookup or membership oracle.
+ */
+import { z } from 'zod';
+import { getUserById } from '../users/service.js';
+import { recordSecurityDecision, recordSecurityReference } from '../security/decision-context.js';
+const organizationUserParamsSchema = z.object({
+    orgId: z.string().uuid(),
+    userId: z.string().uuid(),
+});
+/**
+ * Requires the route's user to belong to the organization named in the same path.
+ *
+ * Place this middleware after `requirePermission(...)`. Callers without the operation's permission
+ * must receive the permission denial before Porta performs or reveals a tenant-membership lookup.
+ *
+ * @returns Koa middleware that continues only for a matching organization and user.
+ */
+export function requireUserOrganization() {
+    return async function requireUserOrganizationMiddleware(ctx, next) {
+        const parsed = organizationUserParamsSchema.safeParse(ctx.params);
+        if (!parsed.success) {
+            recordSecurityDecision(ctx, {
+                decisionPoint: 'resource',
+                reasonCode: 'resource-not-found',
+                outcome: 'deny',
+                detail: { resourceType: 'user' },
+            });
+            ctx.status = 404;
+            ctx.body = { error: 'User not found' };
+            return;
+        }
+        const user = await getUserById(parsed.data.userId);
+        if (user === null || user.organizationId !== parsed.data.orgId) {
+            recordSecurityDecision(ctx, {
+                decisionPoint: 'resource',
+                reasonCode: 'resource-not-found',
+                outcome: 'deny',
+                detail: { resourceType: 'user' },
+            });
+            ctx.status = 404;
+            ctx.body = { error: 'User not found' };
+            return;
+        }
+        recordSecurityReference(ctx, 'resource', parsed.data.userId);
+        await next();
+    };
+}
+//# sourceMappingURL=require-user-organization.js.map

package/dist/middleware/require-user-organization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-user-organization.js","sourceRoot":"","sources":["../../src/middleware/require-user-organization.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAElG,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IACxB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;CAC1B,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB;IACrC,OAAO,KAAK,UAAU,iCAAiC,CAAC,GAAG,EAAE,IAAI;QAC/D,MAAM,MAAM,GAAG,4BAA4B,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,sBAAsB,CAAC,GAAG,EAAE;gBAC1B,aAAa,EAAE,UAAU;gBACzB,UAAU,EAAE,oBAAoB;gBAChC,OAAO,EAAE,MAAM;gBACf,MAAM,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE;aACjC,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;YACvC,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnD,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,cAAc,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAC/D,sBAAsB,CAAC,GAAG,EAAE;gBAC1B,aAAa,EAAE,UAAU;gBACzB,UAAU,EAAE,oBAAoB;gBAChC,OAAO,EAAE,MAAM;gBACf,MAAM,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE;aACjC,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;YACvC,OAAO;QACT,CAAC;QAED,uBAAuB,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAE7D,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/root-page.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Root / public-surface handlers.
+ *
+ * Without these, a bare `GET /` would fall through to Koa's default 404
+ * handler and render "Not Found" — ugly, and the exact shape of that
+ * response (status code + header set) is a small fingerprint signal for
+ * scanners. This module serves an intentionally generic, no-information
+ * response at the public root so the deployment looks deliberate without
+ * disclosing anything about the software running behind it.
+ *
+ * Endpoints:
+ *   GET  /            — 200 with a neutral HTML page
+ *   HEAD /            — 200, no body (mirrors GET /)
+ *   GET  /robots.txt  — `User-agent: *\nDisallow: /` (keep crawlers out)
+ *   GET  /favicon.ico — 204 No Content (suppresses the browser's auto-request)
+ *
+ * Security properties:
+ *   • No product name, version, vendor, or capability description.
+ *   • No external asset references — page renders offline, nothing to
+ *     fingerprint via network requests.
+ *   • `X-Robots-Tag: noindex, nofollow` prevents accidental indexing.
+ *   • `Cache-Control: no-store` avoids intermediate caches persisting
+ *     the response (keeps future changes in our control).
+ *   • `Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'`
+ *     disables script execution and disallows any remote resource.
+ *   • Inline `<style>` block — no external CSS, no JS.
+ *
+ * The body copy is intentionally terse and abstract. Do NOT add branding,
+ * support contacts, tenant hints, or links to admin/docs here.
+ */
+import Router from '@koa/router';
+/**
+ * Root-page-specific response headers applied to `/`, `/robots.txt`, and
+ * `/favicon.ico` only.
+ *
+ * General security headers (X-Content-Type-Options, X-Frame-Options,
+ * Referrer-Policy, Content-Security-Policy, etc.) are handled globally
+ * by the `securityHeaders()` middleware in `src/middleware/security-headers.ts`.
+ * This object only contains headers that are unique to the root-page surface:
+ *
+ *   - `Cache-Control: no-store` — prevents proxies from caching the
+ *     neutral root-page response.
+ *   - `X-Robots-Tag: noindex, nofollow` — prevents accidental search
+ *     engine indexing of the root endpoint.
+ *
+ * Exported for test assertions; kept as a plain object (not a Map) so
+ * tests can snapshot it directly.
+ */
+export declare const ROOT_PAGE_HEADERS: Readonly<Record<string, string>>;
+/**
+ * Create the Koa router that serves `/`, `/robots.txt`, and `/favicon.ico`.
+ *
+ * Mount this router early in the middleware stack — **after** `/health`
+ * (health takes priority for load-balancer probes) but **before** any
+ * `/:orgSlug/*` catch-all. The paths it owns are exact string matches, so
+ * it cannot accidentally shadow tenant or admin routes.
+ *
+ * The handlers are standalone and take no dependencies, so the router is
+ * safe to construct at app-factory time (no DB, Redis, or config access).
+ */
+export declare function createRootPageRouter(): Router;
+//# sourceMappingURL=root-page.d.ts.map

package/dist/middleware/root-page.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"root-page.d.ts","sourceRoot":"","sources":["../../src/middleware/root-page.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AAoCjC;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAG7D,CAAC;AAEH;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAwC7C"}

package/dist/middleware/root-page.js

@@ -0,0 +1,134 @@
+/**
+ * Root / public-surface handlers.
+ *
+ * Without these, a bare `GET /` would fall through to Koa's default 404
+ * handler and render "Not Found" — ugly, and the exact shape of that
+ * response (status code + header set) is a small fingerprint signal for
+ * scanners. This module serves an intentionally generic, no-information
+ * response at the public root so the deployment looks deliberate without
+ * disclosing anything about the software running behind it.
+ *
+ * Endpoints:
+ *   GET  /            — 200 with a neutral HTML page
+ *   HEAD /            — 200, no body (mirrors GET /)
+ *   GET  /robots.txt  — `User-agent: *\nDisallow: /` (keep crawlers out)
+ *   GET  /favicon.ico — 204 No Content (suppresses the browser's auto-request)
+ *
+ * Security properties:
+ *   • No product name, version, vendor, or capability description.
+ *   • No external asset references — page renders offline, nothing to
+ *     fingerprint via network requests.
+ *   • `X-Robots-Tag: noindex, nofollow` prevents accidental indexing.
+ *   • `Cache-Control: no-store` avoids intermediate caches persisting
+ *     the response (keeps future changes in our control).
+ *   • `Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'`
+ *     disables script execution and disallows any remote resource.
+ *   • Inline `<style>` block — no external CSS, no JS.
+ *
+ * The body copy is intentionally terse and abstract. Do NOT add branding,
+ * support contacts, tenant hints, or links to admin/docs here.
+ */
+import Router from '@koa/router';
+/**
+ * Minimal HTML served at `GET /` and `HEAD /`.
+ *
+ * Kept as a single-line template to avoid accidental whitespace drift in
+ * tests that assert on the response body. The message deliberately says
+ * nothing: it does not name the product, the vendor, the protocol, or the
+ * purpose of the service. Anyone who arrived here intentionally already
+ * knows the URL they need; anyone who didn't gets a clean "nothing to see
+ * here" page instead of a stack-trace-adjacent 404.
+ */
+const ROOT_HTML = [
+    '<!DOCTYPE html>',
+    '<html lang="en">',
+    '<head>',
+    '<meta charset="utf-8">',
+    '<meta name="viewport" content="width=device-width, initial-scale=1">',
+    '<meta name="robots" content="noindex, nofollow">',
+    '<title>\u00A0</title>',
+    '<style>',
+    'html,body{height:100%;margin:0;padding:0;background:#fafafa;color:#555;',
+    'font-family:system-ui,-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,',
+    'Helvetica,Arial,sans-serif;}',
+    'main{display:flex;align-items:center;justify-content:center;height:100%;',
+    'padding:2rem;box-sizing:border-box;text-align:center;}',
+    'p{margin:0;font-size:0.95rem;line-height:1.5;max-width:32rem;}',
+    '</style>',
+    '</head>',
+    '<body>',
+    '<main><p>This endpoint does not provide a public interface.</p></main>',
+    '</body>',
+    '</html>',
+    '',
+].join('\n');
+/**
+ * Root-page-specific response headers applied to `/`, `/robots.txt`, and
+ * `/favicon.ico` only.
+ *
+ * General security headers (X-Content-Type-Options, X-Frame-Options,
+ * Referrer-Policy, Content-Security-Policy, etc.) are handled globally
+ * by the `securityHeaders()` middleware in `src/middleware/security-headers.ts`.
+ * This object only contains headers that are unique to the root-page surface:
+ *
+ *   - `Cache-Control: no-store` — prevents proxies from caching the
+ *     neutral root-page response.
+ *   - `X-Robots-Tag: noindex, nofollow` — prevents accidental search
+ *     engine indexing of the root endpoint.
+ *
+ * Exported for test assertions; kept as a plain object (not a Map) so
+ * tests can snapshot it directly.
+ */
+export const ROOT_PAGE_HEADERS = Object.freeze({
+    'Cache-Control': 'no-store',
+    'X-Robots-Tag': 'noindex, nofollow',
+});
+/**
+ * Create the Koa router that serves `/`, `/robots.txt`, and `/favicon.ico`.
+ *
+ * Mount this router early in the middleware stack — **after** `/health`
+ * (health takes priority for load-balancer probes) but **before** any
+ * `/:orgSlug/*` catch-all. The paths it owns are exact string matches, so
+ * it cannot accidentally shadow tenant or admin routes.
+ *
+ * The handlers are standalone and take no dependencies, so the router is
+ * safe to construct at app-factory time (no DB, Redis, or config access).
+ */
+export function createRootPageRouter() {
+    const router = new Router();
+    // GET / → neutral HTML. Also handles HEAD / because @koa/router
+    // automatically derives HEAD from GET with an empty body.
+    router.get('/', (ctx) => {
+        for (const [name, value] of Object.entries(ROOT_PAGE_HEADERS)) {
+            ctx.set(name, value);
+        }
+        ctx.type = 'text/html; charset=utf-8';
+        ctx.status = 200;
+        ctx.body = ROOT_HTML;
+    });
+    // GET /robots.txt → blanket Disallow.
+    // Explicit rule so scanners that respect robots.txt skip the whole host
+    // instead of probing every path looking for a 404 signature.
+    router.get('/robots.txt', (ctx) => {
+        for (const [name, value] of Object.entries(ROOT_PAGE_HEADERS)) {
+            ctx.set(name, value);
+        }
+        ctx.type = 'text/plain; charset=utf-8';
+        ctx.status = 200;
+        ctx.body = 'User-agent: *\nDisallow: /\n';
+    });
+    // GET /favicon.ico → 204 No Content.
+    // Browsers auto-fetch favicon.ico for every host; a 204 stops them
+    // retrying (which a 404 would log on every page load) and returns no
+    // identifying content.
+    router.get('/favicon.ico', (ctx) => {
+        for (const [name, value] of Object.entries(ROOT_PAGE_HEADERS)) {
+            ctx.set(name, value);
+        }
+        ctx.status = 204;
+        // Explicitly null the body so Koa doesn't set a default payload.
+        ctx.body = null;
+    });
+    return router;
+}
+//# sourceMappingURL=root-page.js.map

package/dist/middleware/root-page.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"root-page.js","sourceRoot":"","sources":["../../src/middleware/root-page.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC;;;;;;;;;GASG;AACH,MAAM,SAAS,GAAG;IAChB,iBAAiB;IACjB,kBAAkB;IAClB,QAAQ;IACR,wBAAwB;IACxB,sEAAsE;IACtE,kDAAkD;IAClD,uBAAuB;IACvB,SAAS;IACT,yEAAyE;IACzE,2EAA2E;IAC3E,8BAA8B;IAC9B,0EAA0E;IAC1E,wDAAwD;IACxD,gEAAgE;IAChE,UAAU;IACV,SAAS;IACT,QAAQ;IACR,wEAAwE;IACxE,SAAS;IACT,SAAS;IACT,EAAE;CACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAqC,MAAM,CAAC,MAAM,CAAC;IAC/E,eAAe,EAAE,UAAU;IAC3B,cAAc,EAAE,mBAAmB;CACpC,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;IAE5B,gEAAgE;IAChE,0DAA0D;IAC1D,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE;QACtB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAC9D,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvB,CAAC;QACD,GAAG,CAAC,IAAI,GAAG,0BAA0B,CAAC;QACtC,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,GAAG,CAAC,IAAI,GAAG,SAAS,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,sCAAsC;IACtC,wEAAwE;IACxE,6DAA6D;IAC7D,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,GAAG,EAAE,EAAE;QAChC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAC9D,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvB,CAAC;QACD,GAAG,CAAC,IAAI,GAAG,2BAA2B,CAAC;QACvC,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,GAAG,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,qCAAqC;IACrC,mEAAmE;IACnE,qEAAqE;IACrE,uBAAuB;IACvB,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,GAAG,EAAE,EAAE;QACjC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAC9D,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvB,CAAC;QACD,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,iEAAiE;QACjE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/middleware/security-headers.d.ts

@@ -0,0 +1,98 @@
+/**
+ * Global HTTP security headers middleware.
+ *
+ * Adds defence-in-depth security headers to every response produced by
+ * the Porta application.  The headers mitigate a broad class of browser-
+ * side attacks (clickjacking, MIME-sniffing, cross-origin information
+ * leakage, protocol downgrade) without depending on an upstream reverse
+ * proxy — if the proxy is a dumb passthrough, these headers still reach
+ * the browser.
+ *
+ * Headers set on every response:
+ *   X-Content-Type-Options: nosniff          — prevent MIME-sniffing
+ *   X-Frame-Options: DENY                    — prevent clickjacking
+ *   Referrer-Policy: strict-origin-when-cross-origin
+ *                                            — limit referrer leakage
+ *   X-XSS-Protection: 0                      — disable legacy XSS filter
+ *                                              (buggy; rely on CSP instead)
+ *   Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=()
+ *                                            — restrict browser APIs
+ *   Content-Security-Policy                  — strict default, relaxed for
+ *                                              HTML pages (see below)
+ *
+ * Conditional headers:
+ *   Strict-Transport-Security                — only emitted when the
+ *     configured issuer URL uses https://
+ *
+ * Content-Security-Policy strategy:
+ *   - Default (JSON / non-HTML responses):
+ *       `default-src 'none'`  — nothing to render, nothing to load.
+ *   - HTML responses (login, consent, 2FA, password-reset, etc.):
+ *       `default-src 'none'; style-src 'unsafe-inline'; frame-ancestors 'none'`
+ *     The interaction templates use inline `<style>` blocks and may
+ *     inject custom branding CSS via `{{{branding.customCss}}}`, hence
+ *     `style-src 'unsafe-inline'` is required.  Login pages must never
+ *     be embedded in iframes (`frame-ancestors 'none'`).
+ *
+ *     Note: `form-action` is intentionally omitted.  Chrome enforces
+ *     `form-action` on the entire redirect chain of a form submission,
+ *     not just the immediate target.  After login, the OIDC provider
+ *     redirects through the authorization endpoint and then to the
+ *     client's `redirect_uri` (a different origin).  Chrome blocks
+ *     this final redirect as a `form-action 'self'` violation, while
+ *     Firefox only checks the immediate action URL.  CSRF tokens are
+ *     the primary defence against cross-site form attacks; removing
+ *     `form-action` has negligible security impact given that
+ *     `script-src 'unsafe-inline'` already allows fetch/XHR exfiltration.
+ *
+ * Placement:
+ *   Mount early in the middleware stack — after `errorHandler()` and
+ *   `requestLogger()` but before any route-specific middleware. This
+ *   ensures headers are present even on error responses.
+ */
+import type { Middleware } from 'koa';
+/**
+ * Static security headers applied to every response regardless of
+ * content type or route.
+ */
+export declare const STATIC_SECURITY_HEADERS: Readonly<Record<string, string>>;
+/**
+ * Strict Content-Security-Policy for non-HTML (JSON, plain-text) responses.
+ * Disallows all resource loading — there is nothing for a browser to render
+ * in a JSON API response.
+ */
+export declare const DEFAULT_CSP = "default-src 'none'";
+/**
+ * Relaxed Content-Security-Policy for HTML pages (login, consent, 2FA,
+ * password reset, invitation, magic-link confirmation, etc.).
+ *
+ * - `style-src 'unsafe-inline'`   — templates use inline `<style>` blocks,
+ *                                    inline style attributes, and custom
+ *                                    branding CSS injection.
+ * - `script-src 'unsafe-inline'`  — login.hbs uses an inline `<script>` for
+ *                                    dual-method email copying, and
+ *                                    two-factor-verify.hbs uses one for
+ *                                    OTP/recovery mode toggling.
+ * - `frame-ancestors 'none'`      — prevents embedding in iframes
+ *                                    (modern replacement for X-Frame-Options).
+ *
+ * `form-action` is intentionally omitted — see module-level doc comment.
+ */
+export declare const HTML_CSP = "default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; frame-ancestors 'none'";
+/**
+ * HSTS header value — one year, include subdomains.
+ * Only emitted when the configured issuer URL uses https.
+ */
+export declare const HSTS_VALUE = "max-age=31536000; includeSubDomains";
+/**
+ * Create the global security-headers Koa middleware.
+ *
+ * Sets static security headers on every response **before** downstream
+ * handlers run, then adjusts the Content-Security-Policy after the
+ * response body is produced — if the response is HTML, the CSP is
+ * relaxed to allow inline styles and form submissions.
+ *
+ * @returns Koa middleware function
+ */
+export declare function securityHeaders(): Middleware;
+//# sourceMappingURL=security-headers.d.ts.map

package/dist/middleware/security-headers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-headers.d.ts","sourceRoot":"","sources":["../../src/middleware/security-headers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,KAAK,CAAC;AAQtC;;;GAGG;AACH,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMnE,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,WAAW,uBAAuB,CAAC;AAEhD;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,QAAQ,sGACgF,CAAC;AAEtG;;;GAGG;AACH,eAAO,MAAM,UAAU,wCAAwC,CAAC;AAsBhE;;;;;;;;;GASG;AACH,wBAAgB,eAAe,IAAI,UAAU,CAqC5C"}