@portaidentity/server 1.7.0

package/dist/security/decision-event.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decision-event.js","sourceRoot":"","sources":["../../src/security/decision-event.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAChF,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,wEAAwE;AACxE,MAAM,CAAC,MAAM,4BAA4B,GAAG,sBAA+B,CAAC;AAE5E,4DAA4D;AAC5D,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,SAAS;IACT,yBAAyB;IACzB,qBAAqB;IACrB,qBAAqB;IACrB,oBAAoB;IACpB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,wBAAwB;IACxB,oBAAoB;IACpB,iBAAiB;CACT,CAAC;AAKX,oEAAoE;AACpE,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,CAAU,CAAC;AAK7F,MAAM,YAAY,GAAG,CAAC;KACnB,MAAM,CAAC;IACN,YAAY,EAAE,CAAC;SACZ,MAAM,EAAE;SACR,KAAK,CAAC,wBAAwB,CAAC;SAC/B,QAAQ,EAAE;IACb,WAAW,EAAE,CAAC;SACX,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;SACrD,GAAG,CAAC,EAAE,CAAC;SACP,QAAQ,EAAE;IACb,kBAAkB,EAAE,CAAC;SAClB,MAAM,EAAE;SACR,KAAK,CAAC,yBAAyB,CAAC;SAChC,QAAQ,EAAE;IACb,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACxD,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,oEAAoE;AACpE,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC;KACzC,MAAM,CAAC;IACN,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC;IAClD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACjD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC;IAC1D,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IACpE,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,KAAK,CAAC,wBAAwB,CAAC;SAC/B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACpE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC9C,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3C,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC;QACpB,WAAW;QACX,YAAY;QACZ,gBAAgB;QAChB,YAAY;QACZ,YAAY;QACZ,UAAU;QACV,SAAS;KACV,CAAC;IACF,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC;IAClD,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,KAAK,CAAC,uBAAuB,CAAC;SAC9B,QAAQ,EAAE;IACb,QAAQ,EAAE,CAAC;SACR,MAAM,EAAE;SACR,KAAK,CAAC,4BAA4B,CAAC;SACnC,QAAQ,EAAE;IACb,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,KAAK,CAAC,4BAA4B,CAAC;SACnC,QAAQ,EAAE;IACb,WAAW,EAAE,CAAC;SACX,MAAM,EAAE;SACR,KAAK,CAAC,4BAA4B,CAAC;SACnC,QAAQ,EAAE;IACb,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,KAAK,CAAC,4BAA4B,CAAC;SACnC,QAAQ,EAAE;IACb,MAAM,EAAE,YAAY,CAAC,QAAQ,EAAE;CAChC,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IAC9B,MAAM,UAAU,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACzF,MAAM,YAAY,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;IAC7E,IAAI,YAAY,KAAK,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC,EAAE,CAAC;QAC1D,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,gBAAgB,CAAC;YACxB,OAAO,EAAE,oEAAoE;SAC9E,CAAC,CAAC;IACL,CAAC;IAED,MAAM,eAAe,GACnB,KAAK,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;IACjF,IAAI,KAAK,CAAC,OAAO,KAAK,eAAe,EAAE,CAAC;QACtC,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,SAAS,CAAC;YACjB,OAAO,EAAE,yDAAyD;SACnE,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,EAAE,CAAC;QACrE,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,YAAY,CAAC;YACpB,OAAO,EAAE,yDAAyD;SACnE,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,UAAU,KAAK,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,EAAE,CAAC;QAC5E,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,YAAY,CAAC;YACpB,OAAO,EAAE,8DAA8D;SACxE,CAAC,CAAC;IACL,CAAC;IAED,MAAM,sBAAsB,GAWxB;QACF,OAAO,EAAE,SAAS;QAClB,yBAAyB,EAAE,gBAAgB;QAC3C,qBAAqB,EAAE,YAAY;QACnC,qBAAqB,EAAE,YAAY;QACnC,oBAAoB,EAAE,UAAU;QAChC,iBAAiB,EAAE,UAAU;QAC7B,gBAAgB,EAAE,YAAY;QAC9B,gBAAgB,EAAE,YAAY;QAC9B,gBAAgB,EAAE,YAAY;QAC9B,oBAAoB,EAAE,YAAY;QAClC,gBAAgB,EAAE,SAAS;QAC3B,wBAAwB,EAAE,WAAW;KACtC,CAAC;IACF,MAAM,qBAAqB,GAAG,sBAAsB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACvE,IAAI,qBAAqB,KAAK,SAAS,IAAI,KAAK,CAAC,aAAa,KAAK,qBAAqB,EAAE,CAAC;QACzF,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,eAAe,CAAC;YACvB,OAAO,EAAE,iEAAiE;SAC3E,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAiCL,iFAAiF;AACjF,MAAM,UAAU,2BAA2B,CACzC,KAAiC;IAEjC,OAAO,2BAA2B,CAAC,KAAK,CAAC;QACvC,aAAa,EAAE,CAAC;QAChB,SAAS,EAAE,4BAA4B;QACvC,UAAU,EAAE,CAAC,KAAK,CAAC,UAAU,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;QAC1D,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,GAAG,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC;QACvF,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACtF,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;QACzF,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC/F,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;QACzF,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;KAChE,CAAC,CAAC;AACL,CAAC;AAQD;;;;;GAKG;AACH,MAAM,OAAO,0BAA0B;IAC5B,KAAK,CAAoB;IAElC,2DAA2D;IAC3D,YAAmB,UAA6B;QAC9C,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,EAAE,CAAC;YACzE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC;IAC/B,CAAC;IAED,oDAAoD;IACpD,IAAW,WAAW;QACpB,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;IACjD,CAAC;IAED,0DAA0D;IACnD,OAAO,CAAC,MAA+B,EAAE,aAAqB;QACnE,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,aAAa,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAChD,OAAO,eAAe,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IACjG,CAAC;IAED,2EAA2E;IACpE,MAAM,CACX,MAA+B,EAC/B,aAAqB,EACrB,SAAiB,EACjB,KAAa;QAEb,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,OAAO,KAAK,CAAC;QAChE,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;QAC7E,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACnC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YAChD,IAAI,OAAO,CAAC,EAAE,KAAK,KAAK;gBAAE,SAAS;YACnC,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,EAAE,CAAC;YACvF,OAAO,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACtF,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,qEAAqE;IACrE,OAAO,CAAC,SAAiB,EAAE,MAA+B;QACxD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAC1B,QAAQ,CACN,QAAQ,EACR,MAAM,EACN,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,MAAM,CAAC,EACjD,MAAM,CAAC,IAAI,CAAC,8BAA8B,MAAM,EAAE,EAAE,MAAM,CAAC,EAC3D,EAAE,CACH,CACF,CAAC;QACF,MAAM,kBAAkB,GAAG,MAAM,CAAC,IAAI,CACpC,QAAQ,CACN,QAAQ,EACR,MAAM,EACN,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,MAAM,CAAC,EACjD,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE,MAAM,CAAC,EACxD,EAAE,CACH,CACF,CAAC;QACF,OAAO;YACL,EAAE,EAAE,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;YAC1F,QAAQ;SACT,CAAC;IACJ,CAAC;CACF"}

package/dist/security/transport-decision.d.ts

@@ -0,0 +1,6 @@
+/** Privacy-safe handling for HTTP parser failures which occur before Koa middleware. */
+import type { Server } from 'node:http';
+import { type SecurityDecisionSink } from './decision-context.js';
+/** Attach one owner for HTTP parser failures and return a removal callback. */
+export declare function attachTransportDecisionHandler(server: Server, sink?: SecurityDecisionSink): () => void;
+//# sourceMappingURL=transport-decision.d.ts.map

package/dist/security/transport-decision.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport-decision.d.ts","sourceRoot":"","sources":["../../src/security/transport-decision.ts"],"names":[],"mappings":"AAAA,wFAAwF;AAGxF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAGxC,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,uBAAuB,CAAC;AAK/B,+EAA+E;AAC/E,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,MAAM,EACd,IAAI,GAAE,oBAA0C,GAC/C,MAAM,IAAI,CA4BZ"}

package/dist/security/transport-decision.js

@@ -0,0 +1,37 @@
+/** Privacy-safe handling for HTTP parser failures which occur before Koa middleware. */
+import { randomUUID } from 'node:crypto';
+import { createSecurityDecisionEvent } from './decision-event.js';
+import { logSecurityDecision, recordSecurityDecisionSinkFailure, } from './decision-context.js';
+const MINIMAL_BAD_REQUEST = 'HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Length: 0\r\n\r\n';
+/** Attach one owner for HTTP parser failures and return a removal callback. */
+export function attachTransportDecisionHandler(server, sink = logSecurityDecision) {
+    const handledSockets = new WeakSet();
+    const onClientError = (_error, socket) => {
+        if (handledSockets.has(socket))
+            return;
+        handledSockets.add(socket);
+        const event = createSecurityDecisionEvent({
+            requestId: randomUUID(),
+            surface: 'transport',
+            method: 'UNKNOWN',
+            routeTemplate: '/transport',
+            statusCode: 400,
+            outcome: 'deny',
+            decisionPoint: 'transport',
+            reasonCode: 'transport-parse-failed',
+        });
+        try {
+            void Promise.resolve(sink(event)).catch(recordSecurityDecisionSinkFailure);
+        }
+        catch {
+            recordSecurityDecisionSinkFailure();
+        }
+        if (socket.writable && !socket.destroyed)
+            socket.end(MINIMAL_BAD_REQUEST);
+        else
+            socket.destroy();
+    };
+    server.on('clientError', onClientError);
+    return () => server.off('clientError', onClientError);
+}
+//# sourceMappingURL=transport-decision.js.map

package/dist/security/transport-decision.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport-decision.js","sourceRoot":"","sources":["../../src/security/transport-decision.ts"],"names":[],"mappings":"AAAA,wFAAwF;AAExF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EACL,mBAAmB,EACnB,iCAAiC,GAElC,MAAM,uBAAuB,CAAC;AAE/B,MAAM,mBAAmB,GACvB,4EAA4E,CAAC;AAE/E,+EAA+E;AAC/E,MAAM,UAAU,8BAA8B,CAC5C,MAAc,EACd,IAAI,GAAyB,mBAAmB;IAEhD,MAAM,cAAc,GAAG,IAAI,OAAO,EAAU,CAAC;IAC7C,MAAM,aAAa,GAAG,CAAC,MAAa,EAAE,MAAc,EAAQ,EAAE;QAC5D,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO;QACvC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAE3B,MAAM,KAAK,GAAG,2BAA2B,CAAC;YACxC,SAAS,EAAE,UAAU,EAAE;YACvB,OAAO,EAAE,WAAW;YACpB,MAAM,EAAE,SAAS;YACjB,aAAa,EAAE,YAAY;YAC3B,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,MAAM;YACf,aAAa,EAAE,WAAW;YAC1B,UAAU,EAAE,wBAAwB;SACrC,CAAC,CAAC;QACH,IAAI,CAAC;YACH,KAAK,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;QAC7E,CAAC;QAAC,MAAM,CAAC;YACP,iCAAiC,EAAE,CAAC;QACtC,CAAC;QAED,IAAI,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;;YACrE,MAAM,CAAC,OAAO,EAAE,CAAC;IACxB,CAAC,CAAC;IAEF,MAAM,CAAC,EAAE,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;IACxC,OAAO,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;AACxD,CAAC"}

package/dist/server.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Koa application factory.
+ *
+ * Creates the Koa app with all middleware and routes. Optionally accepts
+ * an OIDC provider instance to mount under /:orgSlug/* for multi-tenant
+ * OIDC functionality.
+ *
+ * Route structure:
+ *   /health                        — Health check (DB + Redis status)
+ *   /api/admin/organizations/*     — Organization management (admin auth)
+ *   /api/admin/applications/*      — Application management (admin auth)
+ *   /api/admin/clients/*           — Client & secret management (admin auth)
+ *   /api/admin/organizations/:orgId/users/* — User management (admin auth)
+ *   /api/admin/applications/:appId/roles/* — Role management (admin auth)
+ *   /api/admin/applications/:appId/permissions/* — Permission management (admin auth)
+ *   /api/admin/organizations/:orgId/users/:userId/roles/* — User-role assignments (admin auth)
+ *   /api/admin/applications/:appId/claims/* — Custom claims management (admin auth)
+ *   /api/admin/config/*            — System configuration management (admin auth)
+ *   /api/admin/keys/*              — Signing key management (admin auth)
+ *   /api/admin/audit/*             — Audit log viewer (admin auth)
+ *   /interaction/:uid/*            — OIDC interaction routes (login, consent, abort)
+ *   /:orgSlug/auth/*               — Auth routes (magic link, password reset, invitation)
+ *   /:orgSlug/*                    — OIDC provider endpoints (auth, token, jwks, etc.)
+ */
+import { AsyncLocalStorage } from 'node:async_hooks';
+import Koa from 'koa';
+import type Provider from 'oidc-provider';
+/**
+ * Per-request OIDC issuer store.
+ *
+ * node-oidc-provider is initialized with a single base issuer URL, but
+ * Porta uses path-based multi-tenancy (/:orgSlug/*) where each org needs
+ * its own issuer (e.g., https://porta.local:3443/acme-corp).
+ *
+ * This AsyncLocalStorage holds the org-scoped issuer for the current
+ * request. The provider's `issuer` property is overridden with a getter
+ * that reads from this store, so all JWT `iss` claims, discovery responses,
+ * and redirect `iss` parameters automatically use the correct org issuer.
+ */
+export declare const issuerStore: AsyncLocalStorage<string>;
+/**
+ * Create the Koa application with all middleware and routes.
+ *
+ * @param oidcProvider - Optional OIDC provider instance. If provided,
+ *   OIDC endpoints are mounted under /:orgSlug/* with tenant resolution.
+ *   Pass undefined for testing scenarios that don't need OIDC.
+ * @returns Configured Koa application
+ */
+export declare function createApp(oidcProvider?: Provider): Koa;
+//# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,GAAG,MAAM,KAAK,CAAC;AAGtB,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAC;AAiD1C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,WAAW,2BAAkC,CAAC;AAE3D;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,YAAY,CAAC,EAAE,QAAQ,GAAG,GAAG,CAuctD"}

package/dist/server.js

@@ -0,0 +1,491 @@
+/**
+ * Koa application factory.
+ *
+ * Creates the Koa app with all middleware and routes. Optionally accepts
+ * an OIDC provider instance to mount under /:orgSlug/* for multi-tenant
+ * OIDC functionality.
+ *
+ * Route structure:
+ *   /health                        — Health check (DB + Redis status)
+ *   /api/admin/organizations/*     — Organization management (admin auth)
+ *   /api/admin/applications/*      — Application management (admin auth)
+ *   /api/admin/clients/*           — Client & secret management (admin auth)
+ *   /api/admin/organizations/:orgId/users/* — User management (admin auth)
+ *   /api/admin/applications/:appId/roles/* — Role management (admin auth)
+ *   /api/admin/applications/:appId/permissions/* — Permission management (admin auth)
+ *   /api/admin/organizations/:orgId/users/:userId/roles/* — User-role assignments (admin auth)
+ *   /api/admin/applications/:appId/claims/* — Custom claims management (admin auth)
+ *   /api/admin/config/*            — System configuration management (admin auth)
+ *   /api/admin/keys/*              — Signing key management (admin auth)
+ *   /api/admin/audit/*             — Audit log viewer (admin auth)
+ *   /interaction/:uid/*            — OIDC interaction routes (login, consent, abort)
+ *   /:orgSlug/auth/*               — Auth routes (magic link, password reset, invitation)
+ *   /:orgSlug/*                    — OIDC provider endpoints (auth, token, jwks, etc.)
+ */
+import { AsyncLocalStorage } from 'node:async_hooks';
+import Koa from 'koa';
+import bodyParser from 'koa-bodyparser';
+import Router from '@koa/router';
+import { requestLogger } from './middleware/request-logger.js';
+import { errorHandler } from './middleware/error-handler.js';
+import { securityHeaders, HTML_CSP } from './middleware/security-headers.js';
+import { healthCheck } from './middleware/health.js';
+import { readyHandler } from './middleware/ready.js';
+import { createRootPageRouter } from './middleware/root-page.js';
+import { tenantResolver } from './middleware/tenant-resolver.js';
+import { oidcClientTenantBinding } from './middleware/oidc-client-tenant.js';
+import { clientSecretHash } from './middleware/client-secret-hash.js';
+import { promptLoginReset } from './middleware/prompt-login-reset.js';
+import { createOrganizationRouter } from './routes/organizations.js';
+import { createApplicationRouter } from './routes/applications.js';
+import { createClientRouter } from './routes/clients.js';
+import { createUserRouter, createStandaloneUserRouter } from './routes/users.js';
+import { createInteractionRouter } from './routes/interactions.js';
+import { createMagicLinkRouter } from './routes/magic-link.js';
+import { createPasswordResetRouter } from './routes/password-reset.js';
+import { createInvitationRouter } from './routes/invitation.js';
+import { createRoleRouter } from './routes/roles.js';
+import { createPermissionRouter } from './routes/permissions.js';
+import { createUserRoleRouter } from './routes/user-roles.js';
+import { createCustomClaimRouter } from './routes/custom-claims.js';
+import { createTwoFactorRouter } from './routes/two-factor.js';
+import { createConfigRouter } from './routes/config.js';
+import { createKeysRouter } from './routes/keys.js';
+import { createAuditRouter } from './routes/audit.js';
+import { createStatsRouter } from './routes/stats.js';
+import { createSessionRouter, createUserSessionRouter } from './routes/sessions.js';
+import { createBulkRouter } from './routes/bulk.js';
+import { createExportRouter } from './routes/exports.js';
+import { createImportRouter } from './routes/imports.js';
+import { createBrandingRouter } from './routes/branding.js';
+import { createTwoFactorUserAdminRouter, createTwoFactorOrgAdminRouter, } from './routes/two-factor-admin.js';
+import { adminCors } from './middleware/admin-cors.js';
+import { oidcPreflightCors } from './middleware/oidc-preflight-cors.js';
+import { metricsCounter, metricsHandler } from './middleware/metrics.js';
+import { tokenRateLimiter, introspectionRateLimiter } from './middleware/token-rate-limiter.js';
+import { adminRateLimiter } from './middleware/admin-rate-limiter.js';
+import { adminMutationAudit } from './middleware/admin-mutation-audit.js';
+import { setAdminAuthProvider } from './middleware/admin-auth.js';
+import { findSuperAdminOrganization } from './organizations/repository.js';
+import { getApplicationBySlug } from './applications/index.js';
+import { listClientsByApplication } from './clients/index.js';
+import { config } from './config/index.js';
+/**
+ * Per-request OIDC issuer store.
+ *
+ * node-oidc-provider is initialized with a single base issuer URL, but
+ * Porta uses path-based multi-tenancy (/:orgSlug/*) where each org needs
+ * its own issuer (e.g., https://porta.local:3443/acme-corp).
+ *
+ * This AsyncLocalStorage holds the org-scoped issuer for the current
+ * request. The provider's `issuer` property is overridden with a getter
+ * that reads from this store, so all JWT `iss` claims, discovery responses,
+ * and redirect `iss` parameters automatically use the correct org issuer.
+ */
+export const issuerStore = new AsyncLocalStorage();
+/**
+ * Create the Koa application with all middleware and routes.
+ *
+ * @param oidcProvider - Optional OIDC provider instance. If provided,
+ *   OIDC endpoints are mounted under /:orgSlug/* with tenant resolution.
+ *   Pass undefined for testing scenarios that don't need OIDC.
+ * @returns Configured Koa application
+ */
+export function createApp(oidcProvider) {
+    const app = new Koa();
+    // Trust proxy headers (X-Forwarded-Proto, X-Forwarded-For, etc.) when
+    // running behind a TLS-terminating reverse proxy. This makes ctx.secure,
+    // ctx.ip, and ctx.protocol reflect the client's real connection, which is
+    // required for secure cookie flags and correct IP-based rate limiting.
+    if (config.trustProxy) {
+        app.proxy = true;
+    }
+    // Global middleware stack (order matters):
+    // 1. Request correlation and terminal finalization wrap every Koa request
+    // 2. Error handler converts downstream failures into minimal public responses
+    // 3. Security headers (CSP, HSTS, X-Frame-Options, etc.)
+    // 4. Selective body parser — only routes that need it (NOT OIDC routes)
+    app.use(requestLogger());
+    app.use(errorHandler());
+    app.use(securityHeaders());
+    // Prometheus metrics counter — increments porta_http_requests_total per response.
+    // Only active when METRICS_ENABLED=true; otherwise no overhead.
+    if (config.metricsEnabled) {
+        app.use(metricsCounter());
+    }
+    // Selective body parser: apply only to admin API, interaction, and auth routes.
+    // OIDC provider routes (/:orgSlug/*) must NOT have pre-parsed bodies because
+    // oidc-provider uses its own internal body parser (selective_body.js).
+    // Pre-parsing the body consumes the request stream, which causes
+    // client_secret_post authentication to fail at the token endpoint with
+    // "no client authentication mechanism provided".
+    //
+    // Routes that NEED body parsing:
+    //   /api/*           — Admin API routes (JSON request bodies)
+    //   /interaction/*   — OIDC interaction routes (login/consent form submissions)
+    //   /:orgSlug/auth/* — Auth workflow routes (magic-link, password-reset, invitation)
+    //   /health          — GET-only, no body needed, but harmless to parse
+    //
+    // Routes that must NOT be body-parsed:
+    //   /:orgSlug/*      — OIDC provider endpoints (token, revocation, introspection, etc.)
+    const bp = bodyParser({
+        jsonLimit: '100kb', // Defence-in-depth: limit JSON body size (default was 1mb)
+        formLimit: '100kb', // Limit form body size
+        textLimit: '100kb', // Limit text body size
+    });
+    app.use(async (ctx, next) => {
+        if (ctx.path.startsWith('/api/') ||
+            ctx.path.startsWith('/interaction/') ||
+            ctx.path.startsWith('/health') ||
+            ctx.path.includes('/auth/')) {
+            return bp(ctx, next);
+        }
+        return next();
+    });
+    // Health check (liveness) and readiness probe — root level, no tenant context.
+    // Kubernetes / container orchestrators map:
+    //   livenessProbe  → GET /health
+    //   readinessProbe → GET /ready
+    const router = new Router();
+    router.get('/health', healthCheck());
+    router.get('/ready', readyHandler());
+    // Prometheus metrics endpoint — only registered when METRICS_ENABLED=true.
+    // When disabled, GET /metrics falls through to 404 (no route match).
+    if (config.metricsEnabled) {
+        router.get('/metrics', metricsHandler());
+    }
+    app.use(router.routes());
+    app.use(router.allowedMethods());
+    // Public-surface handlers — neutral response at GET /, robots.txt, favicon.
+    // Prevents the default Koa "Not Found" page at the public root without
+    // disclosing any product information to unauthenticated visitors. See
+    // src/middleware/root-page.ts for the security posture.
+    const rootPageRouter = createRootPageRouter();
+    app.use(rootPageRouter.routes());
+    app.use(rootPageRouter.allowedMethods());
+    // Admin metadata endpoint — unauthenticated, provides OIDC discovery
+    // info needed by the CLI to initiate the login flow. Returns the issuer
+    // URL, client_id, and org slug for the admin CLI PKCE client.
+    // The client_id is looked up from the database (created by `porta init`)
+    // rather than hardcoded, since client IDs are randomly generated.
+    const metadataRouter = new Router();
+    metadataRouter.get('/api/admin/metadata', async (ctx) => {
+        const superAdminOrg = await findSuperAdminOrganization();
+        if (!superAdminOrg) {
+            ctx.status = 503;
+            ctx.body = {
+                error: 'Not initialized',
+                message: 'Run porta init to set up the admin system',
+            };
+            return;
+        }
+        // Look up the admin application and its CLI client
+        const adminApp = await getApplicationBySlug('porta-admin');
+        if (!adminApp) {
+            ctx.status = 503;
+            ctx.body = {
+                error: 'Not initialized',
+                message: 'Run porta init to set up the admin system',
+            };
+            return;
+        }
+        // Find the CLI client (native, public PKCE client) in the admin app.
+        // Only need the first page — porta init creates exactly one client.
+        const clients = await listClientsByApplication(adminApp.id, {
+            page: 1,
+            pageSize: 10,
+        });
+        const cliClient = clients.data.find((c) => c.applicationType === 'native');
+        ctx.body = {
+            issuer: `${config.issuerBaseUrl}/${superAdminOrg.slug}`,
+            orgSlug: superAdminOrg.slug,
+            clientId: cliClient?.clientId ?? null,
+        };
+    });
+    app.use(metadataRouter.routes());
+    app.use(metadataRouter.allowedMethods());
+    // Admin CORS allow-list — emits CORS headers for /api/admin/* only when
+    // ADMIN_CORS_ORIGINS is configured.  Mounted before admin-auth because
+    // preflight OPTIONS requests don't carry Authorization headers.
+    // Default (empty config) = deny all cross-origin requests.
+    app.use(adminCors(config));
+    // Admin API rate limiter — protects state-changing admin endpoints
+    // (POST/PUT/PATCH/DELETE /api/admin/*) against brute-force and abuse.
+    // Per-IP key, 60 req / 60s.  GET requests pass through unmetered.
+    // Mounted before admin routes so it fires before route handlers.
+    app.use(adminRateLimiter());
+    app.use(adminMutationAudit());
+    // Set the OIDC provider for admin auth middleware — enables opaque access
+    // token validation via provider.AccessToken.find() for all /api/admin/* routes.
+    if (oidcProvider) {
+        setAdminAuthProvider(oidcProvider);
+        // Override the provider's static issuer with a dynamic per-request getter.
+        // node-oidc-provider sets `this.issuer` once at construction (the base URL).
+        // For path-based multi-tenancy, each org needs its own issuer URL. The getter
+        // reads from issuerStore (AsyncLocalStorage) which is populated per-request
+        // in the /:orgSlug route handler via issuerStore.run(). Outside a request
+        // context (e.g., startup, admin API), it falls back to the base issuer.
+        const baseIssuer = config.issuerBaseUrl;
+        Object.defineProperty(oidcProvider, 'issuer', {
+            get: () => issuerStore.getStore() ?? baseIssuer,
+            configurable: true,
+        });
+    }
+    // Organization management API — requires admin authentication
+    // Mounted at /api/admin/organizations (see routes/organizations.ts)
+    const orgRouter = createOrganizationRouter();
+    app.use(orgRouter.routes());
+    app.use(orgRouter.allowedMethods());
+    // Application management API — requires admin authentication
+    // Mounted at /api/admin/applications (see routes/applications.ts)
+    const appRouter = createApplicationRouter();
+    app.use(appRouter.routes());
+    app.use(appRouter.allowedMethods());
+    // Client & secret management API — requires admin authentication
+    // Mounted at /api/admin/clients (see routes/clients.ts)
+    const clientRouter = createClientRouter();
+    app.use(clientRouter.routes());
+    app.use(clientRouter.allowedMethods());
+    // User management API — requires admin authentication
+    // Mounted at /api/admin/organizations/:orgId/users (see routes/users.ts)
+    const userRouter = createUserRouter();
+    app.use(userRouter.routes());
+    app.use(userRouter.allowedMethods());
+    // Standalone user admin API — non-org-scoped user access by userId
+    // Mounted at /api/admin/users/:userId (see routes/users.ts)
+    // Used by the Admin GUI SPA for user detail/mutation operations
+    const standaloneUserRouter = createStandaloneUserRouter();
+    app.use(standaloneUserRouter.routes());
+    app.use(standaloneUserRouter.allowedMethods());
+    // RBAC and custom-claims admin APIs require admin authentication.
+    // Role management at /api/admin/applications/:appId/roles
+    const roleRouter = createRoleRouter();
+    app.use(roleRouter.routes());
+    app.use(roleRouter.allowedMethods());
+    // Permission management at /api/admin/applications/:appId/permissions
+    const permissionRouter = createPermissionRouter();
+    app.use(permissionRouter.routes());
+    app.use(permissionRouter.allowedMethods());
+    // User-role assignments at /api/admin/organizations/:orgId/users/:userId/roles
+    const userRoleRouter = createUserRoleRouter();
+    app.use(userRoleRouter.routes());
+    app.use(userRoleRouter.allowedMethods());
+    // 2FA admin — user-level management (status, disable, reset, regenerate)
+    // Mounted at /api/admin/organizations/:orgId/users/:userId/two-factor
+    const twoFactorUserAdminRouter = createTwoFactorUserAdminRouter();
+    app.use(twoFactorUserAdminRouter.routes());
+    app.use(twoFactorUserAdminRouter.allowedMethods());
+    // Custom claims at /api/admin/applications/:appId/claims
+    const customClaimRouter = createCustomClaimRouter();
+    app.use(customClaimRouter.routes());
+    app.use(customClaimRouter.allowedMethods());
+    // System config management API — requires admin authentication
+    // Mounted at /api/admin/config (see routes/config.ts)
+    const configRouter = createConfigRouter();
+    app.use(configRouter.routes());
+    app.use(configRouter.allowedMethods());
+    // Signing key management API — requires admin authentication
+    // Mounted at /api/admin/keys (see routes/keys.ts)
+    const keysRouter = createKeysRouter();
+    app.use(keysRouter.routes());
+    app.use(keysRouter.allowedMethods());
+    // Audit log API — requires admin authentication
+    // Mounted at /api/admin/audit (see routes/audit.ts)
+    const auditRouter = createAuditRouter();
+    app.use(auditRouter.routes());
+    app.use(auditRouter.allowedMethods());
+    // Dashboard statistics API — requires admin authentication
+    // Mounted at /api/admin/stats (see routes/stats.ts)
+    const statsRouter = createStatsRouter();
+    app.use(statsRouter.routes());
+    app.use(statsRouter.allowedMethods());
+    // Session management API — requires admin authentication
+    // Mounted at /api/admin/sessions (see routes/sessions.ts)
+    const sessionRouter = createSessionRouter();
+    app.use(sessionRouter.routes());
+    app.use(sessionRouter.allowedMethods());
+    // User session revocation — requires admin authentication
+    // Mounted at /api/admin/users/:userId/sessions (see routes/sessions.ts)
+    const userSessionRouter = createUserSessionRouter();
+    app.use(userSessionRouter.routes());
+    app.use(userSessionRouter.allowedMethods());
+    // Bulk operations API — requires admin authentication
+    // Mounted at /api/admin/bulk (see routes/bulk.ts)
+    const bulkRouter = createBulkRouter();
+    app.use(bulkRouter.routes());
+    app.use(bulkRouter.allowedMethods());
+    // Branding assets API — requires admin authentication
+    // Mounted at /api/admin/organizations/:orgId/branding (see routes/branding.ts)
+    const brandingRouter = createBrandingRouter();
+    app.use(brandingRouter.routes());
+    app.use(brandingRouter.allowedMethods());
+    // 2FA admin — org-level management (policy, summary)
+    // Mounted at /api/admin/organizations/:orgId/two-factor
+    const twoFactorOrgAdminRouter = createTwoFactorOrgAdminRouter();
+    app.use(twoFactorOrgAdminRouter.routes());
+    app.use(twoFactorOrgAdminRouter.allowedMethods());
+    // Data export API — requires admin authentication
+    // Mounted at /api/admin/export (see routes/exports.ts)
+    const exportRouter = createExportRouter();
+    app.use(exportRouter.routes());
+    app.use(exportRouter.allowedMethods());
+    // Data import API — requires admin authentication
+    // Mounted at /api/admin/import (see routes/imports.ts)
+    const importRouter = createImportRouter();
+    app.use(importRouter.routes());
+    app.use(importRouter.allowedMethods());
+    // OIDC interaction routes — mounted at /interaction/:uid/* (root level).
+    // These must be at the root (not under /:orgSlug) because the provider sets
+    // interaction cookie paths relative to /interaction/{uid}, and the browser
+    // must send those cookies when navigating to the interaction URL.
+    // Organization context is resolved from the interaction's client_id.
+    if (oidcProvider) {
+        const interactionRouter = createInteractionRouter(oidcProvider);
+        app.use(interactionRouter.routes());
+        app.use(interactionRouter.allowedMethods());
+        // Two-factor authentication routes — mounted at /interaction/:uid/two-factor/*
+        // Must be after the main interaction router for proper routing precedence.
+        const twoFactorRouter = createTwoFactorRouter(oidcProvider);
+        app.use(twoFactorRouter.routes());
+        app.use(twoFactorRouter.allowedMethods());
+    }
+    // Auth routes — magic link, password reset, invitation
+    // These are org-scoped via /:orgSlug/auth/* and use tenant resolution.
+    // Mounted before the OIDC catch-all to prevent it from swallowing auth paths.
+    // Magic link no longer needs the provider — authentication is completed via
+    // the _ml_session cookie and the interaction login handler.
+    const magicLinkRouter = createMagicLinkRouter(oidcProvider);
+    app.use(magicLinkRouter.routes());
+    app.use(magicLinkRouter.allowedMethods());
+    // Password reset and invitation routes don't need the provider
+    const passwordResetRouter = createPasswordResetRouter();
+    app.use(passwordResetRouter.routes());
+    app.use(passwordResetRouter.allowedMethods());
+    const invitationRouter = createInvitationRouter();
+    app.use(invitationRouter.routes());
+    app.use(invitationRouter.allowedMethods());
+    // Token endpoint rate limiter — protects POST /:orgSlug/oidc/token against
+    // flooding and brute-force.  Uses per-IP + per-client_id composite key,
+    // 30 req / 5 min.  Returns 429 with Retry-After when exceeded.
+    // Mounted before the OIDC provider so it fires before token processing.
+    app.use(tokenRateLimiter());
+    // Introspection endpoint rate limiter — protects POST
+    // /:orgSlug/oidc/token/introspection against token enumeration.
+    // Per-IP + per-client_id key, 100 req / 60s (higher than token endpoint
+    // since resource servers introspect on every API call).
+    app.use(introspectionRateLimiter());
+    // OIDC provider routes — mounted under /:orgSlug prefix
+    // This is the catch-all for OIDC protocol endpoints (auth, token, jwks, etc.)
+    // MUST be last because /:orgSlug/* matches everything.
+    if (oidcProvider) {
+        // prompt=login session reset (Bug #1) — mounted on the outer app BEFORE the
+        // OIDC router so it runs on a GET /{orgSlug}/auth request (with prompt=login)
+        // before node-oidc-provider processes it. Clears the stale `_session` cookie
+        // pair so the provider mints a fresh session and resume cannot hit a uid
+        // mismatch. No-op for any non-prompt=login request (normal SSO preserved).
+        app.use(promptLoginReset(oidcProvider));
+        const oidcRouter = new Router({ prefix: '/:orgSlug' });
+        // Tenant resolver validates the org slug and sets ctx.state.organization
+        oidcRouter.use(tenantResolver());
+        // Body parser for OIDC routes — parses application/x-www-form-urlencoded
+        // and JSON bodies before they reach our middleware.
+        //
+        // When the body is already parsed, oidc-provider's selective_body.js detects
+        // ctx.req.readable === false and falls back to reading ctx.req.body.
+        //
+        // IMPORTANT: We must copy the parsed body to ctx.req.body (Node's IncomingMessage)
+        // because oidcProvider.callback() receives ctx.req/ctx.res (raw Node objects),
+        // and oidc-provider creates its own internal Koa context — so it can NOT access
+        // our Koa app's ctx.request.body. Setting ctx.req.body makes the parsed body
+        // available via the fallback path in selective_body.js.
+        const oidcBodyParser = bodyParser();
+        oidcRouter.use(async (ctx, next) => {
+            await oidcBodyParser(ctx, next);
+        });
+        oidcRouter.use(async (ctx, next) => {
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            const body = ctx.request.body;
+            if (body && typeof body === 'object' && Object.keys(body).length > 0) {
+                // eslint-disable-next-line @typescript-eslint/no-explicit-any
+                ctx.req.body = body;
+            }
+            await next();
+        });
+        // A client is valid only beneath the issuer owned by its organization. This check runs before
+        // CORS, secret transformation, and oidc-provider so a foreign client cannot create an
+        // interaction or authenticate under another tenant's issuer.
+        oidcRouter.use(oidcClientTenantBinding(oidcProvider));
+        // OIDC CORS — pre-sets Access-Control-Allow-Origin and related headers
+        // BEFORE the request enters oidc-provider's internal Koa context.
+        //
+        // node-oidc-provider uses @koa/cors with keepHeadersOnError: false,
+        // which strips CORS headers from error responses (e.g., 400 from the
+        // token endpoint). This middleware fixes that by setting CORS headers
+        // at the outer Koa level. The provider's cors.js detects existing
+        // access-control-* headers and skips its own handling, so our headers
+        // survive both success and error responses.
+        //
+        // Mounted after body parser so client_id is available for production
+        // origin checks. OPTIONS preflights are short-circuited here with 204.
+        oidcRouter.use(oidcPreflightCors());
+        // Pre-hash client secrets with SHA-256 before oidc-provider processes them.
+        // This enables secure secret storage: we store SHA-256 hashes in the DB,
+        // the middleware hashes the presented secret, and oidc-provider compares them.
+        // Requires body parser above so ctx.request.body.client_secret is available.
+        oidcRouter.use(clientSecretHash());
+        // Delegate all OIDC requests to node-oidc-provider's callback handler.
+        // URL rewriting strips the /:orgSlug prefix so the provider sees
+        // standard OIDC paths (/auth, /token, /jwks, etc.).
+        oidcRouter.all('/{*path}', async (ctx) => {
+            // Preserve the original URL so the provider can detect the mount path
+            // and generate correct endpoint URLs (e.g., /playground/auth instead of /auth).
+            // node-oidc-provider compares originalUrl vs url to extract the mount prefix.
+            const originalUrl = ctx.req.url;
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            ctx.req.originalUrl = originalUrl;
+            // Strip the org slug prefix from the URL before passing to the provider.
+            // e.g., /acme-corp/token → /token
+            ctx.req.url = originalUrl.replace(`/${ctx.params.orgSlug}`, '');
+            // Pass the tenant-resolved org to the provider's internal context.
+            // The interactionUrl callback (provider.ts) stores it so interaction
+            // handlers can recover the issuer organization after the slug is stripped.
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            ctx.req._portaOrganization = ctx.state.organization;
+            // Override CSP for OIDC provider responses.
+            //
+            // The security-headers middleware (Phase 1) set the strict default CSP
+            // (`default-src 'none'`) on ctx.res.  That CSP lacks a `script-src`
+            // directive.  node-oidc-provider's `pushScriptSrcSha()` helper only
+            // adds inline-script hashes when `script-src` already exists in the
+            // CSP — so with our strict default, it silently does nothing.
+            //
+            // Additionally, `oidcProvider.callback()` creates its own internal Koa
+            // context and calls `ctx.res.end()` directly, which means our Phase 3
+            // (post-response CSP upgrade for HTML) never runs for provider responses.
+            //
+            // Setting the HTML-safe CSP here fixes both issues:
+            //   - form_post / web_message response modes render HTML with inline
+            //     <script> tags that need `script-src 'unsafe-inline'`
+            //   - Logout, error, and device-flow pages rendered by provider hooks
+            //     use inline styles needing `style-src 'unsafe-inline'`
+            //   - Non-HTML provider responses (token, jwks, introspection JSON)
+            //     are unaffected — browsers don't execute scripts in JSON responses
+            ctx.set('Content-Security-Policy', HTML_CSP);
+            // --- Dynamic per-request issuer (RFC 8414 §2 compliance) ---
+            // node-oidc-provider uses `this.issuer` for everything: discovery
+            // JSON, JWT `iss` claims, and redirect `iss` query parameters.
+            // We override the provider's issuer property with a getter that
+            // reads from AsyncLocalStorage (see issuerStore above), so all
+            // outputs automatically include the org slug. Running the provider
+            // callback inside issuerStore.run() scopes the issuer to this
+            // request without affecting concurrent requests for other orgs.
+            const orgIssuer = `${config.issuerBaseUrl}/${ctx.params.orgSlug}`;
+            // Delegate to node-oidc-provider inside the per-request issuer context
+            await issuerStore.run(orgIssuer, () => oidcProvider.callback()(ctx.req, ctx.res));
+        });
+        app.use(oidcRouter.routes());
+        app.use(oidcRouter.allowedMethods());
+    }
+    return app;
+}
+//# sourceMappingURL=server.js.map