@portaidentity/server 1.7.3 → 1.9.0

package/dist/middleware/admin-rate-limiter.d.ts

@@ -5,11 +5,10 @@
  * `/api/admin/*`) against brute-force attacks and automated abuse.
  * GET requests are read-only and pass through without rate limiting.
  *
- * Key format: `ratelimit:admin:{ip}` — per-IP only since admin-auth
- * already restricts access to authenticated super-admin users.  There
- * is no per-user key because the IP-based counter is sufficient:
- * legitimate admins won't make 60 write requests per minute, and
- * attackers from the same IP are blocked regardless of identity.
+ * Key format: `ratelimit:admin:{ip}`. The limiter intentionally runs before
+ * body parsing and authentication so rejected large requests consume minimal
+ * resources. A per-IP counter covers both unauthenticated abuse and legitimate
+ * administrators without requiring an authenticated user identifier.
  *
  * Limit: 60 requests / 60 seconds (sliding window).
  *
@@ -17,9 +16,9 @@
  * provides Redis INCR+EXPIRE sliding window and graceful degradation
  * on Redis failure (allows request + logs warning).
  *
- * Placement: mount as global middleware in `src/server.ts` before the
- * admin route routers.  The path + method check ensures only write
- * requests to `/api/admin/*` are counted.
+ * Placement: mount after Admin CORS and before body parsing, authentication,
+ * and Admin route routers. The path + method check ensures only write requests
+ * to `/api/admin/*` are counted.
  *
  * @module middleware/admin-rate-limiter
  */

package/dist/middleware/admin-rate-limiter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin-rate-limiter.d.ts","sourceRoot":"","sources":["../../src/middleware/admin-rate-limiter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,KAAK,CAAC;AAEtC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAO/D,wCAAwC;AACxC,eAAO,MAAM,iBAAiB,gBAAgB,CAAC;AAE/C;;;GAGG;AACH,eAAO,MAAM,mBAAmB,aAA8C,CAAC;AAE/E;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,EAAE,eAG9B,CAAC;AAMF;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,IAAI,UAAU,CAyC7C"}
+{"version":3,"file":"admin-rate-limiter.d.ts","sourceRoot":"","sources":["../../src/middleware/admin-rate-limiter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,KAAK,CAAC;AAEtC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAO/D,wCAAwC;AACxC,eAAO,MAAM,iBAAiB,gBAAgB,CAAC;AAE/C;;;GAGG;AACH,eAAO,MAAM,mBAAmB,aAA8C,CAAC;AAE/E;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,EAAE,eAG9B,CAAC;AAMF;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,IAAI,UAAU,CAyC7C"}

package/dist/middleware/admin-rate-limiter.js

@@ -5,11 +5,10 @@
  * `/api/admin/*`) against brute-force attacks and automated abuse.
  * GET requests are read-only and pass through without rate limiting.
  *
- * Key format: `ratelimit:admin:{ip}` — per-IP only since admin-auth
- * already restricts access to authenticated super-admin users.  There
- * is no per-user key because the IP-based counter is sufficient:
- * legitimate admins won't make 60 write requests per minute, and
- * attackers from the same IP are blocked regardless of identity.
+ * Key format: `ratelimit:admin:{ip}`. The limiter intentionally runs before
+ * body parsing and authentication so rejected large requests consume minimal
+ * resources. A per-IP counter covers both unauthenticated abuse and legitimate
+ * administrators without requiring an authenticated user identifier.
  *
  * Limit: 60 requests / 60 seconds (sliding window).
  *
@@ -17,9 +16,9 @@
  * provides Redis INCR+EXPIRE sliding window and graceful degradation
  * on Redis failure (allows request + logs warning).
  *
- * Placement: mount as global middleware in `src/server.ts` before the
- * admin route routers.  The path + method check ensures only write
- * requests to `/api/admin/*` are counted.
+ * Placement: mount after Admin CORS and before body parsing, authentication,
+ * and Admin route routers. The path + method check ensures only write requests
+ * to `/api/admin/*` are counted.
  *
  * @module middleware/admin-rate-limiter
  */

package/dist/middleware/admin-rate-limiter.js.map

@@ -1 +1 @@
-{"version":3,"file":"admin-rate-limiter.js","sourceRoot":"","sources":["../../src/middleware/admin-rate-limiter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAEzD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C,8EAA8E;AAC9E,6DAA6D;AAC7D,8EAA8E;AAE9E,wCAAwC;AACxC,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAa,CAAC;AAE/C;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAE/E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAoB;IAC/C,GAAG,EAAE,EAAE;IACP,aAAa,EAAE,EAAE;CAClB,CAAC;AAEF,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,KAAK,UAAU,0BAA0B,CAAC,GAAG,EAAE,IAAI;QACxD,8DAA8D;QAC9D,mEAAmE;QACnE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACpF,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,kEAAkE;QAClE,8DAA8D;QAC9D,sDAAsD;QACtD,MAAM,GAAG,GAAG,mBAAmB,GAAG,CAAC,EAAE,EAAE,CAAC;QAExC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QAE3D,+DAA+D;QAC/D,iDAAiD;QACjD,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QAE3D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,CACT;gBACE,MAAM,EAAE,2BAA2B;gBACnC,MAAM,EAAE,GAAG,CAAC,MAAM;aACnB,EACD,+BAA+B,CAChC,CAAC;YAEF,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;YAClD,GAAG,CAAC,IAAI,GAAG;gBACT,KAAK,EAAE,mBAAmB;gBAC1B,OAAO,EAAE,wDAAwD;gBACjE,WAAW,EAAE,MAAM,CAAC,UAAU;aAC/B,CAAC;YACF,OAAO;QACT,CAAC;QAED,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"admin-rate-limiter.js","sourceRoot":"","sources":["../../src/middleware/admin-rate-limiter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAEzD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C,8EAA8E;AAC9E,6DAA6D;AAC7D,8EAA8E;AAE9E,wCAAwC;AACxC,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAa,CAAC;AAE/C;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAE/E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAoB;IAC/C,GAAG,EAAE,EAAE;IACP,aAAa,EAAE,EAAE;CAClB,CAAC;AAEF,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,KAAK,UAAU,0BAA0B,CAAC,GAAG,EAAE,IAAI;QACxD,8DAA8D;QAC9D,mEAAmE;QACnE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACpF,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,kEAAkE;QAClE,8DAA8D;QAC9D,sDAAsD;QACtD,MAAM,GAAG,GAAG,mBAAmB,GAAG,CAAC,EAAE,EAAE,CAAC;QAExC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QAE3D,+DAA+D;QAC/D,iDAAiD;QACjD,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QAE3D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,CACT;gBACE,MAAM,EAAE,2BAA2B;gBACnC,MAAM,EAAE,GAAG,CAAC,MAAM;aACnB,EACD,+BAA+B,CAChC,CAAC;YAEF,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;YAClD,GAAG,CAAC,IAAI,GAAG;gBACT,KAAK,EAAE,mBAAmB;gBAC1B,OAAO,EAAE,wDAAwD;gBACjE,WAAW,EAAE,MAAM,CAAC,UAAU;aAC/B,CAAC;YACF,OAAO;QACT,CAAC;QAED,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/client-secret-hash.d.ts

@@ -1,34 +1,15 @@
-/**
- * SHA-256 client secret pre-hashing middleware.
- *
- * Transforms client_secret values in incoming requests by replacing
- * the plaintext with its SHA-256 hash BEFORE oidc-provider processes them.
- *
- * Supports:
- * - client_secret_basic: Authorization: Basic base64(client_id:secret)
- * - client_secret_post: client_secret in POST body
- *
- * This allows oidc-provider's built-in string comparison to work
- * with our SHA-256-hashed secret storage — no monkey-patching needed.
- *
- * How it works:
- * 1. At secret generation: SHA-256(secret) is stored in the DB
- * 2. At request time: This middleware hashes the presented secret
- * 3. In the adapter: findForOidc() returns SHA-256 hash as client_secret
- * 4. oidc-provider compares: SHA-256(presented) === SHA-256(stored) → ✅ MATCH
- *
- * Security: SHA-256 is appropriate for machine-generated, high-entropy
- * client secrets (48 bytes / 384 bits of randomness).
- */
+/** Confidential-client active-secret bridge for oidc-provider. */
 import type { Middleware } from 'koa';
+/** Optional controls for the active-secret bridge. */
+export interface ClientSecretBridgeOptions {
+    /** Credential-free test hook awaited after validation and immediately before provider handoff. */
+    afterCredentialValidation?: () => Promise<void>;
+}
 /**
- * Create middleware that pre-hashes client secrets with SHA-256.
- *
- * Must be mounted BEFORE oidc-provider's callback handler on the
- * OIDC router. Transparently transforms secrets so oidc-provider
- * can compare them against stored SHA-256 hashes.
+ * Create the bounded active-secret bridge mounted immediately before oidc-provider.
  *
- * @returns Koa middleware function
+ * @param options - Optional credential-free validation/handoff test hook
+ * @returns Koa middleware
  */
-export declare function clientSecretHash(): Middleware;
+export declare function clientSecretHash(options?: ClientSecretBridgeOptions): Middleware;
 //# sourceMappingURL=client-secret-hash.d.ts.map

package/dist/middleware/client-secret-hash.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client-secret-hash.d.ts","sourceRoot":"","sources":["../../src/middleware/client-secret-hash.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,KAAK,CAAC;AAStC;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,IAAI,UAAU,CAqC7C"}
+{"version":3,"file":"client-secret-hash.d.ts","sourceRoot":"","sources":["../../src/middleware/client-secret-hash.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAElE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,KAAK,CAAC;AAiBtC,sDAAsD;AACtD,MAAM,WAAW,yBAAyB;IACxC,kGAAkG;IAClG,yBAAyB,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CACjD;AA6HD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,GAAE,yBAA8B,GAAG,UAAU,CAoEpF"}

package/dist/middleware/client-secret-hash.js

@@ -1,74 +1,176 @@
-/**
- * SHA-256 client secret pre-hashing middleware.
- *
- * Transforms client_secret values in incoming requests by replacing
- * the plaintext with its SHA-256 hash BEFORE oidc-provider processes them.
- *
- * Supports:
- * - client_secret_basic: Authorization: Basic base64(client_id:secret)
- * - client_secret_post: client_secret in POST body
- *
- * This allows oidc-provider's built-in string comparison to work
- * with our SHA-256-hashed secret storage — no monkey-patching needed.
- *
- * How it works:
- * 1. At secret generation: SHA-256(secret) is stored in the DB
- * 2. At request time: This middleware hashes the presented secret
- * 3. In the adapter: findForOidc() returns SHA-256 hash as client_secret
- * 4. oidc-provider compares: SHA-256(presented) === SHA-256(stored) → ✅ MATCH
- *
- * Security: SHA-256 is appropriate for machine-generated, high-entropy
- * client secrets (48 bytes / 384 bits of randomness).
- */
-import { createHash } from 'node:crypto';
-/**
- * Compute SHA-256 hash of a string, returned as hex.
- */
-function sha256(input) {
-    return createHash('sha256').update(input).digest('hex');
+/** Confidential-client active-secret bridge for oidc-provider. */
+import * as clientCrypto from '../clients/crypto.js';
+import { getClientByClientId } from '../clients/service.js';
+import { findActiveSecretIdBySha256, getActiveLegacySecretHashes, getLatestActiveSha256, } from '../clients/secret-repository.js';
+import { checkRateLimitStrict } from '../auth/rate-limiter.js';
+import { TOKEN_RATE_LIMIT } from './token-rate-limiter.js';
+const MAX_CLIENT_ID_LENGTH = 255;
+const MAX_SECRET_LENGTH = 512;
+const BUSY_RETRY_SECONDS = 1;
+let legacyBatchActive = false;
+/** Identify a plain request-body record without coercing arrays or scalar values. */
+function isRequestBody(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/** Return a parsed object body without coercing arrays or scalar values. */
+function requestBody(ctx) {
+    const body = ctx.request.body;
+    return isRequestBody(body) ? body : undefined;
+}
+/** Parse bounded HTTP Basic credentials while leaving malformed input to the provider. */
+function basicCredential(ctx) {
+    const authorization = ctx.headers.authorization;
+    if (authorization === undefined || !authorization.startsWith('Basic '))
+        return undefined;
+    try {
+        const decoded = Buffer.from(authorization.slice(6), 'base64').toString('utf8');
+        const separator = decoded.indexOf(':');
+        const clientId = decoded.slice(0, separator);
+        const plaintext = decoded.slice(separator + 1);
+        if (separator < 1 ||
+            clientId.length > MAX_CLIENT_ID_LENGTH ||
+            plaintext.length < 1 ||
+            plaintext.length > MAX_SECRET_LENGTH) {
+            return undefined;
+        }
+        return {
+            clientId,
+            plaintext,
+            method: 'client_secret_basic',
+            replace(canonicalValue) {
+                const encoded = Buffer.from(`${clientId}:${canonicalValue}`).toString('base64');
+                ctx.headers.authorization = `Basic ${encoded}`;
+                ctx.req.headers.authorization = `Basic ${encoded}`;
+            },
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Parse bounded form credentials from the body already parsed by the OIDC router. */
+function postCredential(ctx) {
+    const body = requestBody(ctx);
+    const clientId = body?.client_id;
+    const plaintext = body?.client_secret;
+    if (body === undefined ||
+        typeof clientId !== 'string' ||
+        clientId.length < 1 ||
+        clientId.length > MAX_CLIENT_ID_LENGTH ||
+        typeof plaintext !== 'string' ||
+        plaintext.length < 1 ||
+        plaintext.length > MAX_SECRET_LENGTH) {
+        return undefined;
+    }
+    const mutableBody = body;
+    return {
+        clientId,
+        plaintext,
+        method: 'client_secret_post',
+        replace(canonicalValue) {
+            mutableBody.client_secret = canonicalValue;
+            const rawBody = Reflect.get(ctx.req, 'body');
+            if (typeof rawBody === 'object' && rawBody !== null && !Array.isArray(rawBody)) {
+                Reflect.set(rawBody, 'client_secret', canonicalValue);
+            }
+        },
+    };
+}
+/** Return one supported credential source and reject ambiguous dual-mechanism input. */
+function presentedCredential(ctx) {
+    const basic = basicCredential(ctx);
+    const post = postCredential(ctx);
+    if (basic !== undefined && post !== undefined)
+        return undefined;
+    return basic ?? post;
+}
+/** Return the resolved tenant identifier without trusting request-controlled text. */
+function organizationId(ctx) {
+    const organization = ctx.state?.organization;
+    if (typeof organization !== 'object' || organization === null || Array.isArray(organization)) {
+        return undefined;
+    }
+    const id = Reflect.get(organization, 'id');
+    return typeof id === 'string' && id.length > 0 ? id : undefined;
+}
+/** Emit the existing fixed token rate-limit response without credential detail. */
+function denyProtectedWork(ctx, retryAfter) {
+    ctx.status = 429;
+    ctx.set('Retry-After', String(retryAfter));
+    ctx.body = {
+        error: 'rate_limit_exceeded',
+        error_description: 'Too many token requests. Please try again later.',
+        retry_after: retryAfter,
+    };
+}
+/** Rewrite a proven credential and continue to oidc-provider. */
+async function handOffValidatedCredential(credential, canonicalValue, options, next) {
+    credential.replace(canonicalValue);
+    await options.afterCredentialValidation?.();
+    await next();
 }
 /**
- * Create middleware that pre-hashes client secrets with SHA-256.
+ * Create the bounded active-secret bridge mounted immediately before oidc-provider.
  *
- * Must be mounted BEFORE oidc-provider's callback handler on the
- * OIDC router. Transparently transforms secrets so oidc-provider
- * can compare them against stored SHA-256 hashes.
- *
- * @returns Koa middleware function
+ * @param options - Optional credential-free validation/handoff test hook
+ * @returns Koa middleware
  */
-export function clientSecretHash() {
+export function clientSecretHash(options = {}) {
     return async (ctx, next) => {
-        // Handle client_secret_basic: Authorization: Basic base64(client_id:secret)
-        const authHeader = ctx.headers.authorization;
-        if (authHeader && authHeader.startsWith('Basic ')) {
+        const credential = presentedCredential(ctx);
+        const tenantId = organizationId(ctx);
+        if (credential === undefined || tenantId === undefined)
+            return next();
+        try {
+            const client = await getClientByClientId(credential.clientId);
+            if (client === null ||
+                client.organizationId !== tenantId ||
+                client.clientType !== 'confidential' ||
+                client.status !== 'active' ||
+                client.tokenEndpointAuthMethod !== credential.method) {
+                return next();
+            }
+            const canonicalValue = await getLatestActiveSha256(client.id);
+            if (canonicalValue === null)
+                return next();
+            const presentedSha256 = clientCrypto.sha256Secret(credential.plaintext);
+            const modernMatchId = await findActiveSecretIdBySha256(client.id, presentedSha256);
+            if (modernMatchId !== null) {
+                return handOffValidatedCredential(credential, canonicalValue, options, next);
+            }
+            const legacySecrets = await getActiveLegacySecretHashes(client.id);
+            if (legacySecrets.length === 0 || legacySecrets.length > 10)
+                return next();
+            if (legacyBatchActive) {
+                denyProtectedWork(ctx, BUSY_RETRY_SECONDS);
+                return;
+            }
+            legacyBatchActive = true;
+            let legacyMatched = false;
             try {
-                const encoded = authHeader.slice(6); // strip 'Basic '
-                const decoded = Buffer.from(encoded, 'base64').toString('utf8');
-                const colonIndex = decoded.indexOf(':');
-                if (colonIndex !== -1) {
-                    const clientId = decoded.slice(0, colonIndex);
-                    const secret = decoded.slice(colonIndex + 1);
-                    if (secret.length > 0) {
-                        // Hash the secret and re-encode the Basic auth header
-                        const hashedSecret = sha256(secret);
-                        const newEncoded = Buffer.from(`${clientId}:${hashedSecret}`).toString('base64');
-                        ctx.headers.authorization = `Basic ${newEncoded}`;
-                        // Also update the raw request header for oidc-provider
-                        ctx.req.headers.authorization = `Basic ${newEncoded}`;
+                const limit = await checkRateLimitStrict(`ratelimit:client-secret-legacy:${tenantId}:${client.id}`, TOKEN_RATE_LIMIT);
+                if (!limit.allowed) {
+                    denyProtectedWork(ctx, limit.retryAfter);
+                    return;
+                }
+                for (const legacy of legacySecrets) {
+                    if (await clientCrypto.verifySecretHash(legacy.hash, credential.plaintext)) {
+                        legacyMatched = true;
+                        break;
                     }
                 }
             }
-            catch {
-                // Malformed Basic auth — let oidc-provider handle the error
+            finally {
+                legacyBatchActive = false;
+            }
+            if (legacyMatched) {
+                return handOffValidatedCredential(credential, canonicalValue, options, next);
             }
         }
-        // Handle client_secret_post: client_secret in POST body
-        // eslint-disable-next-line @typescript-eslint/no-explicit-any
-        const body = ctx.request.body;
-        if (body && typeof body.client_secret === 'string' && body.client_secret.length > 0) {
-            body.client_secret = sha256(body.client_secret);
+        catch {
+            // Fail closed by leaving the credential untouched for the provider's minimal rejection.
         }
-        await next();
+        return next();
     };
 }
 //# sourceMappingURL=client-secret-hash.js.map

package/dist/middleware/client-secret-hash.js.map

@@ -1 +1 @@
-{"version":3,"file":"client-secret-hash.js","sourceRoot":"","sources":["../../src/middleware/client-secret-hash.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC;;GAEG;AACH,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,4EAA4E;QAC5E,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QAC7C,IAAI,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClD,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB;gBACtD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAChE,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAExC,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;oBACtB,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;oBAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;oBAE7C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACtB,sDAAsD;wBACtD,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;wBACpC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;wBACjF,GAAG,CAAC,OAAO,CAAC,aAAa,GAAG,SAAS,UAAU,EAAE,CAAC;wBAClD,uDAAuD;wBACvD,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,GAAG,SAAS,UAAU,EAAE,CAAC;oBACxD,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,4DAA4D;YAC9D,CAAC;QACH,CAAC;QAED,wDAAwD;QACxD,8DAA8D;QAC9D,MAAM,IAAI,GAAI,GAAG,CAAC,OAAe,CAAC,IAAI,CAAC;QACvC,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpF,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"client-secret-hash.js","sourceRoot":"","sources":["../../src/middleware/client-secret-hash.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAIlE,OAAO,KAAK,YAAY,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EACL,0BAA0B,EAC1B,2BAA2B,EAC3B,qBAAqB,GACtB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE3D,MAAM,oBAAoB,GAAG,GAAG,CAAC;AACjC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAC7B,IAAI,iBAAiB,GAAG,KAAK,CAAC;AAgB9B,qFAAqF;AACrF,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,4EAA4E;AAC5E,SAAS,WAAW,CAAC,GAA8B;IACjD,MAAM,IAAI,GAAY,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;IACvC,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAChD,CAAC;AAED,0FAA0F;AAC1F,SAAS,eAAe,CAAC,GAA8B;IACrD,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IAChD,IAAI,aAAa,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IACzF,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC/E,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;QAC/C,IACE,SAAS,GAAG,CAAC;YACb,QAAQ,CAAC,MAAM,GAAG,oBAAoB;YACtC,SAAS,CAAC,MAAM,GAAG,CAAC;YACpB,SAAS,CAAC,MAAM,GAAG,iBAAiB,EACpC,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO;YACL,QAAQ;YACR,SAAS;YACT,MAAM,EAAE,qBAAqB;YAC7B,OAAO,CAAC,cAAc;gBACpB,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,cAAc,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBAChF,GAAG,CAAC,OAAO,CAAC,aAAa,GAAG,SAAS,OAAO,EAAE,CAAC;gBAC/C,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,GAAG,SAAS,OAAO,EAAE,CAAC;YACrD,CAAC;SACF,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,sFAAsF;AACtF,SAAS,cAAc,CAAC,GAA8B;IACpD,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,QAAQ,GAAG,IAAI,EAAE,SAAS,CAAC;IACjC,MAAM,SAAS,GAAG,IAAI,EAAE,aAAa,CAAC;IACtC,IACE,IAAI,KAAK,SAAS;QAClB,OAAO,QAAQ,KAAK,QAAQ;QAC5B,QAAQ,CAAC,MAAM,GAAG,CAAC;QACnB,QAAQ,CAAC,MAAM,GAAG,oBAAoB;QACtC,OAAO,SAAS,KAAK,QAAQ;QAC7B,SAAS,CAAC,MAAM,GAAG,CAAC;QACpB,SAAS,CAAC,MAAM,GAAG,iBAAiB,EACpC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,CAAC;IACzB,OAAO;QACL,QAAQ;QACR,SAAS;QACT,MAAM,EAAE,oBAAoB;QAC5B,OAAO,CAAC,cAAc;YACpB,WAAW,CAAC,aAAa,GAAG,cAAc,CAAC;YAC3C,MAAM,OAAO,GAAY,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACtD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC/E,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,eAAe,EAAE,cAAc,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,wFAAwF;AACxF,SAAS,mBAAmB,CAAC,GAA8B;IACzD,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAChE,OAAO,KAAK,IAAI,IAAI,CAAC;AACvB,CAAC;AAED,sFAAsF;AACtF,SAAS,cAAc,CAAC,GAA8B;IACpD,MAAM,YAAY,GAAY,GAAG,CAAC,KAAK,EAAE,YAAY,CAAC;IACtD,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7F,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,EAAE,GAAY,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IACpD,OAAO,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAClE,CAAC;AAED,mFAAmF;AACnF,SAAS,iBAAiB,CAAC,GAA8B,EAAE,UAAkB;IAC3E,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;IACjB,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IAC3C,GAAG,CAAC,IAAI,GAAG;QACT,KAAK,EAAE,qBAAqB;QAC5B,iBAAiB,EAAE,kDAAkD;QACrE,WAAW,EAAE,UAAU;KACxB,CAAC;AACJ,CAAC;AAED,iEAAiE;AACjE,KAAK,UAAU,0BAA0B,CACvC,UAA+B,EAC/B,cAAsB,EACtB,OAAkC,EAClC,IAA+B;IAE/B,UAAU,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACnC,MAAM,OAAO,CAAC,yBAAyB,EAAE,EAAE,CAAC;IAC5C,MAAM,IAAI,EAAE,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAO,GAA8B,EAAE;IACtE,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,UAAU,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,UAAU,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,IAAI,EAAE,CAAC;QAEtE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YAC9D,IACE,MAAM,KAAK,IAAI;gBACf,MAAM,CAAC,cAAc,KAAK,QAAQ;gBAClC,MAAM,CAAC,UAAU,KAAK,cAAc;gBACpC,MAAM,CAAC,MAAM,KAAK,QAAQ;gBAC1B,MAAM,CAAC,uBAAuB,KAAK,UAAU,CAAC,MAAM,EACpD,CAAC;gBACD,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;YAED,MAAM,cAAc,GAAG,MAAM,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC9D,IAAI,cAAc,KAAK,IAAI;gBAAE,OAAO,IAAI,EAAE,CAAC;YAE3C,MAAM,eAAe,GAAG,YAAY,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACxE,MAAM,aAAa,GAAG,MAAM,0BAA0B,CAAC,MAAM,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;YACnF,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;gBAC3B,OAAO,0BAA0B,CAC/B,UAAU,EACV,cAAc,EACd,OAAO,EACP,IAAI,CACL,CAAC;YACJ,CAAC;YAED,MAAM,aAAa,GAAG,MAAM,2BAA2B,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACnE,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,aAAa,CAAC,MAAM,GAAG,EAAE;gBAAE,OAAO,IAAI,EAAE,CAAC;YAC3E,IAAI,iBAAiB,EAAE,CAAC;gBACtB,iBAAiB,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;gBAC3C,OAAO;YACT,CAAC;YAED,iBAAiB,GAAG,IAAI,CAAC;YACzB,IAAI,aAAa,GAAG,KAAK,CAAC;YAC1B,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,oBAAoB,CACtC,kCAAkC,QAAQ,IAAI,MAAM,CAAC,EAAE,EAAE,EACzD,gBAAgB,CACjB,CAAC;gBACF,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;oBACnB,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;oBACzC,OAAO;gBACT,CAAC;gBAED,KAAK,MAAM,MAAM,IAAI,aAAa,EAAE,CAAC;oBACnC,IAAI,MAAM,YAAY,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;wBAC3E,aAAa,GAAG,IAAI,CAAC;wBACrB,MAAM;oBACR,CAAC;gBACH,CAAC;YACH,CAAC;oBAAS,CAAC;gBACT,iBAAiB,GAAG,KAAK,CAAC;YAC5B,CAAC;YACD,IAAI,aAAa,EAAE,CAAC;gBAClB,OAAO,0BAA0B,CAAC,UAAU,EAAE,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;YAC/E,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wFAAwF;QAC1F,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/health.d.ts

@@ -1,3 +1,20 @@
+/**
+ * Liveness probe handler — GET /health.
+ *
+ * Reports whether the server process can still reach its dependencies. Or
+ * container orchestration uses this as a liveness probe, so every dependency
+ * check is bounded: a hung database or cache must fail the probe quickly
+ * (503) instead of holding the response open.
+ *
+ * Returns 200 + { status: 'healthy', checks } when both backends respond, or
+ * 503 + { status: 'unhealthy', checks } when either is degraded or too slow.
+ */
 import type { Middleware } from 'koa';
+/**
+ * Create the liveness probe middleware.
+ *
+ * Both checks run concurrently under an individual timeout, so one slow
+ * dependency cannot delay the other and a hang cannot keep the probe pending.
+ */
 export declare function healthCheck(): Middleware;
 //# sourceMappingURL=health.d.ts.map

package/dist/middleware/health.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"health.d.ts","sourceRoot":"","sources":["../../src/middleware/health.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,KAAK,CAAC;AAItC,wBAAgB,WAAW,IAAI,UAAU,CAgCxC"}
+{"version":3,"file":"health.d.ts","sourceRoot":"","sources":["../../src/middleware/health.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,KAAK,CAAC;AAKtC;;;;;GAKG;AACH,wBAAgB,WAAW,IAAI,UAAU,CAqBxC"}

package/dist/middleware/health.js

@@ -1,29 +1,33 @@
+/**
+ * Liveness probe handler — GET /health.
+ *
+ * Reports whether the server process can still reach its dependencies. Or
+ * container orchestration uses this as a liveness probe, so every dependency
+ * check is bounded: a hung database or cache must fail the probe quickly
+ * (503) instead of holding the response open.
+ *
+ * Returns 200 + { status: 'healthy', checks } when both backends respond, or
+ * 503 + { status: 'unhealthy', checks } when either is degraded or too slow.
+ */
 import { getPool } from '../lib/database.js';
 import { getRedis } from '../lib/redis.js';
+import { withTimeout } from '../lib/with-timeout.js';
+/**
+ * Create the liveness probe middleware.
+ *
+ * Both checks run concurrently under an individual timeout, so one slow
+ * dependency cannot delay the other and a hang cannot keep the probe pending.
+ */
 export function healthCheck() {
     return async (ctx) => {
         const checks = { server: 'ok' };
-        let healthy = true;
-        // Check PostgreSQL
-        try {
-            const pool = getPool();
-            await pool.query('SELECT 1');
-            checks.database = 'ok';
-        }
-        catch {
-            checks.database = 'error';
-            healthy = false;
-        }
-        // Check Redis
-        try {
-            const redis = getRedis();
-            await redis.ping();
-            checks.redis = 'ok';
-        }
-        catch {
-            checks.redis = 'error';
-            healthy = false;
-        }
+        const [dbResult, redisResult] = await Promise.allSettled([
+            withTimeout(getPool().query('SELECT 1'), 'database'),
+            withTimeout(getRedis().ping(), 'redis'),
+        ]);
+        checks.database = dbResult.status === 'fulfilled' ? 'ok' : 'error';
+        checks.redis = redisResult.status === 'fulfilled' ? 'ok' : 'error';
+        const healthy = dbResult.status === 'fulfilled' && redisResult.status === 'fulfilled';
         ctx.status = healthy ? 200 : 503;
         ctx.body = {
             status: healthy ? 'healthy' : 'unhealthy',

package/dist/middleware/health.js.map

@@ -1 +1 @@
-{"version":3,"file":"health.js","sourceRoot":"","sources":["../../src/middleware/health.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE3C,MAAM,UAAU,WAAW;IACzB,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,MAAM,MAAM,GAA2B,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACxD,IAAI,OAAO,GAAG,IAAI,CAAC;QAEnB,mBAAmB;QACnB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAC7B,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,QAAQ,GAAG,OAAO,CAAC;YAC1B,OAAO,GAAG,KAAK,CAAC;QAClB,CAAC;QAED,cAAc;QACd,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;YACzB,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;YACnB,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,KAAK,GAAG,OAAO,CAAC;YACvB,OAAO,GAAG,KAAK,CAAC;QAClB,CAAC;QAED,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACjC,GAAG,CAAC,IAAI,GAAG;YACT,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW;YACzC,MAAM;YACN,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"health.js","sourceRoot":"","sources":["../../src/middleware/health.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAErD;;;;;GAKG;AACH,MAAM,UAAU,WAAW;IACzB,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,MAAM,MAAM,GAA2B,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAExD,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC;YACvD,WAAW,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;YACpD,WAAW,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC;SACxC,CAAC,CAAC;QAEH,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;QACnE,MAAM,CAAC,KAAK,GAAG,WAAW,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;QAEnE,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,KAAK,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,WAAW,CAAC;QAEtF,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACjC,GAAG,CAAC,IAAI,GAAG;YACT,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW;YACzC,MAAM;YACN,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/ready.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ready.d.ts","sourceRoot":"","sources":["../../src/middleware/ready.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,KAAK,CAAC;AAwBtC;;;;;GAKG;AACH,wBAAgB,YAAY,IAAI,UAAU,CA6BzC"}
+{"version":3,"file":"ready.d.ts","sourceRoot":"","sources":["../../src/middleware/ready.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,KAAK,CAAC;AAMtC;;;;;GAKG;AACH,wBAAgB,YAAY,IAAI,UAAU,CA6BzC"}

package/dist/middleware/ready.js

@@ -15,18 +15,7 @@
 import { getPool } from '../lib/database.js';
 import { getRedis } from '../lib/redis.js';
 import { logger } from '../lib/logger.js';
-/** Maximum time (ms) to wait for each backend check before failing. */
-const TIMEOUT_MS = 2000;
-/**
- * Race a promise against a timeout. Rejects with a descriptive error
- * if the promise doesn't resolve within `TIMEOUT_MS`.
- */
-function withTimeout(promise, label) {
-    return Promise.race([
-        promise,
-        new Promise((_, reject) => setTimeout(() => reject(new Error(`${label} timeout after ${TIMEOUT_MS}ms`)), TIMEOUT_MS)),
-    ]);
-}
+import { withTimeout } from '../lib/with-timeout.js';
 /**
  * Create the readiness probe middleware.
  *

package/dist/middleware/ready.js.map

@@ -1 +1 @@
-{"version":3,"file":"ready.js","sourceRoot":"","sources":["../../src/middleware/ready.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C,uEAAuE;AACvE,MAAM,UAAU,GAAG,IAAI,CAAC;AAExB;;;GAGG;AACH,SAAS,WAAW,CAAI,OAAmB,EAAE,KAAa;IACxD,OAAO,OAAO,CAAC,IAAI,CAAC;QAClB,OAAO;QACP,IAAI,OAAO,CAAI,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAC3B,UAAU,CACR,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,KAAK,kBAAkB,UAAU,IAAI,CAAC,CAAC,EACjE,UAAU,CACX,CACF;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,MAAM,MAAM,GAAoD,EAAE,CAAC;QAEnE,qEAAqE;QACrE,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC;YACvD,WAAW,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC;YAC9C,WAAW,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC;SACxC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE;YACP,QAAQ,CAAC,MAAM,KAAK,WAAW;gBAC7B,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE;gBACd,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAEpD,MAAM,CAAC,KAAK;YACV,WAAW,CAAC,MAAM,KAAK,WAAW;gBAChC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE;gBACd,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;QAEvD,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAE9C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,EAAE,wBAAwB,CAAC,CAAC;QAC7E,CAAC;QAED,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QAC/B,GAAG,CAAC,IAAI,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC;IAC/D,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"ready.js","sourceRoot":"","sources":["../../src/middleware/ready.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAErD;;;;;GAKG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,MAAM,MAAM,GAAoD,EAAE,CAAC;QAEnE,qEAAqE;QACrE,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC;YACvD,WAAW,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC;YAC9C,WAAW,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC;SACxC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE;YACP,QAAQ,CAAC,MAAM,KAAK,WAAW;gBAC7B,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE;gBACd,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAEpD,MAAM,CAAC,KAAK;YACV,WAAW,CAAC,MAAM,KAAK,WAAW;gBAChC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE;gBACd,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;QAEvD,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAE9C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,EAAE,wBAAwB,CAAC,CAAC;QAC7E,CAAC;QAED,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QAC/B,GAAG,CAAC,IAAI,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC;IAC/D,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/require-existing-organization.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Organization-existence guard for organization-prefixed administrative routes.
+ *
+ * A route value that is not a canonical UUID, or that names no organization, must produce one
+ * non-enumerating not-found response. Without this guard the identifier reaches the database and a
+ * malformed value surfaces as an internal error instead of a client-visible rejection.
+ *
+ * Place this middleware after `requirePermission(...)` so a caller without the operation's
+ * permission still receives the permission denial before any organization lookup.
+ */
+import type { Middleware } from 'koa';
+/**
+ * Require the organization named in the route path to exist.
+ *
+ * @returns Koa middleware that continues only for an existing organization.
+ */
+export declare function requireExistingOrganization(): Middleware;
+//# sourceMappingURL=require-existing-organization.d.ts.map

package/dist/middleware/require-existing-organization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-existing-organization.d.ts","sourceRoot":"","sources":["../../src/middleware/require-existing-organization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,KAAK,CAAC;AAQtC;;;;GAIG;AACH,wBAAgB,2BAA2B,IAAI,UAAU,CAiBxD"}

package/dist/middleware/require-existing-organization.js

@@ -0,0 +1,38 @@
+/**
+ * Organization-existence guard for organization-prefixed administrative routes.
+ *
+ * A route value that is not a canonical UUID, or that names no organization, must produce one
+ * non-enumerating not-found response. Without this guard the identifier reaches the database and a
+ * malformed value surfaces as an internal error instead of a client-visible rejection.
+ *
+ * Place this middleware after `requirePermission(...)` so a caller without the operation's
+ * permission still receives the permission denial before any organization lookup.
+ */
+import { z } from 'zod';
+import { getOrganizationById } from '../organizations/service.js';
+import { recordSecurityDecision } from '../security/decision-context.js';
+const organizationParamSchema = z.object({ orgId: z.string().uuid() });
+/**
+ * Require the organization named in the route path to exist.
+ *
+ * @returns Koa middleware that continues only for an existing organization.
+ */
+export function requireExistingOrganization() {
+    return async function requireExistingOrganizationMiddleware(ctx, next) {
+        const parsed = organizationParamSchema.safeParse(ctx.params);
+        const organization = parsed.success ? await getOrganizationById(parsed.data.orgId) : null;
+        if (organization === null) {
+            recordSecurityDecision(ctx, {
+                decisionPoint: 'resource',
+                reasonCode: 'resource-not-found',
+                outcome: 'deny',
+                detail: { resourceType: 'organization' },
+            });
+            ctx.status = 404;
+            ctx.body = { error: 'Organization not found' };
+            return;
+        }
+        await next();
+    };
+}
+//# sourceMappingURL=require-existing-organization.js.map

package/dist/middleware/require-existing-organization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-existing-organization.js","sourceRoot":"","sources":["../../src/middleware/require-existing-organization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAEzE,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AAEvE;;;;GAIG;AACH,MAAM,UAAU,2BAA2B;IACzC,OAAO,KAAK,UAAU,qCAAqC,CAAC,GAAG,EAAE,IAAI;QACnE,MAAM,MAAM,GAAG,uBAAuB,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7D,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1F,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;YAC1B,sBAAsB,CAAC,GAAG,EAAE;gBAC1B,aAAa,EAAE,UAAU;gBACzB,UAAU,EAAE,oBAAoB;gBAChC,OAAO,EAAE,MAAM;gBACf,MAAM,EAAE,EAAE,YAAY,EAAE,cAAc,EAAE;aACzC,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/require-permission.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"require-permission.d.ts","sourceRoot":"","sources":["../../src/middleware/require-permission.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,KAAK,CAAC;AAItC;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,mBAAmB,EAAE,MAAM,EAAE,GAAG,UAAU,CAqC9E"}
+{"version":3,"file":"require-permission.d.ts","sourceRoot":"","sources":["../../src/middleware/require-permission.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAW,UAAU,EAAE,MAAM,KAAK,CAAC;AAmC/C;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,mBAAmB,EAAE,MAAM,EAAE,GAAG,UAAU,CAyC9E"}