@portaidentity/server 1.7.3 → 1.8.0

package/dist/middleware/admin-auth.js

@@ -3,9 +3,9 @@
  *
  * Validates Bearer access tokens against Porta's own OIDC provider
  * using opaque token lookup (provider.AccessToken.find()). Verifies
- * the user belongs to the super-admin organization and has the
- * porta-admin role. Sets ctx.state.adminUser for downstream handlers
- * and audit logging.
+ * the user belongs to the super-admin organization and has a recognized
+ * built-in role owned by the canonical Porta Admin application. Sets
+ * ctx.state.adminUser for downstream handlers and audit logging.
  *
  * This middleware replaces the old requireSuperAdmin() that checked
  * ctx.state.organization.isSuperAdmin (which required tenant-resolver
@@ -17,7 +17,7 @@
  *   3. Resolve super-admin organization
  *   4. Look up user — must be active
  *   5. Verify user belongs to the super-admin organization
- *   6. Verify user has the porta-admin role
+ *   6. Verify the user has a recognized role from the canonical Admin application
  *   7. Set ctx.state.adminUser and proceed
  *
  * Response codes:
@@ -27,9 +27,10 @@
  */
 import { findUserForOidc } from '../users/service.js';
 import { findSuperAdminOrganization } from '../organizations/repository.js';
-import { getUserRoles } from '../rbac/user-role-service.js';
+import { getUserRolesForAuthority } from '../rbac/user-role-service.js';
+import { getApplicationBySlug } from '../applications/service.js';
 import { logger } from '../lib/logger.js';
-import { resolvePermissionsFromRoles } from '../lib/admin-permissions.js';
+import { getPermissionsForAdminRole, resolvePermissionsFromRoles, } from '../lib/admin-permissions.js';
 import { recordSecurityDecision, recordSecurityReference } from '../security/decision-context.js';
 let _provider = null;
 /**
@@ -69,17 +70,15 @@ export function requireAdminOrganizationMembership(ctx, userOrganizationId, admi
 // ---------------------------------------------------------------------------
 // Admin auth middleware factory
 // ---------------------------------------------------------------------------
-/**
- * Admin role slug prefix — all admin roles start with 'porta-'.
- * Legacy 'porta-admin' role is treated as super-admin for backward compatibility.
- */
-const ADMIN_ROLE_PREFIX = 'porta-';
+/** Immutable slug of the application that owns Porta's control-plane roles. */
+const ADMIN_APPLICATION_SLUG = 'porta-admin';
 /**
  * Create middleware that requires admin authentication and authorization.
  *
  * Validates the Bearer access token in the Authorization header by looking
  * it up via the OIDC provider's opaque token store, then verifies the user
- * is an active member of the super-admin organization with the porta-admin role.
+ * is an active member of the super-admin organization with a recognized role
+ * owned by the canonical Porta Admin application.
  *
  * On success, sets ctx.state.adminUser with the authenticated identity.
  * On failure, responds with 401 (unauthenticated) or 403 (unauthorized).
@@ -201,14 +200,27 @@ export function requireAdminAuth() {
         if (!requireAdminOrganizationMembership(ctx, user.organizationId, superAdminOrg.id))
             return;
         // -----------------------------------------------------------------
-        // Step 6: Verify user has an admin role (any porta-* role)
+        // Step 6: Verify the user has a recognized role from the canonical Admin application.
         // -----------------------------------------------------------------
-        // Supports both legacy porta-admin and new granular roles:
-        // porta-super-admin, porta-org-admin, porta-user-admin, etc.
-        const userRoles = await getUserRoles(userId);
+        const adminApplication = await getApplicationBySlug(ADMIN_APPLICATION_SLUG);
+        if (!adminApplication) {
+            logger.error('Admin auth: canonical application not found — run porta init');
+            recordSecurityDecision(ctx, {
+                decisionPoint: 'handler',
+                reasonCode: 'handler-failed',
+                outcome: 'error',
+            });
+            ctx.status = 500;
+            ctx.body = { error: 'Server configuration error' };
+            return;
+        }
+        const userRoles = await getUserRolesForAuthority(userId);
         const adminRoleSlugs = userRoles
-            .map((role) => role.slug)
-            .filter((slug) => slug.startsWith(ADMIN_ROLE_PREFIX));
+            .filter((role) => role.applicationId === adminApplication.id &&
+            getPermissionsForAdminRole(role.slug).length > 0)
+            .map((role) => role.slug);
+        recordSecurityReference(ctx, 'actor', userId);
+        recordSecurityReference(ctx, 'tenant', user.organizationId);
         if (adminRoleSlugs.length === 0) {
             recordSecurityDecision(ctx, {
                 decisionPoint: 'membership',
@@ -233,8 +245,6 @@ export function requireAdminAuth() {
             roles: adminRoleSlugs,
             permissions,
         };
-        recordSecurityReference(ctx, 'actor', userId);
-        recordSecurityReference(ctx, 'tenant', user.organizationId);
         await next();
     };
 }

package/dist/middleware/admin-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"admin-auth.js","sourceRoot":"","sources":["../../src/middleware/admin-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAIH,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,0BAA0B,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC5D,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAelG,IAAI,SAAS,GAAoC,IAAI,CAAC;AAEtD;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAkC;IACrE,SAAS,GAAG,QAAQ,CAAC;AACvB,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,sBAAsB;IACpC,SAAS,GAAG,IAAI,CAAC;AACnB,CAAC;AA0BD;;;;GAIG;AACH,MAAM,UAAU,kCAAkC,CAChD,GAA8B,EAC9B,kBAA0B,EAC1B,mBAA2B;IAE3B,IAAI,kBAAkB,KAAK,mBAAmB;QAAE,OAAO,IAAI,CAAC;IAC5D,sBAAsB,CAAC,GAAG,EAAE;QAC1B,aAAa,EAAE,YAAY;QAC3B,UAAU,EAAE,qBAAqB;QACjC,OAAO,EAAE,MAAM;KAChB,CAAC,CAAC;IACH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;IACjB,GAAG,CAAC,IAAI,GAAG;QACT,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,wCAAwC;KAClD,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC;AAmBD,8EAA8E;AAC9E,gCAAgC;AAChC,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,iBAAiB,GAAG,QAAQ,CAAC;AAEnC;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,oEAAoE;QACpE,yDAAyD;QACzD,oEAAoE;QACpE,MAAM,UAAU,GAAG,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC5C,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACrD,sBAAsB,CAAC,GAAG,EAAE;gBAC1B,aAAa,EAAE,gBAAgB;gBAC/B,UAAU,EAAE,yBAAyB;gBACrC,OAAO,EAAE,MAAM;aAChB,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG;gBACT,KAAK,EAAE,yBAAyB;gBAChC,OAAO,EAAE,yCAAyC;aACnD,CAAC;YACF,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,0BAA0B;QAE7D,oEAAoE;QACpE,yDAAyD;QACzD,oEAAoE;QACpE,mCAAmC;QACnC,0EAA0E;QAC1E,oEAAoE;QACpE,qEAAqE;QACrE,qEAAqE;QACrE,sEAAsE;QACtE,mEAAmE;QACnE,mDAAmD;QACnD,oEAAoE;QACpE,oEAAoE;QACpE,yEAAyE;QACzE,qEAAqE;QACrE,sEAAsE;QACtE,8DAA8D;QAC9D,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;YAC1D,sBAAsB,CAAC,GAAG,EAAE;gBAC1B,aAAa,EAAE,SAAS;gBACxB,UAAU,EAAE,gBAAgB;gBAC5B,OAAO,EAAE,OAAO;aACjB,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;YACnD,OAAO;QACT,CAAC;QAED,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC5D,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC;gBAC3C,MAAM,CAAC,KAAK,CAAC,yDAAyD,CAAC,CAAC;gBACxE,sBAAsB,CAAC,GAAG,EAAE;oBAC1B,aAAa,EAAE,gBAAgB;oBAC/B,UAAU,EAAE,yBAAyB;oBACrC,OAAO,EAAE,MAAM;iBAChB,CAAC,CAAC;gBACH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;gBACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC;gBAC1E,OAAO;YACT,CAAC;YACD,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;YACrE,gDAAgD;YAChD,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,EAAE,6BAA6B,CAAC,CAAC;YACtF,sBAAsB,CAAC,GAAG,EAAE;gBAC1B,aAAa,EAAE,gBAAgB;gBAC/B,UAAU,EAAE,yBAAyB;gBACrC,OAAO,EAAE,MAAM;aAChB,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC;YAC1E,OAAO;QACT,CAAC;QAED,oEAAoE;QACpE,2CAA2C;QAC3C,oEAAoE;QACpE,+DAA+D;QAC/D,MAAM,aAAa,GAAG,MAAM,0BAA0B,EAAE,CAAC;QACzD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,uDAAuD;YACvD,MAAM,CAAC,KAAK,CAAC,iEAAiE,CAAC,CAAC;YAChF,sBAAsB,CAAC,GAAG,EAAE;gBAC1B,aAAa,EAAE,SAAS;gBACxB,UAAU,EAAE,gBAAgB;gBAC5B,OAAO,EAAE,OAAO;aACjB,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;YACnD,OAAO;QACT,CAAC;QAED,oEAAoE;QACpE,wCAAwC;QACxC,oEAAoE;QACpE,oEAAoE;QACpE,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,sBAAsB,CAAC,GAAG,EAAE;gBAC1B,aAAa,EAAE,gBAAgB;gBAC/B,UAAU,EAAE,yBAAyB;gBACrC,OAAO,EAAE,MAAM;aAChB,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC;YAC1E,OAAO;QACT,CAAC;QAED,oEAAoE;QACpE,8DAA8D;QAC9D,oEAAoE;QACpE,IAAI,CAAC,kCAAkC,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,aAAa,CAAC,EAAE,CAAC;YAAE,OAAO;QAE5F,oEAAoE;QACpE,2DAA2D;QAC3D,oEAAoE;QACpE,2DAA2D;QAC3D,6DAA6D;QAC7D,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,cAAc,GAAG,SAAS;aAC7B,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;aACxB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAExD,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,sBAAsB,CAAC,GAAG,EAAE;gBAC1B,aAAa,EAAE,YAAY;gBAC3B,UAAU,EAAE,qBAAqB;gBACjC,OAAO,EAAE,MAAM;aAChB,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,wCAAwC,EAAE,CAAC;YACrF,OAAO;QACT,CAAC;QAED,oEAAoE;QACpE,mDAAmD;QACnD,oEAAoE;QACpE,MAAM,WAAW,GAAG,2BAA2B,CAAC,cAAc,CAAC,CAAC;QAEhE,oEAAoE;QACpE,8DAA8D;QAC9D,oEAAoE;QACpE,GAAG,CAAC,KAAK,CAAC,SAAS,GAAG;YACpB,EAAE,EAAE,MAAM;YACV,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,KAAK,EAAE,cAAc;YACrB,WAAW;SACQ,CAAC;QACtB,uBAAuB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC9C,uBAAuB,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QAE5D,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"admin-auth.js","sourceRoot":"","sources":["../../src/middleware/admin-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAIH,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,0BAA0B,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EACL,0BAA0B,EAC1B,2BAA2B,GAC5B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAelG,IAAI,SAAS,GAAoC,IAAI,CAAC;AAEtD;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAkC;IACrE,SAAS,GAAG,QAAQ,CAAC;AACvB,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,sBAAsB;IACpC,SAAS,GAAG,IAAI,CAAC;AACnB,CAAC;AA0BD;;;;GAIG;AACH,MAAM,UAAU,kCAAkC,CAChD,GAA8B,EAC9B,kBAA0B,EAC1B,mBAA2B;IAE3B,IAAI,kBAAkB,KAAK,mBAAmB;QAAE,OAAO,IAAI,CAAC;IAC5D,sBAAsB,CAAC,GAAG,EAAE;QAC1B,aAAa,EAAE,YAAY;QAC3B,UAAU,EAAE,qBAAqB;QACjC,OAAO,EAAE,MAAM;KAChB,CAAC,CAAC;IACH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;IACjB,GAAG,CAAC,IAAI,GAAG;QACT,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,wCAAwC;KAClD,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC;AAmBD,8EAA8E;AAC9E,gCAAgC;AAChC,8EAA8E;AAE9E,+EAA+E;AAC/E,MAAM,sBAAsB,GAAG,aAAa,CAAC;AAE7C;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,oEAAoE;QACpE,yDAAyD;QACzD,oEAAoE;QACpE,MAAM,UAAU,GAAG,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC5C,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACrD,sBAAsB,CAAC,GAAG,EAAE;gBAC1B,aAAa,EAAE,gBAAgB;gBAC/B,UAAU,EAAE,yBAAyB;gBACrC,OAAO,EAAE,MAAM;aAChB,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG;gBACT,KAAK,EAAE,yBAAyB;gBAChC,OAAO,EAAE,yCAAyC;aACnD,CAAC;YACF,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,0BAA0B;QAE7D,oEAAoE;QACpE,yDAAyD;QACzD,oEAAoE;QACpE,mCAAmC;QACnC,0EAA0E;QAC1E,oEAAoE;QACpE,qEAAqE;QACrE,qEAAqE;QACrE,sEAAsE;QACtE,mEAAmE;QACnE,mDAAmD;QACnD,oEAAoE;QACpE,oEAAoE;QACpE,yEAAyE;QACzE,qEAAqE;QACrE,sEAAsE;QACtE,8DAA8D;QAC9D,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;YAC1D,sBAAsB,CAAC,GAAG,EAAE;gBAC1B,aAAa,EAAE,SAAS;gBACxB,UAAU,EAAE,gBAAgB;gBAC5B,OAAO,EAAE,OAAO;aACjB,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;YACnD,OAAO;QACT,CAAC;QAED,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC5D,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC;gBAC3C,MAAM,CAAC,KAAK,CAAC,yDAAyD,CAAC,CAAC;gBACxE,sBAAsB,CAAC,GAAG,EAAE;oBAC1B,aAAa,EAAE,gBAAgB;oBAC/B,UAAU,EAAE,yBAAyB;oBACrC,OAAO,EAAE,MAAM;iBAChB,CAAC,CAAC;gBACH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;gBACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC;gBAC1E,OAAO;YACT,CAAC;YACD,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;YACrE,gDAAgD;YAChD,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,EAAE,6BAA6B,CAAC,CAAC;YACtF,sBAAsB,CAAC,GAAG,EAAE;gBAC1B,aAAa,EAAE,gBAAgB;gBAC/B,UAAU,EAAE,yBAAyB;gBACrC,OAAO,EAAE,MAAM;aAChB,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC;YAC1E,OAAO;QACT,CAAC;QAED,oEAAoE;QACpE,2CAA2C;QAC3C,oEAAoE;QACpE,+DAA+D;QAC/D,MAAM,aAAa,GAAG,MAAM,0BAA0B,EAAE,CAAC;QACzD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,uDAAuD;YACvD,MAAM,CAAC,KAAK,CAAC,iEAAiE,CAAC,CAAC;YAChF,sBAAsB,CAAC,GAAG,EAAE;gBAC1B,aAAa,EAAE,SAAS;gBACxB,UAAU,EAAE,gBAAgB;gBAC5B,OAAO,EAAE,OAAO;aACjB,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;YACnD,OAAO;QACT,CAAC;QAED,oEAAoE;QACpE,wCAAwC;QACxC,oEAAoE;QACpE,oEAAoE;QACpE,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,sBAAsB,CAAC,GAAG,EAAE;gBAC1B,aAAa,EAAE,gBAAgB;gBAC/B,UAAU,EAAE,yBAAyB;gBACrC,OAAO,EAAE,MAAM;aAChB,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC;YAC1E,OAAO;QACT,CAAC;QAED,oEAAoE;QACpE,8DAA8D;QAC9D,oEAAoE;QACpE,IAAI,CAAC,kCAAkC,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,aAAa,CAAC,EAAE,CAAC;YAAE,OAAO;QAE5F,oEAAoE;QACpE,sFAAsF;QACtF,oEAAoE;QACpE,MAAM,gBAAgB,GAAG,MAAM,oBAAoB,CAAC,sBAAsB,CAAC,CAAC;QAC5E,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,MAAM,CAAC,KAAK,CAAC,8DAA8D,CAAC,CAAC;YAC7E,sBAAsB,CAAC,GAAG,EAAE;gBAC1B,aAAa,EAAE,SAAS;gBACxB,UAAU,EAAE,gBAAgB;gBAC5B,OAAO,EAAE,OAAO;aACjB,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;YACnD,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,wBAAwB,CAAC,MAAM,CAAC,CAAC;QACzD,MAAM,cAAc,GAAG,SAAS;aAC7B,MAAM,CACL,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,aAAa,KAAK,gBAAgB,CAAC,EAAE;YAC1C,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CACnD;aACA,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAE5B,uBAAuB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC9C,uBAAuB,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QAE5D,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,sBAAsB,CAAC,GAAG,EAAE;gBAC1B,aAAa,EAAE,YAAY;gBAC3B,UAAU,EAAE,qBAAqB;gBACjC,OAAO,EAAE,MAAM;aAChB,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,wCAAwC,EAAE,CAAC;YACrF,OAAO;QACT,CAAC;QAED,oEAAoE;QACpE,mDAAmD;QACnD,oEAAoE;QACpE,MAAM,WAAW,GAAG,2BAA2B,CAAC,cAAc,CAAC,CAAC;QAEhE,oEAAoE;QACpE,8DAA8D;QAC9D,oEAAoE;QACpE,GAAG,CAAC,KAAK,CAAC,SAAS,GAAG;YACpB,EAAE,EAAE,MAAM;YACV,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,KAAK,EAAE,cAAc;YACrB,WAAW;SACQ,CAAC;QAEtB,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/admin-cors.d.ts

@@ -12,9 +12,9 @@
  * Non-browser clients (CLI, same-origin requests) never send an `Origin`
  * header, so they pass through this middleware untouched.
  *
- * Placement: mount after the admin metadata router and before
- * `setAdminAuthProvider()` — preflight `OPTIONS` requests don't carry
- * an `Authorization` header, so CORS must respond before auth runs.
+ * Placement: mount before Admin rate limiting, body parsing, and authentication.
+ * Preflight `OPTIONS` requests carry no `Authorization` header, so CORS must
+ * respond before authentication runs.
  *
  * @module middleware/admin-cors
  */

package/dist/middleware/admin-cors.js

@@ -12,9 +12,9 @@
  * Non-browser clients (CLI, same-origin requests) never send an `Origin`
  * header, so they pass through this middleware untouched.
  *
- * Placement: mount after the admin metadata router and before
- * `setAdminAuthProvider()` — preflight `OPTIONS` requests don't carry
- * an `Authorization` header, so CORS must respond before auth runs.
+ * Placement: mount before Admin rate limiting, body parsing, and authentication.
+ * Preflight `OPTIONS` requests carry no `Authorization` header, so CORS must
+ * respond before authentication runs.
  *
  * @module middleware/admin-cors
  */

package/dist/middleware/admin-mutation-audit.d.ts

@@ -2,8 +2,9 @@ import type { Middleware } from 'koa';
 /**
  * Atomically bind successful administrative mutations to one durable audit row.
  *
- * Bulk and import own specialized transaction/result semantics and are excluded here. Every other
- * state-changing admin request shares one request-local PostgreSQL client across repository calls.
+ * Bulk operations, portability and configuration updates own specialized transaction semantics and are
+ * excluded here. Every other state-changing admin request shares one request-local PostgreSQL
+ * client across repository calls.
  */
 export declare function adminMutationAudit(): Middleware;
 //# sourceMappingURL=admin-mutation-audit.d.ts.map

package/dist/middleware/admin-mutation-audit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin-mutation-audit.d.ts","sourceRoot":"","sources":["../../src/middleware/admin-mutation-audit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,KAAK,CAAC;AA2BtC;;;;;GAKG;AACH,wBAAgB,kBAAkB,IAAI,UAAU,CA2C/C"}
+{"version":3,"file":"admin-mutation-audit.d.ts","sourceRoot":"","sources":["../../src/middleware/admin-mutation-audit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,KAAK,CAAC;AAgCtC;;;;;;GAMG;AACH,wBAAgB,kBAAkB,IAAI,UAAU,CA+C/C"}

package/dist/middleware/admin-mutation-audit.js

@@ -2,7 +2,12 @@ import { writeAuditLogInTransaction } from '../lib/audit-log.js';
 import { getDatabaseTransactionClient, runDatabaseTransaction } from '../lib/database.js';
 import { normalizedRouteTemplate, recordSecurityDecision } from '../security/decision-context.js';
 const MUTATION_METHODS = new Set(['POST', 'PUT', 'PATCH', 'DELETE']);
-const SELF_MANAGED_MUTATION_PREFIXES = ['/api/admin/bulk', '/api/admin/import'];
+const SELF_MANAGED_MUTATION_PREFIXES = [
+    '/api/admin/bulk',
+    '/api/admin/import',
+    '/api/admin/export/manifest',
+    '/api/admin/config',
+];
 /** Internal signal used to roll back a handled non-success response without replacing its body. */
 class HandledMutationRejection extends Error {
 }
@@ -22,8 +27,9 @@ function ownsAdministrativeMutation(method, path) {
 /**
  * Atomically bind successful administrative mutations to one durable audit row.
  *
- * Bulk and import own specialized transaction/result semantics and are excluded here. Every other
- * state-changing admin request shares one request-local PostgreSQL client across repository calls.
+ * Bulk operations, portability and configuration updates own specialized transaction semantics and are
+ * excluded here. Every other state-changing admin request shares one request-local PostgreSQL
+ * client across repository calls.
  */
 export function adminMutationAudit() {
     return async (ctx, next) => {
@@ -42,9 +48,10 @@ export function adminMutationAudit() {
                 const actor = ctx.state.adminUser;
                 if (!actor)
                     throw new Error('Administrative mutation actor is unavailable');
+                const liveActor = await client.query('SELECT id, organization_id FROM users WHERE id = $1', [actor.id]);
                 await writeAuditLogInTransaction(client, {
-                    organizationId: actor.organizationId,
-                    actorId: actor.id,
+                    organizationId: liveActor.rows[0]?.organization_id,
+                    actorId: liveActor.rows[0]?.id,
                     eventType: 'admin.mutation.committed',
                     eventCategory: 'admin',
                     metadata: {

package/dist/middleware/admin-mutation-audit.js.map

@@ -1 +1 @@
-{"version":3,"file":"admin-mutation-audit.js","sourceRoot":"","sources":["../../src/middleware/admin-mutation-audit.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,4BAA4B,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC1F,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAElG,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AACrE,MAAM,8BAA8B,GAAG,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;AAEhF,mGAAmG;AACnG,MAAM,wBAAyB,SAAQ,KAAK;CAAG;AAE/C,yFAAyF;AACzF,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC5C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,CAAC;AACrE,CAAC;AAED,2FAA2F;AAC3F,SAAS,0BAA0B,CAAC,MAAc,EAAE,IAAY;IAC9D,OAAO,CACL,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC;QAC5B,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC;QAC9B,CAAC,8BAA8B,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAC1E,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,sBAAsB,CAAC,KAAK,IAAI,EAAE;gBACtC,MAAM,IAAI,EAAE,CAAC;gBACb,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG;oBAAE,MAAM,IAAI,wBAAwB,EAAE,CAAC;gBAE5D,MAAM,MAAM,GAAG,4BAA4B,EAAE,CAAC;gBAC9C,IAAI,CAAC,MAAM;oBAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;gBACnF,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;gBAClC,IAAI,CAAC,KAAK;oBAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;gBAC5E,MAAM,0BAA0B,CAAC,MAAM,EAAE;oBACvC,cAAc,EAAE,KAAK,CAAC,cAAc;oBACpC,OAAO,EAAE,KAAK,CAAC,EAAE;oBACjB,SAAS,EAAE,0BAA0B;oBACrC,aAAa,EAAE,OAAO;oBACtB,QAAQ,EAAE;wBACR,MAAM,EAAE,GAAG,CAAC,MAAM;wBAClB,aAAa,EAAE,uBAAuB,CAAC,GAAG,CAAC;qBAC5C;iBACF,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,wBAAwB;gBAAE,OAAO;YACtD,IAAI,iBAAiB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC1C,sBAAsB,CAAC,GAAG,EAAE;gBAC1B,aAAa,EAAE,SAAS;gBACxB,UAAU,EAAE,gBAAgB;gBAC5B,OAAO,EAAE,OAAO;aACjB,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG;gBACT,KAAK,EAAE,+CAA+C;gBACtD,IAAI,EAAE,4BAA4B;gBAClC,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,SAAS;aAC/B,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"admin-mutation-audit.js","sourceRoot":"","sources":["../../src/middleware/admin-mutation-audit.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,4BAA4B,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC1F,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAElG,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AACrE,MAAM,8BAA8B,GAAG;IACrC,iBAAiB;IACjB,mBAAmB;IACnB,4BAA4B;IAC5B,mBAAmB;CACpB,CAAC;AAEF,mGAAmG;AACnG,MAAM,wBAAyB,SAAQ,KAAK;CAAG;AAE/C,yFAAyF;AACzF,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC5C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,CAAC;AACrE,CAAC;AAED,2FAA2F;AAC3F,SAAS,0BAA0B,CAAC,MAAc,EAAE,IAAY;IAC9D,OAAO,CACL,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC;QAC5B,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC;QAC9B,CAAC,8BAA8B,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAC1E,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,sBAAsB,CAAC,KAAK,IAAI,EAAE;gBACtC,MAAM,IAAI,EAAE,CAAC;gBACb,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG;oBAAE,MAAM,IAAI,wBAAwB,EAAE,CAAC;gBAE5D,MAAM,MAAM,GAAG,4BAA4B,EAAE,CAAC;gBAC9C,IAAI,CAAC,MAAM;oBAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;gBACnF,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;gBAClC,IAAI,CAAC,KAAK;oBAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;gBAC5E,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAClC,qDAAqD,EACrD,CAAC,KAAK,CAAC,EAAE,CAAC,CACX,CAAC;gBACF,MAAM,0BAA0B,CAAC,MAAM,EAAE;oBACvC,cAAc,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,eAAe;oBAClD,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;oBAC9B,SAAS,EAAE,0BAA0B;oBACrC,aAAa,EAAE,OAAO;oBACtB,QAAQ,EAAE;wBACR,MAAM,EAAE,GAAG,CAAC,MAAM;wBAClB,aAAa,EAAE,uBAAuB,CAAC,GAAG,CAAC;qBAC5C;iBACF,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,wBAAwB;gBAAE,OAAO;YACtD,IAAI,iBAAiB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC1C,sBAAsB,CAAC,GAAG,EAAE;gBAC1B,aAAa,EAAE,SAAS;gBACxB,UAAU,EAAE,gBAAgB;gBAC5B,OAAO,EAAE,OAAO;aACjB,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG;gBACT,KAAK,EAAE,+CAA+C;gBACtD,IAAI,EAAE,4BAA4B;gBAClC,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,SAAS;aAC/B,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/admin-rate-limiter.d.ts

@@ -5,11 +5,10 @@
  * `/api/admin/*`) against brute-force attacks and automated abuse.
  * GET requests are read-only and pass through without rate limiting.
  *
- * Key format: `ratelimit:admin:{ip}` — per-IP only since admin-auth
- * already restricts access to authenticated super-admin users.  There
- * is no per-user key because the IP-based counter is sufficient:
- * legitimate admins won't make 60 write requests per minute, and
- * attackers from the same IP are blocked regardless of identity.
+ * Key format: `ratelimit:admin:{ip}`. The limiter intentionally runs before
+ * body parsing and authentication so rejected large requests consume minimal
+ * resources. A per-IP counter covers both unauthenticated abuse and legitimate
+ * administrators without requiring an authenticated user identifier.
  *
  * Limit: 60 requests / 60 seconds (sliding window).
  *
@@ -17,9 +16,9 @@
  * provides Redis INCR+EXPIRE sliding window and graceful degradation
  * on Redis failure (allows request + logs warning).
  *
- * Placement: mount as global middleware in `src/server.ts` before the
- * admin route routers.  The path + method check ensures only write
- * requests to `/api/admin/*` are counted.
+ * Placement: mount after Admin CORS and before body parsing, authentication,
+ * and Admin route routers. The path + method check ensures only write requests
+ * to `/api/admin/*` are counted.
  *
  * @module middleware/admin-rate-limiter
  */

package/dist/middleware/admin-rate-limiter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin-rate-limiter.d.ts","sourceRoot":"","sources":["../../src/middleware/admin-rate-limiter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,KAAK,CAAC;AAEtC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAO/D,wCAAwC;AACxC,eAAO,MAAM,iBAAiB,gBAAgB,CAAC;AAE/C;;;GAGG;AACH,eAAO,MAAM,mBAAmB,aAA8C,CAAC;AAE/E;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,EAAE,eAG9B,CAAC;AAMF;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,IAAI,UAAU,CAyC7C"}
+{"version":3,"file":"admin-rate-limiter.d.ts","sourceRoot":"","sources":["../../src/middleware/admin-rate-limiter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,KAAK,CAAC;AAEtC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAO/D,wCAAwC;AACxC,eAAO,MAAM,iBAAiB,gBAAgB,CAAC;AAE/C;;;GAGG;AACH,eAAO,MAAM,mBAAmB,aAA8C,CAAC;AAE/E;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,EAAE,eAG9B,CAAC;AAMF;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,IAAI,UAAU,CAyC7C"}

package/dist/middleware/admin-rate-limiter.js

@@ -5,11 +5,10 @@
  * `/api/admin/*`) against brute-force attacks and automated abuse.
  * GET requests are read-only and pass through without rate limiting.
  *
- * Key format: `ratelimit:admin:{ip}` — per-IP only since admin-auth
- * already restricts access to authenticated super-admin users.  There
- * is no per-user key because the IP-based counter is sufficient:
- * legitimate admins won't make 60 write requests per minute, and
- * attackers from the same IP are blocked regardless of identity.
+ * Key format: `ratelimit:admin:{ip}`. The limiter intentionally runs before
+ * body parsing and authentication so rejected large requests consume minimal
+ * resources. A per-IP counter covers both unauthenticated abuse and legitimate
+ * administrators without requiring an authenticated user identifier.
  *
  * Limit: 60 requests / 60 seconds (sliding window).
  *
@@ -17,9 +16,9 @@
  * provides Redis INCR+EXPIRE sliding window and graceful degradation
  * on Redis failure (allows request + logs warning).
  *
- * Placement: mount as global middleware in `src/server.ts` before the
- * admin route routers.  The path + method check ensures only write
- * requests to `/api/admin/*` are counted.
+ * Placement: mount after Admin CORS and before body parsing, authentication,
+ * and Admin route routers. The path + method check ensures only write requests
+ * to `/api/admin/*` are counted.
  *
  * @module middleware/admin-rate-limiter
  */

package/dist/middleware/admin-rate-limiter.js.map

@@ -1 +1 @@
-{"version":3,"file":"admin-rate-limiter.js","sourceRoot":"","sources":["../../src/middleware/admin-rate-limiter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAEzD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C,8EAA8E;AAC9E,6DAA6D;AAC7D,8EAA8E;AAE9E,wCAAwC;AACxC,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAa,CAAC;AAE/C;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAE/E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAoB;IAC/C,GAAG,EAAE,EAAE;IACP,aAAa,EAAE,EAAE;CAClB,CAAC;AAEF,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,KAAK,UAAU,0BAA0B,CAAC,GAAG,EAAE,IAAI;QACxD,8DAA8D;QAC9D,mEAAmE;QACnE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACpF,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,kEAAkE;QAClE,8DAA8D;QAC9D,sDAAsD;QACtD,MAAM,GAAG,GAAG,mBAAmB,GAAG,CAAC,EAAE,EAAE,CAAC;QAExC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QAE3D,+DAA+D;QAC/D,iDAAiD;QACjD,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QAE3D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,CACT;gBACE,MAAM,EAAE,2BAA2B;gBACnC,MAAM,EAAE,GAAG,CAAC,MAAM;aACnB,EACD,+BAA+B,CAChC,CAAC;YAEF,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;YAClD,GAAG,CAAC,IAAI,GAAG;gBACT,KAAK,EAAE,mBAAmB;gBAC1B,OAAO,EAAE,wDAAwD;gBACjE,WAAW,EAAE,MAAM,CAAC,UAAU;aAC/B,CAAC;YACF,OAAO;QACT,CAAC;QAED,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"admin-rate-limiter.js","sourceRoot":"","sources":["../../src/middleware/admin-rate-limiter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAEzD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C,8EAA8E;AAC9E,6DAA6D;AAC7D,8EAA8E;AAE9E,wCAAwC;AACxC,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAa,CAAC;AAE/C;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAE/E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAoB;IAC/C,GAAG,EAAE,EAAE;IACP,aAAa,EAAE,EAAE;CAClB,CAAC;AAEF,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,KAAK,UAAU,0BAA0B,CAAC,GAAG,EAAE,IAAI;QACxD,8DAA8D;QAC9D,mEAAmE;QACnE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACpF,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,kEAAkE;QAClE,8DAA8D;QAC9D,sDAAsD;QACtD,MAAM,GAAG,GAAG,mBAAmB,GAAG,CAAC,EAAE,EAAE,CAAC;QAExC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QAE3D,+DAA+D;QAC/D,iDAAiD;QACjD,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QAE3D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,CACT;gBACE,MAAM,EAAE,2BAA2B;gBACnC,MAAM,EAAE,GAAG,CAAC,MAAM;aACnB,EACD,+BAA+B,CAChC,CAAC;YAEF,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;YAClD,GAAG,CAAC,IAAI,GAAG;gBACT,KAAK,EAAE,mBAAmB;gBAC1B,OAAO,EAAE,wDAAwD;gBACjE,WAAW,EAAE,MAAM,CAAC,UAAU;aAC/B,CAAC;YACF,OAAO;QACT,CAAC;QAED,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/client-secret-hash.d.ts

@@ -1,34 +1,15 @@
-/**
- * SHA-256 client secret pre-hashing middleware.
- *
- * Transforms client_secret values in incoming requests by replacing
- * the plaintext with its SHA-256 hash BEFORE oidc-provider processes them.
- *
- * Supports:
- * - client_secret_basic: Authorization: Basic base64(client_id:secret)
- * - client_secret_post: client_secret in POST body
- *
- * This allows oidc-provider's built-in string comparison to work
- * with our SHA-256-hashed secret storage — no monkey-patching needed.
- *
- * How it works:
- * 1. At secret generation: SHA-256(secret) is stored in the DB
- * 2. At request time: This middleware hashes the presented secret
- * 3. In the adapter: findForOidc() returns SHA-256 hash as client_secret
- * 4. oidc-provider compares: SHA-256(presented) === SHA-256(stored) → ✅ MATCH
- *
- * Security: SHA-256 is appropriate for machine-generated, high-entropy
- * client secrets (48 bytes / 384 bits of randomness).
- */
+/** Confidential-client active-secret bridge for oidc-provider. */
 import type { Middleware } from 'koa';
+/** Optional controls for the active-secret bridge. */
+export interface ClientSecretBridgeOptions {
+    /** Credential-free test hook awaited after validation and immediately before provider handoff. */
+    afterCredentialValidation?: () => Promise<void>;
+}
 /**
- * Create middleware that pre-hashes client secrets with SHA-256.
- *
- * Must be mounted BEFORE oidc-provider's callback handler on the
- * OIDC router. Transparently transforms secrets so oidc-provider
- * can compare them against stored SHA-256 hashes.
+ * Create the bounded active-secret bridge mounted immediately before oidc-provider.
  *
- * @returns Koa middleware function
+ * @param options - Optional credential-free validation/handoff test hook
+ * @returns Koa middleware
  */
-export declare function clientSecretHash(): Middleware;
+export declare function clientSecretHash(options?: ClientSecretBridgeOptions): Middleware;
 //# sourceMappingURL=client-secret-hash.d.ts.map

package/dist/middleware/client-secret-hash.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client-secret-hash.d.ts","sourceRoot":"","sources":["../../src/middleware/client-secret-hash.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,KAAK,CAAC;AAStC;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,IAAI,UAAU,CAqC7C"}
+{"version":3,"file":"client-secret-hash.d.ts","sourceRoot":"","sources":["../../src/middleware/client-secret-hash.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAElE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,KAAK,CAAC;AAiBtC,sDAAsD;AACtD,MAAM,WAAW,yBAAyB;IACxC,kGAAkG;IAClG,yBAAyB,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CACjD;AA6HD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,GAAE,yBAA8B,GAAG,UAAU,CAoEpF"}

package/dist/middleware/client-secret-hash.js

@@ -1,74 +1,176 @@
-/**
- * SHA-256 client secret pre-hashing middleware.
- *
- * Transforms client_secret values in incoming requests by replacing
- * the plaintext with its SHA-256 hash BEFORE oidc-provider processes them.
- *
- * Supports:
- * - client_secret_basic: Authorization: Basic base64(client_id:secret)
- * - client_secret_post: client_secret in POST body
- *
- * This allows oidc-provider's built-in string comparison to work
- * with our SHA-256-hashed secret storage — no monkey-patching needed.
- *
- * How it works:
- * 1. At secret generation: SHA-256(secret) is stored in the DB
- * 2. At request time: This middleware hashes the presented secret
- * 3. In the adapter: findForOidc() returns SHA-256 hash as client_secret
- * 4. oidc-provider compares: SHA-256(presented) === SHA-256(stored) → ✅ MATCH
- *
- * Security: SHA-256 is appropriate for machine-generated, high-entropy
- * client secrets (48 bytes / 384 bits of randomness).
- */
-import { createHash } from 'node:crypto';
-/**
- * Compute SHA-256 hash of a string, returned as hex.
- */
-function sha256(input) {
-    return createHash('sha256').update(input).digest('hex');
+/** Confidential-client active-secret bridge for oidc-provider. */
+import * as clientCrypto from '../clients/crypto.js';
+import { getClientByClientId } from '../clients/service.js';
+import { findActiveSecretIdBySha256, getActiveLegacySecretHashes, getLatestActiveSha256, } from '../clients/secret-repository.js';
+import { checkRateLimitStrict } from '../auth/rate-limiter.js';
+import { TOKEN_RATE_LIMIT } from './token-rate-limiter.js';
+const MAX_CLIENT_ID_LENGTH = 255;
+const MAX_SECRET_LENGTH = 512;
+const BUSY_RETRY_SECONDS = 1;
+let legacyBatchActive = false;
+/** Identify a plain request-body record without coercing arrays or scalar values. */
+function isRequestBody(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/** Return a parsed object body without coercing arrays or scalar values. */
+function requestBody(ctx) {
+    const body = ctx.request.body;
+    return isRequestBody(body) ? body : undefined;
+}
+/** Parse bounded HTTP Basic credentials while leaving malformed input to the provider. */
+function basicCredential(ctx) {
+    const authorization = ctx.headers.authorization;
+    if (authorization === undefined || !authorization.startsWith('Basic '))
+        return undefined;
+    try {
+        const decoded = Buffer.from(authorization.slice(6), 'base64').toString('utf8');
+        const separator = decoded.indexOf(':');
+        const clientId = decoded.slice(0, separator);
+        const plaintext = decoded.slice(separator + 1);
+        if (separator < 1 ||
+            clientId.length > MAX_CLIENT_ID_LENGTH ||
+            plaintext.length < 1 ||
+            plaintext.length > MAX_SECRET_LENGTH) {
+            return undefined;
+        }
+        return {
+            clientId,
+            plaintext,
+            method: 'client_secret_basic',
+            replace(canonicalValue) {
+                const encoded = Buffer.from(`${clientId}:${canonicalValue}`).toString('base64');
+                ctx.headers.authorization = `Basic ${encoded}`;
+                ctx.req.headers.authorization = `Basic ${encoded}`;
+            },
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Parse bounded form credentials from the body already parsed by the OIDC router. */
+function postCredential(ctx) {
+    const body = requestBody(ctx);
+    const clientId = body?.client_id;
+    const plaintext = body?.client_secret;
+    if (body === undefined ||
+        typeof clientId !== 'string' ||
+        clientId.length < 1 ||
+        clientId.length > MAX_CLIENT_ID_LENGTH ||
+        typeof plaintext !== 'string' ||
+        plaintext.length < 1 ||
+        plaintext.length > MAX_SECRET_LENGTH) {
+        return undefined;
+    }
+    const mutableBody = body;
+    return {
+        clientId,
+        plaintext,
+        method: 'client_secret_post',
+        replace(canonicalValue) {
+            mutableBody.client_secret = canonicalValue;
+            const rawBody = Reflect.get(ctx.req, 'body');
+            if (typeof rawBody === 'object' && rawBody !== null && !Array.isArray(rawBody)) {
+                Reflect.set(rawBody, 'client_secret', canonicalValue);
+            }
+        },
+    };
+}
+/** Return one supported credential source and reject ambiguous dual-mechanism input. */
+function presentedCredential(ctx) {
+    const basic = basicCredential(ctx);
+    const post = postCredential(ctx);
+    if (basic !== undefined && post !== undefined)
+        return undefined;
+    return basic ?? post;
+}
+/** Return the resolved tenant identifier without trusting request-controlled text. */
+function organizationId(ctx) {
+    const organization = ctx.state?.organization;
+    if (typeof organization !== 'object' || organization === null || Array.isArray(organization)) {
+        return undefined;
+    }
+    const id = Reflect.get(organization, 'id');
+    return typeof id === 'string' && id.length > 0 ? id : undefined;
+}
+/** Emit the existing fixed token rate-limit response without credential detail. */
+function denyProtectedWork(ctx, retryAfter) {
+    ctx.status = 429;
+    ctx.set('Retry-After', String(retryAfter));
+    ctx.body = {
+        error: 'rate_limit_exceeded',
+        error_description: 'Too many token requests. Please try again later.',
+        retry_after: retryAfter,
+    };
+}
+/** Rewrite a proven credential and continue to oidc-provider. */
+async function handOffValidatedCredential(credential, canonicalValue, options, next) {
+    credential.replace(canonicalValue);
+    await options.afterCredentialValidation?.();
+    await next();
 }
 /**
- * Create middleware that pre-hashes client secrets with SHA-256.
+ * Create the bounded active-secret bridge mounted immediately before oidc-provider.
  *
- * Must be mounted BEFORE oidc-provider's callback handler on the
- * OIDC router. Transparently transforms secrets so oidc-provider
- * can compare them against stored SHA-256 hashes.
- *
- * @returns Koa middleware function
+ * @param options - Optional credential-free validation/handoff test hook
+ * @returns Koa middleware
  */
-export function clientSecretHash() {
+export function clientSecretHash(options = {}) {
     return async (ctx, next) => {
-        // Handle client_secret_basic: Authorization: Basic base64(client_id:secret)
-        const authHeader = ctx.headers.authorization;
-        if (authHeader && authHeader.startsWith('Basic ')) {
+        const credential = presentedCredential(ctx);
+        const tenantId = organizationId(ctx);
+        if (credential === undefined || tenantId === undefined)
+            return next();
+        try {
+            const client = await getClientByClientId(credential.clientId);
+            if (client === null ||
+                client.organizationId !== tenantId ||
+                client.clientType !== 'confidential' ||
+                client.status !== 'active' ||
+                client.tokenEndpointAuthMethod !== credential.method) {
+                return next();
+            }
+            const canonicalValue = await getLatestActiveSha256(client.id);
+            if (canonicalValue === null)
+                return next();
+            const presentedSha256 = clientCrypto.sha256Secret(credential.plaintext);
+            const modernMatchId = await findActiveSecretIdBySha256(client.id, presentedSha256);
+            if (modernMatchId !== null) {
+                return handOffValidatedCredential(credential, canonicalValue, options, next);
+            }
+            const legacySecrets = await getActiveLegacySecretHashes(client.id);
+            if (legacySecrets.length === 0 || legacySecrets.length > 10)
+                return next();
+            if (legacyBatchActive) {
+                denyProtectedWork(ctx, BUSY_RETRY_SECONDS);
+                return;
+            }
+            legacyBatchActive = true;
+            let legacyMatched = false;
             try {
-                const encoded = authHeader.slice(6); // strip 'Basic '
-                const decoded = Buffer.from(encoded, 'base64').toString('utf8');
-                const colonIndex = decoded.indexOf(':');
-                if (colonIndex !== -1) {
-                    const clientId = decoded.slice(0, colonIndex);
-                    const secret = decoded.slice(colonIndex + 1);
-                    if (secret.length > 0) {
-                        // Hash the secret and re-encode the Basic auth header
-                        const hashedSecret = sha256(secret);
-                        const newEncoded = Buffer.from(`${clientId}:${hashedSecret}`).toString('base64');
-                        ctx.headers.authorization = `Basic ${newEncoded}`;
-                        // Also update the raw request header for oidc-provider
-                        ctx.req.headers.authorization = `Basic ${newEncoded}`;
+                const limit = await checkRateLimitStrict(`ratelimit:client-secret-legacy:${tenantId}:${client.id}`, TOKEN_RATE_LIMIT);
+                if (!limit.allowed) {
+                    denyProtectedWork(ctx, limit.retryAfter);
+                    return;
+                }
+                for (const legacy of legacySecrets) {
+                    if (await clientCrypto.verifySecretHash(legacy.hash, credential.plaintext)) {
+                        legacyMatched = true;
+                        break;
                     }
                 }
             }
-            catch {
-                // Malformed Basic auth — let oidc-provider handle the error
+            finally {
+                legacyBatchActive = false;
+            }
+            if (legacyMatched) {
+                return handOffValidatedCredential(credential, canonicalValue, options, next);
             }
         }
-        // Handle client_secret_post: client_secret in POST body
-        // eslint-disable-next-line @typescript-eslint/no-explicit-any
-        const body = ctx.request.body;
-        if (body && typeof body.client_secret === 'string' && body.client_secret.length > 0) {
-            body.client_secret = sha256(body.client_secret);
+        catch {
+            // Fail closed by leaving the credential untouched for the provider's minimal rejection.
         }
-        await next();
+        return next();
     };
 }
 //# sourceMappingURL=client-secret-hash.js.map

package/dist/middleware/client-secret-hash.js.map

@@ -1 +1 @@
-{"version":3,"file":"client-secret-hash.js","sourceRoot":"","sources":["../../src/middleware/client-secret-hash.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC;;GAEG;AACH,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,4EAA4E;QAC5E,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QAC7C,IAAI,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClD,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB;gBACtD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAChE,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAExC,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;oBACtB,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;oBAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;oBAE7C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACtB,sDAAsD;wBACtD,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;wBACpC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;wBACjF,GAAG,CAAC,OAAO,CAAC,aAAa,GAAG,SAAS,UAAU,EAAE,CAAC;wBAClD,uDAAuD;wBACvD,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,GAAG,SAAS,UAAU,EAAE,CAAC;oBACxD,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,4DAA4D;YAC9D,CAAC;QACH,CAAC;QAED,wDAAwD;QACxD,8DAA8D;QAC9D,MAAM,IAAI,GAAI,GAAG,CAAC,OAAe,CAAC,IAAI,CAAC;QACvC,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpF,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"client-secret-hash.js","sourceRoot":"","sources":["../../src/middleware/client-secret-hash.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAIlE,OAAO,KAAK,YAAY,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EACL,0BAA0B,EAC1B,2BAA2B,EAC3B,qBAAqB,GACtB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE3D,MAAM,oBAAoB,GAAG,GAAG,CAAC;AACjC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAC7B,IAAI,iBAAiB,GAAG,KAAK,CAAC;AAgB9B,qFAAqF;AACrF,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,4EAA4E;AAC5E,SAAS,WAAW,CAAC,GAA8B;IACjD,MAAM,IAAI,GAAY,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;IACvC,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAChD,CAAC;AAED,0FAA0F;AAC1F,SAAS,eAAe,CAAC,GAA8B;IACrD,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IAChD,IAAI,aAAa,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IACzF,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC/E,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;QAC/C,IACE,SAAS,GAAG,CAAC;YACb,QAAQ,CAAC,MAAM,GAAG,oBAAoB;YACtC,SAAS,CAAC,MAAM,GAAG,CAAC;YACpB,SAAS,CAAC,MAAM,GAAG,iBAAiB,EACpC,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO;YACL,QAAQ;YACR,SAAS;YACT,MAAM,EAAE,qBAAqB;YAC7B,OAAO,CAAC,cAAc;gBACpB,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,cAAc,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBAChF,GAAG,CAAC,OAAO,CAAC,aAAa,GAAG,SAAS,OAAO,EAAE,CAAC;gBAC/C,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,GAAG,SAAS,OAAO,EAAE,CAAC;YACrD,CAAC;SACF,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,sFAAsF;AACtF,SAAS,cAAc,CAAC,GAA8B;IACpD,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,QAAQ,GAAG,IAAI,EAAE,SAAS,CAAC;IACjC,MAAM,SAAS,GAAG,IAAI,EAAE,aAAa,CAAC;IACtC,IACE,IAAI,KAAK,SAAS;QAClB,OAAO,QAAQ,KAAK,QAAQ;QAC5B,QAAQ,CAAC,MAAM,GAAG,CAAC;QACnB,QAAQ,CAAC,MAAM,GAAG,oBAAoB;QACtC,OAAO,SAAS,KAAK,QAAQ;QAC7B,SAAS,CAAC,MAAM,GAAG,CAAC;QACpB,SAAS,CAAC,MAAM,GAAG,iBAAiB,EACpC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,CAAC;IACzB,OAAO;QACL,QAAQ;QACR,SAAS;QACT,MAAM,EAAE,oBAAoB;QAC5B,OAAO,CAAC,cAAc;YACpB,WAAW,CAAC,aAAa,GAAG,cAAc,CAAC;YAC3C,MAAM,OAAO,GAAY,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACtD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC/E,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,eAAe,EAAE,cAAc,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,wFAAwF;AACxF,SAAS,mBAAmB,CAAC,GAA8B;IACzD,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAChE,OAAO,KAAK,IAAI,IAAI,CAAC;AACvB,CAAC;AAED,sFAAsF;AACtF,SAAS,cAAc,CAAC,GAA8B;IACpD,MAAM,YAAY,GAAY,GAAG,CAAC,KAAK,EAAE,YAAY,CAAC;IACtD,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7F,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,EAAE,GAAY,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IACpD,OAAO,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAClE,CAAC;AAED,mFAAmF;AACnF,SAAS,iBAAiB,CAAC,GAA8B,EAAE,UAAkB;IAC3E,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;IACjB,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IAC3C,GAAG,CAAC,IAAI,GAAG;QACT,KAAK,EAAE,qBAAqB;QAC5B,iBAAiB,EAAE,kDAAkD;QACrE,WAAW,EAAE,UAAU;KACxB,CAAC;AACJ,CAAC;AAED,iEAAiE;AACjE,KAAK,UAAU,0BAA0B,CACvC,UAA+B,EAC/B,cAAsB,EACtB,OAAkC,EAClC,IAA+B;IAE/B,UAAU,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACnC,MAAM,OAAO,CAAC,yBAAyB,EAAE,EAAE,CAAC;IAC5C,MAAM,IAAI,EAAE,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAO,GAA8B,EAAE;IACtE,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,UAAU,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,UAAU,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,IAAI,EAAE,CAAC;QAEtE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YAC9D,IACE,MAAM,KAAK,IAAI;gBACf,MAAM,CAAC,cAAc,KAAK,QAAQ;gBAClC,MAAM,CAAC,UAAU,KAAK,cAAc;gBACpC,MAAM,CAAC,MAAM,KAAK,QAAQ;gBAC1B,MAAM,CAAC,uBAAuB,KAAK,UAAU,CAAC,MAAM,EACpD,CAAC;gBACD,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;YAED,MAAM,cAAc,GAAG,MAAM,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC9D,IAAI,cAAc,KAAK,IAAI;gBAAE,OAAO,IAAI,EAAE,CAAC;YAE3C,MAAM,eAAe,GAAG,YAAY,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACxE,MAAM,aAAa,GAAG,MAAM,0BAA0B,CAAC,MAAM,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;YACnF,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;gBAC3B,OAAO,0BAA0B,CAC/B,UAAU,EACV,cAAc,EACd,OAAO,EACP,IAAI,CACL,CAAC;YACJ,CAAC;YAED,MAAM,aAAa,GAAG,MAAM,2BAA2B,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACnE,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,aAAa,CAAC,MAAM,GAAG,EAAE;gBAAE,OAAO,IAAI,EAAE,CAAC;YAC3E,IAAI,iBAAiB,EAAE,CAAC;gBACtB,iBAAiB,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;gBAC3C,OAAO;YACT,CAAC;YAED,iBAAiB,GAAG,IAAI,CAAC;YACzB,IAAI,aAAa,GAAG,KAAK,CAAC;YAC1B,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,oBAAoB,CACtC,kCAAkC,QAAQ,IAAI,MAAM,CAAC,EAAE,EAAE,EACzD,gBAAgB,CACjB,CAAC;gBACF,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;oBACnB,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;oBACzC,OAAO;gBACT,CAAC;gBAED,KAAK,MAAM,MAAM,IAAI,aAAa,EAAE,CAAC;oBACnC,IAAI,MAAM,YAAY,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;wBAC3E,aAAa,GAAG,IAAI,CAAC;wBACrB,MAAM;oBACR,CAAC;gBACH,CAAC;YACH,CAAC;oBAAS,CAAC;gBACT,iBAAiB,GAAG,KAAK,CAAC;YAC5B,CAAC;YACD,IAAI,aAAa,EAAE,CAAC;gBAClB,OAAO,0BAA0B,CAAC,UAAU,EAAE,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;YAC/E,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wFAAwF;QAC1F,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}