@prenta/core 0.118.0

package/dist/security/center/settings.js

@@ -0,0 +1,218 @@
+/**
+ * Security settings parsing + validation (pure).
+ *
+ * The persisted, enforced policy lives under the `security` key of the
+ * `settings` global. Only fields the runtime actually enforces are stored
+ * here (MFA requirement + grace, concurrent-session cap) so the UI never
+ * presents a control that does nothing.
+ */
+import { isIpAllowed } from '../ip-allowlist.js';
+export const DEFAULT_SESSION_TIMEOUT_HOURS = 168;
+export const DEFAULT_SECURITY_SETTINGS = {
+    mfa: { required: false, gracePeriodDays: 7 },
+    session: {
+        maxConcurrentSessions: 5,
+        timeoutHours: DEFAULT_SESSION_TIMEOUT_HOURS,
+        idleLogoutEnabled: false,
+    },
+    access: { ipAllowlist: [], auditLoggingEnabled: true },
+};
+export const MFA_GRACE_PERIOD_OPTIONS = [0, 1, 7, 14, 30];
+export const MAX_CONCURRENT_SESSION_OPTIONS = [0, 3, 5, 10];
+/** Design contract: 1 hour / 8 hours / 24 hours / 7 days. */
+export const SESSION_TIMEOUT_HOURS_OPTIONS = [1, 8, 24, 168];
+/** Upper bound on stored allowlist entries — enough for real fleets, bounded against abuse. */
+export const MAX_IP_ALLOWLIST_ENTRIES = 100;
+function toInt(value, fallback) {
+    const n = typeof value === 'number' ? value : Number(value);
+    return Number.isFinite(n) ? Math.trunc(n) : fallback;
+}
+/** Read the `security` blob off a settings document, coercing to a safe shape. */
+export function parseSecuritySettings(blob) {
+    const root = (blob && typeof blob === 'object' ? blob : {}) ?? {};
+    const sec = (root.security && typeof root.security === 'object'
+        ? root.security
+        : {});
+    const mfa = (sec.mfa && typeof sec.mfa === 'object' ? sec.mfa : {});
+    const session = (sec.session && typeof sec.session === 'object' ? sec.session : {});
+    const access = (sec.access && typeof sec.access === 'object' ? sec.access : {});
+    return {
+        mfa: {
+            required: Boolean(mfa.required),
+            gracePeriodDays: clampGrace(toInt(mfa.gracePeriodDays, DEFAULT_SECURITY_SETTINGS.mfa.gracePeriodDays)),
+            requiredAt: typeof mfa.requiredAt === 'string' ? mfa.requiredAt : undefined,
+        },
+        session: {
+            maxConcurrentSessions: clampSessions(toInt(session.maxConcurrentSessions, DEFAULT_SECURITY_SETTINGS.session.maxConcurrentSessions)),
+            timeoutHours: snapTimeoutHours(session.timeoutHours),
+            idleLogoutEnabled: Boolean(session.idleLogoutEnabled),
+        },
+        access: {
+            ipAllowlist: toStringList(access.ipAllowlist),
+            // Default ON — only an explicit `false` disables audit logging.
+            auditLoggingEnabled: access.auditLoggingEnabled !== false,
+        },
+        updatedAt: typeof sec.updatedAt === 'string' ? sec.updatedAt : undefined,
+        updatedBy: typeof sec.updatedBy === 'string' ? sec.updatedBy : undefined,
+    };
+}
+/** Snap an arbitrary value onto the allowed timeout options; invalid ⇒ default (7 days). */
+function snapTimeoutHours(value) {
+    const n = toInt(value, DEFAULT_SESSION_TIMEOUT_HOURS);
+    return SESSION_TIMEOUT_HOURS_OPTIONS.includes(n)
+        ? n
+        : DEFAULT_SESSION_TIMEOUT_HOURS;
+}
+/**
+ * Coerce an allowlist blob into trimmed, de-duplicated strings. Invalid
+ * IP/CIDR entries are kept so {@link validateSecuritySettings} can report them
+ * back to the caller instead of silently dropping them.
+ */
+function toStringList(value) {
+    if (!Array.isArray(value))
+        return [];
+    const out = [];
+    for (const entry of value) {
+        if (typeof entry !== 'string')
+            continue;
+        const trimmed = entry.trim();
+        if (!trimmed || out.includes(trimmed))
+            continue;
+        out.push(trimmed);
+        if (out.length >= MAX_IP_ALLOWLIST_ENTRIES)
+            break;
+    }
+    return out;
+}
+function clampGrace(n) {
+    if (n < 0)
+        return 0;
+    if (n > 365)
+        return 365;
+    return n;
+}
+function clampSessions(n) {
+    if (n < 0)
+        return 0;
+    if (n > 100)
+        return 100;
+    return n;
+}
+/** Validate an incoming settings payload. Pure — no DB / lockout checks here. */
+export function validateSecuritySettings(settings) {
+    const issues = [];
+    const grace = settings.mfa.gracePeriodDays;
+    if (!Number.isInteger(grace) || grace < 0 || grace > 365) {
+        issues.push({
+            field: 'mfaGracePeriodDays',
+            message: 'MFA grace period must be a whole number of days between 0 and 365.',
+            severity: 'error',
+        });
+    }
+    const max = settings.session.maxConcurrentSessions;
+    if (!Number.isInteger(max) || max < 0 || max > 100) {
+        issues.push({
+            field: 'maxConcurrentSessions',
+            message: 'Maximum concurrent sessions must be a whole number between 0 (unlimited) and 100.',
+            severity: 'error',
+        });
+    }
+    const timeout = settings.session.timeoutHours;
+    if (!SESSION_TIMEOUT_HOURS_OPTIONS.includes(timeout)) {
+        issues.push({
+            field: 'timeoutHours',
+            message: 'Session timeout must be 1 hour, 8 hours, 24 hours, or 7 days.',
+            severity: 'error',
+        });
+    }
+    const allowlist = settings.access.ipAllowlist;
+    if (allowlist.length > MAX_IP_ALLOWLIST_ENTRIES) {
+        issues.push({
+            field: 'ipAllowlist',
+            message: `The IP allowlist supports at most ${MAX_IP_ALLOWLIST_ENTRIES} entries.`,
+            severity: 'error',
+        });
+    }
+    const invalidEntries = allowlist.filter((entry) => !validateIpRange(entry));
+    if (invalidEntries.length > 0) {
+        issues.push({
+            field: 'ipAllowlist',
+            message: `Invalid IP or CIDR entries: ${invalidEntries.join(', ')}`,
+            severity: 'error',
+        });
+    }
+    return issues;
+}
+/**
+ * Lockout-safe IP allowlist check. Saving a non-empty allowlist that does not
+ * include the acting admin's own IP would cut them off on the very next
+ * request. Callers MUST run this server-side (with the union of DB + config
+ * ranges) and only bypass it when the request explicitly confirms the risk.
+ * Returns `null` when the save is safe.
+ */
+export function ipAllowlistLockoutError(input) {
+    if (input.effectiveAllowlist.length === 0)
+        return null;
+    if (!input.currentIp || input.currentIp === 'unknown') {
+        return 'Your IP address could not be determined, so this allowlist may lock you out. Confirm to save anyway.';
+    }
+    if (!isIpAllowed(input.currentIp, input.effectiveAllowlist)) {
+        return `Your current IP (${input.currentIp}) is not in the allowlist — saving would lock you out. Add it, or confirm to save anyway.`;
+    }
+    return null;
+}
+/**
+ * Lockout-safe MFA enable check. Enabling org-wide MFA while the acting admin
+ * has no TOTP configured would lock them (and possibly everyone) out. Callers
+ * MUST run this server-side before persisting `mfa.required = true`.
+ */
+export function mfaEnableLockoutError(input) {
+    if (!input.enabling)
+        return null;
+    if (!input.viewerHasMfa) {
+        return 'Set up MFA for your own account before requiring it for everyone — otherwise you would lock yourself out.';
+    }
+    return null;
+}
+const IPV4_OCTET = '(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)';
+const IPV4_RE = new RegExp(`^${IPV4_OCTET}(\\.${IPV4_OCTET}){3}$`);
+/**
+ * Validate a single allowlist entry: an IPv4/IPv6 literal or a CIDR range.
+ * Standalone (does not import the matcher's private helpers) so it can run in
+ * the client bundle for inline form validation.
+ */
+export function validateIpRange(entry) {
+    const value = entry.trim();
+    if (!value)
+        return false;
+    const [addr, maskStr, ...rest] = value.split('/');
+    if (rest.length > 0 || addr === undefined)
+        return false;
+    const isV6 = addr.includes(':');
+    if (maskStr !== undefined) {
+        if (!/^\d{1,3}$/.test(maskStr))
+            return false;
+        const mask = Number(maskStr);
+        if (isV6 ? mask > 128 : mask > 32)
+            return false;
+    }
+    return isV6 ? isValidIpv6(addr) : IPV4_RE.test(addr);
+}
+function isValidIpv6(addr) {
+    // Reject IPv4-mapped + multiple `::`; otherwise validate 1–8 hextet groups.
+    if (addr.includes('.'))
+        return false;
+    const halves = addr.split('::');
+    if (halves.length > 2)
+        return false;
+    const groups = addr
+        .replace('::', ':')
+        .split(':')
+        .filter((g) => g.length > 0);
+    if (groups.length === 0 && halves.length !== 2)
+        return false;
+    if (groups.length > 8)
+        return false;
+    return groups.every((g) => /^[0-9a-fA-F]{1,4}$/.test(g));
+}
+//# sourceMappingURL=settings.js.map

package/dist/security/center/settings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings.js","sourceRoot":"","sources":["../../../src/security/center/settings.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAGhD,MAAM,CAAC,MAAM,6BAA6B,GAAG,GAAG,CAAA;AAEhD,MAAM,CAAC,MAAM,yBAAyB,GAAqB;IACzD,GAAG,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,EAAE;IAC5C,OAAO,EAAE;QACP,qBAAqB,EAAE,CAAC;QACxB,YAAY,EAAE,6BAA6B;QAC3C,iBAAiB,EAAE,KAAK;KACzB;IACD,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;CACvD,CAAA;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,CAAU,CAAA;AAClE,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAU,CAAA;AACpE,6DAA6D;AAC7D,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,CAAU,CAAA;AACrE,+FAA+F;AAC/F,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAG,CAAA;AAQ3C,SAAS,KAAK,CAAC,KAAc,EAAE,QAAgB;IAC7C,MAAM,CAAC,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC3D,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAA;AACtD,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,qBAAqB,CAAC,IAAa;IACjD,MAAM,IAAI,GAAG,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAgC,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAA;IAC9F,MAAM,GAAG,GAAG,CACV,IAAI,CAAC,QAAQ,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ;QAChD,CAAC,CAAE,IAAI,CAAC,QAAoC;QAC5C,CAAC,CAAC,EAAE,CACoB,CAAA;IAC5B,MAAM,GAAG,GAAG,CACV,GAAG,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,GAA+B,CAAC,CAAC,CAAC,EAAE,CACxD,CAAA;IAC5B,MAAM,OAAO,GAAG,CACd,GAAG,CAAC,OAAO,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,OAAmC,CAAC,CAAC,CAAC,EAAE,CACpE,CAAA;IAC5B,MAAM,MAAM,GAAG,CACb,GAAG,CAAC,MAAM,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,MAAkC,CAAC,CAAC,CAAC,EAAE,CACjE,CAAA;IAE5B,OAAO;QACL,GAAG,EAAE;YACH,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;YAC/B,eAAe,EAAE,UAAU,CACzB,KAAK,CAAC,GAAG,CAAC,eAAe,EAAE,yBAAyB,CAAC,GAAG,CAAC,eAAe,CAAC,CAC1E;YACD,UAAU,EAAE,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;SAC5E;QACD,OAAO,EAAE;YACP,qBAAqB,EAAE,aAAa,CAClC,KAAK,CACH,OAAO,CAAC,qBAAqB,EAC7B,yBAAyB,CAAC,OAAO,CAAC,qBAAqB,CACxD,CACF;YACD,YAAY,EAAE,gBAAgB,CAAC,OAAO,CAAC,YAAY,CAAC;YACpD,iBAAiB,EAAE,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC;SACtD;QACD,MAAM,EAAE;YACN,WAAW,EAAE,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC;YAC7C,gEAAgE;YAChE,mBAAmB,EAAE,MAAM,CAAC,mBAAmB,KAAK,KAAK;SAC1D;QACD,SAAS,EAAE,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QACxE,SAAS,EAAE,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;KACzE,CAAA;AACH,CAAC;AAED,4FAA4F;AAC5F,SAAS,gBAAgB,CAAC,KAAc;IACtC,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,EAAE,6BAA6B,CAAC,CAAA;IACrD,OAAQ,6BAAmD,CAAC,QAAQ,CAAC,CAAC,CAAC;QACrE,CAAC,CAAC,CAAC;QACH,CAAC,CAAC,6BAA6B,CAAA;AACnC,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAA;IACpC,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAQ;QACvC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAA;QAC5B,IAAI,CAAC,OAAO,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAQ;QAC/C,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACjB,IAAI,GAAG,CAAC,MAAM,IAAI,wBAAwB;YAAE,MAAK;IACnD,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,CAAA;IACnB,IAAI,CAAC,GAAG,GAAG;QAAE,OAAO,GAAG,CAAA;IACvB,OAAO,CAAC,CAAA;AACV,CAAC;AAED,SAAS,aAAa,CAAC,CAAS;IAC9B,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,CAAA;IACnB,IAAI,CAAC,GAAG,GAAG;QAAE,OAAO,GAAG,CAAA;IACvB,OAAO,CAAC,CAAA;AACV,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,wBAAwB,CAAC,QAA0B;IACjE,MAAM,MAAM,GAA8B,EAAE,CAAA;IAC5C,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAA;IAC1C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;QACzD,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,oBAAoB;YAC3B,OAAO,EAAE,oEAAoE;YAC7E,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,qBAAqB,CAAA;IAClD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,GAAG,GAAG,EAAE,CAAC;QACnD,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,uBAAuB;YAC9B,OAAO,EAAE,mFAAmF;YAC5F,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAA;IAC7C,IAAI,CAAE,6BAAmD,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5E,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,cAAc;YACrB,OAAO,EAAE,+DAA+D;YACxE,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAA;IAC7C,IAAI,SAAS,CAAC,MAAM,GAAG,wBAAwB,EAAE,CAAC;QAChD,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,aAAa;YACpB,OAAO,EAAE,qCAAqC,wBAAwB,WAAW;YACjF,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAA;IAC3E,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,aAAa;YACpB,OAAO,EAAE,+BAA+B,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YACnE,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAKvC;IACC,IAAI,KAAK,CAAC,kBAAkB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACtD,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACtD,OAAO,sGAAsG,CAAA;IAC/G,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC5D,OAAO,oBAAoB,KAAK,CAAC,SAAS,2FAA2F,CAAA;IACvI,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAIrC;IACC,IAAI,CAAC,KAAK,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAA;IAChC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QACxB,OAAO,2GAA2G,CAAA;IACpH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,UAAU,GAAG,uCAAuC,CAAA;AAC1D,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,IAAI,UAAU,OAAO,UAAU,OAAO,CAAC,CAAA;AAElE;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAA;IAC1B,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAA;IACxB,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACjD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAA;IAEvD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;IAC/B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,KAAK,CAAA;QAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAA;QAC5B,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE;YAAE,OAAO,KAAK,CAAA;IACjD,CAAC;IACD,OAAO,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACtD,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,4EAA4E;IAC5E,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAA;IACpC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC/B,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAA;IACnC,MAAM,MAAM,GAAG,IAAI;SAChB,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;SAClB,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC9B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAC5D,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAA;IACnC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;AAC1D,CAAC"}

package/dist/security/center/status.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Pure security-posture computation.
+ *
+ * Turns gathered signals ({@link SecurityStatusInput}) into checks, warnings,
+ * an overall level, and an advisory score. No I/O — fully unit-tested so the
+ * "is this safe for production?" verdict is deterministic and reviewable.
+ */
+import type { SecurityStatus, SecurityStatusInput } from './types.js';
+export declare function computeSecurityStatus(input: SecurityStatusInput): SecurityStatus;
+//# sourceMappingURL=status.d.ts.map

package/dist/security/center/status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../../src/security/center/status.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAEV,cAAc,EACd,mBAAmB,EAGpB,MAAM,YAAY,CAAA;AA2BnB,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,mBAAmB,GAAG,cAAc,CAuNhF"}

package/dist/security/center/status.js

@@ -0,0 +1,249 @@
+const ADMIN_HREF = '/settings?tab=users';
+const API_KEYS_HREF = '/settings?tab=api-keys';
+const FAILED_LOGIN_WARN_THRESHOLD = 20;
+const LEVEL_COPY = {
+    secure: {
+        label: 'Secure',
+        description: 'Core protections are configured. Keep MFA coverage and API keys under review.',
+    },
+    needs_attention: {
+        label: 'Needs attention',
+        description: 'Some recommended controls are missing. Review the warnings below.',
+    },
+    at_risk: {
+        label: 'At risk',
+        description: 'Critical protections are missing or misconfigured. Resolve these before running in production.',
+    },
+    unknown: {
+        label: 'Unknown',
+        description: 'Security state could not be fully determined. Some services may be unavailable.',
+    },
+};
+export function computeSecurityStatus(input) {
+    const checks = [];
+    const warnings = [];
+    // ── MFA coverage ──────────────────────────────────────────────────────────
+    if (input.users.totalAdmins === 0) {
+        checks.push({ key: 'mfa', label: 'MFA coverage', status: 'unknown', value: 'No admins' });
+    }
+    else {
+        const allCovered = input.users.adminsWithoutMfa === 0;
+        const mfaStatus = allCovered ? 'pass' : input.settings.mfa.required ? 'fail' : 'warning';
+        checks.push({
+            key: 'mfa',
+            label: 'MFA coverage',
+            status: mfaStatus,
+            value: `${input.users.withMfa} of ${input.users.totalAdmins} admins`,
+            actionHref: ADMIN_HREF,
+        });
+        if (input.settings.mfa.required && input.users.adminsWithoutMfa > 0) {
+            warnings.push({
+                id: 'mfa-required-gap',
+                severity: 'critical',
+                category: 'auth',
+                title: 'Admins without MFA while MFA is required',
+                description: `${input.users.adminsWithoutMfa} admin account(s) have not set up MFA. They must enroll within the grace period.`,
+                actionLabel: 'Review users',
+                actionHref: ADMIN_HREF,
+            });
+        }
+        else if (!input.settings.mfa.required && input.isProduction) {
+            warnings.push({
+                id: 'mfa-not-required',
+                severity: 'warning',
+                category: 'auth',
+                title: 'MFA is not required in production',
+                description: 'Requiring MFA for admins significantly reduces account-takeover risk.',
+            });
+        }
+    }
+    // ── Active sessions (informational) ─────────────────────────────────────────
+    checks.push({
+        key: 'sessions',
+        label: 'Active admin sessions',
+        status: 'pass',
+        value: String(input.activeSessions),
+        actionHref: '/settings?tab=security&section=sessions',
+    });
+    // ── API keys ────────────────────────────────────────────────────────────────
+    const keyRisk = input.apiKeys.broadScope > 0
+        ? 'fail'
+        : input.apiKeys.withoutExpiration > 0 || input.apiKeys.staleUnused90d > 0
+            ? 'warning'
+            : 'pass';
+    checks.push({
+        key: 'api_keys',
+        label: 'High-risk API keys',
+        status: keyRisk === 'pass' ? 'pass' : keyRisk,
+        value: keyRisk === 'pass' ? `${input.apiKeys.active} active` : describeKeyRisk(input.apiKeys),
+        actionHref: API_KEYS_HREF,
+    });
+    if (input.apiKeys.broadScope > 0) {
+        warnings.push({
+            id: 'api-keys-broad',
+            severity: 'warning',
+            category: 'api_keys',
+            title: 'API keys with broad scopes',
+            description: `${input.apiKeys.broadScope} key(s) hold admin or full read/write scope. Scope keys to the minimum required.`,
+            actionLabel: 'Review API keys',
+            actionHref: API_KEYS_HREF,
+        });
+    }
+    if (input.apiKeys.withoutExpiration > 0) {
+        warnings.push({
+            id: 'api-keys-no-expiry',
+            severity: 'info',
+            category: 'api_keys',
+            title: 'API keys without expiration',
+            description: `${input.apiKeys.withoutExpiration} key(s) never expire. Consider setting an expiry.`,
+            actionLabel: 'Review API keys',
+            actionHref: API_KEYS_HREF,
+        });
+    }
+    // ── Failed logins (24h) ──────────────────────────────────────────────────────
+    const loginStatus = input.failedLogins24h >= FAILED_LOGIN_WARN_THRESHOLD ? 'warning' : 'pass';
+    checks.push({
+        key: 'failed_logins',
+        label: 'Failed logins (24h)',
+        status: loginStatus,
+        value: String(input.failedLogins24h),
+    });
+    if (loginStatus === 'warning') {
+        warnings.push({
+            id: 'failed-logins-spike',
+            severity: 'warning',
+            category: 'auth',
+            title: 'Elevated failed login attempts',
+            description: `${input.failedLogins24h} failed logins in the last 24h. This may indicate a brute-force attempt.`,
+        });
+    }
+    // ── CSRF ──────────────────────────────────────────────────────────────────────
+    checks.push({
+        key: 'csrf',
+        label: 'CSRF protection',
+        status: input.csrfEnabled ? 'pass' : 'fail',
+        value: input.csrfEnabled ? 'Enabled' : 'Disabled',
+    });
+    if (!input.csrfEnabled) {
+        warnings.push({
+            id: 'csrf-disabled',
+            severity: 'critical',
+            category: 'access',
+            title: 'CSRF protection disabled',
+            description: 'State-changing requests are not CSRF-protected. This exposes the admin to cross-site request forgery.',
+        });
+    }
+    // ── Rate limiting ──────────────────────────────────────────────────────────────
+    const distributed = input.secrets.rateLimitBackend === 'distributed';
+    checks.push({
+        key: 'rate_limit',
+        label: 'Rate limiting',
+        status: distributed ? 'pass' : 'warning',
+        value: distributed ? 'Distributed (Upstash)' : 'In-memory',
+    });
+    if (!distributed && input.isProduction) {
+        warnings.push({
+            id: 'rate-limit-in-memory',
+            severity: 'warning',
+            category: 'rate_limit',
+            title: 'Rate limiting is in-memory',
+            description: 'Without Upstash/Redis, rate limits are per-process and ineffective across serverless invocations. Configure UPSTASH_REDIS_REST_URL.',
+        });
+    }
+    // ── Upload validation ───────────────────────────────────────────────────────
+    checks.push({
+        key: 'uploads',
+        label: 'Upload validation',
+        status: input.uploadValidation ? 'pass' : 'warning',
+        value: input.uploadValidation ? 'MIME + magic bytes + SVG sanitization' : 'Unknown',
+    });
+    // ── Secrets / encryption ─────────────────────────────────────────────────────
+    checks.push({
+        key: 'cms_secret',
+        label: 'CMS secret',
+        status: input.secrets.cmsSecret,
+        value: secretValueLabel(input.secrets.cmsSecret),
+    });
+    if (input.secrets.cmsSecret === 'fail') {
+        warnings.push({
+            id: 'cms-secret-missing',
+            severity: 'critical',
+            category: 'secrets',
+            title: 'CMS_SECRET is missing or weak',
+            description: 'Session JWTs cannot be signed securely. Set a 32+ character CMS_SECRET.',
+        });
+    }
+    checks.push({
+        key: 'encryption_key',
+        label: 'Encryption key',
+        status: input.secrets.encryptionKey,
+        value: secretValueLabel(input.secrets.encryptionKey),
+    });
+    if (input.secrets.encryptionKey === 'fail') {
+        warnings.push({
+            id: 'encryption-key',
+            severity: input.isProduction ? 'critical' : 'warning',
+            category: 'secrets',
+            title: 'Encryption key not configured',
+            description: 'CMS_ENCRYPTION_KEY (64 hex chars) is required to encrypt secrets at rest (webhook secrets, OAuth tokens, TOTP secrets).',
+        });
+    }
+    // ── Audit logging ──────────────────────────────────────────────────────────────
+    checks.push({
+        key: 'audit',
+        label: 'Audit logging',
+        status: input.auditEnabled ? 'pass' : 'warning',
+        value: input.auditEnabled ? 'Enabled' : 'Disabled',
+        actionHref: '/settings?tab=security&section=audit',
+    });
+    // ── Roll up level + score ────────────────────────────────────────────────────
+    const hasCritical = warnings.some((w) => w.severity === 'critical');
+    const hasWarning = warnings.some((w) => w.severity === 'warning');
+    const unknown = input.secrets.cmsSecret === 'unknown';
+    let level;
+    if (unknown)
+        level = 'unknown';
+    else if (hasCritical)
+        level = 'at_risk';
+    else if (hasWarning)
+        level = 'needs_attention';
+    else
+        level = 'secure';
+    let score = 100;
+    for (const w of warnings) {
+        score -= w.severity === 'critical' ? 30 : w.severity === 'warning' ? 12 : 3;
+    }
+    score = Math.max(0, Math.min(100, score));
+    return {
+        status: level,
+        score,
+        label: LEVEL_COPY[level].label,
+        description: LEVEL_COPY[level].description,
+        checks,
+        warnings,
+        lastCheckedAt: new Date().toISOString(),
+    };
+}
+function describeKeyRisk(k) {
+    const parts = [];
+    if (k.broadScope > 0)
+        parts.push(`${k.broadScope} broad-scope`);
+    if (k.withoutExpiration > 0)
+        parts.push(`${k.withoutExpiration} no expiry`);
+    if (k.staleUnused90d > 0)
+        parts.push(`${k.staleUnused90d} stale`);
+    return parts.join(', ') || 'OK';
+}
+function secretValueLabel(status) {
+    switch (status) {
+        case 'pass':
+            return 'Configured';
+        case 'warning':
+            return 'Not configured';
+        case 'fail':
+            return 'Missing / invalid';
+        default:
+            return 'Unknown';
+    }
+}
+//# sourceMappingURL=status.js.map

package/dist/security/center/status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.js","sourceRoot":"","sources":["../../../src/security/center/status.ts"],"names":[],"mappings":"AAeA,MAAM,UAAU,GAAG,qBAAqB,CAAA;AACxC,MAAM,aAAa,GAAG,wBAAwB,CAAA;AAE9C,MAAM,2BAA2B,GAAG,EAAE,CAAA;AAEtC,MAAM,UAAU,GAAwE;IACtF,MAAM,EAAE;QACN,KAAK,EAAE,QAAQ;QACf,WAAW,EAAE,+EAA+E;KAC7F;IACD,eAAe,EAAE;QACf,KAAK,EAAE,iBAAiB;QACxB,WAAW,EAAE,mEAAmE;KACjF;IACD,OAAO,EAAE;QACP,KAAK,EAAE,SAAS;QAChB,WAAW,EACT,gGAAgG;KACnG;IACD,OAAO,EAAE;QACP,KAAK,EAAE,SAAS;QAChB,WAAW,EAAE,iFAAiF;KAC/F;CACF,CAAA;AAED,MAAM,UAAU,qBAAqB,CAAC,KAA0B;IAC9D,MAAM,MAAM,GAAoB,EAAE,CAAA;IAClC,MAAM,QAAQ,GAAsB,EAAE,CAAA;IAEtC,6EAA6E;IAC7E,IAAI,KAAK,CAAC,KAAK,CAAC,WAAW,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAA;IAC3F,CAAC;SAAM,CAAC;QACN,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,gBAAgB,KAAK,CAAC,CAAA;QACrD,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;QACxF,MAAM,CAAC,IAAI,CAAC;YACV,GAAG,EAAE,KAAK;YACV,KAAK,EAAE,cAAc;YACrB,MAAM,EAAE,SAAS;YACjB,KAAK,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,OAAO,KAAK,CAAC,KAAK,CAAC,WAAW,SAAS;YACpE,UAAU,EAAE,UAAU;SACvB,CAAC,CAAA;QACF,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,gBAAgB,GAAG,CAAC,EAAE,CAAC;YACpE,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,kBAAkB;gBACtB,QAAQ,EAAE,UAAU;gBACpB,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,0CAA0C;gBACjD,WAAW,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,gBAAgB,kFAAkF;gBAC9H,WAAW,EAAE,cAAc;gBAC3B,UAAU,EAAE,UAAU;aACvB,CAAC,CAAA;QACJ,CAAC;aAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;YAC9D,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,kBAAkB;gBACtB,QAAQ,EAAE,SAAS;gBACnB,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,mCAAmC;gBAC1C,WAAW,EAAE,uEAAuE;aACrF,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,MAAM,CAAC,IAAI,CAAC;QACV,GAAG,EAAE,UAAU;QACf,KAAK,EAAE,uBAAuB;QAC9B,MAAM,EAAE,MAAM;QACd,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC;QACnC,UAAU,EAAE,yCAAyC;KACtD,CAAC,CAAA;IAEF,+EAA+E;IAC/E,MAAM,OAAO,GACX,KAAK,CAAC,OAAO,CAAC,UAAU,GAAG,CAAC;QAC1B,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,iBAAiB,GAAG,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,cAAc,GAAG,CAAC;YACvE,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,MAAM,CAAA;IACd,MAAM,CAAC,IAAI,CAAC;QACV,GAAG,EAAE,UAAU;QACf,KAAK,EAAE,oBAAoB;QAC3B,MAAM,EAAE,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;QAC7C,KAAK,EAAE,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC;QAC7F,UAAU,EAAE,aAAa;KAC1B,CAAC,CAAA;IACF,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;QACjC,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,gBAAgB;YACpB,QAAQ,EAAE,SAAS;YACnB,QAAQ,EAAE,UAAU;YACpB,KAAK,EAAE,4BAA4B;YACnC,WAAW,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,kFAAkF;YAC1H,WAAW,EAAE,iBAAiB;YAC9B,UAAU,EAAE,aAAa;SAC1B,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,iBAAiB,GAAG,CAAC,EAAE,CAAC;QACxC,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,oBAAoB;YACxB,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,UAAU;YACpB,KAAK,EAAE,6BAA6B;YACpC,WAAW,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,iBAAiB,mDAAmD;YAClG,WAAW,EAAE,iBAAiB;YAC9B,UAAU,EAAE,aAAa;SAC1B,CAAC,CAAA;IACJ,CAAC;IAED,gFAAgF;IAChF,MAAM,WAAW,GAAG,KAAK,CAAC,eAAe,IAAI,2BAA2B,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAA;IAC7F,MAAM,CAAC,IAAI,CAAC;QACV,GAAG,EAAE,eAAe;QACpB,KAAK,EAAE,qBAAqB;QAC5B,MAAM,EAAE,WAAW;QACnB,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC;KACrC,CAAC,CAAA;IACF,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,qBAAqB;YACzB,QAAQ,EAAE,SAAS;YACnB,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,gCAAgC;YACvC,WAAW,EAAE,GAAG,KAAK,CAAC,eAAe,0EAA0E;SAChH,CAAC,CAAA;IACJ,CAAC;IAED,iFAAiF;IACjF,MAAM,CAAC,IAAI,CAAC;QACV,GAAG,EAAE,MAAM;QACX,KAAK,EAAE,iBAAiB;QACxB,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;QAC3C,KAAK,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU;KAClD,CAAC,CAAA;IACF,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QACvB,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,eAAe;YACnB,QAAQ,EAAE,UAAU;YACpB,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,0BAA0B;YACjC,WAAW,EACT,uGAAuG;SAC1G,CAAC,CAAA;IACJ,CAAC;IAED,kFAAkF;IAClF,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,gBAAgB,KAAK,aAAa,CAAA;IACpE,MAAM,CAAC,IAAI,CAAC;QACV,GAAG,EAAE,YAAY;QACjB,KAAK,EAAE,eAAe;QACtB,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QACxC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,WAAW;KAC3D,CAAC,CAAA;IACF,IAAI,CAAC,WAAW,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvC,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,sBAAsB;YAC1B,QAAQ,EAAE,SAAS;YACnB,QAAQ,EAAE,YAAY;YACtB,KAAK,EAAE,4BAA4B;YACnC,WAAW,EACT,qIAAqI;SACxI,CAAC,CAAA;IACJ,CAAC;IAED,+EAA+E;IAC/E,MAAM,CAAC,IAAI,CAAC;QACV,GAAG,EAAE,SAAS;QACd,KAAK,EAAE,mBAAmB;QAC1B,MAAM,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QACnD,KAAK,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,uCAAuC,CAAC,CAAC,CAAC,SAAS;KACpF,CAAC,CAAA;IAEF,gFAAgF;IAChF,MAAM,CAAC,IAAI,CAAC;QACV,GAAG,EAAE,YAAY;QACjB,KAAK,EAAE,YAAY;QACnB,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;QAC/B,KAAK,EAAE,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;KACjD,CAAC,CAAA;IACF,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;QACvC,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,oBAAoB;YACxB,QAAQ,EAAE,UAAU;YACpB,QAAQ,EAAE,SAAS;YACnB,KAAK,EAAE,+BAA+B;YACtC,WAAW,EAAE,yEAAyE;SACvF,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,CAAC,IAAI,CAAC;QACV,GAAG,EAAE,gBAAgB;QACrB,KAAK,EAAE,gBAAgB;QACvB,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,aAAa;QACnC,KAAK,EAAE,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC;KACrD,CAAC,CAAA;IACF,IAAI,KAAK,CAAC,OAAO,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;QAC3C,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,gBAAgB;YACpB,QAAQ,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;YACrD,QAAQ,EAAE,SAAS;YACnB,KAAK,EAAE,+BAA+B;YACtC,WAAW,EACT,yHAAyH;SAC5H,CAAC,CAAA;IACJ,CAAC;IAED,kFAAkF;IAClF,MAAM,CAAC,IAAI,CAAC;QACV,GAAG,EAAE,OAAO;QACZ,KAAK,EAAE,eAAe;QACtB,MAAM,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QAC/C,KAAK,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU;QAClD,UAAU,EAAE,sCAAsC;KACnD,CAAC,CAAA;IAEF,gFAAgF;IAChF,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAA;IACnE,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAA;IACjE,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAA;IAErD,IAAI,KAA0B,CAAA;IAC9B,IAAI,OAAO;QAAE,KAAK,GAAG,SAAS,CAAA;SACzB,IAAI,WAAW;QAAE,KAAK,GAAG,SAAS,CAAA;SAClC,IAAI,UAAU;QAAE,KAAK,GAAG,iBAAiB,CAAA;;QACzC,KAAK,GAAG,QAAQ,CAAA;IAErB,IAAI,KAAK,GAAG,GAAG,CAAA;IACf,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,KAAK,IAAI,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IAC7E,CAAC;IACD,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAA;IAEzC,OAAO;QACL,MAAM,EAAE,KAAK;QACb,KAAK;QACL,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK;QAC9B,WAAW,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,WAAW;QAC1C,MAAM;QACN,QAAQ;QACR,aAAa,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACxC,CAAA;AACH,CAAC;AAED,SAAS,eAAe,CAAC,CAIxB;IACC,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,IAAI,CAAC,CAAC,UAAU,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,UAAU,cAAc,CAAC,CAAA;IAC/D,IAAI,CAAC,CAAC,iBAAiB,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,iBAAiB,YAAY,CAAC,CAAA;IAC3E,IAAI,CAAC,CAAC,cAAc,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,cAAc,QAAQ,CAAC,CAAA;IACjE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAA;AACjC,CAAC;AAED,SAAS,gBAAgB,CAAC,MAA+B;IACvD,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,MAAM;YACT,OAAO,YAAY,CAAA;QACrB,KAAK,SAAS;YACZ,OAAO,gBAAgB,CAAA;QACzB,KAAK,MAAM;YACT,OAAO,mBAAmB,CAAA;QAC5B;YACE,OAAO,SAAS,CAAA;IACpB,CAAC;AACH,CAAC"}

package/dist/security/center/summaries.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Pure cross-module risk summaries (users + API keys).
+ *
+ * Take already-fetched rows so they can be unit-tested without a DB. The
+ * gatherer queries the minimal columns and hands them here.
+ */
+import type { ApiKeysSecuritySummary, UsersSecuritySummary } from './types.js';
+export interface UserRow {
+    role: string;
+    isActive: boolean;
+    totpEnabled: boolean;
+}
+export declare function summarizeUsers(rows: UserRow[]): UsersSecuritySummary;
+export interface ApiKeyRow {
+    scopes: unknown;
+    expiresAt: Date | string | null;
+    lastUsedAt: Date | string | null;
+    revokedAt: Date | string | null;
+}
+export declare function summarizeApiKeys(rows: ApiKeyRow[], now?: number): ApiKeysSecuritySummary;
+//# sourceMappingURL=summaries.d.ts.map

package/dist/security/center/summaries.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"summaries.d.ts","sourceRoot":"","sources":["../../../src/security/center/summaries.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAE9E,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,OAAO,CAAA;IACjB,WAAW,EAAE,OAAO,CAAA;CACrB;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,oBAAoB,CAwBpE;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,OAAO,CAAA;IACf,SAAS,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IAC/B,UAAU,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IAChC,SAAS,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;CAChC;AAgBD,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,SAAS,EAAE,EACjB,GAAG,GAAE,MAAmB,GACvB,sBAAsB,CAgBxB"}

package/dist/security/center/summaries.js

@@ -0,0 +1,65 @@
+export function summarizeUsers(rows) {
+    let totalAdmins = 0;
+    let withMfa = 0;
+    let adminsWithoutMfa = 0;
+    let withoutMfa = 0;
+    let inactive = 0;
+    for (const u of rows) {
+        if (!u.isActive)
+            inactive++;
+        if (!u.totpEnabled)
+            withoutMfa++;
+        const isAdmin = u.role === 'ADMIN';
+        if (isAdmin) {
+            totalAdmins++;
+            if (u.totpEnabled)
+                withMfa++;
+            else if (u.isActive)
+                adminsWithoutMfa++;
+        }
+    }
+    return {
+        totalUsers: rows.length,
+        totalAdmins,
+        withMfa,
+        withoutMfa,
+        adminsWithoutMfa,
+        inactive,
+    };
+}
+const STALE_MS = 90 * 24 * 60 * 60 * 1000;
+/** A key is "broad" if it carries the admin scope (full control). */
+function isBroadScope(scopes) {
+    if (!scopes || typeof scopes !== 'object')
+        return false;
+    return scopes.admin === true;
+}
+function toTime(v) {
+    if (!v)
+        return null;
+    const t = v instanceof Date ? v.getTime() : new Date(v).getTime();
+    return Number.isFinite(t) ? t : null;
+}
+export function summarizeApiKeys(rows, now = Date.now()) {
+    let active = 0;
+    let withoutExpiration = 0;
+    let broadScope = 0;
+    let staleUnused90d = 0;
+    for (const k of rows) {
+        if (k.revokedAt)
+            continue;
+        const exp = toTime(k.expiresAt);
+        if (exp !== null && exp <= now)
+            continue; // expired ⇒ not active
+        active++;
+        if (exp === null)
+            withoutExpiration++;
+        if (isBroadScope(k.scopes))
+            broadScope++;
+        const used = toTime(k.lastUsedAt);
+        if (used !== null && now - used > STALE_MS)
+            staleUnused90d++;
+    }
+    return { active, withoutExpiration, broadScope, staleUnused90d };
+}
+//# sourceMappingURL=summaries.js.map

package/dist/security/center/summaries.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"summaries.js","sourceRoot":"","sources":["../../../src/security/center/summaries.ts"],"names":[],"mappings":"AAcA,MAAM,UAAU,cAAc,CAAC,IAAe;IAC5C,IAAI,WAAW,GAAG,CAAC,CAAA;IACnB,IAAI,OAAO,GAAG,CAAC,CAAA;IACf,IAAI,gBAAgB,GAAG,CAAC,CAAA;IACxB,IAAI,UAAU,GAAG,CAAC,CAAA;IAClB,IAAI,QAAQ,GAAG,CAAC,CAAA;IAChB,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,CAAC,QAAQ;YAAE,QAAQ,EAAE,CAAA;QAC3B,IAAI,CAAC,CAAC,CAAC,WAAW;YAAE,UAAU,EAAE,CAAA;QAChC,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,KAAK,OAAO,CAAA;QAClC,IAAI,OAAO,EAAE,CAAC;YACZ,WAAW,EAAE,CAAA;YACb,IAAI,CAAC,CAAC,WAAW;gBAAE,OAAO,EAAE,CAAA;iBACvB,IAAI,CAAC,CAAC,QAAQ;gBAAE,gBAAgB,EAAE,CAAA;QACzC,CAAC;IACH,CAAC;IACD,OAAO;QACL,UAAU,EAAE,IAAI,CAAC,MAAM;QACvB,WAAW;QACX,OAAO;QACP,UAAU;QACV,gBAAgB;QAChB,QAAQ;KACT,CAAA;AACH,CAAC;AASD,MAAM,QAAQ,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAEzC,qEAAqE;AACrE,SAAS,YAAY,CAAC,MAAe;IACnC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IACvD,OAAQ,MAAkC,CAAC,KAAK,KAAK,IAAI,CAAA;AAC3D,CAAC;AAED,SAAS,MAAM,CAAC,CAAuB;IACrC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IACnB,MAAM,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAA;IACjE,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AACtC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,IAAiB,EACjB,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,IAAI,iBAAiB,GAAG,CAAC,CAAA;IACzB,IAAI,UAAU,GAAG,CAAC,CAAA;IAClB,IAAI,cAAc,GAAG,CAAC,CAAA;IACtB,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,SAAS;YAAE,SAAQ;QACzB,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QAC/B,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,IAAI,GAAG;YAAE,SAAQ,CAAC,uBAAuB;QAChE,MAAM,EAAE,CAAA;QACR,IAAI,GAAG,KAAK,IAAI;YAAE,iBAAiB,EAAE,CAAA;QACrC,IAAI,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,UAAU,EAAE,CAAA;QACxC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAA;QACjC,IAAI,IAAI,KAAK,IAAI,IAAI,GAAG,GAAG,IAAI,GAAG,QAAQ;YAAE,cAAc,EAAE,CAAA;IAC9D,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,UAAU,EAAE,cAAc,EAAE,CAAA;AAClE,CAAC"}