@portaidentity/server 1.7.3 → 1.9.0

package/dist/routes/permissions.js

@@ -10,7 +10,7 @@
  *   GET    /                — List permissions (optional ?moduleId filter)
  *   GET    /:permId         — Get a permission by ID
  *   PUT    /:permId         — Update a permission (name/description only)
- *   DELETE /:permId         — Delete a permission (?force=true)
+ *   DELETE /:permissionId   — Delete a permission
  *   GET    /:permId/roles   — List roles that have this permission
  *
  * Error mapping:
@@ -22,16 +22,19 @@ import Router from '@koa/router';
 import { z } from 'zod';
 import { requireAdminAuth } from '../middleware/admin-auth.js';
 import { requirePermission } from '../middleware/require-permission.js';
-import { ADMIN_PERMISSIONS } from '../lib/admin-permissions.js';
+import { ADMIN_PERMISSIONS, ALL_ADMIN_PERMISSIONS } from '../lib/admin-permissions.js';
+import { getApplicationBySlug } from '../applications/service.js';
 import * as permissionService from '../rbac/permission-service.js';
 import { PermissionNotFoundError, RbacValidationError } from '../rbac/errors.js';
+const ADMIN_APPLICATION_SLUG = 'porta-admin';
+const ADMIN_PERMISSION_SLUGS = new Set(ALL_ADMIN_PERMISSIONS);
 // ---------------------------------------------------------------------------
 // Validation schemas
 // ---------------------------------------------------------------------------
 /** Schema for creating a new permission */
 const createPermissionSchema = z.object({
     name: z.string().min(1).max(255),
-    slug: z.string().min(1).max(150),
+    slug: z.string().trim().min(1).max(150),
     moduleId: z.string().uuid().optional(),
     description: z.string().max(1000).optional(),
 });
@@ -44,6 +47,18 @@ const updatePermissionSchema = z.object({
 const listPermissionsSchema = z.object({
     moduleId: z.string().uuid().optional(),
 });
+/** Parent-qualified parameters accepted by permission reads and updates. */
+const permissionIdentifierSchema = z.object({
+    appId: z.string().uuid(),
+    permId: z.string().uuid(),
+});
+/** Parent-qualified parameters accepted by permission deletion. */
+const deletionIdentifierSchema = z.object({
+    appId: z.string().uuid(),
+    permissionId: z.string().uuid(),
+});
+/** Application parent parameter accepted by collection routes. */
+const applicationIdentifierSchema = z.object({ appId: z.string().uuid() });
 // ---------------------------------------------------------------------------
 // Error handler helper
 // ---------------------------------------------------------------------------
@@ -65,6 +80,20 @@ function handleError(ctx, err) {
     }
     throw err;
 }
+/** Reject generic route mutations of a canonical Porta Admin permission. */
+async function requireMutablePermission(applicationId, permissionId) {
+    const permission = await permissionService.findPermissionById(applicationId, permissionId);
+    // The mutation service remains responsible for authoritative not-found handling and repeats the
+    // canonical check after locking. This route lookup exists only for an early sanitized rejection.
+    if (!permission)
+        return;
+    if (!ADMIN_PERMISSION_SLUGS.has(permission.slug))
+        return;
+    const adminApplication = await getApplicationBySlug(ADMIN_APPLICATION_SLUG);
+    if (adminApplication?.id === permission.applicationId) {
+        throw new RbacValidationError('Canonical Porta Admin permissions cannot be modified');
+    }
+}
 // ---------------------------------------------------------------------------
 // Router factory
 // ---------------------------------------------------------------------------
@@ -87,11 +116,12 @@ export function createPermissionRouter() {
     // -------------------------------------------------------------------------
     router.post('/', requirePermission(ADMIN_PERMISSIONS.PERMISSION_CREATE), async (ctx) => {
         try {
+            applicationIdentifierSchema.parse(ctx.params);
             const body = createPermissionSchema.parse(ctx.request.body);
             const permission = await permissionService.createPermission({
                 applicationId: ctx.params.appId,
                 ...body,
-            });
+            }, ctx.state.adminUser?.id);
             ctx.status = 201;
             ctx.body = { data: permission };
         }
@@ -104,6 +134,7 @@ export function createPermissionRouter() {
     // -------------------------------------------------------------------------
     router.get('/', requirePermission(ADMIN_PERMISSIONS.PERMISSION_READ), async (ctx) => {
         try {
+            applicationIdentifierSchema.parse(ctx.params);
             const query = listPermissionsSchema.parse(ctx.query);
             const permissions = await permissionService.listPermissionsByApplication(ctx.params.appId, query.moduleId);
             ctx.body = { data: permissions };
@@ -116,19 +147,27 @@ export function createPermissionRouter() {
     // GET /:permId — Get permission by ID
     // -------------------------------------------------------------------------
     router.get('/:permId', requirePermission(ADMIN_PERMISSIONS.PERMISSION_READ), async (ctx) => {
-        const permission = await permissionService.findPermissionById(ctx.params.permId);
-        if (!permission) {
-            ctx.throw(404, 'Permission not found');
+        try {
+            permissionIdentifierSchema.parse(ctx.params);
+            const permission = await permissionService.findPermissionById(ctx.params.appId, ctx.params.permId);
+            if (!permission) {
+                ctx.throw(404, 'Permission not found');
+            }
+            ctx.body = { data: permission };
+        }
+        catch (err) {
+            handleError(ctx, err);
         }
-        ctx.body = { data: permission };
     });
     // -------------------------------------------------------------------------
     // PUT /:permId — Update permission (name and description only)
     // -------------------------------------------------------------------------
-    router.put('/:permId', requirePermission(ADMIN_PERMISSIONS.PERMISSION_CREATE), async (ctx) => {
+    router.put('/:permId', requirePermission(ADMIN_PERMISSIONS.PERMISSION_UPDATE), async (ctx) => {
         try {
+            permissionIdentifierSchema.parse(ctx.params);
             const body = updatePermissionSchema.parse(ctx.request.body);
-            const permission = await permissionService.updatePermission(ctx.params.permId, body);
+            await requireMutablePermission(ctx.params.appId, ctx.params.permId);
+            const permission = await permissionService.updatePermission(ctx.params.appId, ctx.params.permId, body, ctx.state.adminUser?.id);
             ctx.body = { data: permission };
         }
         catch (err) {
@@ -136,14 +175,15 @@ export function createPermissionRouter() {
         }
     });
     // -------------------------------------------------------------------------
-    // DELETE /:permId — Delete permission
-    // Supports ?force=true to delete even when roles reference it
+    // DELETE /:permissionId — Delete permission
     // -------------------------------------------------------------------------
-    router.delete('/:permId', requirePermission(ADMIN_PERMISSIONS.PERMISSION_ARCHIVE), async (ctx) => {
+    router.delete('/:permissionId', requirePermission(ADMIN_PERMISSIONS.PERMISSION_DELETE), async (ctx) => {
         try {
-            const force = ctx.query.force === 'true';
-            await permissionService.deletePermission(ctx.params.permId, force);
-            ctx.status = 204;
+            deletionIdentifierSchema.parse(ctx.params);
+            await requireMutablePermission(ctx.params.appId, ctx.params.permissionId);
+            const result = await permissionService.deletePermission(ctx.params.appId, ctx.params.permissionId, ctx.state.adminUser?.id);
+            ctx.status = 200;
+            ctx.body = { data: result };
         }
         catch (err) {
             handleError(ctx, err);
@@ -154,7 +194,8 @@ export function createPermissionRouter() {
     // -------------------------------------------------------------------------
     router.get('/:permId/roles', requirePermission(ADMIN_PERMISSIONS.PERMISSION_READ), async (ctx) => {
         try {
-            const roles = await permissionService.getRolesWithPermission(ctx.params.permId);
+            permissionIdentifierSchema.parse(ctx.params);
+            const roles = await permissionService.getRolesWithPermission(ctx.params.appId, ctx.params.permId);
             ctx.body = { data: roles };
         }
         catch (err) {

package/dist/routes/permissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../src/routes/permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,iBAAiB,MAAM,+BAA+B,CAAC;AACnE,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAEjF,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,2CAA2C;AAC3C,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACtC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC;AAEH,mEAAmE;AACnE,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC3C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACxD,CAAC,CAAC;AAEH,iDAAiD;AACjD,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,WAAW,CAClB,GAAqF,EACrF,GAAY;IAEZ,IAAI,GAAG,YAAY,uBAAuB,EAAE,CAAC;QAC3C,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;QACvC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,+BAA+B,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,GAAG,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC9B,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;QACtD,OAAO,SAAkB,CAAC;IAC5B,CAAC;IACD,MAAM,GAAG,CAAC;AACZ,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB;IACpC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,MAAM,EAAE,4CAA4C,EAAE,CAAC,CAAC;IAEpF,0CAA0C;IAC1C,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAE/B,4EAA4E;IAC5E,6BAA6B;IAC7B,4EAA4E;IAC5E,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACrF,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,sBAAsB,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC5D,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,gBAAgB,CAAC;gBAC1D,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK;gBAC/B,GAAG,IAAI;aACR,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,sEAAsE;IACtE,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAClF,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,qBAAqB,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACrD,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,4BAA4B,CACtE,GAAG,CAAC,MAAM,CAAC,KAAK,EAChB,KAAK,CAAC,QAAQ,CACf,CAAC;YACF,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,sCAAsC;IACtC,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACzF,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACjF,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;QACzC,CAAC;QACD,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,+DAA+D;IAC/D,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC3F,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,sBAAsB,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC5D,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACrF,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,sCAAsC;IACtC,8DAA8D;IAC9D,4EAA4E;IAC5E,MAAM,CAAC,MAAM,CACX,UAAU,EACV,iBAAiB,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,EACvD,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,MAAM,CAAC;YACzC,MAAM,iBAAiB,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACnE,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,4EAA4E;IAC5E,+DAA+D;IAC/D,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CACR,gBAAgB,EAChB,iBAAiB,CAAC,iBAAiB,CAAC,eAAe,CAAC,EACpD,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAChF,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../src/routes/permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACvF,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,KAAK,iBAAiB,MAAM,+BAA+B,CAAC;AACnE,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAEjF,MAAM,sBAAsB,GAAG,aAAa,CAAC;AAC7C,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAS,qBAAqB,CAAC,CAAC;AAEtE,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,2CAA2C;AAC3C,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACvC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACtC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC;AAEH,mEAAmE;AACnE,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC3C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACxD,CAAC,CAAC;AAEH,iDAAiD;AACjD,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAEH,4EAA4E;AAC5E,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IACxB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;CAC1B,CAAC,CAAC;AAEH,mEAAmE;AACnE,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IACxB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;CAChC,CAAC,CAAC;AAEH,kEAAkE;AAClE,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AAE3E,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,WAAW,CAClB,GAAqF,EACrF,GAAY;IAEZ,IAAI,GAAG,YAAY,uBAAuB,EAAE,CAAC;QAC3C,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;QACvC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,+BAA+B,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,GAAG,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC9B,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;QACtD,OAAO,SAAkB,CAAC;IAC5B,CAAC;IACD,MAAM,GAAG,CAAC;AACZ,CAAC;AAED,4EAA4E;AAC5E,KAAK,UAAU,wBAAwB,CACrC,aAAqB,EACrB,YAAoB;IAEpB,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,kBAAkB,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IAC3F,gGAAgG;IAChG,iGAAiG;IACjG,IAAI,CAAC,UAAU;QAAE,OAAO;IACxB,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO;IACzD,MAAM,gBAAgB,GAAG,MAAM,oBAAoB,CAAC,sBAAsB,CAAC,CAAC;IAC5E,IAAI,gBAAgB,EAAE,EAAE,KAAK,UAAU,CAAC,aAAa,EAAE,CAAC;QACtD,MAAM,IAAI,mBAAmB,CAAC,sDAAsD,CAAC,CAAC;IACxF,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB;IACpC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,MAAM,EAAE,4CAA4C,EAAE,CAAC,CAAC;IAEpF,0CAA0C;IAC1C,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAE/B,4EAA4E;IAC5E,6BAA6B;IAC7B,4EAA4E;IAC5E,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACrF,IAAI,CAAC;YACH,2BAA2B,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC9C,MAAM,IAAI,GAAG,sBAAsB,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC5D,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,gBAAgB,CACzD;gBACE,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK;gBAC/B,GAAG,IAAI;aACR,EACD,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,CACxB,CAAC;YACF,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,sEAAsE;IACtE,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAClF,IAAI,CAAC;YACH,2BAA2B,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC9C,MAAM,KAAK,GAAG,qBAAqB,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACrD,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,4BAA4B,CACtE,GAAG,CAAC,MAAM,CAAC,KAAK,EAChB,KAAK,CAAC,QAAQ,CACf,CAAC;YACF,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,sCAAsC;IACtC,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACzF,IAAI,CAAC;YACH,0BAA0B,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC7C,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,kBAAkB,CAC3D,GAAG,CAAC,MAAM,CAAC,KAAK,EAChB,GAAG,CAAC,MAAM,CAAC,MAAM,CAClB,CAAC;YACF,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;YACzC,CAAC;YACD,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,+DAA+D;IAC/D,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC3F,IAAI,CAAC;YACH,0BAA0B,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC7C,MAAM,IAAI,GAAG,sBAAsB,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC5D,MAAM,wBAAwB,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACpE,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,gBAAgB,CACzD,GAAG,CAAC,MAAM,CAAC,KAAK,EAChB,GAAG,CAAC,MAAM,CAAC,MAAM,EACjB,IAAI,EACJ,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,CACxB,CAAC;YACF,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,4CAA4C;IAC5C,4EAA4E;IAC5E,MAAM,CAAC,MAAM,CACX,gBAAgB,EAChB,iBAAiB,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,EACtD,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,wBAAwB,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC3C,MAAM,wBAAwB,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC1E,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,gBAAgB,CACrD,GAAG,CAAC,MAAM,CAAC,KAAK,EAChB,GAAG,CAAC,MAAM,CAAC,YAAY,EACvB,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,CACxB,CAAC;YACF,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,4EAA4E;IAC5E,+DAA+D;IAC/D,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CACR,gBAAgB,EAChB,iBAAiB,CAAC,iBAAiB,CAAC,eAAe,CAAC,EACpD,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,0BAA0B,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC7C,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,sBAAsB,CAC1D,GAAG,CAAC,MAAM,CAAC,KAAK,EAChB,GAAG,CAAC,MAAM,CAAC,MAAM,CAClB,CAAC;YACF,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/routes/public-branding.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Public organization branding image delivery.
+ *
+ * Authentication pages reference this route for uploaded logos and favicons. The route resolves
+ * the organization directly because suspended organizations must retain their branding while
+ * administrators repair or reactivate them.
+ */
+import Router from '@koa/router';
+/**
+ * Create the anonymous router that serves one exact organization branding asset.
+ *
+ * Missing organizations, unsupported slots, and empty slots intentionally use one response so
+ * callers cannot distinguish tenant existence from asset configuration.
+ */
+export declare function createPublicBrandingRouter(): Router;
+//# sourceMappingURL=public-branding.d.ts.map

package/dist/routes/public-branding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-branding.d.ts","sourceRoot":"","sources":["../../src/routes/public-branding.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AAcjC;;;;;GAKG;AACH,wBAAgB,0BAA0B,IAAI,MAAM,CAgCnD"}

package/dist/routes/public-branding.js

@@ -0,0 +1,52 @@
+/**
+ * Public organization branding image delivery.
+ *
+ * Authentication pages reference this route for uploaded logos and favicons. The route resolves
+ * the organization directly because suspended organizations must retain their branding while
+ * administrators repair or reactivate them.
+ */
+import Router from '@koa/router';
+import { getAsset } from '../lib/branding-assets.js';
+import { setETagHeader } from '../lib/etag.js';
+import { findOrganizationBySlug } from '../organizations/repository.js';
+/** Restrictive policy used when an SVG is opened as a document instead of rendered as an image. */
+const SVG_CONTENT_SECURITY_POLICY = "sandbox; default-src 'none'; style-src 'unsafe-inline'; img-src data:";
+/** Return whether a route value identifies a supported public branding slot. */
+function isAssetType(value) {
+    return value === 'logo' || value === 'favicon';
+}
+/**
+ * Create the anonymous router that serves one exact organization branding asset.
+ *
+ * Missing organizations, unsupported slots, and empty slots intentionally use one response so
+ * callers cannot distinguish tenant existence from asset configuration.
+ */
+export function createPublicBrandingRouter() {
+    const router = new Router({ prefix: '/:orgSlug/branding' });
+    router.get('/:type', async (ctx) => {
+        const { orgSlug, type } = ctx.params;
+        if (!isAssetType(type)) {
+            ctx.throw(404);
+            return;
+        }
+        const organization = await findOrganizationBySlug(orgSlug);
+        if (organization === null) {
+            ctx.throw(404);
+            return;
+        }
+        const asset = await getAsset(organization.id, type);
+        if (asset === null) {
+            ctx.throw(404);
+            return;
+        }
+        ctx.type = asset.contentType;
+        ctx.set('Cache-Control', 'public, no-cache');
+        setETagHeader(ctx, 'branding-asset', asset.id, asset.updatedAt);
+        if (asset.contentType === 'image/svg+xml') {
+            ctx.set('Content-Security-Policy', SVG_CONTENT_SECURITY_POLICY);
+        }
+        ctx.body = asset.data;
+    });
+    return router;
+}
+//# sourceMappingURL=public-branding.js.map

package/dist/routes/public-branding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-branding.js","sourceRoot":"","sources":["../../src/routes/public-branding.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAkB,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAExE,mGAAmG;AACnG,MAAM,2BAA2B,GAC/B,uEAAuE,CAAC;AAE1E,gFAAgF;AAChF,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,SAAS,CAAC;AACjD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B;IACxC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;IAE5D,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACjC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QACrC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACf,OAAO;QACT,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAC3D,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;YAC1B,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACf,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACpD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACf,OAAO;QACT,CAAC;QAED,GAAG,CAAC,IAAI,GAAG,KAAK,CAAC,WAAW,CAAC;QAC7B,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,kBAAkB,CAAC,CAAC;QAC7C,aAAa,CAAC,GAAG,EAAE,gBAAgB,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAChE,IAAI,KAAK,CAAC,WAAW,KAAK,eAAe,EAAE,CAAC;YAC1C,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,2BAA2B,CAAC,CAAC;QAClE,CAAC;QACD,GAAG,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/routes/roles.d.ts

@@ -11,7 +11,7 @@
  *   GET    /                       — List all roles for an application
  *   GET    /:roleId                — Get a role by ID
  *   PUT    /:roleId                — Update a role
- *   DELETE /:roleId                — Delete a role (?force=true)
+ *   DELETE /:roleId                — Delete a role
  *   GET    /:roleId/permissions    — List permissions for a role
  *   PUT    /:roleId/permissions    — Assign permissions to a role
  *   DELETE /:roleId/permissions    — Remove permissions from a role

package/dist/routes/roles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"roles.d.ts","sourceRoot":"","sources":["../../src/routes/roles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AAwEjC;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CA6IzC"}
+{"version":3,"file":"roles.d.ts","sourceRoot":"","sources":["../../src/routes/roles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AAkGjC;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CA4LzC"}

package/dist/routes/roles.js

@@ -11,7 +11,7 @@
  *   GET    /                       — List all roles for an application
  *   GET    /:roleId                — Get a role by ID
  *   PUT    /:roleId                — Update a role
- *   DELETE /:roleId                — Delete a role (?force=true)
+ *   DELETE /:roleId                — Delete a role
  *   GET    /:roleId/permissions    — List permissions for a role
  *   PUT    /:roleId/permissions    — Assign permissions to a role
  *   DELETE /:roleId/permissions    — Remove permissions from a role
@@ -26,23 +26,26 @@ import Router from '@koa/router';
 import { z } from 'zod';
 import { requireAdminAuth } from '../middleware/admin-auth.js';
 import { requirePermission } from '../middleware/require-permission.js';
-import { ADMIN_PERMISSIONS } from '../lib/admin-permissions.js';
+import { ADMIN_PERMISSIONS, ALL_ADMIN_ROLES } from '../lib/admin-permissions.js';
+import { getApplicationBySlug } from '../applications/service.js';
 import * as roleService from '../rbac/role-service.js';
 import * as userRoleService from '../rbac/user-role-service.js';
 import { RoleNotFoundError, PermissionNotFoundError, RbacValidationError } from '../rbac/errors.js';
+const ADMIN_APPLICATION_SLUG = 'porta-admin';
+const ADMIN_ROLE_SLUGS = new Set(ALL_ADMIN_ROLES.map((role) => role.slug));
 // ---------------------------------------------------------------------------
 // Validation schemas
 // ---------------------------------------------------------------------------
 /** Schema for creating a new role */
 const createRoleSchema = z.object({
     name: z.string().min(1).max(255),
-    slug: z.string().min(1).max(100).optional(),
+    slug: z.string().trim().min(1).max(100).optional(),
     description: z.string().max(1000).optional(),
 });
 /** Schema for updating a role (all fields optional) */
 const updateRoleSchema = z.object({
     name: z.string().min(1).max(255).optional(),
-    slug: z.string().min(1).max(100).optional(),
+    slug: z.string().trim().min(1).max(100).optional(),
     description: z.string().max(1000).nullable().optional(),
 });
 /** Schema for assigning/removing permissions (array of UUIDs) */
@@ -55,6 +58,13 @@ const listUsersWithRoleSchema = z.object({
     page: z.coerce.number().int().min(1).default(1),
     pageSize: z.coerce.number().int().min(1).max(100).default(20),
 });
+/** Parent-qualified parameters accepted by role deletion. */
+const identifierSchema = z.object({
+    appId: z.string().uuid(),
+    roleId: z.string().uuid(),
+});
+/** Application parent parameter accepted by collection routes. */
+const applicationIdentifierSchema = z.object({ appId: z.string().uuid() });
 // ---------------------------------------------------------------------------
 // Error handler helper
 // ---------------------------------------------------------------------------
@@ -79,6 +89,20 @@ function handleError(ctx, err) {
     }
     throw err;
 }
+/** Reject generic route mutations of a canonical Porta Admin role. */
+async function requireMutableRole(applicationId, roleId) {
+    const role = await roleService.findRoleById(applicationId, roleId);
+    // The mutation service remains responsible for authoritative not-found handling and repeats the
+    // canonical check after locking. This route lookup exists only for an early sanitized rejection.
+    if (!role)
+        return;
+    if (!ADMIN_ROLE_SLUGS.has(role.slug))
+        return;
+    const adminApplication = await getApplicationBySlug(ADMIN_APPLICATION_SLUG);
+    if (adminApplication?.id === role.applicationId) {
+        throw new RbacValidationError('Canonical Porta Admin roles cannot be modified');
+    }
+}
 // ---------------------------------------------------------------------------
 // Router factory
 // ---------------------------------------------------------------------------
@@ -101,11 +125,12 @@ export function createRoleRouter() {
     // -------------------------------------------------------------------------
     router.post('/', requirePermission(ADMIN_PERMISSIONS.ROLE_CREATE), async (ctx) => {
         try {
+            applicationIdentifierSchema.parse(ctx.params);
             const body = createRoleSchema.parse(ctx.request.body);
             const role = await roleService.createRole({
                 applicationId: ctx.params.appId,
                 ...body,
-            });
+            }, ctx.state.adminUser?.id);
             ctx.status = 201;
             ctx.body = { data: role };
         }
@@ -118,6 +143,7 @@ export function createRoleRouter() {
     // -------------------------------------------------------------------------
     router.get('/', requirePermission(ADMIN_PERMISSIONS.ROLE_READ), async (ctx) => {
         try {
+            applicationIdentifierSchema.parse(ctx.params);
             const roles = await roleService.listRolesByApplication(ctx.params.appId);
             ctx.body = { data: roles };
         }
@@ -129,20 +155,28 @@ export function createRoleRouter() {
     // GET /:roleId — Get role by ID
     // -------------------------------------------------------------------------
     router.get('/:roleId', requirePermission(ADMIN_PERMISSIONS.ROLE_READ), async (ctx) => {
-        const role = await roleService.findRoleById(ctx.params.roleId);
-        if (!role) {
-            ctx.throw(404, 'Role not found');
+        try {
+            identifierSchema.parse(ctx.params);
+            const role = await roleService.findRoleById(ctx.params.appId, ctx.params.roleId);
+            if (!role) {
+                ctx.throw(404, 'Role not found');
+            }
+            ctx.body = { data: role };
+        }
+        catch (err) {
+            handleError(ctx, err);
         }
-        ctx.body = { data: role };
     });
     // -------------------------------------------------------------------------
     // PUT /:roleId — Update role
     // -------------------------------------------------------------------------
     router.put('/:roleId', requirePermission(ADMIN_PERMISSIONS.ROLE_UPDATE), async (ctx) => {
         try {
+            identifierSchema.parse(ctx.params);
             const body = updateRoleSchema.parse(ctx.request.body);
-            const role = await roleService.updateRole(ctx.params.roleId, body);
-            ctx.body = { data: role };
+            await requireMutableRole(ctx.params.appId, ctx.params.roleId);
+            const result = await roleService.updateRole(ctx.params.appId, ctx.params.roleId, body, ctx.state.adminUser?.id);
+            ctx.body = { data: result };
         }
         catch (err) {
             handleError(ctx, err);
@@ -150,13 +184,14 @@ export function createRoleRouter() {
     });
     // -------------------------------------------------------------------------
     // DELETE /:roleId — Delete role
-    // Supports ?force=true to delete even when users are assigned
     // -------------------------------------------------------------------------
-    router.delete('/:roleId', requirePermission(ADMIN_PERMISSIONS.ROLE_ARCHIVE), async (ctx) => {
+    router.delete('/:roleId', requirePermission(ADMIN_PERMISSIONS.ROLE_DELETE), async (ctx) => {
         try {
-            const force = ctx.query.force === 'true';
-            await roleService.deleteRole(ctx.params.roleId, force);
-            ctx.status = 204;
+            identifierSchema.parse(ctx.params);
+            await requireMutableRole(ctx.params.appId, ctx.params.roleId);
+            const result = await roleService.deleteRole(ctx.params.appId, ctx.params.roleId, ctx.state.adminUser?.id);
+            ctx.status = 200;
+            ctx.body = { data: result };
         }
         catch (err) {
             handleError(ctx, err);
@@ -167,7 +202,8 @@ export function createRoleRouter() {
     // -------------------------------------------------------------------------
     router.get('/:roleId/permissions', requirePermission(ADMIN_PERMISSIONS.ROLE_READ), async (ctx) => {
         try {
-            const permissions = await roleService.getPermissionsForRole(ctx.params.roleId);
+            identifierSchema.parse(ctx.params);
+            const permissions = await roleService.getPermissionsForRole(ctx.params.appId, ctx.params.roleId);
             ctx.body = { data: permissions };
         }
         catch (err) {
@@ -179,8 +215,10 @@ export function createRoleRouter() {
     // -------------------------------------------------------------------------
     router.put('/:roleId/permissions', requirePermission(ADMIN_PERMISSIONS.ROLE_UPDATE), async (ctx) => {
         try {
+            identifierSchema.parse(ctx.params);
             const body = permissionIdsSchema.parse(ctx.request.body);
-            await roleService.assignPermissionsToRole(ctx.params.roleId, body.permissionIds);
+            await requireMutableRole(ctx.params.appId, ctx.params.roleId);
+            await roleService.assignPermissionsToRole(ctx.params.appId, ctx.params.roleId, body.permissionIds, ctx.state.adminUser?.id);
             ctx.status = 204;
         }
         catch (err) {
@@ -192,9 +230,12 @@ export function createRoleRouter() {
     // -------------------------------------------------------------------------
     router.delete('/:roleId/permissions', requirePermission(ADMIN_PERMISSIONS.ROLE_UPDATE), async (ctx) => {
         try {
+            identifierSchema.parse(ctx.params);
             const body = permissionIdsSchema.parse(ctx.request.body);
-            await roleService.removePermissionsFromRole(ctx.params.roleId, body.permissionIds);
-            ctx.status = 204;
+            await requireMutableRole(ctx.params.appId, ctx.params.roleId);
+            const result = await roleService.removePermissionsFromRole(ctx.params.appId, ctx.params.roleId, body.permissionIds, ctx.state.adminUser?.id);
+            ctx.status = 200;
+            ctx.body = { data: result };
         }
         catch (err) {
             handleError(ctx, err);
@@ -206,8 +247,9 @@ export function createRoleRouter() {
     // -------------------------------------------------------------------------
     router.get('/:roleId/users', requirePermission(ADMIN_PERMISSIONS.ROLE_READ), async (ctx) => {
         try {
+            identifierSchema.parse(ctx.params);
             const query = listUsersWithRoleSchema.parse(ctx.query);
-            const result = await userRoleService.getUsersWithRole(ctx.params.roleId, query.orgId, {
+            const result = await userRoleService.getUsersWithRole(ctx.params.appId, ctx.params.roleId, query.orgId, {
                 page: query.page,
                 pageSize: query.pageSize,
             });

package/dist/routes/roles.js.map

@@ -1 +1 @@
-{"version":3,"file":"roles.js","sourceRoot":"","sources":["../../src/routes/roles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,WAAW,MAAM,yBAAyB,CAAC;AACvD,OAAO,KAAK,eAAe,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAEpG,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,qCAAqC;AACrC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC3C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC;AAEH,uDAAuD;AACvD,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC3C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC3C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACxD,CAAC,CAAC;AAEH,iEAAiE;AACjE,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CACjD,CAAC,CAAC;AAEH,mEAAmE;AACnE,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IACxB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/C,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC9D,CAAC,CAAC;AAEH,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,WAAW,CAClB,GAAqF,EACrF,GAAY;IAEZ,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;QACrC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,GAAG,YAAY,uBAAuB,EAAE,CAAC;QAC3C,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;QACvC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,GAAG,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC9B,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;QAChD,OAAO,SAAkB,CAAC;IAC5B,CAAC;IACD,MAAM,GAAG,CAAC;AACZ,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAC,CAAC;IAE9E,0CAA0C;IAC1C,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAE/B,4EAA4E;IAC5E,uBAAuB;IACvB,4EAA4E;IAC5E,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC/E,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACtD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,UAAU,CAAC;gBACxC,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK;gBAC/B,GAAG,IAAI;aACR,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,qCAAqC;IACrC,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC5E,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACzE,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,gCAAgC;IAChC,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACnF,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QACnC,CAAC;QACD,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,6BAA6B;IAC7B,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACrF,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACtD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACnE,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,gCAAgC;IAChC,8DAA8D;IAC9D,4EAA4E;IAC5E,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACzF,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,MAAM,CAAC;YACzC,MAAM,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACvD,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,yDAAyD;IACzD,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CACR,sBAAsB,EACtB,iBAAiB,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAC9C,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC/E,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,4EAA4E;IAC5E,0DAA0D;IAC1D,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CACR,sBAAsB,EACtB,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAChD,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACzD,MAAM,WAAW,CAAC,uBAAuB,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;YACjF,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,4EAA4E;IAC5E,+DAA+D;IAC/D,4EAA4E;IAC5E,MAAM,CAAC,MAAM,CACX,sBAAsB,EACtB,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAChD,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACzD,MAAM,WAAW,CAAC,yBAAyB,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;YACnF,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,4EAA4E;IAC5E,yEAAyE;IACzE,sCAAsC;IACtC,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACzF,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,uBAAuB,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACvD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE;gBACpF,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;aACzB,CAAC,CAAC;YACH,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QACxD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"roles.js","sourceRoot":"","sources":["../../src/routes/roles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,KAAK,WAAW,MAAM,yBAAyB,CAAC;AACvD,OAAO,KAAK,eAAe,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAEpG,MAAM,sBAAsB,GAAG,aAAa,CAAC;AAC7C,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAE3E,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,qCAAqC;AACrC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAClD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC;AAEH,uDAAuD;AACvD,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC3C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAClD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACxD,CAAC,CAAC;AAEH,iEAAiE;AACjE,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CACjD,CAAC,CAAC;AAEH,mEAAmE;AACnE,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IACxB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/C,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC9D,CAAC,CAAC;AAEH,6DAA6D;AAC7D,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IACxB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;CAC1B,CAAC,CAAC;AAEH,kEAAkE;AAClE,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AAE3E,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,WAAW,CAClB,GAAqF,EACrF,GAAY;IAEZ,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;QACrC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,GAAG,YAAY,uBAAuB,EAAE,CAAC;QAC3C,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;QACvC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,GAAG,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC9B,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;QAChD,OAAO,SAAkB,CAAC;IAC5B,CAAC;IACD,MAAM,GAAG,CAAC;AACZ,CAAC;AAED,sEAAsE;AACtE,KAAK,UAAU,kBAAkB,CAAC,aAAqB,EAAE,MAAc;IACrE,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACnE,gGAAgG;IAChG,iGAAiG;IACjG,IAAI,CAAC,IAAI;QAAE,OAAO;IAClB,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO;IAC7C,MAAM,gBAAgB,GAAG,MAAM,oBAAoB,CAAC,sBAAsB,CAAC,CAAC;IAC5E,IAAI,gBAAgB,EAAE,EAAE,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC;QAChD,MAAM,IAAI,mBAAmB,CAAC,gDAAgD,CAAC,CAAC;IAClF,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAC,CAAC;IAE9E,0CAA0C;IAC1C,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAE/B,4EAA4E;IAC5E,uBAAuB;IACvB,4EAA4E;IAC5E,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC/E,IAAI,CAAC;YACH,2BAA2B,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC9C,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACtD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,UAAU,CACvC;gBACE,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK;gBAC/B,GAAG,IAAI;aACR,EACD,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,CACxB,CAAC;YACF,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,qCAAqC;IACrC,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC5E,IAAI,CAAC;YACH,2BAA2B,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC9C,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACzE,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,gCAAgC;IAChC,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACnF,IAAI,CAAC;YACH,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACnC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACjF,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;YACnC,CAAC;YACD,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,6BAA6B;IAC7B,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACrF,IAAI,CAAC;YACH,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACnC,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACtD,MAAM,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC9D,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,UAAU,CACzC,GAAG,CAAC,MAAM,CAAC,KAAK,EAChB,GAAG,CAAC,MAAM,CAAC,MAAM,EACjB,IAAI,EACJ,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,CACxB,CAAC;YACF,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,gCAAgC;IAChC,4EAA4E;IAC5E,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACxF,IAAI,CAAC;YACH,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACnC,MAAM,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC9D,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,UAAU,CACzC,GAAG,CAAC,MAAM,CAAC,KAAK,EAChB,GAAG,CAAC,MAAM,CAAC,MAAM,EACjB,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,CACxB,CAAC;YACF,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,yDAAyD;IACzD,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CACR,sBAAsB,EACtB,iBAAiB,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAC9C,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACnC,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,qBAAqB,CACzD,GAAG,CAAC,MAAM,CAAC,KAAK,EAChB,GAAG,CAAC,MAAM,CAAC,MAAM,CAClB,CAAC;YACF,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,4EAA4E;IAC5E,0DAA0D;IAC1D,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CACR,sBAAsB,EACtB,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAChD,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACnC,MAAM,IAAI,GAAG,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACzD,MAAM,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC9D,MAAM,WAAW,CAAC,uBAAuB,CACvC,GAAG,CAAC,MAAM,CAAC,KAAK,EAChB,GAAG,CAAC,MAAM,CAAC,MAAM,EACjB,IAAI,CAAC,aAAa,EAClB,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,CACxB,CAAC;YACF,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,4EAA4E;IAC5E,+DAA+D;IAC/D,4EAA4E;IAC5E,MAAM,CAAC,MAAM,CACX,sBAAsB,EACtB,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAChD,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACnC,MAAM,IAAI,GAAG,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACzD,MAAM,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC9D,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,yBAAyB,CACxD,GAAG,CAAC,MAAM,CAAC,KAAK,EAChB,GAAG,CAAC,MAAM,CAAC,MAAM,EACjB,IAAI,CAAC,aAAa,EAClB,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,CACxB,CAAC;YACF,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,4EAA4E;IAC5E,yEAAyE;IACzE,sCAAsC;IACtC,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACzF,IAAI,CAAC;YACH,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACnC,MAAM,KAAK,GAAG,uBAAuB,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACvD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,gBAAgB,CACnD,GAAG,CAAC,MAAM,CAAC,KAAK,EAChB,GAAG,CAAC,MAAM,CAAC,MAAM,EACjB,KAAK,CAAC,KAAK,EACX;gBACE,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;aACzB,CACF,CAAC;YACF,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QACxD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/routes/sessions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../src/routes/sessions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AA6BjC;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAuD5C;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,CAehD"}
+{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../src/routes/sessions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AA0CjC;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CA2D5C;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,CAehD"}

package/dist/routes/sessions.js

@@ -35,6 +35,15 @@ const listSessionsSchema = z.object({
     page: z.coerce.number().int().min(1).default(1),
     pageSize: z.coerce.number().int().min(1).max(100).default(20),
 });
+/** Public UUID accepted by single-session administrative operations. */
+const publicSessionIdSchema = z.string().uuid();
+/** Validate a public session identifier without exposing parser details. */
+function publicSessionId(ctx, value) {
+    const result = publicSessionIdSchema.safeParse(value);
+    if (!result.success)
+        ctx.throw(400, 'Session request is invalid');
+    return result.data;
+}
 // ---------------------------------------------------------------------------
 // Router factory
 // ---------------------------------------------------------------------------
@@ -64,7 +73,7 @@ export function createSessionRouter() {
     // GET /:sessionId — Get session detail
     // -------------------------------------------------------------------------
     router.get('/:sessionId', requirePermission(ADMIN_PERMISSIONS.SESSION_READ), async (ctx) => {
-        const session = await sessionTracking.getSession(ctx.params.sessionId);
+        const session = await sessionTracking.getSessionByPublicId(publicSessionId(ctx, ctx.params.sessionId));
         if (!session) {
             ctx.throw(404, 'Session not found');
             return;
@@ -80,19 +89,21 @@ export function createSessionRouter() {
     //   3. Audit log entry for session revocation
     // -------------------------------------------------------------------------
     router.delete('/:sessionId', requirePermission(ADMIN_PERMISSIONS.SESSION_REVOKE), async (ctx) => {
-        const { sessionId } = ctx.params;
+        const requestedSessionId = publicSessionId(ctx, ctx.params.sessionId);
         // 1. Mark revoked in PG tracking table
-        await sessionTracking.revokeSession(sessionId);
+        const redisSessionId = await sessionTracking.revokeSessionByPublicId(requestedSessionId);
         // 2. Delete from Redis to kill the live session
-        await afterDatabaseCommit(async () => {
-            try {
-                const redis = getRedis();
-                await redis.del(`oidc:Session:${sessionId}`);
-            }
-            catch {
-                // Redis deletion failure is non-fatal — session will expire naturally.
-            }
-        });
+        if (redisSessionId !== null) {
+            await afterDatabaseCommit(async () => {
+                try {
+                    const redis = getRedis();
+                    await redis.del(`oidc:Session:${redisSessionId}`);
+                }
+                catch {
+                    // Redis deletion failure is non-fatal — session will expire naturally.
+                }
+            });
+        }
         ctx.status = 204;
     });
     return router;

package/dist/routes/sessions.js.map

@@ -1 +1 @@
-{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../src/routes/sessions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,eAAe,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACpC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC5C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACtC,UAAU,EAAE,CAAC;SACV,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;SACvB,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC;SAC9B,QAAQ,EAAE;IACb,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/C,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC9D,CAAC,CAAC;AAEH,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC;IAE7D,0CAA0C;IAC1C,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAE/B,4EAA4E;IAC5E,oCAAoC;IACpC,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC/E,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACzD,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,uCAAuC;IACvC,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACzF,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACvE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;YACpC,OAAO;QACT,CAAC;QACD,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,wCAAwC;IACxC,EAAE;IACF,sBAAsB;IACtB,4DAA4D;IAC5D,0DAA0D;IAC1D,8CAA8C;IAC9C,4EAA4E;IAC5E,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC9F,MAAM,EAAE,SAAS,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QAEjC,uCAAuC;QACvC,MAAM,eAAe,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAE/C,gDAAgD;QAChD,MAAM,mBAAmB,CAAC,KAAK,IAAI,EAAE;YACnC,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;gBACzB,MAAM,KAAK,CAAC,GAAG,CAAC,gBAAgB,SAAS,EAAE,CAAC,CAAC;YAC/C,CAAC;YAAC,MAAM,CAAC;gBACP,uEAAuE;YACzE,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB;IACrC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC,CAAC;IAE3E,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAE/B,4EAA4E;IAC5E,4CAA4C;IAC5C,4EAA4E;IAC5E,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACpF,MAAM,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QAC9B,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAC/D,GAAG,CAAC,IAAI,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../src/routes/sessions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,eAAe,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACpC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC5C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACtC,UAAU,EAAE,CAAC;SACV,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;SACvB,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC;SAC9B,QAAQ,EAAE;IACb,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/C,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC9D,CAAC,CAAC;AAEH,wEAAwE;AACxE,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;AAEhD,4EAA4E;AAC5E,SAAS,eAAe,CACtB,GAA0D,EAC1D,KAAa;IAEb,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACtD,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC;IAClE,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC;IAE7D,0CAA0C;IAC1C,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAE/B,4EAA4E;IAC5E,oCAAoC;IACpC,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC/E,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACzD,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,uCAAuC;IACvC,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACzF,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,oBAAoB,CACxD,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAC3C,CAAC;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;YACpC,OAAO;QACT,CAAC;QACD,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,wCAAwC;IACxC,EAAE;IACF,sBAAsB;IACtB,4DAA4D;IAC5D,0DAA0D;IAC1D,8CAA8C;IAC9C,4EAA4E;IAC5E,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC9F,MAAM,kBAAkB,GAAG,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAEtE,uCAAuC;QACvC,MAAM,cAAc,GAAG,MAAM,eAAe,CAAC,uBAAuB,CAAC,kBAAkB,CAAC,CAAC;QAEzF,gDAAgD;QAChD,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;YAC5B,MAAM,mBAAmB,CAAC,KAAK,IAAI,EAAE;gBACnC,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;oBACzB,MAAM,KAAK,CAAC,GAAG,CAAC,gBAAgB,cAAc,EAAE,CAAC,CAAC;gBACpD,CAAC;gBAAC,MAAM,CAAC;oBACP,uEAAuE;gBACzE,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;QAED,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB;IACrC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC,CAAC;IAE3E,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAE/B,4EAA4E;IAC5E,4CAA4C;IAC5C,4EAA4E;IAC5E,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACpF,MAAM,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QAC9B,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAC/D,GAAG,CAAC,IAAI,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/routes/two-factor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"two-factor.d.ts","sourceRoot":"","sources":["../../src/routes/two-factor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAC;AA4J1C;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,GAAG,MAAM,CA6BhE"}
+{"version":3,"file":"two-factor.d.ts","sourceRoot":"","sources":["../../src/routes/two-factor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAC;AA+I1C;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,GAAG,MAAM,CA6BhE"}