@portaidentity/server 1.7.0

package/dist/oidc/redis-adapter.d.ts

@@ -0,0 +1,140 @@
+/**
+ * Redis adapter for node-oidc-provider.
+ *
+ * Stores short-lived, high-throughput OIDC artifacts (Session, Interaction,
+ * AuthorizationCode, ReplayDetection, ClientCredentials, PushedAuthorizationRequest)
+ * in Redis with automatic expiry via TTL.
+ *
+ * Key patterns:
+ *   oidc:{type}:{id}                — Primary key (stores JSON payload)
+ *   oidc:{type}:uid:{uid}           — UID index → primary ID (sessions)
+ *   oidc:{type}:user_code:{uc}      — User code index → primary ID (device flow)
+ *   oidc:{type}:grant:{grantId}     — Grant set of primary IDs (for revocation)
+ */
+import type { AdapterPayload } from './postgres-adapter.js';
+/**
+ * Redis adapter implementing the node-oidc-provider storage interface.
+ *
+ * Each instance is created per-model (e.g., new RedisAdapter('Session')).
+ * All keys are namespaced under `oidc:{modelName}:` to avoid collisions
+ * with other Redis data.
+ */
+export declare class RedisAdapter {
+    /** Model name — used in Redis key prefixes (e.g., 'Session', 'Interaction') */
+    protected name: string;
+    constructor(name: string);
+    /**
+     * Build the primary Redis key for an artifact.
+     * @param id - Artifact ID
+     * @returns Redis key like 'oidc:Session:abc123'
+     */
+    protected key(id: string): string;
+    /**
+     * Build the UID index key.
+     * @param uid - Unique identifier
+     * @returns Redis key like 'oidc:Session:uid:def456'
+     */
+    protected uidKey(uid: string): string;
+    /**
+     * Build the user code index key.
+     * @param userCode - User-facing device code
+     * @returns Redis key like 'oidc:DeviceCode:user_code:XYZ'
+     */
+    protected userCodeKey(userCode: string): string;
+    /**
+     * Build the grant set key.
+     * @param grantId - Grant identifier
+     * @returns Redis key like 'oidc:Session:grant:grant789'
+     */
+    protected grantKey(grantId: string): string;
+    /**
+     * Store an artifact in Redis with TTL.
+     *
+     * Sets the main key with the full payload as JSON. Also creates index keys
+     * for uid, userCode, and grantId if present in the payload, enabling
+     * efficient lookups by those fields.
+     *
+     * @param id - Artifact ID
+     * @param payload - Full OIDC artifact payload
+     * @param expiresIn - TTL in seconds
+     */
+    upsert(id: string, payload: AdapterPayload, expiresIn: number): Promise<void>;
+    /**
+     * Find an artifact by its ID.
+     *
+     * Returns undefined if the key doesn't exist (expired via TTL or never stored).
+     *
+     * @param id - Artifact ID
+     * @returns The artifact payload, or undefined if not found
+     */
+    find(id: string): Promise<AdapterPayload | undefined>;
+    /**
+     * Find an artifact by user code (device flow).
+     *
+     * Looks up the user code index key to get the primary artifact ID,
+     * then retrieves the full payload from the main key.
+     *
+     * @param userCode - The user-facing device code
+     * @returns The artifact payload, or undefined if not found
+     */
+    findByUserCode(userCode: string): Promise<AdapterPayload | undefined>;
+    /**
+     * Find an artifact by UID (sessions).
+     *
+     * Looks up the UID index key to get the primary artifact ID,
+     * then retrieves the full payload from the main key.
+     *
+     * @param uid - The unique identifier
+     * @returns The artifact payload, or undefined if not found
+     */
+    findByUid(uid: string): Promise<AdapterPayload | undefined>;
+    /**
+     * Mark an artifact as consumed.
+     *
+     * Reads the current payload, adds a `consumed` timestamp (epoch seconds),
+     * and writes it back with the remaining TTL preserved. This is used for
+     * authorization code replay detection.
+     *
+     * @param id - Artifact ID to mark as consumed
+     */
+    consume(id: string): Promise<void>;
+    /**
+     * Delete an artifact and its associated index keys.
+     *
+     * Reads the payload first to identify any index keys that need cleanup,
+     * then deletes all keys in a single pipeline operation.
+     *
+     * @param id - Artifact ID to delete
+     */
+    destroy(id: string): Promise<void>;
+    /**
+     * Revoke all artifacts associated with a grant.
+     *
+     * Reads the grant set to find all artifact IDs, then deletes each
+     * artifact (including its index keys) and finally the grant set itself.
+     * Uses best-effort deletion — logs warnings for individual failures
+     * but continues with remaining keys.
+     *
+     * @param grantId - Grant ID whose artifacts should be revoked
+     */
+    revokeByGrantId(grantId: string): Promise<void>;
+}
+/**
+ * Clean up Redis grant sets and their member keys for the given grant_ids.
+ *
+ * When a session is destroyed during explicit logout, the PostgreSQL cascade
+ * (revokeGrantsByIds) handles the critical data cleanup. This function provides
+ * best-effort cleanup of the corresponding Redis keys — grant set keys and
+ * the individual artifact keys they reference.
+ *
+ * This is NOT critical for correctness: Redis keys have TTLs and will expire
+ * on their own. However, cleaning them up immediately prevents stale keys from
+ * being used during the window between logout and TTL expiry.
+ *
+ * Errors are logged but never propagated — the logout flow must not fail
+ * because of a Redis cleanup issue.
+ *
+ * @param grantIds - Array of grant IDs whose Redis keys should be cleaned up
+ */
+export declare function cleanupRedisGrants(grantIds: string[]): Promise<void>;
+//# sourceMappingURL=redis-adapter.d.ts.map

package/dist/oidc/redis-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis-adapter.d.ts","sourceRoot":"","sources":["../../src/oidc/redis-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE5D;;;;;;GAMG;AACH,qBAAa,YAAY;IACvB,+EAA+E;IAC/E,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC;IAEvB,YAAY,IAAI,EAAE,MAAM,EAEvB;IAED;;;;OAIG;IACH,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAEhC;IAED;;;;OAIG;IACH,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEpC;IAED;;;;OAIG;IACH,SAAS,CAAC,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE9C;IAED;;;;OAIG;IACH,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE1C;IAED;;;;;;;;;;OAUG;IACG,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA6DlF;IAED;;;;;;;OAOG;IACG,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAY1D;IAED;;;;;;;;OAQG;IACG,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAO1E;IAED;;;;;;;;OAQG;IACG,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAOhE;IAED;;;;;;;;OAQG;IACG,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAsBvC;IAED;;;;;;;OAOG;IACG,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA6BvC;IAED;;;;;;;;;OASG;IACG,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAmBpD;CACF;AAoBD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA+B1E"}

package/dist/oidc/redis-adapter.js

@@ -0,0 +1,344 @@
+/**
+ * Redis adapter for node-oidc-provider.
+ *
+ * Stores short-lived, high-throughput OIDC artifacts (Session, Interaction,
+ * AuthorizationCode, ReplayDetection, ClientCredentials, PushedAuthorizationRequest)
+ * in Redis with automatic expiry via TTL.
+ *
+ * Key patterns:
+ *   oidc:{type}:{id}                — Primary key (stores JSON payload)
+ *   oidc:{type}:uid:{uid}           — UID index → primary ID (sessions)
+ *   oidc:{type}:user_code:{uc}      — User code index → primary ID (device flow)
+ *   oidc:{type}:grant:{grantId}     — Grant set of primary IDs (for revocation)
+ */
+import { getRedis } from '../lib/redis.js';
+import { logger } from '../lib/logger.js';
+import { upsertSession, revokeSession } from '../lib/session-tracking.js';
+/**
+ * Redis adapter implementing the node-oidc-provider storage interface.
+ *
+ * Each instance is created per-model (e.g., new RedisAdapter('Session')).
+ * All keys are namespaced under `oidc:{modelName}:` to avoid collisions
+ * with other Redis data.
+ */
+export class RedisAdapter {
+    /** Model name — used in Redis key prefixes (e.g., 'Session', 'Interaction') */
+    name;
+    constructor(name) {
+        this.name = name;
+    }
+    /**
+     * Build the primary Redis key for an artifact.
+     * @param id - Artifact ID
+     * @returns Redis key like 'oidc:Session:abc123'
+     */
+    key(id) {
+        return `oidc:${this.name}:${id}`;
+    }
+    /**
+     * Build the UID index key.
+     * @param uid - Unique identifier
+     * @returns Redis key like 'oidc:Session:uid:def456'
+     */
+    uidKey(uid) {
+        return `oidc:${this.name}:uid:${uid}`;
+    }
+    /**
+     * Build the user code index key.
+     * @param userCode - User-facing device code
+     * @returns Redis key like 'oidc:DeviceCode:user_code:XYZ'
+     */
+    userCodeKey(userCode) {
+        return `oidc:${this.name}:user_code:${userCode}`;
+    }
+    /**
+     * Build the grant set key.
+     * @param grantId - Grant identifier
+     * @returns Redis key like 'oidc:Session:grant:grant789'
+     */
+    grantKey(grantId) {
+        return `oidc:${this.name}:grant:${grantId}`;
+    }
+    /**
+     * Store an artifact in Redis with TTL.
+     *
+     * Sets the main key with the full payload as JSON. Also creates index keys
+     * for uid, userCode, and grantId if present in the payload, enabling
+     * efficient lookups by those fields.
+     *
+     * @param id - Artifact ID
+     * @param payload - Full OIDC artifact payload
+     * @param expiresIn - TTL in seconds
+     */
+    async upsert(id, payload, expiresIn) {
+        const redis = getRedis();
+        const mainKey = this.key(id);
+        // Use pipeline for atomic multi-key operations
+        const pipeline = redis.pipeline();
+        // Store the full payload with TTL
+        if (expiresIn) {
+            pipeline.set(mainKey, JSON.stringify(payload), 'EX', expiresIn);
+        }
+        else {
+            pipeline.set(mainKey, JSON.stringify(payload));
+        }
+        // Create UID index key if present (used by findByUid for session lookups)
+        if (payload.uid) {
+            const uidIdx = this.uidKey(payload.uid);
+            if (expiresIn) {
+                pipeline.set(uidIdx, id, 'EX', expiresIn);
+            }
+            else {
+                pipeline.set(uidIdx, id);
+            }
+        }
+        // Create user code index key if present (used by findByUserCode for device flow)
+        if (payload.userCode) {
+            const ucIdx = this.userCodeKey(payload.userCode);
+            if (expiresIn) {
+                pipeline.set(ucIdx, id, 'EX', expiresIn);
+            }
+            else {
+                pipeline.set(ucIdx, id);
+            }
+        }
+        // Track artifact in grant set if grant_id present (used by revokeByGrantId)
+        if (payload.grantId) {
+            const grantSetKey = this.grantKey(payload.grantId);
+            pipeline.sadd(grantSetKey, id);
+            if (expiresIn) {
+                pipeline.expire(grantSetKey, expiresIn);
+            }
+        }
+        await pipeline.exec();
+        // Fire-and-forget: mirror session data to PostgreSQL for admin listing.
+        // Only Session model needs tracking — other models (Interaction, AuthorizationCode, etc.)
+        // are short-lived artifacts that don't need admin visibility.
+        if (this.name === 'Session') {
+            const expiresAt = new Date(Date.now() + expiresIn * 1000);
+            upsertSession({
+                sessionId: id,
+                userId: payload.accountId,
+                organizationId: payload.orgId,
+                grantId: payload.grantId,
+                expiresAt,
+            }).catch(() => {
+                // Intentionally swallowed — tracking must never break the OIDC flow.
+                // upsertSession already logs warnings internally.
+            });
+        }
+    }
+    /**
+     * Find an artifact by its ID.
+     *
+     * Returns undefined if the key doesn't exist (expired via TTL or never stored).
+     *
+     * @param id - Artifact ID
+     * @returns The artifact payload, or undefined if not found
+     */
+    async find(id) {
+        const redis = getRedis();
+        const data = await redis.get(this.key(id));
+        if (!data)
+            return undefined;
+        try {
+            return JSON.parse(data);
+        }
+        catch (error) {
+            logger.warn({ key: this.key(id), error }, 'Invalid JSON in Redis OIDC payload');
+            return undefined;
+        }
+    }
+    /**
+     * Find an artifact by user code (device flow).
+     *
+     * Looks up the user code index key to get the primary artifact ID,
+     * then retrieves the full payload from the main key.
+     *
+     * @param userCode - The user-facing device code
+     * @returns The artifact payload, or undefined if not found
+     */
+    async findByUserCode(userCode) {
+        const redis = getRedis();
+        const id = await redis.get(this.userCodeKey(userCode));
+        if (!id)
+            return undefined;
+        return this.find(id);
+    }
+    /**
+     * Find an artifact by UID (sessions).
+     *
+     * Looks up the UID index key to get the primary artifact ID,
+     * then retrieves the full payload from the main key.
+     *
+     * @param uid - The unique identifier
+     * @returns The artifact payload, or undefined if not found
+     */
+    async findByUid(uid) {
+        const redis = getRedis();
+        const id = await redis.get(this.uidKey(uid));
+        if (!id)
+            return undefined;
+        return this.find(id);
+    }
+    /**
+     * Mark an artifact as consumed.
+     *
+     * Reads the current payload, adds a `consumed` timestamp (epoch seconds),
+     * and writes it back with the remaining TTL preserved. This is used for
+     * authorization code replay detection.
+     *
+     * @param id - Artifact ID to mark as consumed
+     */
+    async consume(id) {
+        const redis = getRedis();
+        const mainKey = this.key(id);
+        const data = await redis.get(mainKey);
+        if (!data)
+            return;
+        try {
+            const payload = JSON.parse(data);
+            payload.consumed = Math.floor(Date.now() / 1000);
+            // Preserve the remaining TTL when updating the payload
+            const ttl = await redis.ttl(mainKey);
+            if (ttl > 0) {
+                await redis.set(mainKey, JSON.stringify(payload), 'EX', ttl);
+            }
+            else {
+                // No TTL set (or key is expiring imminently) — just update
+                await redis.set(mainKey, JSON.stringify(payload));
+            }
+        }
+        catch (error) {
+            logger.warn({ key: mainKey, error }, 'Failed to consume OIDC artifact in Redis');
+        }
+    }
+    /**
+     * Delete an artifact and its associated index keys.
+     *
+     * Reads the payload first to identify any index keys that need cleanup,
+     * then deletes all keys in a single pipeline operation.
+     *
+     * @param id - Artifact ID to delete
+     */
+    async destroy(id) {
+        const redis = getRedis();
+        const mainKey = this.key(id);
+        // Read payload to find associated index keys
+        const data = await redis.get(mainKey);
+        const keysToDelete = [mainKey];
+        if (data) {
+            try {
+                const payload = JSON.parse(data);
+                // Clean up index keys if they exist
+                if (payload.uid)
+                    keysToDelete.push(this.uidKey(payload.uid));
+                if (payload.userCode)
+                    keysToDelete.push(this.userCodeKey(payload.userCode));
+            }
+            catch {
+                // If JSON parse fails, just delete the main key
+            }
+        }
+        await redis.del(...keysToDelete);
+        // Fire-and-forget: mark session as revoked in PostgreSQL tracking table.
+        // Only Session model needs tracking — other model destroys don't need admin visibility.
+        if (this.name === 'Session') {
+            revokeSession(id).catch(() => {
+                // Intentionally swallowed — tracking must never break the OIDC flow.
+                // revokeSession already logs warnings internally.
+            });
+        }
+    }
+    /**
+     * Revoke all artifacts associated with a grant.
+     *
+     * Reads the grant set to find all artifact IDs, then deletes each
+     * artifact (including its index keys) and finally the grant set itself.
+     * Uses best-effort deletion — logs warnings for individual failures
+     * but continues with remaining keys.
+     *
+     * @param grantId - Grant ID whose artifacts should be revoked
+     */
+    async revokeByGrantId(grantId) {
+        const redis = getRedis();
+        const grantSetKey = this.grantKey(grantId);
+        // Get all artifact IDs in this grant
+        const members = await redis.smembers(grantSetKey);
+        if (members.length === 0) {
+            // No artifacts to revoke — clean up the empty set key just in case
+            await redis.del(grantSetKey);
+            return;
+        }
+        // Delete each artifact (destroy handles index key cleanup)
+        const deletePromises = members.map((id) => this.destroy(id));
+        await Promise.all(deletePromises);
+        // Delete the grant set itself
+        await redis.del(grantSetKey);
+    }
+}
+// ---------------------------------------------------------------------------
+// Standalone helpers for session lifecycle management
+// ---------------------------------------------------------------------------
+/**
+ * Models stored in Redis — used by cleanupRedisGrants to iterate grant sets.
+ * Must match the REDIS_MODELS set in adapter-factory.ts. Defined here as an
+ * array (not imported) to avoid circular dependencies between adapter files.
+ */
+const REDIS_MODEL_NAMES = [
+    'Session',
+    'Interaction',
+    'AuthorizationCode',
+    'ReplayDetection',
+    'ClientCredentials',
+    'PushedAuthorizationRequest',
+];
+/**
+ * Clean up Redis grant sets and their member keys for the given grant_ids.
+ *
+ * When a session is destroyed during explicit logout, the PostgreSQL cascade
+ * (revokeGrantsByIds) handles the critical data cleanup. This function provides
+ * best-effort cleanup of the corresponding Redis keys — grant set keys and
+ * the individual artifact keys they reference.
+ *
+ * This is NOT critical for correctness: Redis keys have TTLs and will expire
+ * on their own. However, cleaning them up immediately prevents stale keys from
+ * being used during the window between logout and TTL expiry.
+ *
+ * Errors are logged but never propagated — the logout flow must not fail
+ * because of a Redis cleanup issue.
+ *
+ * @param grantIds - Array of grant IDs whose Redis keys should be cleaned up
+ */
+export async function cleanupRedisGrants(grantIds) {
+    if (grantIds.length === 0)
+        return;
+    try {
+        const redis = getRedis();
+        const keysToDelete = [];
+        // For each model type × grant ID, look up the grant set and collect
+        // both the set key and all member keys for deletion.
+        for (const model of REDIS_MODEL_NAMES) {
+            for (const grantId of grantIds) {
+                const grantKey = `oidc:${model}:grant:${grantId}`;
+                // Get all artifact IDs in this grant set
+                const members = await redis.smembers(grantKey);
+                // Queue the grant set key itself for deletion
+                keysToDelete.push(grantKey);
+                // Queue each member's primary key for deletion
+                for (const memberId of members) {
+                    keysToDelete.push(`oidc:${model}:${memberId}`);
+                }
+            }
+        }
+        // Batch delete all collected keys in one DEL command
+        if (keysToDelete.length > 0) {
+            await redis.del(...keysToDelete);
+        }
+    }
+    catch (err) {
+        // Best-effort — Redis keys have TTLs and will expire naturally
+        logger.warn({ err, grantIds }, 'Failed to clean up Redis grant keys (keys will expire via TTL)');
+    }
+}
+//# sourceMappingURL=redis-adapter.js.map

package/dist/oidc/redis-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis-adapter.js","sourceRoot":"","sources":["../../src/oidc/redis-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAG1E;;;;;;GAMG;AACH,MAAM,OAAO,YAAY;IACvB,+EAA+E;IACrE,IAAI,CAAS;IAEvB,YAAY,IAAY;QACtB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED;;;;OAIG;IACO,GAAG,CAAC,EAAU;QACtB,OAAO,QAAQ,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;IACnC,CAAC;IAED;;;;OAIG;IACO,MAAM,CAAC,GAAW;QAC1B,OAAO,QAAQ,IAAI,CAAC,IAAI,QAAQ,GAAG,EAAE,CAAC;IACxC,CAAC;IAED;;;;OAIG;IACO,WAAW,CAAC,QAAgB;QACpC,OAAO,QAAQ,IAAI,CAAC,IAAI,cAAc,QAAQ,EAAE,CAAC;IACnD,CAAC;IAED;;;;OAIG;IACO,QAAQ,CAAC,OAAe;QAChC,OAAO,QAAQ,IAAI,CAAC,IAAI,UAAU,OAAO,EAAE,CAAC;IAC9C,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,OAAuB,EAAE,SAAiB;QACjE,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAE7B,+CAA+C;QAC/C,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;QAElC,kCAAkC;QAClC,IAAI,SAAS,EAAE,CAAC;YACd,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QAClE,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QACjD,CAAC;QAED,0EAA0E;QAC1E,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YAChB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,SAAS,EAAE,CAAC;gBACd,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;YAC5C,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QAED,iFAAiF;QACjF,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACjD,IAAI,SAAS,EAAE,CAAC;gBACd,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;YAC3C,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,4EAA4E;QAC5E,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACnD,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YAC/B,IAAI,SAAS,EAAE,CAAC;gBACd,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAEtB,wEAAwE;QACxE,0FAA0F;QAC1F,8DAA8D;QAC9D,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC;YAC1D,aAAa,CAAC;gBACZ,SAAS,EAAE,EAAE;gBACb,MAAM,EAAE,OAAO,CAAC,SAA+B;gBAC/C,cAAc,EAAE,OAAO,CAAC,KAA2B;gBACnD,OAAO,EAAE,OAAO,CAAC,OAA6B;gBAC9C,SAAS;aACV,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;gBACZ,qEAAqE;gBACrE,kDAAkD;YACpD,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,IAAI,CAAC,EAAU;QACnB,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAE3C,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC;QAE5B,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAmB,CAAC;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,oCAAoC,CAAC,CAAC;YAChF,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,cAAc,CAAC,QAAgB;QACnC,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;QAEvD,IAAI,CAAC,EAAE;YAAE,OAAO,SAAS,CAAC;QAE1B,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvB,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,SAAS,CAAC,GAAW;QACzB,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAE7C,IAAI,CAAC,EAAE;YAAE,OAAO,SAAS,CAAC;QAE1B,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvB,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAE7B,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI;YAAE,OAAO;QAElB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAmB,CAAC;YACnD,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YAEjD,uDAAuD;YACvD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACrC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;gBACZ,MAAM,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAC/D,CAAC;iBAAM,CAAC;gBACN,2DAA2D;gBAC3D,MAAM,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,0CAA0C,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAE7B,6CAA6C;QAC7C,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,YAAY,GAAG,CAAC,OAAO,CAAC,CAAC;QAE/B,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAmB,CAAC;gBACnD,oCAAoC;gBACpC,IAAI,OAAO,CAAC,GAAG;oBAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC7D,IAAI,OAAO,CAAC,QAAQ;oBAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC9E,CAAC;YAAC,MAAM,CAAC;gBACP,gDAAgD;YAClD,CAAC;QACH,CAAC;QAED,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,CAAC;QAEjC,yEAAyE;QACzE,wFAAwF;QACxF,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5B,aAAa,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;gBAC3B,qEAAqE;gBACrE,kDAAkD;YACpD,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,eAAe,CAAC,OAAe;QACnC,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAE3C,qCAAqC;QACrC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAElD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,mEAAmE;YACnE,MAAM,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC7B,OAAO;QACT,CAAC;QAED,2DAA2D;QAC3D,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7D,MAAM,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAElC,8BAA8B;QAC9B,MAAM,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC/B,CAAC;CACF;AAED,8EAA8E;AAC9E,sDAAsD;AACtD,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,iBAAiB,GAAG;IACxB,SAAS;IACT,aAAa;IACb,mBAAmB;IACnB,iBAAiB;IACjB,mBAAmB;IACnB,4BAA4B;CAC7B,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,QAAkB;IACzD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAElC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,MAAM,YAAY,GAAa,EAAE,CAAC;QAElC,oEAAoE;QACpE,qDAAqD;QACrD,KAAK,MAAM,KAAK,IAAI,iBAAiB,EAAE,CAAC;YACtC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;gBAC/B,MAAM,QAAQ,GAAG,QAAQ,KAAK,UAAU,OAAO,EAAE,CAAC;gBAClD,yCAAyC;gBACzC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBAC/C,8CAA8C;gBAC9C,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAC5B,+CAA+C;gBAC/C,KAAK,MAAM,QAAQ,IAAI,OAAO,EAAE,CAAC;oBAC/B,YAAY,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,QAAQ,EAAE,CAAC,CAAC;gBACjD,CAAC;YACH,CAAC;QACH,CAAC;QAED,qDAAqD;QACrD,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,+DAA+D;QAC/D,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,gEAAgE,CAAC,CAAC;IACnG,CAAC;AACH,CAAC"}

package/dist/organizations/cache.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Organization cache — Redis-backed fast lookup layer.
+ *
+ * Provides get/set/invalidate operations for Organization objects
+ * stored in Redis. Each organization is cached under two keys:
+ *   - `org:slug:{slug}` — for tenant resolver lookups by URL path
+ *   - `org:id:{id}`     — for service layer lookups by UUID
+ *
+ * Both keys store the same JSON-serialized Organization object
+ * with a 5-minute TTL. Date fields (createdAt, updatedAt) are
+ * serialized as ISO 8601 strings and deserialized back to Date
+ * objects on read.
+ *
+ * All Redis errors are caught and logged — cache failures never
+ * propagate to callers. The system gracefully degrades to direct
+ * database lookups when Redis is unavailable.
+ */
+import type { Organization } from './types.js';
+/**
+ * Get an organization from cache by slug.
+ *
+ * Returns null on cache miss, invalid JSON, or Redis error.
+ * Callers should fall back to the database on null.
+ *
+ * @param slug - Organization slug
+ * @returns Cached organization or null
+ */
+export declare function getCachedOrganizationBySlug(slug: string): Promise<Organization | null>;
+/**
+ * Get an organization from cache by ID.
+ *
+ * Returns null on cache miss, invalid JSON, or Redis error.
+ * Callers should fall back to the database on null.
+ *
+ * @param id - Organization UUID
+ * @returns Cached organization or null
+ */
+export declare function getCachedOrganizationById(id: string): Promise<Organization | null>;
+/**
+ * Store an organization in cache under both slug and ID keys.
+ *
+ * Both keys get the same TTL so they expire together.
+ * Date fields are serialized to ISO 8601 strings automatically
+ * by JSON.stringify().
+ *
+ * @param org - Organization to cache
+ */
+export declare function cacheOrganization(org: Organization): Promise<void>;
+/**
+ * Invalidate all cache entries for an organization.
+ *
+ * Deletes both the slug-keyed and ID-keyed cache entries.
+ * Should be called after any write operation (create, update,
+ * status change) to ensure stale data is not served.
+ *
+ * @param slug - Organization slug
+ * @param id - Organization UUID
+ */
+export declare function invalidateOrganizationCache(slug: string, id: string): Promise<void>;
+//# sourceMappingURL=cache.d.ts.map

package/dist/organizations/cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../src/organizations/cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAmB/C;;;;;;;;GAQG;AACH,wBAAsB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAW5F;AAED;;;;;;;;GAQG;AACH,wBAAsB,yBAAyB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAWxF;AAMD;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAcxE;AAMD;;;;;;;;;GASG;AACH,wBAAsB,2BAA2B,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAazF"}