@portaidentity/server 1.7.0

package/dist/routes/config.js

@@ -0,0 +1,115 @@
+/**
+ * System configuration admin API routes.
+ *
+ * All routes are under `/api/admin/config` and require admin
+ * authorization with granular permissions.
+ *
+ * Route structure:
+ *   GET    /                  — List all config entries
+ *   GET    /:key              — Get a specific config value
+ *   PUT    /:key              — Set (update) a config value
+ *
+ * Sensitive values (is_sensitive=true) are masked in GET responses
+ * with '***' to prevent accidental exposure in CLI output / logs.
+ *
+ * @module routes/config
+ */
+import Router from '@koa/router';
+import { z } from 'zod';
+import { requireAdminAuth } from '../middleware/admin-auth.js';
+import { requirePermission } from '../middleware/require-permission.js';
+import { ADMIN_PERMISSIONS } from '../lib/admin-permissions.js';
+import { getPool } from '../lib/database.js';
+// ---------------------------------------------------------------------------
+// Validation schemas
+// ---------------------------------------------------------------------------
+/** Schema for updating a config value */
+export const updateConfigSchema = z.object({
+    value: z.string().min(1, 'Value must not be empty'),
+});
+/** Return the only public representation allowed for a stored configuration value. */
+export function publicConfigValue(value, isSensitive) {
+    return isSensitive ? '***' : value;
+}
+// ---------------------------------------------------------------------------
+// Router factory
+// ---------------------------------------------------------------------------
+/**
+ * Create the system config admin API router.
+ *
+ * All routes require admin authorization with granular permissions.
+ * Provides read and write access to the `system_config` table via
+ * a RESTful interface.
+ *
+ * @returns Koa router mounted at /api/admin/config
+ */
+export function createConfigRouter() {
+    const router = new Router({ prefix: '/api/admin/config' });
+    // Apply admin auth to all config routes
+    router.use(requireAdminAuth());
+    // ── GET / — List all config entries ───────────────────────────────
+    router.get('/', requirePermission(ADMIN_PERMISSIONS.CONFIG_READ), async (ctx) => {
+        const result = await getPool().query(`SELECT key, value, value_type, description, is_sensitive, updated_at
+       FROM system_config ORDER BY key`);
+        // Mask sensitive values to prevent accidental exposure
+        const data = result.rows.map((r) => ({
+            key: r.key,
+            value: publicConfigValue(r.value, r.is_sensitive),
+            valueType: r.value_type,
+            description: r.description,
+            isSensitive: r.is_sensitive,
+            updatedAt: r.updated_at,
+        }));
+        ctx.body = { data };
+    });
+    // ── GET /:key — Get a specific config value ───────────────────────
+    router.get('/:key', requirePermission(ADMIN_PERMISSIONS.CONFIG_READ), async (ctx) => {
+        const { key } = ctx.params;
+        const result = await getPool().query('SELECT key, value, value_type, description, is_sensitive, updated_at FROM system_config WHERE key = $1', [key]);
+        if (result.rows.length === 0) {
+            ctx.status = 404;
+            ctx.body = { error: 'Configuration entry not found' };
+            return;
+        }
+        const row = result.rows[0];
+        ctx.body = {
+            data: {
+                key: row.key,
+                value: publicConfigValue(row.value, row.is_sensitive),
+                valueType: row.value_type,
+                description: row.description,
+                isSensitive: row.is_sensitive,
+                updatedAt: row.updated_at,
+            },
+        };
+    });
+    // ── PUT /:key — Update a config value ─────────────────────────────
+    router.put('/:key', requirePermission(ADMIN_PERMISSIONS.CONFIG_UPDATE), async (ctx) => {
+        const { key } = ctx.params;
+        const body = ctx.request.body;
+        // Validate request body with Zod
+        const parsed = updateConfigSchema.safeParse(body);
+        if (!parsed.success) {
+            ctx.status = 400;
+            ctx.body = { error: 'Configuration request is invalid' };
+            return;
+        }
+        const result = await getPool().query(`UPDATE system_config SET value = $1, updated_at = NOW() WHERE key = $2
+       RETURNING key, value, value_type, is_sensitive`, [parsed.data.value, key]);
+        if (result.rows.length === 0) {
+            ctx.status = 404;
+            ctx.body = { error: 'Configuration entry not found' };
+            return;
+        }
+        const row = result.rows[0];
+        ctx.body = {
+            data: {
+                key: row.key,
+                value: publicConfigValue(row.value, row.is_sensitive),
+                valueType: row.value_type,
+            },
+        };
+    });
+    return router;
+}
+//# sourceMappingURL=config.js.map

package/dist/routes/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/routes/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE7C,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,yCAAyC;AACzC,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,yBAAyB,CAAC;CACpD,CAAC,CAAC;AAEH,sFAAsF;AACtF,MAAM,UAAU,iBAAiB,CAAC,KAAa,EAAE,WAAoB;IACnE,OAAO,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;AACrC,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAE3D,wCAAwC;IACxC,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAE/B,qEAAqE;IACrE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC9E,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAAC,KAAK,CAClC;uCACiC,CAClC,CAAC;QAEF,uDAAuD;QACvD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAC1B,CAAC,CAOA,EAAE,EAAE,CAAC,CAAC;YACL,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,KAAK,EAAE,iBAAiB,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,YAAY,CAAC;YACjD,SAAS,EAAE,CAAC,CAAC,UAAU;YACvB,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,WAAW,EAAE,CAAC,CAAC,YAAY;YAC3B,SAAS,EAAE,CAAC,CAAC,UAAU;SACxB,CAAC,CACH,CAAC;QAEF,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,qEAAqE;IACrE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAClF,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QAE3B,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAAC,KAAK,CAClC,wGAAwG,EACxG,CAAC,GAAG,CAAC,CACN,CAAC;QAEF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;YACtD,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAOxB,CAAC;QAEF,GAAG,CAAC,IAAI,GAAG;YACT,IAAI,EAAE;gBACJ,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,KAAK,EAAE,iBAAiB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,YAAY,CAAC;gBACrD,SAAS,EAAE,GAAG,CAAC,UAAU;gBACzB,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,WAAW,EAAE,GAAG,CAAC,YAAY;gBAC7B,SAAS,EAAE,GAAG,CAAC,UAAU;aAC1B;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,qEAAqE;IACrE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACpF,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAA+B,CAAC;QAEzD,iCAAiC;QACjC,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC;YACzD,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAAC,KAAK,CAClC;sDACgD,EAChD,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CACzB,CAAC;QAEF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;YACtD,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAKxB,CAAC;QACF,GAAG,CAAC,IAAI,GAAG;YACT,IAAI,EAAE;gBACJ,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,KAAK,EAAE,iBAAiB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,YAAY,CAAC;gBACrD,SAAS,EAAE,GAAG,CAAC,UAAU;aAC1B;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/routes/custom-claims.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Custom claims management API routes.
+ *
+ * All routes are under `/api/admin/applications/:appId/claims` and
+ * require admin authorization with granular permissions. Provides
+ * CRUD for claim definitions (per-application) and claim values
+ * (per-user).
+ *
+ * Route structure:
+ *   POST   /                         — Create a claim definition
+ *   GET    /                         — List claim definitions for the app
+ *   GET    /users/:userId            — Get all claim values for a user
+ *   GET    /:claimId                 — Get a claim definition
+ *   PUT    /:claimId                 — Update a claim definition
+ *   DELETE /:claimId                 — Delete a claim definition
+ *   PUT    /:claimId/users/:userId   — Set a claim value for a user
+ *   GET    /:claimId/users/:userId   — Get a claim value for a user
+ *   DELETE /:claimId/users/:userId   — Delete a claim value
+ *
+ * Error mapping:
+ *   ClaimNotFoundError → 404
+ *   ClaimValidationError → 400
+ *   ZodError → 400 with validation details
+ */
+import Router from '@koa/router';
+/**
+ * Create the custom claims management router.
+ *
+ * All routes require admin authorization with granular permissions.
+ * Claim definitions are scoped to an application via the :appId URL
+ * parameter. Claim values are per-user, referenced via :userId sub-routes.
+ *
+ * Prefix: /api/admin/applications/:appId/claims
+ *
+ * @returns Configured Koa Router
+ */
+export declare function createCustomClaimRouter(): Router;
+//# sourceMappingURL=custom-claims.d.ts.map

package/dist/routes/custom-claims.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom-claims.d.ts","sourceRoot":"","sources":["../../src/routes/custom-claims.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AAiEjC;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,CAyIhD"}

package/dist/routes/custom-claims.js

@@ -0,0 +1,208 @@
+/**
+ * Custom claims management API routes.
+ *
+ * All routes are under `/api/admin/applications/:appId/claims` and
+ * require admin authorization with granular permissions. Provides
+ * CRUD for claim definitions (per-application) and claim values
+ * (per-user).
+ *
+ * Route structure:
+ *   POST   /                         — Create a claim definition
+ *   GET    /                         — List claim definitions for the app
+ *   GET    /users/:userId            — Get all claim values for a user
+ *   GET    /:claimId                 — Get a claim definition
+ *   PUT    /:claimId                 — Update a claim definition
+ *   DELETE /:claimId                 — Delete a claim definition
+ *   PUT    /:claimId/users/:userId   — Set a claim value for a user
+ *   GET    /:claimId/users/:userId   — Get a claim value for a user
+ *   DELETE /:claimId/users/:userId   — Delete a claim value
+ *
+ * Error mapping:
+ *   ClaimNotFoundError → 404
+ *   ClaimValidationError → 400
+ *   ZodError → 400 with validation details
+ */
+import Router from '@koa/router';
+import { z } from 'zod';
+import { requireAdminAuth } from '../middleware/admin-auth.js';
+import { requirePermission } from '../middleware/require-permission.js';
+import { ADMIN_PERMISSIONS } from '../lib/admin-permissions.js';
+import * as claimService from '../custom-claims/service.js';
+import { ClaimNotFoundError, ClaimValidationError } from '../custom-claims/errors.js';
+// ---------------------------------------------------------------------------
+// Validation schemas
+// ---------------------------------------------------------------------------
+/** Schema for creating a new claim definition */
+const createDefinitionSchema = z.object({
+    claimName: z.string().min(1).max(255),
+    claimType: z.enum(['string', 'number', 'boolean', 'json']),
+    description: z.string().max(1000).optional(),
+    includeInIdToken: z.boolean().optional(),
+    includeInAccessToken: z.boolean().optional(),
+    includeInUserinfo: z.boolean().optional(),
+});
+/** Schema for updating a claim definition (description and inclusion flags only) */
+const updateDefinitionSchema = z.object({
+    description: z.string().max(1000).nullable().optional(),
+    includeInIdToken: z.boolean().optional(),
+    includeInAccessToken: z.boolean().optional(),
+    includeInUserinfo: z.boolean().optional(),
+});
+/** Schema for setting a claim value — type validation done by the service layer */
+const setValueSchema = z.object({
+    value: z.unknown(),
+});
+// ---------------------------------------------------------------------------
+// Error handler helper
+// ---------------------------------------------------------------------------
+/**
+ * Handle domain errors and map them to HTTP responses.
+ * Unknown errors are re-thrown for the global error handler.
+ */
+function handleError(ctx, err) {
+    if (err instanceof ClaimNotFoundError) {
+        ctx.throw(404, 'Claim not found');
+    }
+    if (err instanceof ClaimValidationError) {
+        ctx.throw(400, 'Claim request is invalid');
+    }
+    if (err instanceof z.ZodError) {
+        ctx.status = 400;
+        ctx.body = { error: 'Claim request is invalid' };
+        return undefined;
+    }
+    throw err;
+}
+// ---------------------------------------------------------------------------
+// Router factory
+// ---------------------------------------------------------------------------
+/**
+ * Create the custom claims management router.
+ *
+ * All routes require admin authorization with granular permissions.
+ * Claim definitions are scoped to an application via the :appId URL
+ * parameter. Claim values are per-user, referenced via :userId sub-routes.
+ *
+ * Prefix: /api/admin/applications/:appId/claims
+ *
+ * @returns Configured Koa Router
+ */
+export function createCustomClaimRouter() {
+    const router = new Router({ prefix: '/api/admin/applications/:appId/claims' });
+    // All routes require admin authentication
+    router.use(requireAdminAuth());
+    // -------------------------------------------------------------------------
+    // POST / — Create claim definition
+    // -------------------------------------------------------------------------
+    router.post('/', requirePermission(ADMIN_PERMISSIONS.CLAIM_CREATE), async (ctx) => {
+        try {
+            const body = createDefinitionSchema.parse(ctx.request.body);
+            const definition = await claimService.createDefinition({
+                applicationId: ctx.params.appId,
+                ...body,
+            });
+            ctx.status = 201;
+            ctx.body = { data: definition };
+        }
+        catch (err) {
+            handleError(ctx, err);
+        }
+    });
+    // -------------------------------------------------------------------------
+    // GET / — List claim definitions for application
+    // -------------------------------------------------------------------------
+    router.get('/', requirePermission(ADMIN_PERMISSIONS.CLAIM_READ), async (ctx) => {
+        try {
+            const definitions = await claimService.listDefinitions(ctx.params.appId);
+            ctx.body = { data: definitions };
+        }
+        catch (err) {
+            handleError(ctx, err);
+        }
+    });
+    // -------------------------------------------------------------------------
+    // GET /users/:userId — Get all claim values for a user
+    // Must be before /:claimId to avoid matching "users" as a claimId
+    // -------------------------------------------------------------------------
+    router.get('/users/:userId', requirePermission(ADMIN_PERMISSIONS.CLAIM_READ), async (ctx) => {
+        try {
+            const values = await claimService.getValuesForUser(ctx.params.userId);
+            ctx.body = { data: values };
+        }
+        catch (err) {
+            handleError(ctx, err);
+        }
+    });
+    // -------------------------------------------------------------------------
+    // GET /:claimId — Get claim definition by ID
+    // -------------------------------------------------------------------------
+    router.get('/:claimId', requirePermission(ADMIN_PERMISSIONS.CLAIM_READ), async (ctx) => {
+        const definition = await claimService.findDefinitionById(ctx.params.claimId);
+        if (!definition) {
+            ctx.throw(404, 'Claim definition not found');
+        }
+        ctx.body = { data: definition };
+    });
+    // -------------------------------------------------------------------------
+    // PUT /:claimId — Update claim definition
+    // -------------------------------------------------------------------------
+    router.put('/:claimId', requirePermission(ADMIN_PERMISSIONS.CLAIM_UPDATE), async (ctx) => {
+        try {
+            const body = updateDefinitionSchema.parse(ctx.request.body);
+            const definition = await claimService.updateDefinition(ctx.params.claimId, body);
+            ctx.body = { data: definition };
+        }
+        catch (err) {
+            handleError(ctx, err);
+        }
+    });
+    // -------------------------------------------------------------------------
+    // DELETE /:claimId — Delete claim definition
+    // -------------------------------------------------------------------------
+    router.delete('/:claimId', requirePermission(ADMIN_PERMISSIONS.CLAIM_ARCHIVE), async (ctx) => {
+        try {
+            await claimService.deleteDefinition(ctx.params.claimId);
+            ctx.status = 204;
+        }
+        catch (err) {
+            handleError(ctx, err);
+        }
+    });
+    // -------------------------------------------------------------------------
+    // PUT /:claimId/users/:userId — Set a claim value for a user
+    // -------------------------------------------------------------------------
+    router.put('/:claimId/users/:userId', requirePermission(ADMIN_PERMISSIONS.CLAIM_UPDATE), async (ctx) => {
+        try {
+            const body = setValueSchema.parse(ctx.request.body);
+            const value = await claimService.setValue(ctx.params.userId, ctx.params.claimId, body.value);
+            ctx.body = { data: value };
+        }
+        catch (err) {
+            handleError(ctx, err);
+        }
+    });
+    // -------------------------------------------------------------------------
+    // GET /:claimId/users/:userId — Get a claim value for a user
+    // -------------------------------------------------------------------------
+    router.get('/:claimId/users/:userId', requirePermission(ADMIN_PERMISSIONS.CLAIM_READ), async (ctx) => {
+        const value = await claimService.getValue(ctx.params.userId, ctx.params.claimId);
+        if (!value) {
+            ctx.throw(404, 'Claim value not found');
+        }
+        ctx.body = { data: value };
+    });
+    // -------------------------------------------------------------------------
+    // DELETE /:claimId/users/:userId — Delete a claim value
+    // -------------------------------------------------------------------------
+    router.delete('/:claimId/users/:userId', requirePermission(ADMIN_PERMISSIONS.CLAIM_UPDATE), async (ctx) => {
+        try {
+            await claimService.deleteValue(ctx.params.userId, ctx.params.claimId);
+            ctx.status = 204;
+        }
+        catch (err) {
+            handleError(ctx, err);
+        }
+    });
+    return router;
+}
+//# sourceMappingURL=custom-claims.js.map

package/dist/routes/custom-claims.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom-claims.js","sourceRoot":"","sources":["../../src/routes/custom-claims.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,YAAY,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAEtF,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,iDAAiD;AACjD,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACrC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IAC1D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IAC5C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACxC,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC5C,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAEH,oFAAoF;AACpF,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACvD,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACxC,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC5C,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAEH,mFAAmF;AACnF,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE;CACnB,CAAC,CAAC;AAEH,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,WAAW,CAClB,GAAqF,EACrF,GAAY;IAEZ,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;QACtC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;QACxC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,GAAG,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC9B,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC;QACjD,OAAO,SAAkB,CAAC;IAC5B,CAAC;IACD,MAAM,GAAG,CAAC;AACZ,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB;IACrC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC,CAAC;IAE/E,0CAA0C;IAC1C,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAE/B,4EAA4E;IAC5E,mCAAmC;IACnC,4EAA4E;IAC5E,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAChF,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,sBAAsB,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC5D,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,gBAAgB,CAAC;gBACrD,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK;gBAC/B,GAAG,IAAI;aACR,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,iDAAiD;IACjD,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC7E,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACzE,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,uDAAuD;IACvD,kEAAkE;IAClE,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC1F,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACtE,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,6CAA6C;IAC7C,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACrF,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC7E,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC;QAC/C,CAAC;QACD,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,0CAA0C;IAC1C,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACvF,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,sBAAsB,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC5D,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACjF,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,6CAA6C;IAC7C,4EAA4E;IAC5E,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC3F,IAAI,CAAC;YACH,MAAM,YAAY,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACxD,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,6DAA6D;IAC7D,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CACR,yBAAyB,EACzB,iBAAiB,CAAC,iBAAiB,CAAC,YAAY,CAAC,EACjD,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACpD,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,QAAQ,CACvC,GAAG,CAAC,MAAM,CAAC,MAAM,EACjB,GAAG,CAAC,MAAM,CAAC,OAAO,EAClB,IAAI,CAAC,KAAK,CACX,CAAC;YACF,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,4EAA4E;IAC5E,6DAA6D;IAC7D,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CACR,yBAAyB,EACzB,iBAAiB,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAC/C,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACjF,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;QAC1C,CAAC;QACD,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC,CACF,CAAC;IAEF,4EAA4E;IAC5E,wDAAwD;IACxD,4EAA4E;IAC5E,MAAM,CAAC,MAAM,CACX,yBAAyB,EACzB,iBAAiB,CAAC,iBAAiB,CAAC,YAAY,CAAC,EACjD,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,MAAM,YAAY,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACtE,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/routes/exports.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Data export API routes.
+ *
+ * Provides admin endpoints for exporting entity data in CSV or JSON format.
+ * Exports exclude sensitive data (passwords, secrets, keys).
+ *
+ * Route structure:
+ *   GET /api/admin/export/:entityType  — Export entity data
+ *
+ * Query parameters:
+ *   format: 'json' | 'csv' (default: json)
+ *   organizationId: UUID (required for users, clients, audit)
+ *   applicationId: UUID (required for roles)
+ *   startDate: ISO date (audit only)
+ *   endDate: ISO date (audit only)
+ *
+ * @see 07-import-export-invitations.md
+ */
+import Router from '@koa/router';
+export declare function createExportRouter(): Router;
+//# sourceMappingURL=exports.d.ts.map

package/dist/routes/exports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exports.d.ts","sourceRoot":"","sources":["../../src/routes/exports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AAoCjC,wBAAgB,kBAAkB,IAAI,MAAM,CAqD3C"}

package/dist/routes/exports.js

@@ -0,0 +1,98 @@
+/**
+ * Data export API routes.
+ *
+ * Provides admin endpoints for exporting entity data in CSV or JSON format.
+ * Exports exclude sensitive data (passwords, secrets, keys).
+ *
+ * Route structure:
+ *   GET /api/admin/export/:entityType  — Export entity data
+ *
+ * Query parameters:
+ *   format: 'json' | 'csv' (default: json)
+ *   organizationId: UUID (required for users, clients, audit)
+ *   applicationId: UUID (required for roles)
+ *   startDate: ISO date (audit only)
+ *   endDate: ISO date (audit only)
+ *
+ * @see 07-import-export-invitations.md
+ */
+import Router from '@koa/router';
+import { z } from 'zod';
+import { requireAdminAuth } from '../middleware/admin-auth.js';
+import { requirePermission } from '../middleware/require-permission.js';
+import { ADMIN_PERMISSIONS } from '../lib/admin-permissions.js';
+import { exportData, ExportOperationError } from '../lib/data-export.js';
+// ---------------------------------------------------------------------------
+// Validation
+// ---------------------------------------------------------------------------
+const exportEntitySchema = z.enum(['users', 'organizations', 'clients', 'roles', 'audit']);
+const exportQuerySchema = z
+    .object({
+    format: z.enum(['json', 'csv']).default('json'),
+    organizationId: z.string().uuid().optional(),
+    applicationId: z.string().uuid().optional(),
+    startDate: z.string().datetime().optional(),
+    endDate: z.string().datetime().optional(),
+})
+    .strict();
+const ENTITY_PERMISSIONS = {
+    users: ADMIN_PERMISSIONS.USER_READ,
+    organizations: ADMIN_PERMISSIONS.ORG_READ,
+    clients: ADMIN_PERMISSIONS.CLIENT_READ,
+    roles: ADMIN_PERMISSIONS.ROLE_READ,
+    audit: ADMIN_PERMISSIONS.AUDIT_READ,
+};
+// ---------------------------------------------------------------------------
+// Router factory
+// ---------------------------------------------------------------------------
+export function createExportRouter() {
+    const router = new Router({ prefix: '/api/admin/export' });
+    router.use(requireAdminAuth());
+    // -------------------------------------------------------------------------
+    // GET /:entityType — Export data
+    // -------------------------------------------------------------------------
+    router.get('/:entityType', requirePermission(ADMIN_PERMISSIONS.EXPORT_READ), async (ctx) => {
+        const entityResult = exportEntitySchema.safeParse(ctx.params.entityType);
+        if (!entityResult.success) {
+            ctx.status = 400;
+            ctx.body = { error: 'Export request is invalid', code: 'export_entity_invalid' };
+            return;
+        }
+        const entityType = entityResult.data;
+        const permission = ENTITY_PERMISSIONS[entityType];
+        const permMiddleware = requirePermission(permission);
+        await permMiddleware(ctx, async () => {
+            try {
+                const query = exportQuerySchema.parse(ctx.query);
+                const result = await exportData({
+                    entityType,
+                    format: query.format,
+                    organizationId: query.organizationId,
+                    applicationId: query.applicationId,
+                    startDate: query.startDate ? new Date(query.startDate) : undefined,
+                    endDate: query.endDate ? new Date(query.endDate) : undefined,
+                    actorId: ctx.state.adminUser?.id,
+                });
+                ctx.set('Content-Disposition', `attachment; filename="${result.filename}"`);
+                ctx.type = result.contentType;
+                ctx.body = result.data;
+            }
+            catch (error) {
+                if (error instanceof z.ZodError) {
+                    ctx.status = 400;
+                    ctx.body = { error: 'Export request is invalid', code: 'export_request_invalid' };
+                    return;
+                }
+                if (error instanceof ExportOperationError) {
+                    ctx.status = error.status;
+                    ctx.body = { error: 'Export request could not be completed', code: error.code };
+                    return;
+                }
+                ctx.status = 503;
+                ctx.body = { error: 'Export request could not be completed', code: 'export_failed' };
+            }
+        });
+    });
+    return router;
+}
+//# sourceMappingURL=exports.js.map

package/dist/routes/exports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exports.js","sourceRoot":"","sources":["../../src/routes/exports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAGzE,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAE3F,MAAM,iBAAiB,GAAG,CAAC;KACxB,MAAM,CAAC;IACN,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC/C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC5C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC3C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC3C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC1C,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,kBAAkB,GAA2B;IACjD,KAAK,EAAE,iBAAiB,CAAC,SAAS;IAClC,aAAa,EAAE,iBAAiB,CAAC,QAAQ;IACzC,OAAO,EAAE,iBAAiB,CAAC,WAAW;IACtC,KAAK,EAAE,iBAAiB,CAAC,SAAS;IAClC,KAAK,EAAE,iBAAiB,CAAC,UAAU;CACpC,CAAC;AAEF,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,MAAM,UAAU,kBAAkB;IAChC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAE3D,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAE/B,4EAA4E;IAC5E,iCAAiC;IACjC,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACzF,MAAM,YAAY,GAAG,kBAAkB,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACzE,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;YAC1B,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,2BAA2B,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC;YACjF,OAAO;QACT,CAAC;QACD,MAAM,UAAU,GAAqB,YAAY,CAAC,IAAI,CAAC;QACvD,MAAM,UAAU,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAElD,MAAM,cAAc,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;QACrD,MAAM,cAAc,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE;YACnC,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBACjD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC;oBAC9B,UAAU;oBACV,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,cAAc,EAAE,KAAK,CAAC,cAAc;oBACpC,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS;oBAClE,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;oBAC5D,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE;iBACjC,CAAC,CAAC;gBAEH,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,yBAAyB,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC;gBAC5E,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC;gBAC9B,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;YACzB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;oBAChC,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;oBACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,2BAA2B,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC;oBAClF,OAAO;gBACT,CAAC;gBACD,IAAI,KAAK,YAAY,oBAAoB,EAAE,CAAC;oBAC1C,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;oBAC1B,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,uCAAuC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;oBAChF,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;gBACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,uCAAuC,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;YACvF,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/routes/imports.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Data import API routes.
+ *
+ * Provides admin endpoint for importing configuration from a JSON manifest.
+ * Supports three modes: merge (skip existing), overwrite, and dry-run.
+ *
+ * Route structure:
+ *   POST /api/admin/import  — Import configuration manifest
+ *
+ * @see 07-import-export-invitation.md
+ */
+import Router from '@koa/router';
+/**
+ * Create the import router for configuration import.
+ * @returns Configured Koa router
+ */
+export declare function createImportRouter(): Router;
+//# sourceMappingURL=imports.d.ts.map

package/dist/routes/imports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"imports.d.ts","sourceRoot":"","sources":["../../src/routes/imports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AAuBjC;;;GAGG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAwC3C"}

package/dist/routes/imports.js

@@ -0,0 +1,72 @@
+/**
+ * Data import API routes.
+ *
+ * Provides admin endpoint for importing configuration from a JSON manifest.
+ * Supports three modes: merge (skip existing), overwrite, and dry-run.
+ *
+ * Route structure:
+ *   POST /api/admin/import  — Import configuration manifest
+ *
+ * @see 07-import-export-invitation.md
+ */
+import Router from '@koa/router';
+import { z } from 'zod';
+import { requireAdminAuth } from '../middleware/admin-auth.js';
+import { requirePermission } from '../middleware/require-permission.js';
+import { ADMIN_PERMISSIONS } from '../lib/admin-permissions.js';
+import { importData, importManifestSchema, ImportOperationError } from '../lib/data-import.js';
+// ---------------------------------------------------------------------------
+// Validation
+// ---------------------------------------------------------------------------
+const importRequestSchema = z
+    .object({
+    mode: z.enum(['merge', 'overwrite', 'dry-run']).default('dry-run'),
+    organizationId: z.string().uuid().optional(),
+    manifest: importManifestSchema,
+})
+    .strict();
+// ---------------------------------------------------------------------------
+// Router factory
+// ---------------------------------------------------------------------------
+/**
+ * Create the import router for configuration import.
+ * @returns Configured Koa router
+ */
+export function createImportRouter() {
+    const router = new Router({ prefix: '/api/admin/import' });
+    router.use(requireAdminAuth());
+    // -------------------------------------------------------------------------
+    // POST / — Import configuration
+    // -------------------------------------------------------------------------
+    router.post('/', requirePermission(ADMIN_PERMISSIONS.IMPORT_WRITE), async (ctx) => {
+        try {
+            const body = importRequestSchema.parse(ctx.request.body);
+            const actorId = ctx.state.adminUser?.id;
+            const result = await importData(body.manifest, body.mode, actorId, body.organizationId);
+            ctx.body = result;
+        }
+        catch (err) {
+            if (err instanceof z.ZodError) {
+                ctx.status = 400;
+                ctx.body = { error: 'Import manifest is invalid', code: 'import_manifest_invalid' };
+                return;
+            }
+            if (err instanceof ImportOperationError) {
+                ctx.status = err.status;
+                ctx.body = {
+                    error: 'Import request could not be completed',
+                    code: err.code,
+                    correlationId: err.correlationId,
+                };
+                return;
+            }
+            ctx.status = 503;
+            ctx.body = {
+                error: 'Import request could not be completed',
+                code: 'import_execution_failed',
+            };
+        }
+    });
+    return router;
+}
+//# sourceMappingURL=imports.js.map

package/dist/routes/imports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"imports.js","sourceRoot":"","sources":["../../src/routes/imports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAE/F,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E,MAAM,mBAAmB,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAClE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC5C,QAAQ,EAAE,oBAAoB;CAC/B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAE3D,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAE/B,4EAA4E;IAC5E,gCAAgC;IAChC,4EAA4E;IAC5E,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAChF,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACzD,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC;YAExC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;YAExF,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;gBAC9B,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;gBACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,4BAA4B,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC;gBACpF,OAAO;YACT,CAAC;YACD,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;gBACxC,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;gBACxB,GAAG,CAAC,IAAI,GAAG;oBACT,KAAK,EAAE,uCAAuC;oBAC9C,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,aAAa,EAAE,GAAG,CAAC,aAAa;iBACjC,CAAC;gBACF,OAAO;YACT,CAAC;YACD,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG;gBACT,KAAK,EAAE,uCAAuC;gBAC9C,IAAI,EAAE,yBAAyB;aAChC,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}