@portaidentity/server 1.7.3 → 1.9.0

package/dist/routes/imports.js

@@ -1,8 +1,8 @@
 /**
  * Data import API routes.
  *
- * Provides admin endpoint for importing configuration from a JSON manifest.
- * Supports three modes: merge (skip existing), overwrite, and dry-run.
+ * Provides the Admin endpoint for previewing or atomically applying a strict portability manifest.
+ * Supports dry-run, keep-existing, and update-existing behavior.
  *
  * Route structure:
  *   POST /api/admin/import  — Import configuration manifest
@@ -10,21 +10,46 @@
  * @see 07-import-export-invitation.md
  */
 import Router from '@koa/router';
-import { z } from 'zod';
+import bodyParser from 'koa-bodyparser';
 import { requireAdminAuth } from '../middleware/admin-auth.js';
 import { requirePermission } from '../middleware/require-permission.js';
 import { ADMIN_PERMISSIONS } from '../lib/admin-permissions.js';
-import { importData, importManifestSchema, ImportOperationError } from '../lib/data-import.js';
-// ---------------------------------------------------------------------------
-// Validation
-// ---------------------------------------------------------------------------
-const importRequestSchema = z
-    .object({
-    mode: z.enum(['merge', 'overwrite', 'dry-run']).default('dry-run'),
-    organizationId: z.string().uuid().optional(),
-    manifest: importManifestSchema,
-})
-    .strict();
+import { logger } from '../lib/logger.js';
+import { applyPortabilityManifest } from '../portability/apply.js';
+import { importManifestRequestSchema, PortabilityError, requirePortabilityAuthorization, } from '../portability/index.js';
+import { buildPortabilityPlan } from '../portability/plan.js';
+/** Route-owned JSON parser used only after authentication and the base import permission. */
+const importManifestBodyParser = bodyParser({
+    enableTypes: ['json'],
+    jsonLimit: '64mb',
+});
+/** Return the public status carried by a body-parser error, when present. */
+function bodyParserStatus(error) {
+    if (typeof error !== 'object' || error === null)
+        return undefined;
+    const status = Reflect.get(error, 'status');
+    return typeof status === 'number' ? status : undefined;
+}
+/** Parse one protected manifest body and map parser failures to fixed safe responses. */
+async function parseImportManifestBody(ctx, next) {
+    try {
+        await importManifestBodyParser(ctx, next);
+    }
+    catch (error) {
+        const status = bodyParserStatus(error);
+        if (status === 413) {
+            ctx.status = 413;
+            ctx.body = { error: 'Import manifest is too large', code: 'import_manifest_too_large' };
+            return;
+        }
+        if (status === 400) {
+            ctx.status = 400;
+            ctx.body = { error: 'Invalid import manifest', code: 'import_manifest_invalid' };
+            return;
+        }
+        throw error;
+    }
+}
 // ---------------------------------------------------------------------------
 // Router factory
 // ---------------------------------------------------------------------------
@@ -33,40 +58,70 @@ const importRequestSchema = z
  * @returns Configured Koa router
  */
 export function createImportRouter() {
-    const router = new Router({ prefix: '/api/admin/import' });
-    router.use(requireAdminAuth());
+    const router = new Router({ sensitive: false, strict: false });
     // -------------------------------------------------------------------------
     // POST / — Import configuration
     // -------------------------------------------------------------------------
-    router.post('/', requirePermission(ADMIN_PERMISSIONS.IMPORT_WRITE), async (ctx) => {
-        try {
-            const body = importRequestSchema.parse(ctx.request.body);
-            const actorId = ctx.state.adminUser?.id;
-            const result = await importData(body.manifest, body.mode, actorId, body.organizationId);
-            ctx.body = result;
+    router.post('/api/admin/import', async (ctx, next) => {
+        ctx.set('Cache-Control', 'no-store');
+        await next();
+    }, requireAdminAuth(), requirePermission(ADMIN_PERMISSIONS.IMPORT_WRITE), parseImportManifestBody, async (ctx) => {
+        const parsed = importManifestRequestSchema.safeParse(ctx.request.body);
+        if (!parsed.success) {
+            ctx.status = 400;
+            ctx.body = { error: 'Invalid import manifest', code: 'import_manifest_invalid' };
+            return;
         }
-        catch (err) {
-            if (err instanceof z.ZodError) {
-                ctx.status = 400;
-                ctx.body = { error: 'Import manifest is invalid', code: 'import_manifest_invalid' };
-                return;
-            }
-            if (err instanceof ImportOperationError) {
-                ctx.status = err.status;
-                ctx.body = {
-                    error: 'Import request could not be completed',
-                    code: err.code,
-                    correlationId: err.correlationId,
-                };
+        await requirePortabilityAuthorization('import', () => parsed.data.manifest.categories)(ctx, async () => {
+            await handleManifestImport(ctx, parsed.data);
+        });
+    });
+    return router;
+}
+/** Preview or apply a validated manifest and expose only fixed safe failures. */
+async function handleManifestImport(ctx, request) {
+    try {
+        if (request.mode === 'dry-run') {
+            const result = await buildPortabilityPlan(request.manifest, request.mode);
+            if (result.errors.length > 0) {
+                ctx.status = 409;
+                ctx.body = { error: 'Import plan rejected', code: 'import_plan_rejected', result };
                 return;
             }
-            ctx.status = 503;
+            ctx.body = result;
+            return;
+        }
+        ctx.body = await applyPortabilityManifest(request.manifest, request.mode, portabilityActor(ctx));
+    }
+    catch (error) {
+        if (error instanceof PortabilityError && error.code === 'import_plan_rejected') {
+            ctx.status = 409;
             ctx.body = {
-                error: 'Import request could not be completed',
-                code: 'import_execution_failed',
+                error: 'Import plan rejected',
+                code: error.code,
+                result: error.result,
             };
+            return;
         }
-    });
-    return router;
+        const requestId = ctx.state.requestId;
+        logger.error({
+            operation: 'import',
+            code: 'import_execution_failed',
+            request_id: requestId,
+            mode: request.mode,
+        }, 'Portability import failed');
+        ctx.status = 503;
+        ctx.body = { error: 'Import failed', code: 'import_execution_failed', request_id: requestId };
+    }
+}
+/** Build the audit actor from the authenticated Admin identity. */
+function portabilityActor(ctx) {
+    const adminUser = ctx.state.adminUser;
+    if (!adminUser)
+        throw new Error('Admin identity is unavailable');
+    return {
+        userId: adminUser.id,
+        controlPlaneOrganizationId: adminUser.organizationId,
+    };
 }
 //# sourceMappingURL=imports.js.map

package/dist/routes/imports.js.map

@@ -1 +1 @@
-{"version":3,"file":"imports.js","sourceRoot":"","sources":["../../src/routes/imports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAE/F,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E,MAAM,mBAAmB,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAClE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC5C,QAAQ,EAAE,oBAAoB;CAC/B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAE3D,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAE/B,4EAA4E;IAC5E,gCAAgC;IAChC,4EAA4E;IAC5E,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAChF,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACzD,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC;YAExC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;YAExF,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;gBAC9B,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;gBACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,4BAA4B,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC;gBACpF,OAAO;YACT,CAAC;YACD,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;gBACxC,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;gBACxB,GAAG,CAAC,IAAI,GAAG;oBACT,KAAK,EAAE,uCAAuC;oBAC9C,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,aAAa,EAAE,GAAG,CAAC,aAAa;iBACjC,CAAC;gBACF,OAAO;YACT,CAAC;YACD,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG;gBACT,KAAK,EAAE,uCAAuC;gBAC9C,IAAI,EAAE,yBAAyB;aAChC,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"imports.js","sourceRoot":"","sources":["../../src/routes/imports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,MAA8B,MAAM,aAAa,CAAC;AACzD,OAAO,UAAU,MAAM,gBAAgB,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EACL,2BAA2B,EAC3B,gBAAgB,EAChB,+BAA+B,GAGhC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAE9D,6FAA6F;AAC7F,MAAM,wBAAwB,GAAG,UAAU,CAAC;IAC1C,WAAW,EAAE,CAAC,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM;CAClB,CAAC,CAAC;AAEH,6EAA6E;AAC7E,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAClE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC5C,OAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACzD,CAAC;AAED,yFAAyF;AACzF,KAAK,UAAU,uBAAuB,CACpC,GAAkB,EAClB,IAA4B;IAE5B,IAAI,CAAC;QACH,MAAM,wBAAwB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,8BAA8B,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC;YACxF,OAAO;QACT,CAAC;QACD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,yBAAyB,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC;YACjF,OAAO;QACT,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAE/D,4EAA4E;IAC5E,gCAAgC;IAChC,4EAA4E;IAC5E,MAAM,CAAC,IAAI,CACT,mBAAmB,EACnB,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAClB,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACrC,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,EACD,gBAAgB,EAAE,EAClB,iBAAiB,CAAC,iBAAiB,CAAC,YAAY,CAAC,EACjD,uBAAuB,EACvB,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,MAAM,MAAM,GAAG,2BAA2B,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,yBAAyB,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC;YACjF,OAAO;QACT,CAAC;QAED,MAAM,+BAA+B,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CACpF,GAAG,EACH,KAAK,IAAI,EAAE;YACT,MAAM,oBAAoB,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC/C,CAAC,CACF,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,iFAAiF;AACjF,KAAK,UAAU,oBAAoB,CACjC,GAAkB,EAClB,OAA8B;IAE9B,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;YAC1E,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7B,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;gBACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,sBAAsB,EAAE,IAAI,EAAE,sBAAsB,EAAE,MAAM,EAAE,CAAC;gBACnF,OAAO;YACT,CAAC;YACD,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC;YAClB,OAAO;QACT,CAAC;QACD,GAAG,CAAC,IAAI,GAAG,MAAM,wBAAwB,CACvC,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,IAAI,EACZ,gBAAgB,CAAC,GAAG,CAAC,CACtB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,gBAAgB,IAAI,KAAK,CAAC,IAAI,KAAK,sBAAsB,EAAE,CAAC;YAC/E,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG;gBACT,KAAK,EAAE,sBAAsB;gBAC7B,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC;YACF,OAAO;QACT,CAAC;QACD,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;QACtC,MAAM,CAAC,KAAK,CACV;YACE,SAAS,EAAE,QAAQ;YACnB,IAAI,EAAE,yBAAyB;YAC/B,UAAU,EAAE,SAAS;YACrB,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,EACD,2BAA2B,CAC5B,CAAC;QACF,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,yBAAyB,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;IAChG,CAAC;AACH,CAAC;AAED,mEAAmE;AACnE,SAAS,gBAAgB,CAAC,GAAkB;IAC1C,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;IACtC,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACjE,OAAO;QACL,MAAM,EAAE,SAAS,CAAC,EAAE;QACpB,0BAA0B,EAAE,SAAS,CAAC,cAAc;KACrD,CAAC;AACJ,CAAC"}

package/dist/routes/interactions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"interactions.d.ts","sourceRoot":"","sources":["../../src/routes/interactions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,KAAK,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAC;AAC1C,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,iBAAiB,EAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,cAAc,EACd,cAAc,EACd,sBAAsB,EACtB,0BAA0B,EAC1B,wBAAwB,EACxB,4BAA4B,EAC7B,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAExD,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EACnB,WAAW,EACX,qBAAqB,EACtB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAKpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAY9D;;;GAGG;AACH,UAAU,kBAAmB,SAAQ,OAAO;IAC1C,KAAK,EAAE;QACL,YAAY,EAAE,YAAY,CAAC;QAC3B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;CACH;AAED,gFAAgF;AAChF,MAAM,WAAW,2CAA2C;IAC1D,sCAAsC;IACtC,QAAQ,CAAC,iBAAiB,EAAE,OAAO,iBAAiB,CAAC;IACrD,uCAAuC;IACvC,QAAQ,CAAC,eAAe,EAAE,OAAO,eAAe,CAAC;IACjD,sCAAsC;IACtC,QAAQ,CAAC,iBAAiB,EAAE,OAAO,iBAAiB,CAAC;IACrD,oCAAoC;IACpC,QAAQ,CAAC,aAAa,EAAE,OAAO,aAAa,CAAC;IAC7C,gDAAgD;IAChD,QAAQ,CAAC,sBAAsB,EAAE,OAAO,sBAAsB,CAAC;IAC/D,kDAAkD;IAClD,QAAQ,CAAC,0BAA0B,EAAE,OAAO,0BAA0B,CAAC;IACvE,uCAAuC;IACvC,QAAQ,CAAC,wBAAwB,EAAE,OAAO,wBAAwB,CAAC;IACnE,4CAA4C;IAC5C,QAAQ,CAAC,4BAA4B,EAAE,OAAO,4BAA4B,CAAC;IAC3E,+CAA+C;IAC/C,QAAQ,CAAC,cAAc,EAAE,OAAO,cAAc,CAAC;IAC/C,mDAAmD;IACnD,QAAQ,CAAC,cAAc,EAAE,OAAO,cAAc,CAAC;IAC/C,wDAAwD;IACxD,QAAQ,CAAC,aAAa,EAAE,OAAO,aAAa,CAAC;IAC7C,6CAA6C;IAC7C,QAAQ,CAAC,sBAAsB,EAAE,OAAO,sBAAsB,CAAC;IAC/D,qCAAqC;IACrC,QAAQ,CAAC,UAAU,EAAE,OAAO,UAAU,CAAC;IACvC,mDAAmD;IACnD,QAAQ,CAAC,2BAA2B,EAAE,OAAO,2BAA2B,CAAC;IACzE,kEAAkE;IAClE,QAAQ,CAAC,mBAAmB,EAAE,OAAO,mBAAmB,CAAC;IACzD,wDAAwD;IACxD,QAAQ,CAAC,qBAAqB,EAAE,OAAO,qBAAqB,CAAC;IAC7D,0CAA0C;IAC1C,QAAQ,CAAC,WAAW,EAAE,OAAO,WAAW,CAAC;IACzC,yDAAyD;IACzD,QAAQ,CAAC,sBAAsB,EAAE,OAAO,sBAAsB,CAAC;IAC/D,wCAAwC;IACxC,QAAQ,CAAC,aAAa,EAAE,OAAO,aAAa,CAAC;CAC9C;AA6HD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,iCAAiC,CACrD,GAAG,EAAE,kBAAkB,EACvB,QAAQ,EAAE,MAAM,EAChB,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,IAAI,CAAC,CAiCf;AAgED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,QAAQ,EAClB,uBAAuB,GAAE,2CAA4E,GACpG,MAAM,CA4DR"}
+{"version":3,"file":"interactions.d.ts","sourceRoot":"","sources":["../../src/routes/interactions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,KAAK,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAC;AAC1C,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,iBAAiB,EAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,cAAc,EACd,cAAc,EACd,sBAAsB,EACtB,0BAA0B,EAC1B,wBAAwB,EACxB,4BAA4B,EAC7B,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAExD,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EACnB,WAAW,EACX,qBAAqB,EACtB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAKpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAY9D;;;GAGG;AACH,UAAU,kBAAmB,SAAQ,OAAO;IAC1C,KAAK,EAAE;QACL,YAAY,EAAE,YAAY,CAAC;QAC3B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;CACH;AAED,gFAAgF;AAChF,MAAM,WAAW,2CAA2C;IAC1D,sCAAsC;IACtC,QAAQ,CAAC,iBAAiB,EAAE,OAAO,iBAAiB,CAAC;IACrD,uCAAuC;IACvC,QAAQ,CAAC,eAAe,EAAE,OAAO,eAAe,CAAC;IACjD,sCAAsC;IACtC,QAAQ,CAAC,iBAAiB,EAAE,OAAO,iBAAiB,CAAC;IACrD,oCAAoC;IACpC,QAAQ,CAAC,aAAa,EAAE,OAAO,aAAa,CAAC;IAC7C,gDAAgD;IAChD,QAAQ,CAAC,sBAAsB,EAAE,OAAO,sBAAsB,CAAC;IAC/D,kDAAkD;IAClD,QAAQ,CAAC,0BAA0B,EAAE,OAAO,0BAA0B,CAAC;IACvE,uCAAuC;IACvC,QAAQ,CAAC,wBAAwB,EAAE,OAAO,wBAAwB,CAAC;IACnE,4CAA4C;IAC5C,QAAQ,CAAC,4BAA4B,EAAE,OAAO,4BAA4B,CAAC;IAC3E,+CAA+C;IAC/C,QAAQ,CAAC,cAAc,EAAE,OAAO,cAAc,CAAC;IAC/C,mDAAmD;IACnD,QAAQ,CAAC,cAAc,EAAE,OAAO,cAAc,CAAC;IAC/C,wDAAwD;IACxD,QAAQ,CAAC,aAAa,EAAE,OAAO,aAAa,CAAC;IAC7C,6CAA6C;IAC7C,QAAQ,CAAC,sBAAsB,EAAE,OAAO,sBAAsB,CAAC;IAC/D,qCAAqC;IACrC,QAAQ,CAAC,UAAU,EAAE,OAAO,UAAU,CAAC;IACvC,mDAAmD;IACnD,QAAQ,CAAC,2BAA2B,EAAE,OAAO,2BAA2B,CAAC;IACzE,kEAAkE;IAClE,QAAQ,CAAC,mBAAmB,EAAE,OAAO,mBAAmB,CAAC;IACzD,wDAAwD;IACxD,QAAQ,CAAC,qBAAqB,EAAE,OAAO,qBAAqB,CAAC;IAC7D,0CAA0C;IAC1C,QAAQ,CAAC,WAAW,EAAE,OAAO,WAAW,CAAC;IACzC,yDAAyD;IACzD,QAAQ,CAAC,sBAAsB,EAAE,OAAO,sBAAsB,CAAC;IAC/D,wCAAwC;IACxC,QAAQ,CAAC,aAAa,EAAE,OAAO,aAAa,CAAC;CAC9C;AA6GD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,iCAAiC,CACrD,GAAG,EAAE,kBAAkB,EACvB,QAAQ,EAAE,MAAM,EAChB,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,IAAI,CAAC,CAiCf;AAgED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,QAAQ,EAClB,uBAAuB,GAAE,2CAA4E,GACpG,MAAM,CA4DR"}

package/dist/routes/interactions.js

@@ -23,6 +23,7 @@ import Router from '@koa/router';
 import { generateCsrfToken, verifyCsrfToken, setCsrfCookie, getCsrfFromCookie, } from '../auth/csrf.js';
 import { checkRateLimit, resetRateLimit, buildLoginRateLimitKey, buildMagicLinkRateLimitKey, loadLoginRateLimitConfig, loadMagicLinkRateLimitConfig, } from '../auth/rate-limiter.js';
 import { sendOtpCodeEmail } from '../auth/email-service.js';
+import { resolveEffectiveBranding } from '../auth/effective-branding.js';
 import { enqueueAccountRecovery } from '../auth/recovery-service.js';
 import { resolveLocale, getTranslationFunction } from '../auth/i18n.js';
 import { renderPage } from '../auth/template-engine.js';
@@ -61,13 +62,6 @@ const defaultEnumerationDependencies = {
 // ---------------------------------------------------------------------------
 // Helpers
 // ---------------------------------------------------------------------------
-/**
- * Build a branding context object from organization data.
- * Used to populate template context with org-specific branding.
- *
- * @param org - Organization with branding fields
- * @returns Branding context for templates
- */
 /**
  * Resolve the effective login methods for an OIDC provider Client.
  *
@@ -95,15 +89,6 @@ function resolveLoginMethodsFromOidcClient(client, org) {
     const normalized = Array.isArray(raw) ? raw : null;
     return resolveLoginMethods(org, { loginMethods: normalized });
 }
-function buildBrandingFromOrg(org) {
-    return {
-        logoUrl: org.brandingLogoUrl,
-        faviconUrl: org.brandingFaviconUrl,
-        primaryColor: org.brandingPrimaryColor ?? '#3B82F6',
-        companyName: org.brandingCompanyName ?? org.name,
-        customCss: org.brandingCustomCss,
-    };
-}
 /**
  * Build a base template context from an interaction context.
  * Shared across all interaction route handlers to provide consistent
@@ -113,11 +98,11 @@ function buildBrandingFromOrg(org) {
  * @param locale - Resolved locale string
  * @param csrfToken - CSRF token for form protection
  * @param orgSlug - Organization slug for template resolution
- * @returns Base template context (without the `t` translation function)
+ * @returns Base template context (without the `t` translation function).
  */
-function buildBaseContext(ctx, locale, csrfToken, orgSlug) {
+async function buildBaseContext(ctx, locale, csrfToken, orgSlug) {
     return {
-        branding: buildBrandingFromOrg(ctx.state.organization),
+        branding: await resolveEffectiveBranding(ctx.state.organization),
         locale,
         csrfToken,
         orgSlug,
@@ -133,6 +118,7 @@ function buildBaseContext(ctx, locale, csrfToken, orgSlug) {
  * @param statusCode - HTTP status code (default: 200)
  */
 async function renderAndRespond(ctx, pageName, context, statusCode = 200, renderer = renderPage) {
+    ctx.state.brandingImageSources = context.branding.imageSources;
     const html = await renderer(pageName, context);
     ctx.status = statusCode;
     ctx.type = 'text/html';
@@ -408,7 +394,7 @@ async function showLogin(ctx, provider) {
         const showPassword = effectiveMethods.includes('password');
         const showMagicLink = effectiveMethods.includes('magic_link');
         const context = {
-            ...buildBaseContext(ctx, locale, csrfToken, org.slug),
+            ...(await buildBaseContext(ctx, locale, csrfToken, org.slug)),
             t,
             interaction: {
                 uid: interaction.uid,
@@ -451,7 +437,7 @@ async function renderMagicLinkSuccessPage(ctx, org) {
     const t = getTranslationFunction(locale, org.slug);
     const csrfToken = generateCsrfToken();
     const context = {
-        branding: buildBrandingFromOrg(org),
+        branding: await resolveEffectiveBranding(org),
         locale,
         t,
         csrfToken,
@@ -577,8 +563,9 @@ async function processLogin(ctx, provider, dependencies) {
                     email: user.email,
                 },
             }, { mergeWithLastSubmission: true });
-            // If method is email, auto-send the first OTP code
-            if (twoFactorMethod === 'email' || (!user.twoFactorEnabled && !twoFactorMethod)) {
+            // Enrolled email users can receive their challenge immediately. Unenrolled users receive
+            // one only after choosing email during setup, so they are not sent duplicate or unwanted codes.
+            if (user.twoFactorEnabled && twoFactorMethod === 'email') {
                 try {
                     const otpCode = await sendOtpCode(user.id, user.email, org.id);
                     // Send the OTP code via email (fire-and-forget)
@@ -587,13 +574,7 @@ async function processLogin(ctx, provider, dependencies) {
                         email: user.email,
                         givenName: user.givenName,
                         familyName: user.familyName,
-                    }, {
-                        id: org.id,
-                        slug: org.slug,
-                        brandingLogoUrl: org.brandingLogoUrl,
-                        brandingPrimaryColor: org.brandingPrimaryColor,
-                        brandingCompanyName: org.brandingCompanyName,
-                    }, otpCode, 10, locale);
+                    }, org, otpCode, 10, locale);
                 }
                 catch {
                     logger.warn({ event: 'login-otp-delivery-failed' }, 'Initial OTP delivery failed');
@@ -737,7 +718,7 @@ async function handleSendMagicLink(ctx, provider, dependencies) {
         // Always render the "check your email" page — prevents user enumeration
         const csrfToken = dependencies.generateCsrfToken();
         const context = {
-            ...buildBaseContext(ctx, locale, csrfToken, org.slug),
+            ...(await buildBaseContext(ctx, locale, csrfToken, org.slug)),
             t,
             email,
             loginUrl: `/interaction/${interaction.uid}`,
@@ -749,12 +730,82 @@ async function handleSendMagicLink(ctx, provider, dependencies) {
         await renderErrorPage(ctx, 'errors.interaction_expired');
     }
 }
+/**
+ * Report whether the authorization request carries an explicit `prompt=consent`.
+ *
+ * @param params - Authorization request parameters from the interaction
+ * @returns `true` when the client explicitly requested consent
+ */
+function requestedExplicitConsent(params) {
+    const prompt = typeof params.prompt === 'string' ? params.prompt : '';
+    return prompt.split(' ').includes('consent');
+}
+/**
+ * Report whether the interaction has no scope, claim, or resource left to grant.
+ *
+ * @param details - The interaction prompt details listing what is missing
+ * @returns `true` when nothing remains to consent to
+ */
+function nothingMissing(details) {
+    const missingScopes = details.missingOIDCScope ?? [];
+    const missingClaims = details.missingOIDCClaims ?? [];
+    const missingResources = details.missingResourceScopes ?? {};
+    return ([...missingScopes].length === 0 &&
+        [...missingClaims].length === 0 &&
+        Object.values(missingResources).every((scopes) => [...scopes].length === 0));
+}
+/**
+ * Persist a consent grant covering the interaction's missing scopes and finish.
+ *
+ * Grants exactly what the provider listed as missing plus `offline_access` when
+ * requested (the provider treats it as a consent signal and may omit it from
+ * `missingOIDCScope`, but the grant must include it for a refresh token).
+ *
+ * @param ctx - Koa context with organization state
+ * @param provider - OIDC provider instance
+ * @param interaction - Current interaction details
+ * @param description - Audit description for the recorded grant
+ */
+async function grantConsentAndFinish(ctx, provider, interaction, description) {
+    const params = interaction.params;
+    const details = interaction.prompt.details;
+    const clientId = params.client_id;
+    const grant = new provider.Grant({ accountId: interaction.session?.accountId, clientId });
+    if (details.missingOIDCScope) {
+        grant.addOIDCScope([...details.missingOIDCScope].join(' '));
+    }
+    if (details.missingOIDCClaims) {
+        grant.addOIDCClaims([...details.missingOIDCClaims]);
+    }
+    if (details.missingResourceScopes) {
+        for (const [indicator, scopes] of Object.entries(details.missingResourceScopes)) {
+            grant.addResourceScope(indicator, [...scopes].join(' '));
+        }
+    }
+    const requestedScope = params.scope ?? '';
+    if (requestedScope.includes('offline_access')) {
+        grant.addOIDCScope('offline_access');
+    }
+    const grantId = await grant.save();
+    writeAuditLog({
+        organizationId: ctx.state.organization.id,
+        userId: interaction.session?.accountId,
+        eventType: 'user.consent.granted',
+        eventCategory: 'authentication',
+        description,
+    });
+    await provider.interactionFinished(ctx.req, ctx.res, { consent: { grantId } }, { mergeWithLastSubmission: true });
+}
 /**
  * Show the consent page for an OIDC interaction.
  *
- * If the client belongs to the same organization (first-party app),
- * auto-consents by immediately finishing the interaction. Otherwise,
- * renders the consent page with requested scopes and client info.
+ * The decision is trust-driven rather than organization-driven:
+ *   - Nothing is missing → finish without rendering and reuse or create the
+ *     grant. An explicit `prompt=consent` is ignored so a user who already
+ *     consented is never asked again.
+ *   - Something is missing → render the consent page when the client requires
+ *     consent (`requireConsent`) or explicitly requested `prompt=consent`;
+ *     otherwise auto-consent the trusted first-party client.
  *
  * @param ctx - Koa context with organization state
  * @param provider - OIDC provider instance
@@ -766,66 +817,40 @@ async function showConsent(ctx, provider) {
         // Resolve organization from the interaction's client_id
         await resolveOrganizationForInteraction(ctx, params.client_id, interaction.uid);
         const org = ctx.state.organization;
-        // Resolve locale for the consent page
-        const uiLocales = params.ui_locales;
-        const acceptLanguage = ctx.get('Accept-Language') || undefined;
-        const locale = await resolveLocale(uiLocales, acceptLanguage, org.defaultLocale);
-        const t = getTranslationFunction(locale, org.slug);
-        // Auto-consent for first-party apps: if the client metadata includes
-        // the org ID matching the current tenant, skip the consent screen
         const clientId = params.client_id;
         const client = await provider.Client.find(clientId);
-        if (client) {
-            // Check if this is a first-party client (belongs to the same org)
-            const clientOrgId = client.metadata()?.organizationId;
-            if (clientOrgId && clientOrgId === org.id) {
-                // Auto-consent: finish interaction immediately with consent grant
-                const grant = new provider.Grant({ accountId: interaction.session?.accountId, clientId });
-                // Use prompt.details to grant exactly what the provider requires
-                const details = prompt.details;
-                if (details.missingOIDCScope) {
-                    const scopes = details.missingOIDCScope;
-                    grant.addOIDCScope([...scopes].join(' '));
-                }
-                if (details.missingOIDCClaims) {
-                    const claims = details.missingOIDCClaims;
-                    grant.addOIDCClaims([...claims]);
-                }
-                if (details.missingResourceScopes) {
-                    for (const [indicator, scopes] of Object.entries(details.missingResourceScopes)) {
-                        grant.addResourceScope(indicator, [...scopes].join(' '));
-                    }
-                }
-                // Explicitly grant offline_access if requested — node-oidc-provider
-                // treats it as a consent signal and may not include it in missingOIDCScope,
-                // but the Grant must include it for a refresh_token to be issued.
-                const requestedScope = params.scope ?? '';
-                if (requestedScope.includes('offline_access')) {
-                    grant.addOIDCScope('offline_access');
-                }
-                const grantId = await grant.save();
-                const result = {
-                    consent: { grantId },
-                };
-                writeAuditLog({
-                    organizationId: org.id,
-                    userId: interaction.session?.accountId,
-                    eventType: 'user.consent.granted',
-                    eventCategory: 'authentication',
-                    description: `Auto-consent granted for first-party client ${clientId}`,
-                });
-                await provider.interactionFinished(ctx.req, ctx.res, result, {
-                    mergeWithLastSubmission: true,
-                });
+        const requiresConsent = client?.metadata()?.requireConsent === true;
+        const details = prompt.details;
+        // Nothing left to grant: finish without rendering, even under prompt=consent.
+        // Reuse the provider's resolved grant; creating a new grant here would
+        // replace it with an empty one and drop the scopes the user already
+        // approved, which would make the provider prompt again.
+        if (nothingMissing(details)) {
+            const existingGrantId = interaction.grantId;
+            if (existingGrantId !== undefined) {
+                await provider.interactionFinished(ctx.req, ctx.res, { consent: { grantId: existingGrantId } }, { mergeWithLastSubmission: true });
                 return;
             }
+            await grantConsentAndFinish(ctx, provider, interaction, `Consent already granted for client ${clientId}`);
+            return;
+        }
+        // A new scope, claim, or resource is requested. Ask only when the client
+        // requires consent or explicitly requested it; trusted clients auto-consent.
+        const explicitConsent = requestedExplicitConsent(params);
+        if (!requiresConsent && !explicitConsent) {
+            await grantConsentAndFinish(ctx, provider, interaction, `Auto-consent granted for first-party client ${clientId}`);
+            return;
         }
-        // Third-party client: show the consent page
+        // Resolve locale for the consent page
+        const uiLocales = params.ui_locales;
+        const acceptLanguage = ctx.get('Accept-Language') || undefined;
+        const locale = await resolveLocale(uiLocales, acceptLanguage, org.defaultLocale);
+        const t = getTranslationFunction(locale, org.slug);
         const csrfToken = generateCsrfToken();
         setCsrfCookie(ctx, csrfToken);
         const requestedScopes = (params.scope ?? '').split(' ').filter(Boolean);
         const context = {
-            ...buildBaseContext(ctx, locale, csrfToken, org.slug),
+            ...(await buildBaseContext(ctx, locale, csrfToken, org.slug)),
             t,
             interaction: {
                 uid: interaction.uid,
@@ -1008,7 +1033,7 @@ async function renderLoginWithError(ctx, provider, interaction, t, locale, email
     const showPassword = effectiveMethods.includes('password');
     const showMagicLink = effectiveMethods.includes('magic_link');
     const context = {
-        ...buildBaseContext(ctx, locale, csrfToken, org.slug),
+        ...(await buildBaseContext(ctx, locale, csrfToken, org.slug)),
         t,
         interaction: {
             uid: interaction.uid,
@@ -1048,13 +1073,14 @@ async function renderErrorPage(ctx, errorKey) {
         const csrfToken = generateCsrfToken();
         const context = {
             branding: org
-                ? buildBrandingFromOrg(org)
+                ? await resolveEffectiveBranding(org)
                 : {
                     logoUrl: null,
                     faviconUrl: null,
                     primaryColor: '#3B82F6',
                     companyName: 'Porta',
                     customCss: null,
+                    imageSources: [],
                 },
             locale,
             t,