@prenta/core 0.118.0

package/dist/security/captcha.js

@@ -0,0 +1,186 @@
+/**
+ * Server-side CAPTCHA verification for reCAPTCHA v3 and Cloudflare Turnstile.
+ *
+ * Policy (#676):
+ * - When a provider is configured and `enforce` is true, missing/invalid tokens
+ *   are rejected (fail-closed for token failures).
+ * - Provider outages (timeout / network / upstream HTTP) follow
+ *   `onProviderError`: `fail-closed` (default) rejects; `fail-open` allows the
+ *   submission and logs the incident.
+ * - Honeypot / time-to-submit remain complementary spam controls.
+ */
+import { getPrentaConfig } from '../config/runtime.js';
+const VERIFY_URLS = {
+    recaptcha: 'https://www.google.com/recaptcha/api/siteverify',
+    turnstile: 'https://challenges.cloudflare.com/turnstile/v0/siteverify',
+};
+const DEFAULT_TIMEOUT_MS = 5_000;
+const PROVIDER_ERROR_CODES = new Set(['network-error', 'timeout', 'http-error']);
+function isProviderErrorCode(code) {
+    if (PROVIDER_ERROR_CODES.has(code))
+        return true;
+    return code.startsWith('http-error:');
+}
+function parseBool(raw, fallback) {
+    if (raw == null || raw.trim() === '')
+        return fallback;
+    const v = raw.trim().toLowerCase();
+    if (['1', 'true', 'yes', 'on'].includes(v))
+        return true;
+    if (['0', 'false', 'no', 'off'].includes(v))
+        return false;
+    return fallback;
+}
+function parseProviderErrorPolicy(raw, fallback) {
+    if (raw === 'fail-open' || raw === 'fail-closed')
+        return raw;
+    return fallback;
+}
+function parseTimeoutMs(raw, fallback) {
+    const n = Number(raw);
+    if (!Number.isFinite(n))
+        return fallback;
+    return Math.min(30_000, Math.max(1_000, Math.floor(n)));
+}
+/**
+ * Verifies a CAPTCHA token server-side.
+ * Works for both reCAPTCHA v3 and Cloudflare Turnstile.
+ */
+export async function verifyCaptcha(token, config, remoteIp) {
+    if (config.provider === 'none') {
+        return { success: true };
+    }
+    if (!token) {
+        return { success: false, errorCodes: ['missing-input-response'] };
+    }
+    const verifyUrl = VERIFY_URLS[config.provider];
+    if (!verifyUrl) {
+        return { success: false, errorCodes: [`unknown-provider:${config.provider}`] };
+    }
+    const params = new URLSearchParams({
+        secret: config.secretKey,
+        response: token,
+    });
+    if (remoteIp) {
+        params.set('remoteip', remoteIp);
+    }
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), config.timeoutMs);
+    try {
+        const res = await fetch(verifyUrl, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: params.toString(),
+            signal: controller.signal,
+        });
+        if (!res.ok) {
+            return {
+                success: false,
+                errorCodes: [`http-error:${res.status}`],
+                providerError: true,
+            };
+        }
+        const data = (await res.json());
+        if (!data.success) {
+            return {
+                success: false,
+                score: data.score,
+                action: data.action,
+                errorCodes: data['error-codes'] ?? [],
+            };
+        }
+        // reCAPTCHA v3 returns a score; enforce the threshold
+        if (config.provider === 'recaptcha' && typeof data.score === 'number') {
+            const threshold = config.scoreThreshold ?? 0.5;
+            if (data.score < threshold) {
+                return {
+                    success: false,
+                    score: data.score,
+                    action: data.action,
+                    errorCodes: ['score-below-threshold'],
+                };
+            }
+        }
+        return {
+            success: true,
+            score: data.score,
+            action: data.action,
+        };
+    }
+    catch (err) {
+        const aborted = (err instanceof Error && err.name === 'AbortError') ||
+            (typeof DOMException !== 'undefined' &&
+                err instanceof DOMException &&
+                err.name === 'AbortError');
+        return {
+            success: false,
+            errorCodes: [aborted ? 'timeout' : 'network-error'],
+            providerError: true,
+        };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/** True when the verify failure should be treated as a provider outage. */
+export function isCaptchaProviderError(result) {
+    if (result.providerError)
+        return true;
+    return (result.errorCodes ?? []).some(isProviderErrorCode);
+}
+/**
+ * Resolves CAPTCHA config from environment variables + optional `forms.captcha`
+ * overrides in CMS config. Returns `{ provider: 'none' }` if no keys are set.
+ */
+export function getCaptchaConfig() {
+    const formsCaptcha = getPrentaConfig()?.forms?.captcha;
+    const onProviderError = parseProviderErrorPolicy(process.env.CAPTCHA_ON_PROVIDER_ERROR, formsCaptcha?.onProviderError ?? 'fail-closed');
+    const timeoutMs = parseTimeoutMs(process.env.CAPTCHA_TIMEOUT_MS, formsCaptcha?.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+    const recaptchaSiteKey = process.env.RECAPTCHA_SITE_KEY;
+    const recaptchaSecret = process.env.RECAPTCHA_SECRET_KEY;
+    if (recaptchaSiteKey && recaptchaSecret) {
+        const enforce = parseBool(process.env.CAPTCHA_ENFORCE, formsCaptcha?.enforce ?? true);
+        return {
+            provider: 'recaptcha',
+            siteKey: recaptchaSiteKey,
+            secretKey: recaptchaSecret,
+            scoreThreshold: parseFloat(process.env.RECAPTCHA_SCORE_THRESHOLD ?? '0.5'),
+            enforce,
+            onProviderError,
+            timeoutMs,
+        };
+    }
+    const turnstileSiteKey = process.env.TURNSTILE_SITE_KEY;
+    const turnstileSecret = process.env.TURNSTILE_SECRET_KEY;
+    if (turnstileSiteKey && turnstileSecret) {
+        const enforce = parseBool(process.env.CAPTCHA_ENFORCE, formsCaptcha?.enforce ?? true);
+        return {
+            provider: 'turnstile',
+            siteKey: turnstileSiteKey,
+            secretKey: turnstileSecret,
+            enforce,
+            onProviderError,
+            timeoutMs,
+        };
+    }
+    return {
+        provider: 'none',
+        siteKey: '',
+        secretKey: '',
+        enforce: false,
+        onProviderError,
+        timeoutMs,
+    };
+}
+/** Secret-free captcha status for `/captcha/config` and admin Settings. */
+export function getPublicCaptchaConfig(config = getCaptchaConfig()) {
+    return {
+        provider: config.provider,
+        siteKey: config.provider !== 'none' ? config.siteKey : null,
+        enforce: config.enforce && config.provider !== 'none',
+        onProviderError: config.onProviderError,
+        timeoutMs: config.timeoutMs,
+        scoreThreshold: config.provider === 'recaptcha' ? (config.scoreThreshold ?? 0.5) : null,
+    };
+}
+//# sourceMappingURL=captcha.js.map

package/dist/security/captcha.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"captcha.js","sourceRoot":"","sources":["../../src/security/captcha.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AA+CtD,MAAM,WAAW,GAA2B;IAC1C,SAAS,EAAE,iDAAiD;IAC5D,SAAS,EAAE,2DAA2D;CACvE,CAAA;AAED,MAAM,kBAAkB,GAAG,KAAK,CAAA;AAChC,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAA;AAEhF,SAAS,mBAAmB,CAAC,IAAY;IACvC,IAAI,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAC/C,OAAO,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,CAAA;AACvC,CAAC;AAED,SAAS,SAAS,CAAC,GAAuB,EAAE,QAAiB;IAC3D,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAA;IACrD,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IAClC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IACvD,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAA;IACzD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,SAAS,wBAAwB,CAC/B,GAAuB,EACvB,QAAoC;IAEpC,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,aAAa;QAAE,OAAO,GAAG,CAAA;IAC5D,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,SAAS,cAAc,CAAC,GAAuB,EAAE,QAAgB;IAC/D,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACrB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,QAAQ,CAAA;IACxC,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AACzD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAa,EACb,MAAqB,EACrB,QAAiB;IAEjB,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QAC/B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;IAC1B,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,wBAAwB,CAAC,EAAE,CAAA;IACnE,CAAC;IAED,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;IAC9C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,oBAAoB,MAAM,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAA;IAChF,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,MAAM,EAAE,MAAM,CAAC,SAAS;QACxB,QAAQ,EAAE,KAAK;KAChB,CAAC,CAAA;IACF,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAA;IAClC,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;IACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,SAAS,CAAC,CAAA;IAEpE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,SAAS,EAAE;YACjC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;YACvB,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAA;QAEF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,UAAU,EAAE,CAAC,cAAc,GAAG,CAAC,MAAM,EAAE,CAAC;gBACxC,aAAa,EAAE,IAAI;aACpB,CAAA;QACH,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAK7B,CAAA;QAED,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE;aACtC,CAAA;QACH,CAAC;QAED,sDAAsD;QACtD,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACtE,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,IAAI,GAAG,CAAA;YAC9C,IAAI,IAAI,CAAC,KAAK,GAAG,SAAS,EAAE,CAAC;gBAC3B,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,UAAU,EAAE,CAAC,uBAAuB,CAAC;iBACtC,CAAA;YACH,CAAC;QACH,CAAC;QAED,OAAO;YACL,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAA;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GACX,CAAC,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,CAAC;YACnD,CAAC,OAAO,YAAY,KAAK,WAAW;gBAClC,GAAG,YAAY,YAAY;gBAC3B,GAAG,CAAC,IAAI,KAAK,YAAY,CAAC,CAAA;QAC9B,OAAO;YACL,OAAO,EAAE,KAAK;YACd,UAAU,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC;YACnD,aAAa,EAAE,IAAI;SACpB,CAAA;IACH,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAA;IACrB,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,sBAAsB,CAAC,MAA2B;IAChE,IAAI,MAAM,CAAC,aAAa;QAAE,OAAO,IAAI,CAAA;IACrC,OAAO,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;AAC5D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,YAAY,GAAG,eAAe,EAAE,EAAE,KAAK,EAAE,OAAO,CAAA;IACtD,MAAM,eAAe,GAAG,wBAAwB,CAC9C,OAAO,CAAC,GAAG,CAAC,yBAAyB,EACrC,YAAY,EAAE,eAAe,IAAI,aAAa,CAC/C,CAAA;IACD,MAAM,SAAS,GAAG,cAAc,CAC9B,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAC9B,YAAY,EAAE,SAAS,IAAI,kBAAkB,CAC9C,CAAA;IAED,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAA;IACvD,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAA;IAExD,IAAI,gBAAgB,IAAI,eAAe,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,YAAY,EAAE,OAAO,IAAI,IAAI,CAAC,CAAA;QACrF,OAAO;YACL,QAAQ,EAAE,WAAW;YACrB,OAAO,EAAE,gBAAgB;YACzB,SAAS,EAAE,eAAe;YAC1B,cAAc,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,KAAK,CAAC;YAC1E,OAAO;YACP,eAAe;YACf,SAAS;SACV,CAAA;IACH,CAAC;IAED,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAA;IACvD,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAA;IAExD,IAAI,gBAAgB,IAAI,eAAe,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,YAAY,EAAE,OAAO,IAAI,IAAI,CAAC,CAAA;QACrF,OAAO;YACL,QAAQ,EAAE,WAAW;YACrB,OAAO,EAAE,gBAAgB;YACzB,SAAS,EAAE,eAAe;YAC1B,OAAO;YACP,eAAe;YACf,SAAS;SACV,CAAA;IACH,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,EAAE;QACX,SAAS,EAAE,EAAE;QACb,OAAO,EAAE,KAAK;QACd,eAAe;QACf,SAAS;KACV,CAAA;AACH,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,sBAAsB,CACpC,SAAwB,gBAAgB,EAAE;IAE1C,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,OAAO,EAAE,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;QAC3D,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM;QACrD,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,cAAc,EAAE,MAAM,CAAC,QAAQ,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI;KACxF,CAAA;AACH,CAAC"}

package/dist/security/center/gather.d.ts

@@ -0,0 +1,20 @@
+import type { SecuritySettings, SecurityCenterData } from './types.js';
+/** Read the persisted, enforced security policy from the `settings` global. */
+export declare function getStoredSecuritySettings(db: unknown): Promise<SecuritySettings>;
+export declare function getCachedSecuritySettings(db: unknown): Promise<SecuritySettings>;
+export declare function invalidateSecuritySettingsCache(): void;
+/**
+ * Effective IP allowlist: the union of the config `admin.ipAllowlist` and the
+ * database-stored `security.access.ipAllowlist`. Either source being non-empty
+ * turns enforcement on. Uses the cached policy read — safe on hot paths.
+ */
+export declare function getEffectiveIpAllowlist(db: unknown): Promise<string[]>;
+export interface GatherOptions {
+    db: unknown;
+    /** Acting admin's user id (for the lockout-safe MFA enable check). */
+    userId?: string;
+    /** Resolved client IP of the request (for the allowlist indicator). */
+    currentIp?: string | null;
+}
+export declare function getSecurityCenterData(opts: GatherOptions): Promise<SecurityCenterData>;
+//# sourceMappingURL=gather.d.ts.map

package/dist/security/center/gather.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gather.d.ts","sourceRoot":"","sources":["../../../src/security/center/gather.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAGV,gBAAgB,EAChB,kBAAkB,EAEnB,MAAM,YAAY,CAAA;AAmCnB,+EAA+E;AAC/E,wBAAsB,yBAAyB,CAAC,EAAE,EAAE,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAYtF;AAYD,wBAAsB,yBAAyB,CAAC,EAAE,EAAE,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAStF;AAED,wBAAgB,+BAA+B,IAAI,IAAI,CAEtD;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAAC,EAAE,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAW5E;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,OAAO,CAAA;IACX,sEAAsE;IACtE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1B;AAED,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAsK5F"}

package/dist/security/center/gather.js

@@ -0,0 +1,240 @@
+/**
+ * Security Center data gathering (async, DB + env I/O).
+ *
+ * Reads real auth/session/secret/audit state and composes the
+ * {@link SecurityCenterData} the admin tab renders. Never returns secret
+ * values — only configured/missing verdicts.
+ */
+import { getPrentaConfig } from '../../config/runtime.js';
+import { validateEnvShape } from '../../diagnostics/env.js';
+import { isIpAllowed } from '../ip-allowlist.js';
+import { parseSecuritySettings } from './settings.js';
+import { computeSecurityStatus } from './status.js';
+import { summarizeApiKeys, summarizeUsers } from './summaries.js';
+function hasModel(db, model) {
+    return Boolean(db && typeof db === 'object' && db[model]);
+}
+function isProductionEnv() {
+    return (process.env.VERCEL_ENV ?? process.env.NODE_ENV) === 'production';
+}
+function envSeverityToCheck(s) {
+    switch (s) {
+        case 'ok':
+            return 'pass';
+        case 'warn':
+            return 'warning';
+        case 'error':
+        case 'missing':
+            return 'fail';
+        default:
+            return 'unknown';
+    }
+}
+/** Read the persisted, enforced security policy from the `settings` global. */
+export async function getStoredSecuritySettings(db) {
+    const d = db;
+    if (!hasModel(d, 'document'))
+        return parseSecuritySettings({});
+    try {
+        const row = await d.document.findFirst({
+            where: { collection: 'settings', deletedAt: null },
+            select: { data: true },
+        });
+        return parseSecuritySettings(row?.data ?? {});
+    }
+    catch {
+        return parseSecuritySettings({});
+    }
+}
+// ── Cached policy reads for hot paths (audit logging, per-request allowlist) ──
+//
+// Keyed by DB instance (WeakMap) so tests and multi-tenant boots that swap the
+// client never see another instance's policy. A short TTL keeps enforcement
+// near-real-time; `invalidateSecuritySettingsCache()` makes saves immediate
+// within the same process.
+const SETTINGS_CACHE_TTL_MS = 30_000;
+const settingsCache = new WeakMap();
+let cacheGeneration = 0;
+export async function getCachedSecuritySettings(db) {
+    if (!db || typeof db !== 'object')
+        return parseSecuritySettings({});
+    const cached = settingsCache.get(db);
+    if (cached && cached.gen === cacheGeneration && Date.now() - cached.at < SETTINGS_CACHE_TTL_MS) {
+        return cached.value;
+    }
+    const value = await getStoredSecuritySettings(db);
+    settingsCache.set(db, { value, at: Date.now(), gen: cacheGeneration });
+    return value;
+}
+export function invalidateSecuritySettingsCache() {
+    cacheGeneration++;
+}
+/**
+ * Effective IP allowlist: the union of the config `admin.ipAllowlist` and the
+ * database-stored `security.access.ipAllowlist`. Either source being non-empty
+ * turns enforcement on. Uses the cached policy read — safe on hot paths.
+ */
+export async function getEffectiveIpAllowlist(db) {
+    const config = getPrentaConfig();
+    const configRanges = Array.isArray(config?.admin?.ipAllowlist)
+        ? config.admin.ipAllowlist
+        : [];
+    const settings = await getCachedSecuritySettings(db);
+    const union = [...configRanges];
+    for (const entry of settings.access.ipAllowlist) {
+        if (!union.includes(entry))
+            union.push(entry);
+    }
+    return union;
+}
+export async function getSecurityCenterData(opts) {
+    const d = opts.db;
+    const isProduction = isProductionEnv();
+    const now = Date.now();
+    const settings = await getStoredSecuritySettings(opts.db);
+    const userRows = hasModel(d, 'user')
+        ? await d
+            .user.findMany({ select: { role: true, isActive: true, totpEnabled: true } })
+            .catch(() => [])
+        : [];
+    const users = summarizeUsers(userRows);
+    let viewerHasMfa = false;
+    if (opts.userId && hasModel(d, 'user')) {
+        const viewer = await d
+            .user.findUnique({
+            where: { id: opts.userId },
+            select: { totpEnabled: true },
+        })
+            .catch(() => null);
+        viewerHasMfa = Boolean(viewer?.totpEnabled);
+    }
+    const activeSessions = hasModel(d, 'session')
+        ? await d
+            .session.count({ where: { revokedAt: null, expiresAt: { gt: new Date() } } })
+            .catch(() => 0)
+        : 0;
+    const apiKeyRows = hasModel(d, 'apiKey')
+        ? await d
+            .apiKey.findMany({
+            select: { scopes: true, expiresAt: true, lastUsedAt: true, revokedAt: true },
+        })
+            .catch(() => [])
+        : [];
+    const apiKeys = summarizeApiKeys(apiKeyRows, now);
+    const since = new Date(now - 24 * 60 * 60 * 1000);
+    const failedLogins24h = hasModel(d, 'auditLog')
+        ? await d
+            .auditLog.count({ where: { event: 'login_failed', timestamp: { gte: since } } })
+            .catch(() => 0)
+        : 0;
+    // ── Secrets / encryption (verdicts only, never values) ───────────────────────
+    const env = validateEnvShape();
+    const byName = new Map(env.checks.map((c) => [c.name, c]));
+    const config = getPrentaConfig();
+    const configSecret = typeof config?.secret === 'string' && config.secret.length >= 32;
+    let cmsSecret = envSeverityToCheck(byName.get('CMS_SECRET')?.status ?? 'missing');
+    if (cmsSecret === 'fail' && configSecret)
+        cmsSecret = 'pass';
+    const encRaw = byName.get('CMS_ENCRYPTION_KEY')?.status ?? 'warn';
+    // A *missing* key is only a hard failure in production; elsewhere it's a warning.
+    let encryptionKey = envSeverityToCheck(encRaw);
+    if (encRaw === 'warn' && isProduction)
+        encryptionKey = 'fail';
+    const upstash = byName.get('UPSTASH_REDIS_REST_URL')?.status;
+    const rateLimitBackend = upstash === 'ok' ? 'distributed' : 'in_memory';
+    const secrets = {
+        cmsSecret,
+        encryptionKey,
+        rateLimitBackend,
+        apiKeysHashed: true,
+        webhookSecretsEncrypted: encryptionKey === 'pass',
+    };
+    // ── IP allowlist (config ∪ database; enforced per-request) ───────────────────
+    const configRanges = Array.isArray(config?.admin?.ipAllowlist)
+        ? config.admin.ipAllowlist
+        : [];
+    const dbRanges = settings.access.ipAllowlist;
+    const ranges = [...configRanges];
+    for (const entry of dbRanges) {
+        if (!ranges.includes(entry))
+            ranges.push(entry);
+    }
+    const currentIp = opts.currentIp ?? null;
+    const allowlistSource = configRanges.length > 0 && dbRanges.length > 0
+        ? 'mixed'
+        : configRanges.length > 0
+            ? 'config'
+            : dbRanges.length > 0
+                ? 'database'
+                : 'none';
+    const ipAllowlist = {
+        enabled: ranges.length > 0,
+        source: allowlistSource,
+        ranges,
+        configRanges,
+        currentIp,
+        currentIpAllowed: ranges.length > 0 && currentIp ? isIpAllowed(currentIp, ranges) : null,
+    };
+    const sessionMaxAgeHours = settings.session.timeoutHours;
+    const auditEnabled = settings.access.auditLoggingEnabled;
+    const status = computeSecurityStatus({
+        isProduction,
+        settings,
+        users,
+        apiKeys,
+        secrets,
+        ipAllowlist,
+        failedLogins24h,
+        activeSessions,
+        csrfEnabled: true,
+        uploadValidation: true,
+        auditEnabled,
+    });
+    const editable = { source: 'database', editable: true };
+    const sources = {
+        mfaRequired: editable,
+        mfaGracePeriodDays: editable,
+        maxConcurrentSessions: editable,
+        sessionMaxAgeHours: editable,
+        idleLogout: editable,
+        ipAllowlist: configRanges.length > 0
+            ? {
+                source: 'database',
+                editable: true,
+                reason: 'Config ranges from admin.ipAllowlist are always enforced and merged with this list.',
+            }
+            : editable,
+        csrf: { source: 'computed', editable: false, reason: 'Always enabled for mutating requests.' },
+        rateLimiting: {
+            source: 'environment',
+            editable: false,
+            reason: 'Backend is selected from UPSTASH_REDIS_REST_URL / KV_REST_API_URL.',
+        },
+        uploadValidation: {
+            source: 'computed',
+            editable: false,
+            reason: 'Always enforced server-side.',
+        },
+        cmsSecret: { source: 'environment', editable: false },
+        encryptionKey: { source: 'environment', editable: false },
+        audit: editable,
+    };
+    return {
+        settings,
+        status,
+        users,
+        apiKeys,
+        secrets,
+        ipAllowlist,
+        failedLogins24h,
+        activeSessions,
+        csrfEnabled: true,
+        uploadValidation: true,
+        auditEnabled,
+        sessionMaxAgeHours,
+        viewerHasMfa,
+        environment: process.env.VERCEL_ENV ?? process.env.NODE_ENV ?? 'development',
+        sources,
+    };
+}
+//# sourceMappingURL=gather.js.map

package/dist/security/center/gather.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gather.js","sourceRoot":"","sources":["../../../src/security/center/gather.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AACzD,OAAO,EAAE,gBAAgB,EAAyB,MAAM,0BAA0B,CAAA;AAClF,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAChD,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAA;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAgC,MAAM,gBAAgB,CAAA;AAoB/F,SAAS,QAAQ,CAAyB,EAAU,EAAE,KAAQ;IAC5D,OAAO,OAAO,CAAC,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAA;AAC3D,CAAC;AAED,SAAS,eAAe;IACtB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,YAAY,CAAA;AAC1E,CAAC;AAED,SAAS,kBAAkB,CAAC,CAAmB;IAC7C,QAAQ,CAAC,EAAE,CAAC;QACV,KAAK,IAAI;YACP,OAAO,MAAM,CAAA;QACf,KAAK,MAAM;YACT,OAAO,SAAS,CAAA;QAClB,KAAK,OAAO,CAAC;QACb,KAAK,SAAS;YACZ,OAAO,MAAM,CAAA;QACf;YACE,OAAO,SAAS,CAAA;IACpB,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,EAAW;IACzD,MAAM,CAAC,GAAG,EAAY,CAAA;IACtB,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,UAAU,CAAC;QAAE,OAAO,qBAAqB,CAAC,EAAE,CAAC,CAAA;IAC9D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,QAAS,CAAC,SAAS,CAAC;YACtC,KAAK,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE;YAClD,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;SACvB,CAAC,CAAA;QACF,OAAO,qBAAqB,CAAC,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC,CAAA;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,qBAAqB,CAAC,EAAE,CAAC,CAAA;IAClC,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,EAAE;AACF,+EAA+E;AAC/E,4EAA4E;AAC5E,4EAA4E;AAC5E,2BAA2B;AAC3B,MAAM,qBAAqB,GAAG,MAAM,CAAA;AACpC,MAAM,aAAa,GAAG,IAAI,OAAO,EAAgE,CAAA;AACjG,IAAI,eAAe,GAAG,CAAC,CAAA;AAEvB,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,EAAW;IACzD,IAAI,CAAC,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ;QAAE,OAAO,qBAAqB,CAAC,EAAE,CAAC,CAAA;IACnE,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACpC,IAAI,MAAM,IAAI,MAAM,CAAC,GAAG,KAAK,eAAe,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,GAAG,qBAAqB,EAAE,CAAC;QAC/F,OAAO,MAAM,CAAC,KAAK,CAAA;IACrB,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,yBAAyB,CAAC,EAAE,CAAC,CAAA;IACjD,aAAa,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC,CAAA;IACtE,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,UAAU,+BAA+B;IAC7C,eAAe,EAAE,CAAA;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,EAAW;IACvD,MAAM,MAAM,GAAG,eAAe,EAAE,CAAA;IAChC,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,WAAW,CAAC;QAC5D,CAAC,CAAE,MAAO,CAAC,KAAM,CAAC,WAAwB;QAC1C,CAAC,CAAC,EAAE,CAAA;IACN,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC,EAAE,CAAC,CAAA;IACpD,MAAM,KAAK,GAAG,CAAC,GAAG,YAAY,CAAC,CAAA;IAC/B,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAChD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC/C,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAUD,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAAmB;IAC7D,MAAM,CAAC,GAAG,IAAI,CAAC,EAAY,CAAA;IAC3B,MAAM,YAAY,GAAG,eAAe,EAAE,CAAA;IACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IAEtB,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAEzD,MAAM,QAAQ,GAAc,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;QAC7C,CAAC,CAAC,MAAM,CAAC;aACJ,IAAK,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC;aAC7E,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;QACpB,CAAC,CAAC,EAAE,CAAA;IACN,MAAM,KAAK,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAA;IAEtC,IAAI,YAAY,GAAG,KAAK,CAAA;IACxB,IAAI,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,MAAM,CAAC;aACnB,IAAK,CAAC,UAAU,CAAC;YAChB,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE;YAC1B,MAAM,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE;SAC9B,CAAC;aACD,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;QACpB,YAAY,GAAG,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IAC7C,CAAC;IAED,MAAM,cAAc,GAAG,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC;QAC3C,CAAC,CAAC,MAAM,CAAC;aACJ,OAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC;aAC7E,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACnB,CAAC,CAAC,CAAC,CAAA;IAEL,MAAM,UAAU,GAAgB,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC;QACnD,CAAC,CAAC,MAAM,CAAC;aACJ,MAAO,CAAC,QAAQ,CAAC;YAChB,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;SAC7E,CAAC;aACD,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;QACpB,CAAC,CAAC,EAAE,CAAA;IACN,MAAM,OAAO,GAAG,gBAAgB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;IAEjD,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IACjD,MAAM,eAAe,GAAG,QAAQ,CAAC,CAAC,EAAE,UAAU,CAAC;QAC7C,CAAC,CAAC,MAAM,CAAC;aACJ,QAAS,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;aAChF,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACnB,CAAC,CAAC,CAAC,CAAA;IAEL,gFAAgF;IAChF,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAA;IAC9B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IAC1D,MAAM,MAAM,GAAG,eAAe,EAAE,CAAA;IAChC,MAAM,YAAY,GAAG,OAAO,MAAM,EAAE,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAA;IAErF,IAAI,SAAS,GAAG,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,MAAM,IAAI,SAAS,CAAC,CAAA;IACjF,IAAI,SAAS,KAAK,MAAM,IAAI,YAAY;QAAE,SAAS,GAAG,MAAM,CAAA;IAE5D,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,MAAM,IAAI,MAAM,CAAA;IACjE,kFAAkF;IAClF,IAAI,aAAa,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAA;IAC9C,IAAI,MAAM,KAAK,MAAM,IAAI,YAAY;QAAE,aAAa,GAAG,MAAM,CAAA;IAE7D,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,wBAAwB,CAAC,EAAE,MAAM,CAAA;IAC5D,MAAM,gBAAgB,GACpB,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAA;IAEhD,MAAM,OAAO,GAAkB;QAC7B,SAAS;QACT,aAAa;QACb,gBAAgB;QAChB,aAAa,EAAE,IAAI;QACnB,uBAAuB,EAAE,aAAa,KAAK,MAAM;KAClD,CAAA;IAED,gFAAgF;IAChF,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,WAAW,CAAC;QAC5D,CAAC,CAAE,MAAO,CAAC,KAAM,CAAC,WAAwB;QAC1C,CAAC,CAAC,EAAE,CAAA;IACN,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAA;IAC5C,MAAM,MAAM,GAAG,CAAC,GAAG,YAAY,CAAC,CAAA;IAChC,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACjD,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAA;IACxC,MAAM,eAAe,GACnB,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAC5C,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC;YACvB,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;gBACnB,CAAC,CAAC,UAAU;gBACZ,CAAC,CAAC,MAAM,CAAA;IAChB,MAAM,WAAW,GAAG;QAClB,OAAO,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC;QAC1B,MAAM,EAAE,eAAe;QACvB,MAAM;QACN,YAAY;QACZ,SAAS;QACT,gBAAgB,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI;KACzF,CAAA;IAED,MAAM,kBAAkB,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAA;IACxD,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,mBAAmB,CAAA;IAExD,MAAM,MAAM,GAAG,qBAAqB,CAAC;QACnC,YAAY;QACZ,QAAQ;QACR,KAAK;QACL,OAAO;QACP,OAAO;QACP,WAAW;QACX,eAAe;QACf,cAAc;QACd,WAAW,EAAE,IAAI;QACjB,gBAAgB,EAAE,IAAI;QACtB,YAAY;KACb,CAAC,CAAA;IAEF,MAAM,QAAQ,GAA2B,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;IAC/E,MAAM,OAAO,GAA2C;QACtD,WAAW,EAAE,QAAQ;QACrB,kBAAkB,EAAE,QAAQ;QAC5B,qBAAqB,EAAE,QAAQ;QAC/B,kBAAkB,EAAE,QAAQ;QAC5B,UAAU,EAAE,QAAQ;QACpB,WAAW,EACT,YAAY,CAAC,MAAM,GAAG,CAAC;YACrB,CAAC,CAAC;gBACE,MAAM,EAAE,UAAU;gBAClB,QAAQ,EAAE,IAAI;gBACd,MAAM,EACJ,qFAAqF;aACxF;YACH,CAAC,CAAC,QAAQ;QACd,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,uCAAuC,EAAE;QAC9F,YAAY,EAAE;YACZ,MAAM,EAAE,aAAa;YACrB,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,oEAAoE;SAC7E;QACD,gBAAgB,EAAE;YAChB,MAAM,EAAE,UAAU;YAClB,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,8BAA8B;SACvC;QACD,SAAS,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE;QACrD,aAAa,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE;QACzD,KAAK,EAAE,QAAQ;KAChB,CAAA;IAED,OAAO;QACL,QAAQ;QACR,MAAM;QACN,KAAK;QACL,OAAO;QACP,OAAO;QACP,WAAW;QACX,eAAe;QACf,cAAc;QACd,WAAW,EAAE,IAAI;QACjB,gBAAgB,EAAE,IAAI;QACtB,YAAY;QACZ,kBAAkB;QAClB,YAAY;QACZ,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,aAAa;QAC5E,OAAO;KACR,CAAA;AACH,CAAC"}

package/dist/security/center/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Security Center — public barrel.
+ *
+ * Exports the PURE pieces only (types, settings parse/validate, IP validation,
+ * status computation, cross-module summaries) so the admin client can import
+ * them without pulling in server-side DB/env code. The async gatherer
+ * (`gather.ts`) is imported directly by the API handlers, not re-exported here.
+ */
+export type { AccessSettings, ApiKeysSecuritySummary, CheckStatus, IpAllowlistStatus, MfaSettings, SecretsStatus, SecurityCenterData, SecurityCheck, SecuritySettings, SecuritySourceMetadata, SecurityStatus, SecurityStatusInput, SecurityStatusLevel, SecurityWarning, SecurityWarningCategory, SessionSettings, UsersSecuritySummary, } from './types.js';
+export { DEFAULT_SECURITY_SETTINGS, DEFAULT_SESSION_TIMEOUT_HOURS, MAX_CONCURRENT_SESSION_OPTIONS, MAX_IP_ALLOWLIST_ENTRIES, MFA_GRACE_PERIOD_OPTIONS, SESSION_TIMEOUT_HOURS_OPTIONS, ipAllowlistLockoutError, mfaEnableLockoutError, parseSecuritySettings, validateIpRange, validateSecuritySettings, type SecurityValidationIssue, } from './settings.js';
+export { computeSecurityStatus } from './status.js';
+export { summarizeApiKeys, summarizeUsers, type ApiKeyRow, type UserRow } from './summaries.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/security/center/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/security/center/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,YAAY,EACV,cAAc,EACd,sBAAsB,EACtB,WAAW,EACX,iBAAiB,EACjB,WAAW,EACX,aAAa,EACb,kBAAkB,EAClB,aAAa,EACb,gBAAgB,EAChB,sBAAsB,EACtB,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,EACf,uBAAuB,EACvB,eAAe,EACf,oBAAoB,GACrB,MAAM,YAAY,CAAA;AAEnB,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,8BAA8B,EAC9B,wBAAwB,EACxB,wBAAwB,EACxB,6BAA6B,EAC7B,uBAAuB,EACvB,qBAAqB,EACrB,qBAAqB,EACrB,eAAe,EACf,wBAAwB,EACxB,KAAK,uBAAuB,GAC7B,MAAM,eAAe,CAAA;AAEtB,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AAEnD,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,SAAS,EAAE,KAAK,OAAO,EAAE,MAAM,gBAAgB,CAAA"}

package/dist/security/center/index.js

@@ -0,0 +1,4 @@
+export { DEFAULT_SECURITY_SETTINGS, DEFAULT_SESSION_TIMEOUT_HOURS, MAX_CONCURRENT_SESSION_OPTIONS, MAX_IP_ALLOWLIST_ENTRIES, MFA_GRACE_PERIOD_OPTIONS, SESSION_TIMEOUT_HOURS_OPTIONS, ipAllowlistLockoutError, mfaEnableLockoutError, parseSecuritySettings, validateIpRange, validateSecuritySettings, } from './settings.js';
+export { computeSecurityStatus } from './status.js';
+export { summarizeApiKeys, summarizeUsers } from './summaries.js';
+//# sourceMappingURL=index.js.map

package/dist/security/center/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/security/center/index.ts"],"names":[],"mappings":"AA4BA,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,8BAA8B,EAC9B,wBAAwB,EACxB,wBAAwB,EACxB,6BAA6B,EAC7B,uBAAuB,EACvB,qBAAqB,EACrB,qBAAqB,EACrB,eAAe,EACf,wBAAwB,GAEzB,MAAM,eAAe,CAAA;AAEtB,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AAEnD,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAgC,MAAM,gBAAgB,CAAA"}

package/dist/security/center/settings.d.ts

@@ -0,0 +1,48 @@
+import type { SecuritySettings } from './types.js';
+export declare const DEFAULT_SESSION_TIMEOUT_HOURS = 168;
+export declare const DEFAULT_SECURITY_SETTINGS: SecuritySettings;
+export declare const MFA_GRACE_PERIOD_OPTIONS: readonly [0, 1, 7, 14, 30];
+export declare const MAX_CONCURRENT_SESSION_OPTIONS: readonly [0, 3, 5, 10];
+/** Design contract: 1 hour / 8 hours / 24 hours / 7 days. */
+export declare const SESSION_TIMEOUT_HOURS_OPTIONS: readonly [1, 8, 24, 168];
+/** Upper bound on stored allowlist entries — enough for real fleets, bounded against abuse. */
+export declare const MAX_IP_ALLOWLIST_ENTRIES = 100;
+export interface SecurityValidationIssue {
+    field: string;
+    message: string;
+    severity: 'error' | 'warning';
+}
+/** Read the `security` blob off a settings document, coercing to a safe shape. */
+export declare function parseSecuritySettings(blob: unknown): SecuritySettings;
+/** Validate an incoming settings payload. Pure — no DB / lockout checks here. */
+export declare function validateSecuritySettings(settings: SecuritySettings): SecurityValidationIssue[];
+/**
+ * Lockout-safe IP allowlist check. Saving a non-empty allowlist that does not
+ * include the acting admin's own IP would cut them off on the very next
+ * request. Callers MUST run this server-side (with the union of DB + config
+ * ranges) and only bypass it when the request explicitly confirms the risk.
+ * Returns `null` when the save is safe.
+ */
+export declare function ipAllowlistLockoutError(input: {
+    /** Effective ranges being enforced after the save (DB entries ∪ config entries). */
+    effectiveAllowlist: string[];
+    /** Resolved client IP of the request, or null/'unknown' when unresolvable. */
+    currentIp: string | null;
+}): string | null;
+/**
+ * Lockout-safe MFA enable check. Enabling org-wide MFA while the acting admin
+ * has no TOTP configured would lock them (and possibly everyone) out. Callers
+ * MUST run this server-side before persisting `mfa.required = true`.
+ */
+export declare function mfaEnableLockoutError(input: {
+    enabling: boolean;
+    viewerHasMfa: boolean;
+    totalAdmins: number;
+}): string | null;
+/**
+ * Validate a single allowlist entry: an IPv4/IPv6 literal or a CIDR range.
+ * Standalone (does not import the matcher's private helpers) so it can run in
+ * the client bundle for inline form validation.
+ */
+export declare function validateIpRange(entry: string): boolean;
+//# sourceMappingURL=settings.d.ts.map

package/dist/security/center/settings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings.d.ts","sourceRoot":"","sources":["../../../src/security/center/settings.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAElD,eAAO,MAAM,6BAA6B,MAAM,CAAA;AAEhD,eAAO,MAAM,yBAAyB,EAAE,gBAQvC,CAAA;AAED,eAAO,MAAM,wBAAwB,4BAA6B,CAAA;AAClE,eAAO,MAAM,8BAA8B,wBAAyB,CAAA;AACpE,6DAA6D;AAC7D,eAAO,MAAM,6BAA6B,0BAA2B,CAAA;AACrE,+FAA+F;AAC/F,eAAO,MAAM,wBAAwB,MAAM,CAAA;AAE3C,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAA;CAC9B;AAOD,kFAAkF;AAClF,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,OAAO,GAAG,gBAAgB,CA2CrE;AAwCD,iFAAiF;AACjF,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,uBAAuB,EAAE,CA2C9F;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE;IAC7C,oFAAoF;IACpF,kBAAkB,EAAE,MAAM,EAAE,CAAA;IAC5B,8EAA8E;IAC9E,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CACzB,GAAG,MAAM,GAAG,IAAI,CAShB;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,QAAQ,EAAE,OAAO,CAAA;IACjB,YAAY,EAAE,OAAO,CAAA;IACrB,WAAW,EAAE,MAAM,CAAA;CACpB,GAAG,MAAM,GAAG,IAAI,CAMhB;AAKD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAatD"}