@prenta/core 0.118.0

package/dist/security/access.d.ts

@@ -0,0 +1,35 @@
+import type { FieldDefinition } from '../config/types.js';
+export type Role = 'ADMIN' | 'EDITOR' | 'AUTHOR' | 'CLIENT';
+export type FieldAccessUser = {
+    id: string;
+    role: string;
+} | null;
+export interface Permission {
+    action: 'create' | 'read' | 'update' | 'delete' | 'publish';
+    resource: string;
+    fields?: string[];
+}
+/** Check whether a user with the given role can perform an action on a resource. */
+export declare function checkAccess(userRole: Role, requiredRole: Role): boolean;
+/** Return the list of permissions granted to a role. */
+export declare function getPermissionsForRole(role: Role): Permission[];
+/** Filter field definitions to only include those the user is allowed to read. */
+export declare function filterFieldsByRole(fields: Record<string, FieldDefinition>, user: FieldAccessUser): Promise<Record<string, FieldDefinition>>;
+/** Filter incoming data to only include keys the user is allowed to update. */
+export declare function filterWritableFields(fields: Record<string, FieldDefinition>, data: Record<string, unknown>, user: FieldAccessUser): Promise<Record<string, unknown>>;
+/**
+ * Undeclared keys that may still be written on create/update.
+ *
+ * Mass-assignment protection strips unknown keys on write — but SEO
+ * conventions and page-builder envelopes are intentionally stored outside
+ * (or alongside) declared `fields` and must survive create, version restore,
+ * and partial editor saves (#671 follow-up).
+ */
+export declare const WRITE_PASSTHROUGH_KEYS: Set<string>;
+/**
+ * Apply field-level access control to a data object.
+ * For 'read': strips keys the user cannot read.
+ * For 'write': strips keys the user cannot update.
+ */
+export declare function applyFieldAccess(operation: 'read' | 'write', fields: Record<string, FieldDefinition>, data: Record<string, unknown>, user: FieldAccessUser): Promise<Record<string, unknown>>;
+//# sourceMappingURL=access.d.ts.map

package/dist/security/access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../../src/security/access.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAEzD,MAAM,MAAM,IAAI,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAA;AAE3D,MAAM,MAAM,eAAe,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAA;AAEjE,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAA;IAC3D,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAClB;AASD,oFAAoF;AACpF,wBAAgB,WAAW,CAAC,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,GAAG,OAAO,CAEvE;AAED,wDAAwD;AACxD,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,IAAI,GAAG,UAAU,EAAE,CAgB9D;AAED,kFAAkF;AAClF,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,EACvC,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAe1C;AAED,+EAA+E;AAC/E,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,EACvC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAgBlC;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,aAqCjC,CAAA;AAEF;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,SAAS,EAAE,MAAM,GAAG,OAAO,EAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,EACvC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAyBlC"}

package/dist/security/access.js

@@ -0,0 +1,133 @@
+const ROLE_HIERARCHY = {
+    ADMIN: 100,
+    EDITOR: 75,
+    AUTHOR: 50,
+    CLIENT: 25,
+};
+/** Check whether a user with the given role can perform an action on a resource. */
+export function checkAccess(userRole, requiredRole) {
+    return ROLE_HIERARCHY[userRole] >= ROLE_HIERARCHY[requiredRole];
+}
+/** Return the list of permissions granted to a role. */
+export function getPermissionsForRole(role) {
+    const permissions = [{ action: 'read', resource: '*' }];
+    if (checkAccess(role, 'AUTHOR')) {
+        permissions.push({ action: 'create', resource: '*' });
+        permissions.push({ action: 'update', resource: 'own' });
+    }
+    if (checkAccess(role, 'EDITOR')) {
+        permissions.push({ action: 'update', resource: '*' });
+        permissions.push({ action: 'publish', resource: '*' });
+    }
+    if (checkAccess(role, 'ADMIN')) {
+        permissions.push({ action: 'delete', resource: '*' });
+    }
+    return permissions;
+}
+/** Filter field definitions to only include those the user is allowed to read. */
+export async function filterFieldsByRole(fields, user) {
+    const result = {};
+    for (const [name, field] of Object.entries(fields)) {
+        if (!field.access?.read) {
+            result[name] = field;
+            continue;
+        }
+        const allowed = await field.access.read({ user });
+        if (allowed) {
+            result[name] = field;
+        }
+    }
+    return result;
+}
+/** Filter incoming data to only include keys the user is allowed to update. */
+export async function filterWritableFields(fields, data, user) {
+    const result = {};
+    for (const [key, value] of Object.entries(data)) {
+        const field = fields[key];
+        if (!field || !field.access?.update) {
+            result[key] = value;
+            continue;
+        }
+        const allowed = await field.access.update({ user });
+        if (allowed) {
+            result[key] = value;
+        }
+    }
+    return result;
+}
+/**
+ * Undeclared keys that may still be written on create/update.
+ *
+ * Mass-assignment protection strips unknown keys on write — but SEO
+ * conventions and page-builder envelopes are intentionally stored outside
+ * (or alongside) declared `fields` and must survive create, version restore,
+ * and partial editor saves (#671 follow-up).
+ */
+export const WRITE_PASSTHROUGH_KEYS = new Set([
+    'title',
+    'slug',
+    'status',
+    '_aiScore',
+    '_embedding',
+    '_layout',
+    '_pageSettings',
+    // Pages list / tag manager write these even when a consumer config omitted
+    // the matching field declarations (create-prenta historically shipped
+    // pages without tags/primaryTag/parentPageId). Without passthrough the
+    // field-access layer silently drops the keys and bulk "Add tag" appears
+    // to succeed while nothing persists.
+    'tags',
+    'primaryTag',
+    'parentPageId',
+    // SEO conventions (also written via updateDocumentSeoFields)
+    'focusKeyword',
+    'focusKeyphrase', // legacy alias — normalized to focusKeyword in actions
+    'schemaType',
+    'structuredDataType',
+    'metaTitle',
+    'metaDescription',
+    'canonical',
+    'canonicalUrl',
+    'ogTitle',
+    'ogDescription',
+    'ogImage',
+    'twitterTitle',
+    'twitterDescription',
+    'twitterImage',
+    'noIndex',
+    'noFollow',
+    'robotsPolicy',
+    'keyTakeaway',
+    'isCornerstone',
+    'structuredData',
+]);
+/**
+ * Apply field-level access control to a data object.
+ * For 'read': strips keys the user cannot read.
+ * For 'write': strips keys the user cannot update.
+ */
+export async function applyFieldAccess(operation, fields, data, user) {
+    const accessKey = operation === 'read' ? 'read' : 'update';
+    const result = {};
+    for (const [key, value] of Object.entries(data)) {
+        const field = fields[key];
+        if (!field) {
+            if (operation === 'write' && !WRITE_PASSTHROUGH_KEYS.has(key)) {
+                continue;
+            }
+            result[key] = value;
+            continue;
+        }
+        const check = field.access?.[accessKey];
+        if (!check) {
+            result[key] = value;
+            continue;
+        }
+        const allowed = await check({ user });
+        if (allowed) {
+            result[key] = value;
+        }
+    }
+    return result;
+}
+//# sourceMappingURL=access.js.map

package/dist/security/access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.js","sourceRoot":"","sources":["../../src/security/access.ts"],"names":[],"mappings":"AAYA,MAAM,cAAc,GAAyB;IAC3C,KAAK,EAAE,GAAG;IACV,MAAM,EAAE,EAAE;IACV,MAAM,EAAE,EAAE;IACV,MAAM,EAAE,EAAE;CACX,CAAA;AAED,oFAAoF;AACpF,MAAM,UAAU,WAAW,CAAC,QAAc,EAAE,YAAkB;IAC5D,OAAO,cAAc,CAAC,QAAQ,CAAC,IAAI,cAAc,CAAC,YAAY,CAAC,CAAA;AACjE,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,qBAAqB,CAAC,IAAU;IAC9C,MAAM,WAAW,GAAiB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAA;IAErE,IAAI,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;QAChC,WAAW,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAA;QACrD,WAAW,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;IACzD,CAAC;IACD,IAAI,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;QAChC,WAAW,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAA;QACrD,WAAW,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAA;IACxD,CAAC;IACD,IAAI,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;QAC/B,WAAW,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAA;IACvD,CAAC;IAED,OAAO,WAAW,CAAA;AACpB,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAuC,EACvC,IAAqB;IAErB,MAAM,MAAM,GAAoC,EAAE,CAAA;IAElD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;YACxB,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAA;YACpB,SAAQ;QACV,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;QACjD,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAA;QACtB,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAuC,EACvC,IAA6B,EAC7B,IAAqB;IAErB,MAAM,MAAM,GAA4B,EAAE,CAAA;IAE1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;QACzB,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;YACpC,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;YACnB,SAAQ;QACV,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;QACnD,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;QACrB,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IAC5C,OAAO;IACP,MAAM;IACN,QAAQ;IACR,UAAU;IACV,YAAY;IACZ,SAAS;IACT,eAAe;IACf,2EAA2E;IAC3E,sEAAsE;IACtE,uEAAuE;IACvE,wEAAwE;IACxE,qCAAqC;IACrC,MAAM;IACN,YAAY;IACZ,cAAc;IACd,6DAA6D;IAC7D,cAAc;IACd,gBAAgB,EAAE,uDAAuD;IACzE,YAAY;IACZ,oBAAoB;IACpB,WAAW;IACX,iBAAiB;IACjB,WAAW;IACX,cAAc;IACd,SAAS;IACT,eAAe;IACf,SAAS;IACT,cAAc;IACd,oBAAoB;IACpB,cAAc;IACd,SAAS;IACT,UAAU;IACV,cAAc;IACd,aAAa;IACb,eAAe;IACf,gBAAgB;CACjB,CAAC,CAAA;AAEF;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,SAA2B,EAC3B,MAAuC,EACvC,IAA6B,EAC7B,IAAqB;IAErB,MAAM,SAAS,GAAG,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAA;IAC1D,MAAM,MAAM,GAA4B,EAAE,CAAA;IAE1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;QACzB,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,SAAS,KAAK,OAAO,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC9D,SAAQ;YACV,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;YACnB,SAAQ;QACV,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,CAAA;QACvC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;YACnB,SAAQ;QACV,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;QACrC,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;QACrB,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/security/anomaly-detection.d.ts

@@ -0,0 +1,17 @@
+export interface LoginAttempt {
+    userId: string;
+    ipAddress: string;
+    userAgent: string;
+    timestamp: Date;
+    success: boolean;
+}
+export interface AnomalyResult {
+    suspicious: boolean;
+    reasons: string[];
+    riskScore: number;
+}
+/** Analyze a login attempt for anomalous behavior. */
+export declare function detectLoginAnomaly(attempt: LoginAttempt, recentAttempts: LoginAttempt[]): Promise<AnomalyResult>;
+/** Check if there are too many failed login attempts for an account. */
+export declare function checkBruteForce(recentAttempts: LoginAttempt[], maxFailures?: number, windowMs?: number): boolean;
+//# sourceMappingURL=anomaly-detection.d.ts.map

package/dist/security/anomaly-detection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"anomaly-detection.d.ts","sourceRoot":"","sources":["../../src/security/anomaly-detection.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,IAAI,CAAA;IACf,OAAO,EAAE,OAAO,CAAA;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,OAAO,CAAA;IACnB,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,sDAAsD;AACtD,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,YAAY,EACrB,cAAc,EAAE,YAAY,EAAE,GAC7B,OAAO,CAAC,aAAa,CAAC,CAsCxB;AAED,wEAAwE;AACxE,wBAAgB,eAAe,CAC7B,cAAc,EAAE,YAAY,EAAE,EAC9B,WAAW,SAAI,EACf,QAAQ,SAAiB,GACxB,OAAO,CAIT"}

package/dist/security/anomaly-detection.js

@@ -0,0 +1,39 @@
+/** Analyze a login attempt for anomalous behavior. */
+export async function detectLoginAnomaly(attempt, recentAttempts) {
+    const reasons = [];
+    let riskScore = 0;
+    const userAttempts = recentAttempts.filter((a) => a.userId === attempt.userId);
+    if (userAttempts.length > 0) {
+        const knownIPs = new Set(userAttempts.filter((a) => a.success).map((a) => a.ipAddress));
+        if (knownIPs.size > 0 && !knownIPs.has(attempt.ipAddress)) {
+            riskScore += 20;
+            reasons.push('Login from previously unseen IP address');
+        }
+        const knownAgents = new Set(userAttempts.filter((a) => a.success).map((a) => a.userAgent));
+        if (knownAgents.size > 0 && !knownAgents.has(attempt.userAgent)) {
+            riskScore += 15;
+            reasons.push('Login from previously unseen user agent');
+        }
+        const fiveMinAgo = Date.now() - 5 * 60 * 1000;
+        const recentDistinctIPs = new Set(userAttempts
+            .filter((a) => !a.success && a.timestamp.getTime() > fiveMinAgo)
+            .map((a) => a.ipAddress));
+        if (recentDistinctIPs.size >= 3) {
+            riskScore += 30;
+            reasons.push(`Failed logins from ${recentDistinctIPs.size} distinct IPs in 5 minutes`);
+        }
+    }
+    const hour = attempt.timestamp.getHours();
+    if (hour >= 1 && hour <= 5) {
+        riskScore += 10;
+        reasons.push('Login attempt during unusual hours (1 AM–5 AM)');
+    }
+    return { suspicious: riskScore > 50, reasons, riskScore };
+}
+/** Check if there are too many failed login attempts for an account. */
+export function checkBruteForce(recentAttempts, maxFailures = 5, windowMs = 15 * 60 * 1000) {
+    const cutoff = Date.now() - windowMs;
+    const recentFailures = recentAttempts.filter((a) => !a.success && a.timestamp.getTime() > cutoff);
+    return recentFailures.length >= maxFailures;
+}
+//# sourceMappingURL=anomaly-detection.js.map

package/dist/security/anomaly-detection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"anomaly-detection.js","sourceRoot":"","sources":["../../src/security/anomaly-detection.ts"],"names":[],"mappings":"AAcA,sDAAsD;AACtD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAqB,EACrB,cAA8B;IAE9B,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,IAAI,SAAS,GAAG,CAAC,CAAA;IAEjB,MAAM,YAAY,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;IAE9E,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAA;QACvF,IAAI,QAAQ,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1D,SAAS,IAAI,EAAE,CAAA;YACf,OAAO,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAA;QACzD,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAA;QAC1F,IAAI,WAAW,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAChE,SAAS,IAAI,EAAE,CAAA;YACf,OAAO,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAA;QACzD,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;QAC7C,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAC/B,YAAY;aACT,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,UAAU,CAAC;aAC/D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAC3B,CAAA;QACD,IAAI,iBAAiB,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC;YAChC,SAAS,IAAI,EAAE,CAAA;YACf,OAAO,CAAC,IAAI,CAAC,sBAAsB,iBAAiB,CAAC,IAAI,4BAA4B,CAAC,CAAA;QACxF,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAA;IACzC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;QAC3B,SAAS,IAAI,EAAE,CAAA;QACf,OAAO,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAA;IAChE,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,SAAS,GAAG,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,CAAA;AAC3D,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,eAAe,CAC7B,cAA8B,EAC9B,WAAW,GAAG,CAAC,EACf,QAAQ,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;IAEzB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAA;IACpC,MAAM,cAAc,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,CAAA;IACjG,OAAO,cAAc,CAAC,MAAM,IAAI,WAAW,CAAA;AAC7C,CAAC"}

package/dist/security/api-key-enhanced.d.ts

@@ -0,0 +1,68 @@
+/**
+ * API key generation and scope validation.
+ *
+ * Keys are formatted `act_sk_<64 hex chars>`. We store only a SHA-256 hash of
+ * the key in the database; the raw key is shown to the user exactly once at
+ * creation time. The first 15 chars (`act_sk_` + 8 hex) are stored as
+ * `keyPrefix` so the admin UI can display a human-recognizable token without
+ * leaking the secret half.
+ */
+export interface ApiKeyScope {
+    /**
+     * Collection slugs the key is allowed to act on. Use `'*'` for all
+     * collections. Omit/empty to deny collection access entirely.
+     */
+    collections?: string[];
+    /**
+     * Actions allowed on the listed collections. Omit/empty to deny.
+     */
+    actions?: ('read' | 'create' | 'update' | 'delete')[];
+    /**
+     * Global slugs the key is allowed to read or update. `'*'` for all.
+     */
+    globals?: string[];
+    /** When true, the key can upload/manage media. */
+    media?: boolean;
+    /**
+     * When true, the key can call AI page-builder endpoints (`/page-builder/*`).
+     * AI generation is expensive — issue this scope sparingly.
+     */
+    pageBuilder?: boolean;
+    /**
+     * When true, the key has full admin access (can manage users, settings,
+     * other API keys). Equivalent to a logged-in ADMIN session.
+     */
+    admin?: boolean;
+}
+export interface EnhancedApiKeyConfig {
+    /** Token prefix (always `act_sk` for live keys). */
+    prefix: string;
+    scopes: ApiKeyScope;
+    ipRestrictions?: string[];
+    expiresAt?: Date;
+}
+/** Generate a new API key with scoped permissions. */
+export declare function generateApiKey(config: EnhancedApiKeyConfig): Promise<{
+    key: string;
+    keyHash: string;
+    keyPrefix: string;
+}>;
+/** SHA-256 hash a raw API key for lookup. */
+export declare function hashApiKey(rawKey: string): Promise<string>;
+/** True when the request's bearer token looks like an API key (vs a session JWT). */
+export declare function looksLikeApiKey(token: string): boolean;
+/**
+ * Validate an API key's scopes against a collection action. Returns true when
+ * the key is permitted to perform `action` on `collection`. Admin keys always
+ * pass.
+ */
+export declare function validateApiKeyScope(scopes: ApiKeyScope, collection: string, action: 'read' | 'create' | 'update' | 'delete'): boolean;
+/** Validate scope for a global action. */
+export declare function validateApiKeyGlobalScope(scopes: ApiKeyScope, slug: string): boolean;
+/** Validate scope for media uploads/management. */
+export declare function validateApiKeyMediaScope(scopes: ApiKeyScope): boolean;
+/** Validate scope for page-builder/AI endpoints. */
+export declare function validateApiKeyPageBuilderScope(scopes: ApiKeyScope): boolean;
+/** Validate IP restrictions against the request's client IP. */
+export declare function validateApiKeyIp(restrictions: string[] | null | undefined, ip: string): boolean;
+//# sourceMappingURL=api-key-enhanced.d.ts.map

package/dist/security/api-key-enhanced.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key-enhanced.d.ts","sourceRoot":"","sources":["../../src/security/api-key-enhanced.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,WAAW,WAAW;IAC1B;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB;;OAEG;IACH,OAAO,CAAC,EAAE,CAAC,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC,EAAE,CAAA;IACrD;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,kDAAkD;IAClD,KAAK,CAAC,EAAE,OAAO,CAAA;IACf;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB;AAED,MAAM,WAAW,oBAAoB;IACnC,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,WAAW,CAAA;IACnB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,SAAS,CAAC,EAAE,IAAI,CAAA;CACjB;AAED,sDAAsD;AACtD,wBAAsB,cAAc,CAClC,MAAM,EAAE,oBAAoB,GAC3B,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAY9D;AAED,6CAA6C;AAC7C,wBAAsB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAKhE;AAED,qFAAqF;AACrF,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEtD;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,WAAW,EACnB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAC9C,OAAO,CAMT;AAED,0CAA0C;AAC1C,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAKpF;AAED,mDAAmD;AACnD,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAErE;AAED,oDAAoD;AACpD,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAE3E;AAED,gEAAgE;AAChE,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,IAAI,GAAG,SAAS,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAI/F"}

package/dist/security/api-key-enhanced.js

@@ -0,0 +1,76 @@
+/**
+ * API key generation and scope validation.
+ *
+ * Keys are formatted `act_sk_<64 hex chars>`. We store only a SHA-256 hash of
+ * the key in the database; the raw key is shown to the user exactly once at
+ * creation time. The first 15 chars (`act_sk_` + 8 hex) are stored as
+ * `keyPrefix` so the admin UI can display a human-recognizable token without
+ * leaking the secret half.
+ */
+/** Generate a new API key with scoped permissions. */
+export async function generateApiKey(config) {
+    const rawBytes = crypto.getRandomValues(new Uint8Array(32));
+    const rawKey = Array.from(rawBytes)
+        .map((b) => b.toString(16).padStart(2, '0'))
+        .join('');
+    const key = `${config.prefix}_${rawKey}`;
+    // First 8 hex chars after the underscore are safe to display (the remaining
+    // 56 hex chars provide >224 bits of entropy).
+    const keyPrefix = key.slice(0, config.prefix.length + 9);
+    const keyHash = await hashApiKey(key);
+    return { key, keyHash, keyPrefix };
+}
+/** SHA-256 hash a raw API key for lookup. */
+export async function hashApiKey(rawKey) {
+    const hashBuffer = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(rawKey));
+    return Array.from(new Uint8Array(hashBuffer))
+        .map((b) => b.toString(16).padStart(2, '0'))
+        .join('');
+}
+/** True when the request's bearer token looks like an API key (vs a session JWT). */
+export function looksLikeApiKey(token) {
+    return /^act_sk_[a-f0-9]{32,}$/i.test(token);
+}
+/**
+ * Validate an API key's scopes against a collection action. Returns true when
+ * the key is permitted to perform `action` on `collection`. Admin keys always
+ * pass.
+ */
+export function validateApiKeyScope(scopes, collection, action) {
+    if (scopes.admin)
+        return true;
+    if (!scopes.collections || scopes.collections.length === 0)
+        return false;
+    if (!scopes.actions || !scopes.actions.includes(action))
+        return false;
+    if (scopes.collections.includes('*'))
+        return true;
+    return scopes.collections.includes(collection);
+}
+/** Validate scope for a global action. */
+export function validateApiKeyGlobalScope(scopes, slug) {
+    if (scopes.admin)
+        return true;
+    if (!scopes.globals || scopes.globals.length === 0)
+        return false;
+    if (scopes.globals.includes('*'))
+        return true;
+    return scopes.globals.includes(slug);
+}
+/** Validate scope for media uploads/management. */
+export function validateApiKeyMediaScope(scopes) {
+    return scopes.admin === true || scopes.media === true;
+}
+/** Validate scope for page-builder/AI endpoints. */
+export function validateApiKeyPageBuilderScope(scopes) {
+    return scopes.admin === true || scopes.pageBuilder === true;
+}
+/** Validate IP restrictions against the request's client IP. */
+export function validateApiKeyIp(restrictions, ip) {
+    if (!restrictions || restrictions.length === 0)
+        return true;
+    if (!ip || ip === 'unknown')
+        return false;
+    return restrictions.includes(ip);
+}
+//# sourceMappingURL=api-key-enhanced.js.map

package/dist/security/api-key-enhanced.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key-enhanced.js","sourceRoot":"","sources":["../../src/security/api-key-enhanced.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAsCH,sDAAsD;AACtD,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAA4B;IAE5B,MAAM,QAAQ,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;IAC3D,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;SAChC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC,CAAA;IACX,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,EAAE,CAAA;IACxC,4EAA4E;IAC5E,8CAA8C;IAC9C,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IACxD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAA;IAErC,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,CAAA;AACpC,CAAC;AAED,6CAA6C;AAC7C,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAc;IAC7C,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;IAC1F,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;SAC1C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC,CAAA;AACb,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAO,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AAC9C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAmB,EACnB,UAAkB,EAClB,MAA+C;IAE/C,IAAI,MAAM,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IAC7B,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACxE,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAA;IACrE,IAAI,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACjD,OAAO,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;AAChD,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,yBAAyB,CAAC,MAAmB,EAAE,IAAY;IACzE,IAAI,MAAM,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IAC7B,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAChE,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IAC7C,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;AACtC,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,wBAAwB,CAAC,MAAmB;IAC1D,OAAO,MAAM,CAAC,KAAK,KAAK,IAAI,IAAI,MAAM,CAAC,KAAK,KAAK,IAAI,CAAA;AACvD,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,8BAA8B,CAAC,MAAmB;IAChE,OAAO,MAAM,CAAC,KAAK,KAAK,IAAI,IAAI,MAAM,CAAC,WAAW,KAAK,IAAI,CAAA;AAC7D,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,gBAAgB,CAAC,YAAyC,EAAE,EAAU;IACpF,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAC3D,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,SAAS;QAAE,OAAO,KAAK,CAAA;IACzC,OAAO,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;AAClC,CAAC"}

package/dist/security/audit.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Events that are ALWAYS recorded, even when the operator disables audit
+ * logging in Settings → Security. Turning the audit toggle off must never be
+ * able to hide failed logins, MFA changes, or changes to the security policy
+ * itself (including the audit toggle change — `security_settings_changed`).
+ */
+export declare const SECURITY_CRITICAL_AUDIT_EVENTS: ReadonlySet<string>;
+export interface AuditEntry {
+    event: string;
+    userId?: string;
+    ipAddress?: string;
+    userAgent?: string;
+    details?: Record<string, unknown>;
+    timestamp?: Date;
+}
+export interface AuditLogQuery {
+    event?: string;
+    userId?: string;
+    from?: Date;
+    to?: Date;
+    limit?: number;
+    offset?: number;
+}
+export interface AuditLogResult {
+    entries: AuditEntry[];
+    total: number;
+}
+/** Record an audit log event. */
+export declare function logEvent(event: {
+    event: string;
+    userId?: string;
+    ipAddress?: string;
+    userAgent?: string;
+    details?: Record<string, unknown>;
+}): Promise<void>;
+/** Query audit log entries with filters and pagination. */
+export declare function getAuditLog(options?: {
+    userId?: string;
+    event?: string;
+    page?: number;
+    pageSize?: number;
+}): Promise<{
+    entries: any[];
+    total: number;
+}>;
+//# sourceMappingURL=audit.d.ts.map

package/dist/security/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/security/audit.ts"],"names":[],"mappings":"AAOA;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,EAAE,WAAW,CAAC,MAAM,CAK7D,CAAA;AAEF,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACjC,SAAS,CAAC,EAAE,IAAI,CAAA;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,IAAI,CAAA;IACX,EAAE,CAAC,EAAE,IAAI,CAAA;IACT,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,UAAU,EAAE,CAAA;IACrB,KAAK,EAAE,MAAM,CAAA;CACd;AAED,iCAAiC;AACjC,wBAAsB,QAAQ,CAAC,KAAK,EAAE;IACpC,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAClC,GAAG,OAAO,CAAC,IAAI,CAAC,CA0BhB;AAED,2DAA2D;AAC3D,wBAAsB,WAAW,CAC/B,OAAO,GAAE;IACP,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,MAAM,CAAA;CACb,GACL,OAAO,CAAC;IAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAmB5C"}

package/dist/security/audit.js

@@ -0,0 +1,67 @@
+import { getDB } from '../db.js';
+import { createLogger } from '../diagnostics/logger.js';
+import { getCachedSecuritySettings } from './center/gather.js';
+const logger = createLogger('audit');
+/**
+ * Events that are ALWAYS recorded, even when the operator disables audit
+ * logging in Settings → Security. Turning the audit toggle off must never be
+ * able to hide failed logins, MFA changes, or changes to the security policy
+ * itself (including the audit toggle change — `security_settings_changed`).
+ */
+export const SECURITY_CRITICAL_AUDIT_EVENTS = new Set([
+    'login_failed',
+    'totp_enabled',
+    'totp_disabled',
+    'security_settings_changed',
+]);
+/** Record an audit log event. */
+export async function logEvent(event) {
+    try {
+        const db = getDB();
+        // Honor the Settings → Security audit toggle, except for security-critical
+        // events which are recorded unconditionally. The cached read keeps this a
+        // near-free check on the hot path.
+        if (!SECURITY_CRITICAL_AUDIT_EVENTS.has(event.event)) {
+            const settings = await getCachedSecuritySettings(db);
+            if (!settings.access.auditLoggingEnabled)
+                return;
+        }
+        await db.auditLog.create({
+            data: {
+                event: event.event,
+                userId: event.userId ?? null,
+                ipAddress: event.ipAddress ?? null,
+                userAgent: event.userAgent ?? null,
+                details: event.details ?? null,
+            },
+        });
+    }
+    catch (err) {
+        // Fail open — audit logging should never block the primary operation,
+        // but still surface the failure so the operator can fix it.
+        if (process.env.NODE_ENV !== 'test') {
+            logger.error('logEvent failed', { reason: err instanceof Error ? err.message : String(err) });
+        }
+    }
+}
+/** Query audit log entries with filters and pagination. */
+export async function getAuditLog(options = {}) {
+    const db = getDB();
+    const { userId, event, page = 1, pageSize = 50 } = options;
+    const where = {};
+    if (userId)
+        where.userId = userId;
+    if (event)
+        where.event = event;
+    const [entries, total] = await Promise.all([
+        db.auditLog.findMany({
+            where,
+            orderBy: { timestamp: 'desc' },
+            skip: (page - 1) * pageSize,
+            take: pageSize,
+        }),
+        db.auditLog.count({ where }),
+    ]);
+    return { entries, total };
+}
+//# sourceMappingURL=audit.js.map

package/dist/security/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/security/audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,UAAU,CAAA;AAChC,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AACvD,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAA;AAG9D,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAA;AAEpC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAwB,IAAI,GAAG,CAAC;IACzE,cAAc;IACd,cAAc;IACd,eAAe;IACf,2BAA2B;CAC5B,CAAC,CAAA;AAyBF,iCAAiC;AACjC,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,KAM9B;IACC,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,KAAK,EAAY,CAAA;QAC5B,2EAA2E;QAC3E,0EAA0E;QAC1E,mCAAmC;QACnC,IAAI,CAAC,8BAA8B,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACrD,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC,EAAE,CAAC,CAAA;YACpD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,mBAAmB;gBAAE,OAAM;QAClD,CAAC;QACD,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;YACvB,IAAI,EAAE;gBACJ,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI;gBAC5B,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;gBAClC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;gBAClC,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI;aAC/B;SACF,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,sEAAsE;QACtE,4DAA4D;QAC5D,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YACpC,MAAM,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC/F,CAAC;IACH,CAAC;AACH,CAAC;AAED,2DAA2D;AAC3D,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,UAKI,EAAE;IAEN,MAAM,EAAE,GAAG,KAAK,EAAY,CAAA;IAC5B,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,GAAG,CAAC,EAAE,QAAQ,GAAG,EAAE,EAAE,GAAG,OAAO,CAAA;IAE1D,MAAM,KAAK,GAAQ,EAAE,CAAA;IACrB,IAAI,MAAM;QAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAA;IACjC,IAAI,KAAK;QAAE,KAAK,CAAC,KAAK,GAAG,KAAK,CAAA;IAE9B,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACzC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACnB,KAAK;YACL,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE;YAC9B,IAAI,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ;YAC3B,IAAI,EAAE,QAAQ;SACf,CAAC;QACF,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC;KAC7B,CAAC,CAAA;IAEF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;AAC3B,CAAC"}

package/dist/security/breach-check.d.ts

@@ -0,0 +1,3 @@
+/** Check a password against the HaveIBeenPwned Passwords API using k-anonymity. */
+export declare function checkBreached(password: string): Promise<boolean>;
+//# sourceMappingURL=breach-check.d.ts.map

package/dist/security/breach-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"breach-check.d.ts","sourceRoot":"","sources":["../../src/security/breach-check.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,wBAAsB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CA0BtE"}

package/dist/security/breach-check.js

@@ -0,0 +1,27 @@
+/** Check a password against the HaveIBeenPwned Passwords API using k-anonymity. */
+export async function checkBreached(password) {
+    const encoder = new TextEncoder();
+    const data = encoder.encode(password);
+    const hashBuffer = await crypto.subtle.digest('SHA-1', data);
+    const hashArray = Array.from(new Uint8Array(hashBuffer));
+    const hashHex = hashArray
+        .map((b) => b.toString(16).padStart(2, '0'))
+        .join('')
+        .toUpperCase();
+    const prefix = hashHex.substring(0, 5);
+    const suffix = hashHex.substring(5);
+    try {
+        const response = await fetch(`https://api.pwnedpasswords.com/range/${prefix}`, {
+            headers: { 'User-Agent': 'PrentaCMS-PasswordCheck' },
+            signal: AbortSignal.timeout(5000),
+        });
+        if (!response.ok)
+            return false;
+        const text = await response.text();
+        return text.split('\n').some((line) => line.startsWith(suffix));
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=breach-check.js.map

package/dist/security/breach-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"breach-check.js","sourceRoot":"","sources":["../../src/security/breach-check.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,QAAgB;IAClD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;IACjC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;IACrC,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IAC5D,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAA;IACxD,MAAM,OAAO,GAAG,SAAS;SACtB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC;SACR,WAAW,EAAE,CAAA;IAEhB,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;IACtC,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;IAEnC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,wCAAwC,MAAM,EAAE,EAAE;YAC7E,OAAO,EAAE,EAAE,YAAY,EAAE,yBAAyB,EAAE;YACpD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAA;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,KAAK,CAAA;QAE9B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;QAClC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAA;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC"}

package/dist/security/captcha.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Server-side CAPTCHA verification for reCAPTCHA v3 and Cloudflare Turnstile.
+ *
+ * Policy (#676):
+ * - When a provider is configured and `enforce` is true, missing/invalid tokens
+ *   are rejected (fail-closed for token failures).
+ * - Provider outages (timeout / network / upstream HTTP) follow
+ *   `onProviderError`: `fail-closed` (default) rejects; `fail-open` allows the
+ *   submission and logs the incident.
+ * - Honeypot / time-to-submit remain complementary spam controls.
+ */
+export type CaptchaProvider = 'recaptcha' | 'turnstile' | 'none';
+export type CaptchaProviderErrorPolicy = 'fail-open' | 'fail-closed';
+export interface CaptchaConfig {
+    provider: CaptchaProvider;
+    /** Public site key (safe to expose to client) */
+    siteKey: string;
+    /** Server-side secret key (from env) */
+    secretKey: string;
+    /** Minimum score threshold for reCAPTCHA v3 (0.0–1.0, default 0.5). Ignored by Turnstile. */
+    scoreThreshold?: number;
+    /**
+     * When true (default if a provider is configured), public form submit requires
+     * a valid captcha token. Set `CAPTCHA_ENFORCE=false` or `forms.captcha.enforce`
+     * to disable without removing keys.
+     */
+    enforce: boolean;
+    /**
+     * Behavior when the captcha provider is unreachable / times out.
+     * Token validation failures always reject when `enforce` is true.
+     */
+    onProviderError: CaptchaProviderErrorPolicy;
+    /** Upstream verify timeout in ms (default 5000). */
+    timeoutMs: number;
+}
+export interface CaptchaVerifyResult {
+    success: boolean;
+    score?: number;
+    action?: string;
+    errorCodes?: string[];
+    /** True when failure is a provider outage (timeout/network/HTTP), not a bad token. */
+    providerError?: boolean;
+}
+/** Public (secret-free) view of captcha config for admin + public clients. */
+export interface PublicCaptchaConfig {
+    provider: CaptchaProvider;
+    siteKey: string | null;
+    enforce: boolean;
+    onProviderError: CaptchaProviderErrorPolicy;
+    timeoutMs: number;
+    scoreThreshold: number | null;
+}
+/**
+ * Verifies a CAPTCHA token server-side.
+ * Works for both reCAPTCHA v3 and Cloudflare Turnstile.
+ */
+export declare function verifyCaptcha(token: string, config: CaptchaConfig, remoteIp?: string): Promise<CaptchaVerifyResult>;
+/** True when the verify failure should be treated as a provider outage. */
+export declare function isCaptchaProviderError(result: CaptchaVerifyResult): boolean;
+/**
+ * Resolves CAPTCHA config from environment variables + optional `forms.captcha`
+ * overrides in CMS config. Returns `{ provider: 'none' }` if no keys are set.
+ */
+export declare function getCaptchaConfig(): CaptchaConfig;
+/** Secret-free captcha status for `/captcha/config` and admin Settings. */
+export declare function getPublicCaptchaConfig(config?: CaptchaConfig): PublicCaptchaConfig;
+//# sourceMappingURL=captcha.d.ts.map

package/dist/security/captcha.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"captcha.d.ts","sourceRoot":"","sources":["../../src/security/captcha.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,MAAM,MAAM,eAAe,GAAG,WAAW,GAAG,WAAW,GAAG,MAAM,CAAA;AAChE,MAAM,MAAM,0BAA0B,GAAG,WAAW,GAAG,aAAa,CAAA;AAEpE,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,eAAe,CAAA;IACzB,iDAAiD;IACjD,OAAO,EAAE,MAAM,CAAA;IACf,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAA;IACjB,6FAA6F;IAC7F,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAA;IAChB;;;OAGG;IACH,eAAe,EAAE,0BAA0B,CAAA;IAC3C,oDAAoD;IACpD,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACrB,sFAAsF;IACtF,aAAa,CAAC,EAAE,OAAO,CAAA;CACxB;AAED,8EAA8E;AAC9E,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,eAAe,CAAA;IACzB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,OAAO,EAAE,OAAO,CAAA;IAChB,eAAe,EAAE,0BAA0B,CAAA;IAC3C,SAAS,EAAE,MAAM,CAAA;IACjB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;CAC9B;AAqCD;;;GAGG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,aAAa,EACrB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,mBAAmB,CAAC,CAyF9B;AAED,2EAA2E;AAC3E,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAG3E;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,aAAa,CAkDhD;AAED,2EAA2E;AAC3E,wBAAgB,sBAAsB,CACpC,MAAM,GAAE,aAAkC,GACzC,mBAAmB,CASrB"}