@portaidentity/server 1.7.0

package/dist/routes/organizations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizations.js","sourceRoot":"","sources":["../../src/routes/organizations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,mBAAmB,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,yBAAyB,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAC;AACpG,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;AAEhD;;;;GAIG;AACH,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAEpE,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC3C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACnD,mBAAmB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IACzD,QAAQ,EAAE,CAAC;SACR,MAAM,CAAC;QACN,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;QAC/C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;QAClD,YAAY,EAAE,CAAC;aACZ,MAAM,EAAE;aACR,KAAK,CAAC,mBAAmB,CAAC;aAC1B,QAAQ,EAAE;aACV,QAAQ,EAAE;QACb,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;QACtD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;KACvD,CAAC;SACD,QAAQ,EAAE;CACd,CAAC,CAAC;AAEH,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC3C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACnD,mBAAmB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IACzD,QAAQ,EAAE,CAAC;SACR,MAAM,CAAC;QACN,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;QAC/C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;QAClD,YAAY,EAAE,CAAC;aACZ,MAAM,EAAE;aACR,KAAK,CAAC,mBAAmB,CAAC;aAC1B,QAAQ,EAAE;aACV,QAAQ,EAAE;QACb,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;QACtD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;KACvD,CAAC;SACD,QAAQ,EAAE;CACd,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC/C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAClD,YAAY,EAAE,CAAC;SACZ,MAAM,EAAE;SACR,KAAK,CAAC,mBAAmB,CAAC;SAC1B,QAAQ,EAAE;SACV,QAAQ,EAAE;IACb,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACtD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACvD,CAAC,CAAC;AAEH,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/C,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC7D,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC9D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACtC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IAC5D,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;CACnD,CAAC,CAAC;AAEH,0DAA0D;AAC1D,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1D,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC9D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACtC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IAC5D,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;CACnD,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACxB,CAAC,CAAC;AAEH,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,WAAW,CAClB,GAAqF,EACrF,GAAY;IAEZ,IAAI,GAAG,YAAY,yBAAyB,EAAE,CAAC;QAC7C,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,GAAG,YAAY,2BAA2B,EAAE,CAAC;QAC/C,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,iCAAiC,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,GAAG,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC9B,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC;QACxD,OAAO,SAAkB,CAAC;IAC5B,CAAC;IACD,MAAM,GAAG,CAAC;AACZ,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,wBAAwB;IACtC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC,CAAC;IAElE,0CAA0C;IAC1C,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAE/B,4EAA4E;IAC5E,+BAA+B;IAC/B,4EAA4E;IAC5E,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC9E,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,wBAAwB,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC9D,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;YAC/D,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,yCAAyC;IACzC,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC3E,IAAI,CAAC;YACH,oEAAoE;YACpE,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBACpE,MAAM,KAAK,GAAG,6BAA6B,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBAC7D,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;gBACxE,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC;gBAClB,OAAO;YACT,CAAC;YACD,yDAAyD;YACzD,MAAM,KAAK,GAAG,uBAAuB,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACvD,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAClE,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,kDAAkD;IAClD,wEAAwE;IACxE,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACxF,IAAI,CAAC;YACH,MAAM,EAAE,IAAI,EAAE,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACrD,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC;YACxE,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,oCAAoC;IACpC,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC9E,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,4EAA4E;QAC5E,MAAM,MAAM,GAAG,iEAAiE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7F,MAAM,GAAG,GAAG,MAAM;YAChB,CAAC,CAAC,MAAM,mBAAmB,CAAC,mBAAmB,CAAC,KAAK,CAAC;YACtD,CAAC,CAAC,MAAM,mBAAmB,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAC3D,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAC;YACzC,OAAO,CAAC,yCAAyC;QACnD,CAAC;QACD,aAAa,CAAC,GAAG,EAAE,cAAc,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QAC1D,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,iCAAiC;IACjC,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAChF,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,wBAAwB,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC9D,6EAA6E;YAC7E,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC7E,IAAI,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC;gBACvF,OAAO;YACT,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YAC9E,aAAa,CAAC,GAAG,EAAE,cAAc,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;YAC1D,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,sCAAsC;IACtC,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACzF,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC1D,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,0BAA0B,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACtF,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,2CAA2C;IAC3C,4EAA4E;IAC5E,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC1F,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAuC,CAAC;YACjE,MAAM,mBAAmB,CAAC,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YAC3E,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,6CAA6C;IAC7C,4EAA4E;IAC5E,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC3F,IAAI,CAAC;YACH,MAAM,mBAAmB,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC9D,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,2CAA2C;IAC3C,4EAA4E;IAC5E,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC1F,IAAI,CAAC;YACH,MAAM,mBAAmB,CAAC,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC7D,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,iDAAiD;IACjD,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACtF,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC,KAA+B,CAAC;QACzE,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE;YACnE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;YAC9C,KAAK,EAAE,KAAK,IAAI,SAAS;YACzB,eAAe,EAAE,UAAU,IAAI,SAAS;SACzC,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,2CAA2C;IAC3C,4EAA4E;IAC5E,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC1F,IAAI,CAAC;YACH,MAAM,mBAAmB,CAAC,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC7D,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,iEAAiE;IACjE,4EAA4E;IAC5E,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC1F,IAAI,CAAC;YACH,MAAM,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;YAChC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,MAAM,CAAC;YAE/C,IAAI,MAAM,EAAE,CAAC;gBACX,yDAAyD;gBACzD,MAAM,GAAG,GACP,CAAC,MAAM,mBAAmB,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;oBACzD,CAAC,MAAM,mBAAmB,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAC9D,IAAI,CAAC,GAAG,EAAE,CAAC;oBACT,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,2BAA2B,QAAQ,EAAE,CAAC,CAAC;oBACtD,OAAO;gBACT,CAAC;gBACD,IAAI,GAAG,CAAC,YAAY,EAAE,CAAC;oBACrB,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,6CAA6C,CAAC,CAAC;oBAC9D,OAAO;gBACT,CAAC;gBACD,MAAM,aAAa,GAAG,MAAM,mBAAmB,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACzE,GAAG,CAAC,IAAI,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC;gBAC9D,OAAO;YACT,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,mBAAmB,CAC1D,QAAQ,EACR,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,CACxB,CAAC;YACF,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/routes/password-reset.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Password reset route handlers.
+ *
+ * Handles the forgot-password and reset-password flows:
+ *   - Forgot password: user submits email, receives reset link
+ *   - Reset password: user clicks reset link, sets new password
+ *
+ * Route structure:
+ *   GET  /:orgSlug/auth/forgot-password          → showForgotPassword
+ *   POST /:orgSlug/auth/forgot-password          → processForgotPassword
+ *   GET  /:orgSlug/auth/reset-password/:token    → showResetPassword
+ *   POST /:orgSlug/auth/reset-password/:token    → processResetPassword
+ *
+ * Security features:
+ *   - User enumeration prevention (always shows "check your email")
+ *   - Rate limiting on forgot-password requests
+ *   - CSRF protection on all POST endpoints
+ *   - Token single-use (marked as used after password reset)
+ *   - Password validation (NIST SP 800-63B compliant)
+ *   - Audit logging for all password reset events
+ */
+import Router from '@koa/router';
+import { generateCsrfToken, verifyCsrfToken, setCsrfCookie, getCsrfFromCookie } from '../auth/csrf.js';
+import { checkRateLimit, buildPasswordResetRateLimitKey, loadPasswordResetRateLimitConfig } from '../auth/rate-limiter.js';
+import { enqueueAccountRecovery } from '../auth/recovery-service.js';
+import { resolveLocale, getTranslationFunction } from '../auth/i18n.js';
+import { renderPage } from '../auth/template-engine.js';
+import { writeAuditLog } from '../lib/audit-log.js';
+/** Injectable boundaries used by the public recovery-request handlers. */
+export interface RecoveryRequestRouteDependencies {
+    /** Read the request CSRF cookie. */
+    readonly getCsrfFromCookie: typeof getCsrfFromCookie;
+    /** Verify the submitted CSRF value. */
+    readonly verifyCsrfToken: typeof verifyCsrfToken;
+    /** Generate a response CSRF value. */
+    readonly generateCsrfToken: typeof generateCsrfToken;
+    /** Set the response CSRF cookie. */
+    readonly setCsrfCookie: typeof setCsrfCookie;
+    /** Build the tenant/address reset-rate key. */
+    readonly buildPasswordResetRateLimitKey: typeof buildPasswordResetRateLimitKey;
+    /** Load the configured password-reset limit. */
+    readonly loadPasswordResetRateLimitConfig: typeof loadPasswordResetRateLimitConfig;
+    /** Apply one admitted rate-limit operation. */
+    readonly checkRateLimit: typeof checkRateLimit;
+    /** Resolve a locale without exposing identity state. */
+    readonly resolveLocale: typeof resolveLocale;
+    /** Resolve the page translation function. */
+    readonly getTranslationFunction: typeof getTranslationFunction;
+    /** Render one public HTML response. */
+    readonly renderPage: typeof renderPage;
+    /** Durably enqueue account-independent recovery work. */
+    readonly enqueueAccountRecovery: typeof enqueueAccountRecovery;
+    /** Write a privacy-safe audit event. */
+    readonly writeAuditLog: typeof writeAuditLog;
+}
+/**
+ * Create the password reset auth router.
+ *
+ * Handles forgot-password and reset-password flows at
+ * /:orgSlug/auth/forgot-password and /:orgSlug/auth/reset-password/:token.
+ *
+ * @returns Koa router with password reset routes
+ */
+export declare function createPasswordResetRouter(recoveryDependencies?: RecoveryRequestRouteDependencies): Router;
+//# sourceMappingURL=password-reset.d.ts.map

package/dist/routes/password-reset.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-reset.d.ts","sourceRoot":"","sources":["../../src/routes/password-reset.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,iBAAiB,EAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,cAAc,EACd,8BAA8B,EAC9B,gCAAgC,EACjC,MAAM,yBAAyB,CAAC;AAIjC,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAIxD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAkBpD,0EAA0E;AAC1E,MAAM,WAAW,gCAAgC;IAC/C,oCAAoC;IACpC,QAAQ,CAAC,iBAAiB,EAAE,OAAO,iBAAiB,CAAC;IACrD,uCAAuC;IACvC,QAAQ,CAAC,eAAe,EAAE,OAAO,eAAe,CAAC;IACjD,sCAAsC;IACtC,QAAQ,CAAC,iBAAiB,EAAE,OAAO,iBAAiB,CAAC;IACrD,oCAAoC;IACpC,QAAQ,CAAC,aAAa,EAAE,OAAO,aAAa,CAAC;IAC7C,+CAA+C;IAC/C,QAAQ,CAAC,8BAA8B,EAAE,OAAO,8BAA8B,CAAC;IAC/E,gDAAgD;IAChD,QAAQ,CAAC,gCAAgC,EAAE,OAAO,gCAAgC,CAAC;IACnF,+CAA+C;IAC/C,QAAQ,CAAC,cAAc,EAAE,OAAO,cAAc,CAAC;IAC/C,wDAAwD;IACxD,QAAQ,CAAC,aAAa,EAAE,OAAO,aAAa,CAAC;IAC7C,6CAA6C;IAC7C,QAAQ,CAAC,sBAAsB,EAAE,OAAO,sBAAsB,CAAC;IAC/D,uCAAuC;IACvC,QAAQ,CAAC,UAAU,EAAE,OAAO,UAAU,CAAC;IACvC,yDAAyD;IACzD,QAAQ,CAAC,sBAAsB,EAAE,OAAO,sBAAsB,CAAC;IAC/D,wCAAwC;IACxC,QAAQ,CAAC,aAAa,EAAE,OAAO,aAAa,CAAC;CAC9C;AA8DD;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CACvC,oBAAoB,GAAE,gCAAqE,GAC1F,MAAM,CAyBR"}

package/dist/routes/password-reset.js

@@ -0,0 +1,493 @@
+/**
+ * Password reset route handlers.
+ *
+ * Handles the forgot-password and reset-password flows:
+ *   - Forgot password: user submits email, receives reset link
+ *   - Reset password: user clicks reset link, sets new password
+ *
+ * Route structure:
+ *   GET  /:orgSlug/auth/forgot-password          → showForgotPassword
+ *   POST /:orgSlug/auth/forgot-password          → processForgotPassword
+ *   GET  /:orgSlug/auth/reset-password/:token    → showResetPassword
+ *   POST /:orgSlug/auth/reset-password/:token    → processResetPassword
+ *
+ * Security features:
+ *   - User enumeration prevention (always shows "check your email")
+ *   - Rate limiting on forgot-password requests
+ *   - CSRF protection on all POST endpoints
+ *   - Token single-use (marked as used after password reset)
+ *   - Password validation (NIST SP 800-63B compliant)
+ *   - Audit logging for all password reset events
+ */
+import Router from '@koa/router';
+import { generateCsrfToken, verifyCsrfToken, setCsrfCookie, getCsrfFromCookie, } from '../auth/csrf.js';
+import { checkRateLimit, buildPasswordResetRateLimitKey, loadPasswordResetRateLimitConfig, } from '../auth/rate-limiter.js';
+import { hashToken } from '../auth/tokens.js';
+import { findValidTokenForOrganization, markTokenUsed } from '../auth/token-repository.js';
+import { sendPasswordChangedEmail } from '../auth/email-service.js';
+import { enqueueAccountRecovery } from '../auth/recovery-service.js';
+import { resolveLocale, getTranslationFunction } from '../auth/i18n.js';
+import { renderPage } from '../auth/template-engine.js';
+import { getUserById, setUserPassword } from '../users/service.js';
+import { validatePassword } from '../users/password.js';
+import { writeAuditLog } from '../lib/audit-log.js';
+import { logger } from '../lib/logger.js';
+import { tenantResolver } from '../middleware/tenant-resolver.js';
+import { resolveLoginMethods } from '../clients/resolve-login-methods.js';
+const defaultRecoveryRequestDependencies = {
+    getCsrfFromCookie,
+    verifyCsrfToken,
+    generateCsrfToken,
+    setCsrfCookie,
+    buildPasswordResetRateLimitKey,
+    loadPasswordResetRateLimitConfig,
+    checkRateLimit,
+    resolveLocale,
+    getTranslationFunction,
+    renderPage,
+    enqueueAccountRecovery,
+    writeAuditLog,
+};
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+/**
+ * Build branding context from organization data.
+ *
+ * @param org - Organization with branding fields
+ * @returns Branding context for templates
+ */
+function buildBrandingFromOrg(org) {
+    return {
+        logoUrl: org.brandingLogoUrl,
+        faviconUrl: org.brandingFaviconUrl,
+        primaryColor: org.brandingPrimaryColor ?? '#3B82F6',
+        companyName: org.brandingCompanyName ?? org.name,
+        customCss: org.brandingCustomCss,
+    };
+}
+/**
+ * Render an HTML page and send it as the response.
+ *
+ * @param ctx - Koa context
+ * @param pageName - Page template name
+ * @param context - Full template context
+ * @param statusCode - HTTP status code (default: 200)
+ */
+async function renderAndRespond(ctx, pageName, context, statusCode = 200, renderer = renderPage) {
+    const html = await renderer(pageName, context);
+    ctx.status = statusCode;
+    ctx.type = 'text/html';
+    ctx.body = html;
+}
+// ---------------------------------------------------------------------------
+// Router factory
+// ---------------------------------------------------------------------------
+/**
+ * Create the password reset auth router.
+ *
+ * Handles forgot-password and reset-password flows at
+ * /:orgSlug/auth/forgot-password and /:orgSlug/auth/reset-password/:token.
+ *
+ * @returns Koa router with password reset routes
+ */
+export function createPasswordResetRouter(recoveryDependencies = defaultRecoveryRequestDependencies) {
+    const router = new Router();
+    const resolve = tenantResolver();
+    // GET /:orgSlug/auth/forgot-password — Show forgot password form
+    router.get('/:orgSlug/auth/forgot-password', resolve, async (ctx) => {
+        await showForgotPassword(ctx, recoveryDependencies);
+    });
+    // POST /:orgSlug/auth/forgot-password — Process forgot password request
+    router.post('/:orgSlug/auth/forgot-password', resolve, async (ctx) => {
+        await processForgotPassword(ctx, recoveryDependencies);
+    });
+    // GET /:orgSlug/auth/reset-password/:token — Show reset password form
+    router.get('/:orgSlug/auth/reset-password/:token', resolve, async (ctx) => {
+        await showResetPassword(ctx);
+    });
+    // POST /:orgSlug/auth/reset-password/:token — Process password reset
+    router.post('/:orgSlug/auth/reset-password/:token', resolve, async (ctx) => {
+        await processResetPassword(ctx);
+    });
+    return router;
+}
+// ---------------------------------------------------------------------------
+// Route handlers
+// ---------------------------------------------------------------------------
+/**
+ * Enforce that the organization default supports password login.
+ *
+ * The forgot-password / reset-password flows belong exclusively to the
+ * password login method. Offering them when the org has disabled password
+ * login entirely would be confusing (resetting a password that can't be
+ * used) and would leak that password auth is structurally possible.
+ *
+ * This check is org-level only, not client-level: the password-reset routes
+ * don't carry an interaction UID or client_id, so we have no way to scope
+ * the check to a specific client. Org-level enforcement is the right layer
+ * for "is password auth possible anywhere in this tenant?".
+ *
+ * Uses {@link resolveLoginMethods} with `loginMethods: null` so the resolver
+ * returns the org's `defaultLoginMethods` verbatim.
+ *
+ * @param ctx - Koa context with organization state
+ * @param t - Translation function for the error page
+ * @param locale - Resolved locale
+ * @returns `true` when password is allowed and the caller should proceed;
+ *          `false` when the caller must return immediately (the error page
+ *          has already been rendered).
+ */
+async function enforcePasswordMethod(ctx, t, locale, dependencies = defaultRecoveryRequestDependencies) {
+    const org = ctx.state.organization;
+    const effective = resolveLoginMethods(org, { loginMethods: null });
+    if (effective.includes('password'))
+        return true;
+    dependencies.writeAuditLog({
+        organizationId: org.id,
+        eventType: 'security.login_method_disabled',
+        eventCategory: 'security',
+        description: `Password-reset route accessed on org where password method is disabled (${ctx.path})`,
+        ipAddress: ctx.ip,
+        metadata: {
+            route: ctx.path,
+            attemptedMethod: 'password',
+            effectiveMethods: effective,
+        },
+    });
+    await renderErrorPageForAuth(ctx, org, locale, t, t('errors.login_method_disabled'));
+    return false;
+}
+/**
+ * Show the forgot-password form.
+ *
+ * Renders the forgot-password page with a CSRF token for form protection.
+ *
+ * @param ctx - Koa context with organization state
+ */
+async function showForgotPassword(ctx, dependencies) {
+    const org = ctx.state.organization;
+    const locale = await dependencies.resolveLocale(undefined, ctx.get('Accept-Language') || undefined, org.defaultLocale);
+    const t = dependencies.getTranslationFunction(locale, org.slug);
+    // Block the entire forgot-password UI when password auth is org-disabled.
+    if (!(await enforcePasswordMethod(ctx, t, locale, dependencies)))
+        return;
+    const csrfToken = dependencies.generateCsrfToken();
+    dependencies.setCsrfCookie(ctx, csrfToken);
+    const context = {
+        branding: buildBrandingFromOrg(org),
+        locale,
+        t,
+        csrfToken,
+        orgSlug: org.slug,
+    };
+    await renderAndRespond(ctx, 'forgot-password', context, 200, dependencies.renderPage);
+}
+/**
+ * Process a forgot-password form submission.
+ *
+ * Always shows the "check your email" confirmation page regardless of
+ * whether the email exists — this prevents user enumeration attacks.
+ * Account lookup and delivery happen asynchronously after the request is durably admitted.
+ *
+ * 1. Verify CSRF token
+ * 2. Extract email from form body
+ * 3. Check rate limit (per email)
+ * 4. Always show "check your email" page
+ * 5. Durably enqueue identical account-independent work
+ *
+ * @param ctx - Koa context with organization state
+ */
+async function processForgotPassword(ctx, dependencies) {
+    const org = ctx.state.organization;
+    const body = ctx.request.body;
+    const email = (body.email ?? '').trim().toLowerCase();
+    const submittedCsrf = body._csrf ?? '';
+    const storedCsrf = dependencies.getCsrfFromCookie(ctx) ?? '';
+    const locale = await dependencies.resolveLocale(undefined, ctx.get('Accept-Language') || undefined, org.defaultLocale);
+    const t = dependencies.getTranslationFunction(locale, org.slug);
+    // Enforce password method BEFORE CSRF to avoid revealing whether the
+    // endpoint is active based on CSRF errors vs. method errors.
+    if (!(await enforcePasswordMethod(ctx, t, locale, dependencies)))
+        return;
+    // Step 1: Verify CSRF token (cookie vs form field)
+    if (!dependencies.verifyCsrfToken(storedCsrf, submittedCsrf)) {
+        logger.warn('CSRF token mismatch on forgot-password');
+        const csrfToken = dependencies.generateCsrfToken();
+        dependencies.setCsrfCookie(ctx, csrfToken);
+        const context = {
+            branding: buildBrandingFromOrg(org),
+            locale,
+            t,
+            csrfToken,
+            orgSlug: org.slug,
+            flash: { error: t('errors.csrf_invalid') },
+        };
+        await renderAndRespond(ctx, 'forgot-password', context, 403, dependencies.renderPage);
+        return;
+    }
+    // Step 2: Check rate limit
+    const rateLimitKey = dependencies.buildPasswordResetRateLimitKey(org.id, email);
+    const rateLimitConfig = await dependencies.loadPasswordResetRateLimitConfig();
+    const rateLimitResult = await dependencies.checkRateLimit(rateLimitKey, rateLimitConfig);
+    if (!rateLimitResult.allowed) {
+        ctx.set('Retry-After', String(rateLimitResult.retryAfter));
+        dependencies.writeAuditLog({
+            organizationId: org.id,
+            eventType: 'rate_limit.password_reset',
+            eventCategory: 'security',
+            description: 'Password reset rate limit exceeded',
+            ipAddress: ctx.ip,
+        });
+        const csrfToken = dependencies.generateCsrfToken();
+        dependencies.setCsrfCookie(ctx, csrfToken);
+        const context = {
+            branding: buildBrandingFromOrg(org),
+            locale,
+            t,
+            csrfToken,
+            orgSlug: org.slug,
+            flash: { error: t('errors.rate_limit_exceeded') },
+        };
+        await renderAndRespond(ctx, 'forgot-password', context, 429, dependencies.renderPage);
+        return;
+    }
+    try {
+        await dependencies.enqueueAccountRecovery({
+            jobType: 'password_reset',
+            organizationId: org.id,
+            email,
+            interactionUid: null,
+            actionNonce: submittedCsrf,
+        });
+    }
+    catch {
+        logger.error({ event: 'password_reset_enqueue_failed' }, 'Failed to enqueue password reset');
+        const csrfToken = dependencies.generateCsrfToken();
+        dependencies.setCsrfCookie(ctx, csrfToken);
+        await renderAndRespond(ctx, 'forgot-password', {
+            branding: buildBrandingFromOrg(org),
+            locale,
+            t,
+            csrfToken,
+            orgSlug: org.slug,
+            flash: { error: t('errors.interaction_expired') },
+        }, 503, dependencies.renderPage);
+        return;
+    }
+    // Step 4: Always show "check your email" page — prevents user enumeration
+    const csrfToken = dependencies.generateCsrfToken();
+    dependencies.setCsrfCookie(ctx, csrfToken);
+    const context = {
+        branding: buildBrandingFromOrg(org),
+        locale,
+        t,
+        csrfToken,
+        orgSlug: org.slug,
+        email,
+        flash: { success: t('forgot-password.check_email') },
+    };
+    await renderAndRespond(ctx, 'forgot-password', context, 200, dependencies.renderPage);
+}
+/**
+ * Show the reset-password form.
+ *
+ * Validates the token before showing the form. If the token is invalid
+ * or expired, renders an error page instead.
+ *
+ * @param ctx - Koa context with organization state
+ */
+async function showResetPassword(ctx) {
+    const org = ctx.state.organization;
+    const tokenPlaintext = ctx.params.token;
+    const locale = await resolveLocale(undefined, ctx.get('Accept-Language') || undefined, org.defaultLocale);
+    const t = getTranslationFunction(locale, org.slug);
+    if (!(await enforcePasswordMethod(ctx, t, locale)))
+        return;
+    // Validate the token
+    const tokenHash = hashToken(tokenPlaintext);
+    const tokenRecord = await findValidTokenForOrganization('password_reset_tokens', tokenHash, org.id);
+    if (!tokenRecord) {
+        writeAuditLog({
+            organizationId: org.id,
+            eventType: 'user.password_reset.failed',
+            eventCategory: 'security',
+            description: 'Password reset failed: invalid or expired token',
+            ipAddress: ctx.ip,
+        });
+        await renderErrorPageForAuth(ctx, org, locale, t, t('errors.reset_link_expired'));
+        return;
+    }
+    // Token is valid — show the reset password form
+    const csrfToken = generateCsrfToken();
+    setCsrfCookie(ctx, csrfToken);
+    const context = {
+        branding: buildBrandingFromOrg(org),
+        locale,
+        t,
+        csrfToken,
+        orgSlug: org.slug,
+        token: tokenPlaintext,
+    };
+    await renderAndRespond(ctx, 'reset-password', context);
+}
+/**
+ * Process a password reset form submission.
+ *
+ * 1. Verify CSRF token
+ * 2. Re-validate the reset token (may have expired since form was shown)
+ * 3. Validate the new password (NIST SP 800-63B length checks)
+ * 4. Set the new password via user service
+ * 5. Mark the token as used
+ * 6. Send password-changed confirmation email
+ * 7. Audit log the completion
+ * 8. Render success page
+ *
+ * @param ctx - Koa context with organization state
+ */
+async function processResetPassword(ctx) {
+    const org = ctx.state.organization;
+    const tokenPlaintext = ctx.params.token;
+    const body = ctx.request.body;
+    const password = body.password ?? '';
+    const confirmPassword = body.confirmPassword ?? '';
+    const submittedCsrf = body._csrf ?? '';
+    const storedCsrf = getCsrfFromCookie(ctx) ?? '';
+    const locale = await resolveLocale(undefined, ctx.get('Accept-Language') || undefined, org.defaultLocale);
+    const t = getTranslationFunction(locale, org.slug);
+    if (!(await enforcePasswordMethod(ctx, t, locale)))
+        return;
+    // Step 1: Verify CSRF token (cookie vs form field)
+    if (!verifyCsrfToken(storedCsrf, submittedCsrf)) {
+        logger.warn('CSRF token mismatch on reset-password');
+        await renderResetFormWithError(ctx, org, locale, t, tokenPlaintext, t('errors.csrf_invalid'), 403);
+        return;
+    }
+    // Step 2: Re-validate the token
+    const tokenHash = hashToken(tokenPlaintext);
+    const tokenRecord = await findValidTokenForOrganization('password_reset_tokens', tokenHash, org.id);
+    if (!tokenRecord) {
+        writeAuditLog({
+            organizationId: org.id,
+            eventType: 'user.password_reset.failed',
+            eventCategory: 'security',
+            description: 'Password reset failed: token expired during submission',
+            ipAddress: ctx.ip,
+        });
+        await renderErrorPageForAuth(ctx, org, locale, t, t('errors.reset_link_expired'));
+        return;
+    }
+    // Step 3: Validate passwords match
+    if (password !== confirmPassword) {
+        await renderResetFormWithError(ctx, org, locale, t, tokenPlaintext, t('reset-password.error_mismatch'));
+        return;
+    }
+    // Step 4: Validate password strength (NIST SP 800-63B)
+    const validation = validatePassword(password);
+    if (!validation.isValid) {
+        await renderResetFormWithError(ctx, org, locale, t, tokenPlaintext, validation.error);
+        return;
+    }
+    try {
+        // Step 5: Set the new password
+        await setUserPassword(tokenRecord.userId, password);
+        // Step 6: Mark token as used (single-use)
+        await markTokenUsed('password_reset_tokens', tokenRecord.id);
+        // Step 7: Send password-changed confirmation email
+        const user = await getUserById(tokenRecord.userId);
+        if (user) {
+            sendPasswordChangedEmail({ id: user.id, email: user.email, givenName: user.givenName, familyName: user.familyName }, {
+                id: org.id,
+                slug: org.slug,
+                brandingLogoUrl: org.brandingLogoUrl,
+                brandingPrimaryColor: org.brandingPrimaryColor,
+                brandingCompanyName: org.brandingCompanyName,
+            }, locale);
+        }
+        // Step 8: Audit log
+        writeAuditLog({
+            organizationId: org.id,
+            userId: tokenRecord.userId,
+            eventType: 'user.password_reset.completed',
+            eventCategory: 'security',
+            description: 'Password reset completed successfully',
+            ipAddress: ctx.ip,
+        });
+        // Step 9: Render success page
+        const csrfToken = generateCsrfToken();
+        setCsrfCookie(ctx, csrfToken);
+        const context = {
+            branding: buildBrandingFromOrg(org),
+            locale,
+            t,
+            csrfToken,
+            orgSlug: org.slug,
+            flash: { success: t('reset-password.success') },
+        };
+        await renderAndRespond(ctx, 'reset-success', context);
+    }
+    catch {
+        logger.error({ event: 'password-reset-processing-failed' }, 'Password reset processing failed');
+        await renderResetFormWithError(ctx, org, locale, t, tokenPlaintext, t('errors.generic'));
+    }
+}
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+/**
+ * Render the reset password form with an error flash message.
+ *
+ * @param ctx - Koa context
+ * @param org - Organization for branding
+ * @param locale - Resolved locale
+ * @param t - Translation function
+ * @param token - Reset token (to re-embed in the form)
+ * @param errorMessage - Error message to display
+ * @param statusCode - HTTP status code (default: 200)
+ */
+async function renderResetFormWithError(ctx, org, locale, t, token, errorMessage, statusCode = 200) {
+    const csrfToken = generateCsrfToken();
+    setCsrfCookie(ctx, csrfToken);
+    const context = {
+        branding: buildBrandingFromOrg(org),
+        locale,
+        t,
+        csrfToken,
+        orgSlug: org.slug,
+        token,
+        flash: { error: errorMessage },
+    };
+    await renderAndRespond(ctx, 'reset-password', context, statusCode);
+}
+/**
+ * Render an error page for auth routes.
+ *
+ * @param ctx - Koa context
+ * @param org - Organization for branding
+ * @param locale - Resolved locale
+ * @param t - Translation function
+ * @param errorMessage - Error message to display
+ */
+async function renderErrorPageForAuth(ctx, org, locale, t, errorMessage) {
+    try {
+        const csrfToken = generateCsrfToken();
+        const context = {
+            branding: buildBrandingFromOrg(org),
+            locale,
+            t,
+            csrfToken,
+            orgSlug: org.slug,
+            errorMessage,
+        };
+        const html = await renderPage('error', context);
+        ctx.status = 400;
+        ctx.type = 'text/html';
+        ctx.body = html;
+    }
+    catch {
+        logger.error({ event: 'auth-error-render-failed' }, 'Authentication error page failed');
+        ctx.status = 500;
+        ctx.body = 'An error occurred';
+    }
+}
+//# sourceMappingURL=password-reset.js.map

package/dist/routes/password-reset.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-reset.js","sourceRoot":"","sources":["../../src/routes/password-reset.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,cAAc,EACd,8BAA8B,EAC9B,gCAAgC,GACjC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,6BAA6B,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC3F,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAExD,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AA0C1E,MAAM,kCAAkC,GAAqC;IAC3E,iBAAiB;IACjB,eAAe;IACf,iBAAiB;IACjB,aAAa;IACb,8BAA8B;IAC9B,gCAAgC;IAChC,cAAc;IACd,aAAa;IACb,sBAAsB;IACtB,UAAU;IACV,sBAAsB;IACtB,aAAa;CACd,CAAC;AAEF,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,GAAiB;IAC7C,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,eAAe;QAC5B,UAAU,EAAE,GAAG,CAAC,kBAAkB;QAClC,YAAY,EAAE,GAAG,CAAC,oBAAoB,IAAI,SAAS;QACnD,WAAW,EAAE,GAAG,CAAC,mBAAmB,IAAI,GAAG,CAAC,IAAI;QAChD,SAAS,EAAE,GAAG,CAAC,iBAAiB;KACjC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,gBAAgB,CAC7B,GAAY,EACZ,QAAgB,EAChB,OAAwB,EACxB,UAAU,GAAG,GAAG,EAChB,QAAQ,GAAsB,UAAU;IAExC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC/C,GAAG,CAAC,MAAM,GAAG,UAAU,CAAC;IACxB,GAAG,CAAC,IAAI,GAAG,WAAW,CAAC;IACvB,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;AAClB,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CACvC,oBAAoB,GAAqC,kCAAkC;IAE3F,MAAM,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IAEjC,iEAAiE;IACjE,MAAM,CAAC,GAAG,CAAC,gCAAgC,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAClE,MAAM,kBAAkB,CAAC,GAAkB,EAAE,oBAAoB,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,wEAAwE;IACxE,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACnE,MAAM,qBAAqB,CAAC,GAAkB,EAAE,oBAAoB,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,sEAAsE;IACtE,MAAM,CAAC,GAAG,CAAC,sCAAsC,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACxE,MAAM,iBAAiB,CAAC,GAAkB,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,qEAAqE;IACrE,MAAM,CAAC,IAAI,CAAC,sCAAsC,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACzE,MAAM,oBAAoB,CAAC,GAAkB,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,KAAK,UAAU,qBAAqB,CAClC,GAAgB,EAChB,CAA6D,EAC7D,MAAc,EACd,YAAY,GAAqC,kCAAkC;IAEnF,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC;IACnC,MAAM,SAAS,GAAG,mBAAmB,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;IACnE,IAAI,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAEhD,YAAY,CAAC,aAAa,CAAC;QACzB,cAAc,EAAE,GAAG,CAAC,EAAE;QACtB,SAAS,EAAE,gCAAgC;QAC3C,aAAa,EAAE,UAAU;QACzB,WAAW,EAAE,2EAA2E,GAAG,CAAC,IAAI,GAAG;QACnG,SAAS,EAAE,GAAG,CAAC,EAAE;QACjB,QAAQ,EAAE;YACR,KAAK,EAAE,GAAG,CAAC,IAAI;YACf,eAAe,EAAE,UAAU;YAC3B,gBAAgB,EAAE,SAAS;SAC5B;KACF,CAAC,CAAC;IAEH,MAAM,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC;IACrF,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,kBAAkB,CAC/B,GAAgB,EAChB,YAA8C;IAE9C,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC;IACnC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,aAAa,CAC7C,SAAS,EACT,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,SAAS,EACvC,GAAG,CAAC,aAAa,CAClB,CAAC;IACF,MAAM,CAAC,GAAG,YAAY,CAAC,sBAAsB,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAEhE,0EAA0E;IAC1E,IAAI,CAAC,CAAC,MAAM,qBAAqB,CAAC,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;QAAE,OAAO;IAEzE,MAAM,SAAS,GAAG,YAAY,CAAC,iBAAiB,EAAE,CAAC;IACnD,YAAY,CAAC,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAE3C,MAAM,OAAO,GAAoB;QAC/B,QAAQ,EAAE,oBAAoB,CAAC,GAAG,CAAC;QACnC,MAAM;QACN,CAAC;QACD,SAAS;QACT,OAAO,EAAE,GAAG,CAAC,IAAI;KAClB,CAAC;IAEF,MAAM,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,EAAE,OAAO,EAAE,GAAG,EAAE,YAAY,CAAC,UAAU,CAAC,CAAC;AACxF,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,KAAK,UAAU,qBAAqB,CAClC,GAAgB,EAChB,YAA8C;IAE9C,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC;IACnC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAA8B,CAAC;IACxD,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACtD,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;IACvC,MAAM,UAAU,GAAG,YAAY,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAE7D,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,aAAa,CAC7C,SAAS,EACT,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,SAAS,EACvC,GAAG,CAAC,aAAa,CAClB,CAAC;IACF,MAAM,CAAC,GAAG,YAAY,CAAC,sBAAsB,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAEhE,qEAAqE;IACrE,6DAA6D;IAC7D,IAAI,CAAC,CAAC,MAAM,qBAAqB,CAAC,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;QAAE,OAAO;IAEzE,mDAAmD;IACnD,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,UAAU,EAAE,aAAa,CAAC,EAAE,CAAC;QAC7D,MAAM,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;QACtD,MAAM,SAAS,GAAG,YAAY,CAAC,iBAAiB,EAAE,CAAC;QACnD,YAAY,CAAC,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAoB;YAC/B,QAAQ,EAAE,oBAAoB,CAAC,GAAG,CAAC;YACnC,MAAM;YACN,CAAC;YACD,SAAS;YACT,OAAO,EAAE,GAAG,CAAC,IAAI;YACjB,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,qBAAqB,CAAC,EAAE;SAC3C,CAAC;QACF,MAAM,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,EAAE,OAAO,EAAE,GAAG,EAAE,YAAY,CAAC,UAAU,CAAC,CAAC;QACtF,OAAO;IACT,CAAC;IAED,2BAA2B;IAC3B,MAAM,YAAY,GAAG,YAAY,CAAC,8BAA8B,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAChF,MAAM,eAAe,GAAG,MAAM,YAAY,CAAC,gCAAgC,EAAE,CAAC;IAC9E,MAAM,eAAe,GAAG,MAAM,YAAY,CAAC,cAAc,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IAEzF,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC;QAC7B,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC;QAE3D,YAAY,CAAC,aAAa,CAAC;YACzB,cAAc,EAAE,GAAG,CAAC,EAAE;YACtB,SAAS,EAAE,2BAA2B;YACtC,aAAa,EAAE,UAAU;YACzB,WAAW,EAAE,oCAAoC;YACjD,SAAS,EAAE,GAAG,CAAC,EAAE;SAClB,CAAC,CAAC;QAEH,MAAM,SAAS,GAAG,YAAY,CAAC,iBAAiB,EAAE,CAAC;QACnD,YAAY,CAAC,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAoB;YAC/B,QAAQ,EAAE,oBAAoB,CAAC,GAAG,CAAC;YACnC,MAAM;YACN,CAAC;YACD,SAAS;YACT,OAAO,EAAE,GAAG,CAAC,IAAI;YACjB,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,4BAA4B,CAAC,EAAE;SAClD,CAAC;QACF,MAAM,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,EAAE,OAAO,EAAE,GAAG,EAAE,YAAY,CAAC,UAAU,CAAC,CAAC;QACtF,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QACH,MAAM,YAAY,CAAC,sBAAsB,CAAC;YACxC,OAAO,EAAE,gBAAgB;YACzB,cAAc,EAAE,GAAG,CAAC,EAAE;YACtB,KAAK;YACL,cAAc,EAAE,IAAI;YACpB,WAAW,EAAE,aAAa;SAC3B,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE,EAAE,kCAAkC,CAAC,CAAC;QAC7F,MAAM,SAAS,GAAG,YAAY,CAAC,iBAAiB,EAAE,CAAC;QACnD,YAAY,CAAC,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC3C,MAAM,gBAAgB,CACpB,GAAG,EACH,iBAAiB,EACjB;YACE,QAAQ,EAAE,oBAAoB,CAAC,GAAG,CAAC;YACnC,MAAM;YACN,CAAC;YACD,SAAS;YACT,OAAO,EAAE,GAAG,CAAC,IAAI;YACjB,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,4BAA4B,CAAC,EAAE;SAClD,EACD,GAAG,EACH,YAAY,CAAC,UAAU,CACxB,CAAC;QACF,OAAO;IACT,CAAC;IAED,0EAA0E;IAC1E,MAAM,SAAS,GAAG,YAAY,CAAC,iBAAiB,EAAE,CAAC;IACnD,YAAY,CAAC,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAoB;QAC/B,QAAQ,EAAE,oBAAoB,CAAC,GAAG,CAAC;QACnC,MAAM;QACN,CAAC;QACD,SAAS;QACT,OAAO,EAAE,GAAG,CAAC,IAAI;QACjB,KAAK;QACL,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,6BAA6B,CAAC,EAAE;KACrD,CAAC;IAEF,MAAM,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,EAAE,OAAO,EAAE,GAAG,EAAE,YAAY,CAAC,UAAU,CAAC,CAAC;AACxF,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,iBAAiB,CAAC,GAAgB;IAC/C,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC;IACnC,MAAM,cAAc,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC;IAExC,MAAM,MAAM,GAAG,MAAM,aAAa,CAChC,SAAS,EACT,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,SAAS,EACvC,GAAG,CAAC,aAAa,CAClB,CAAC;IACF,MAAM,CAAC,GAAG,sBAAsB,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAEnD,IAAI,CAAC,CAAC,MAAM,qBAAqB,CAAC,GAAG,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;QAAE,OAAO;IAE3D,qBAAqB;IACrB,MAAM,SAAS,GAAG,SAAS,CAAC,cAAc,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAG,MAAM,6BAA6B,CACrD,uBAAuB,EACvB,SAAS,EACT,GAAG,CAAC,EAAE,CACP,CAAC;IAEF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,aAAa,CAAC;YACZ,cAAc,EAAE,GAAG,CAAC,EAAE;YACtB,SAAS,EAAE,4BAA4B;YACvC,aAAa,EAAE,UAAU;YACzB,WAAW,EAAE,iDAAiD;YAC9D,SAAS,EAAE,GAAG,CAAC,EAAE;SAClB,CAAC,CAAC;QAEH,MAAM,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC;QAClF,OAAO;IACT,CAAC;IAED,gDAAgD;IAChD,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;IACtC,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC9B,MAAM,OAAO,GAAoB;QAC/B,QAAQ,EAAE,oBAAoB,CAAC,GAAG,CAAC;QACnC,MAAM;QACN,CAAC;QACD,SAAS;QACT,OAAO,EAAE,GAAG,CAAC,IAAI;QACjB,KAAK,EAAE,cAAc;KACtB,CAAC;IAEF,MAAM,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,oBAAoB,CAAC,GAAgB;IAClD,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC;IACnC,MAAM,cAAc,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC;IACxC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAA8B,CAAC;IACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;IACrC,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC;IACnD,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;IACvC,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAEhD,MAAM,MAAM,GAAG,MAAM,aAAa,CAChC,SAAS,EACT,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,SAAS,EACvC,GAAG,CAAC,aAAa,CAClB,CAAC;IACF,MAAM,CAAC,GAAG,sBAAsB,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAEnD,IAAI,CAAC,CAAC,MAAM,qBAAqB,CAAC,GAAG,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;QAAE,OAAO;IAE3D,mDAAmD;IACnD,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,aAAa,CAAC,EAAE,CAAC;QAChD,MAAM,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;QACrD,MAAM,wBAAwB,CAC5B,GAAG,EACH,GAAG,EACH,MAAM,EACN,CAAC,EACD,cAAc,EACd,CAAC,CAAC,qBAAqB,CAAC,EACxB,GAAG,CACJ,CAAC;QACF,OAAO;IACT,CAAC;IAED,gCAAgC;IAChC,MAAM,SAAS,GAAG,SAAS,CAAC,cAAc,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAG,MAAM,6BAA6B,CACrD,uBAAuB,EACvB,SAAS,EACT,GAAG,CAAC,EAAE,CACP,CAAC;IAEF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,aAAa,CAAC;YACZ,cAAc,EAAE,GAAG,CAAC,EAAE;YACtB,SAAS,EAAE,4BAA4B;YACvC,aAAa,EAAE,UAAU;YACzB,WAAW,EAAE,wDAAwD;YACrE,SAAS,EAAE,GAAG,CAAC,EAAE;SAClB,CAAC,CAAC;QAEH,MAAM,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC;QAClF,OAAO;IACT,CAAC;IAED,mCAAmC;IACnC,IAAI,QAAQ,KAAK,eAAe,EAAE,CAAC;QACjC,MAAM,wBAAwB,CAC5B,GAAG,EACH,GAAG,EACH,MAAM,EACN,CAAC,EACD,cAAc,EACd,CAAC,CAAC,+BAA+B,CAAC,CACnC,CAAC;QACF,OAAO;IACT,CAAC;IAED,uDAAuD;IACvD,MAAM,UAAU,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QACxB,MAAM,wBAAwB,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,cAAc,EAAE,UAAU,CAAC,KAAM,CAAC,CAAC;QACvF,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QACH,+BAA+B;QAC/B,MAAM,eAAe,CAAC,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAEpD,0CAA0C;QAC1C,MAAM,aAAa,CAAC,uBAAuB,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC;QAE7D,mDAAmD;QACnD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACnD,IAAI,IAAI,EAAE,CAAC;YACT,wBAAwB,CACtB,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,EAC1F;gBACE,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,eAAe,EAAE,GAAG,CAAC,eAAe;gBACpC,oBAAoB,EAAE,GAAG,CAAC,oBAAoB;gBAC9C,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;aAC7C,EACD,MAAM,CACP,CAAC;QACJ,CAAC;QAED,oBAAoB;QACpB,aAAa,CAAC;YACZ,cAAc,EAAE,GAAG,CAAC,EAAE;YACtB,MAAM,EAAE,WAAW,CAAC,MAAM;YAC1B,SAAS,EAAE,+BAA+B;YAC1C,aAAa,EAAE,UAAU;YACzB,WAAW,EAAE,uCAAuC;YACpD,SAAS,EAAE,GAAG,CAAC,EAAE;SAClB,CAAC,CAAC;QAEH,8BAA8B;QAC9B,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;QACtC,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC9B,MAAM,OAAO,GAAoB;YAC/B,QAAQ,EAAE,oBAAoB,CAAC,GAAG,CAAC;YACnC,MAAM;YACN,CAAC;YACD,SAAS;YACT,OAAO,EAAE,GAAG,CAAC,IAAI;YACjB,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,wBAAwB,CAAC,EAAE;SAChD,CAAC;QAEF,MAAM,gBAAgB,CAAC,GAAG,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,EAAE,kCAAkC,CAAC,CAAC;QAChG,MAAM,wBAAwB,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC3F,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,KAAK,UAAU,wBAAwB,CACrC,GAAY,EACZ,GAAiB,EACjB,MAAc,EACd,CAA6D,EAC7D,KAAa,EACb,YAAoB,EACpB,UAAU,GAAG,GAAG;IAEhB,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;IACtC,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC9B,MAAM,OAAO,GAAoB;QAC/B,QAAQ,EAAE,oBAAoB,CAAC,GAAG,CAAC;QACnC,MAAM;QACN,CAAC;QACD,SAAS;QACT,OAAO,EAAE,GAAG,CAAC,IAAI;QACjB,KAAK;QACL,KAAK,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE;KAC/B,CAAC;IAEF,MAAM,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,sBAAsB,CACnC,GAAY,EACZ,GAAiB,EACjB,MAAc,EACd,CAA6D,EAC7D,YAAoB;IAEpB,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;QACtC,MAAM,OAAO,GAAoB;YAC/B,QAAQ,EAAE,oBAAoB,CAAC,GAAG,CAAC;YACnC,MAAM;YACN,CAAC;YACD,SAAS;YACT,OAAO,EAAE,GAAG,CAAC,IAAI;YACjB,YAAY;SACb,CAAC;QAEF,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAChD,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,GAAG,CAAC,IAAI,GAAG,WAAW,CAAC;QACvB,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,EAAE,kCAAkC,CAAC,CAAC;QACxF,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,GAAG,CAAC,IAAI,GAAG,mBAAmB,CAAC;IACjC,CAAC;AACH,CAAC"}

package/dist/routes/permissions.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Permission management API routes.
+ *
+ * All routes are under `/api/admin/applications/:appId/permissions` and
+ * require admin authorization with granular permissions. Provides CRUD
+ * for permissions and a query for roles that include a given permission.
+ *
+ * Route structure:
+ *   POST   /                — Create a new permission
+ *   GET    /                — List permissions (optional ?moduleId filter)
+ *   GET    /:permId         — Get a permission by ID
+ *   PUT    /:permId         — Update a permission (name/description only)
+ *   DELETE /:permId         — Delete a permission (?force=true)
+ *   GET    /:permId/roles   — List roles that have this permission
+ *
+ * Error mapping:
+ *   PermissionNotFoundError → 404
+ *   RbacValidationError → 400
+ *   ZodError → 400 with validation details
+ */
+import Router from '@koa/router';
+/**
+ * Create the permission management router.
+ *
+ * All routes require admin authorization with granular permissions.
+ * Permissions are scoped to an application via the :appId URL parameter.
+ *
+ * Prefix: /api/admin/applications/:appId/permissions
+ *
+ * @returns Configured Koa Router
+ */
+export declare function createPermissionRouter(): Router;
+//# sourceMappingURL=permissions.d.ts.map

package/dist/routes/permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../src/routes/permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AA6DjC;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,CAkG/C"}