@prenta/core 7.7.0 → 7.7.2

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @actuate-media/cms-core
 
+## 7.7.2
+
+### Patch Changes
+
+- 23fbe86: Split route helpers and user route registration into smaller modules. HTTP behavior is unchanged.
+
+## 7.7.1
+
+### Patch Changes
+
+- 3343dac: Split SEO route registration into per-area handlers. HTTP behavior is unchanged.
+
 ## 7.7.0
 
 ### Minor Changes

package/dist/api/route-helpers/auth.d.ts

@@ -0,0 +1,131 @@
+import type { ActionContext } from '../../actions.js';
+import { type TeamOptions } from '../../auth/team.js';
+import { type ApiKeyScope } from '../../security/api-key-enhanced.js';
+import type { PrentaDB } from '../../db/client-types.js';
+export declare function getSessionSecret(): string;
+export declare function isSecretMissing(): boolean;
+/**
+ * Authenticated request context. `apiKey` is set when the request was
+ * authenticated via an `act_sk_*` API key (rather than a user session) — in
+ * that case `sessionId` is the API key id and `role` reflects either the
+ * granted `admin` scope or `'API_KEY'` for scoped keys.
+ */
+export type AuthSession = {
+    userId: string;
+    role: string;
+    sessionId: string;
+    apiKey?: {
+        id: string;
+        scopes: ApiKeyScope;
+    };
+};
+export declare function extractSession(request: Request): Promise<AuthSession | null>;
+export declare function parseCookieHeader(cookieHeader: string): Record<string, string>;
+/**
+ * Verify a password (or "current password") posted in the X-Reauth-Password
+ * header against the authenticated user. Returns an error Response when the
+ * header is missing or the password is wrong; returns null on success.
+ *
+ * Use this for high-impact account changes (TOTP enable/disable, role change,
+ * delete user, etc.) so a stolen session alone cannot perform them.
+ */
+export declare function requirePasswordReauth(request: Request, userId: string): Promise<Response | null>;
+export declare function requireAuth(request: Request): Promise<{
+    session: AuthSession;
+    error?: never;
+} | {
+    session?: never;
+    error: Response;
+}>;
+/**
+ * API-key collection-scope check as a plain denial reason (`null` = allowed).
+ * JWT sessions are never denied here — role checks are the route's job. Use
+ * this where the collection is only known deep inside a service (e.g. an SEO
+ * fix that writes a document) and a `Response` cannot be returned directly.
+ */
+export declare function apiKeyCollectionScopeDenial(session: AuthSession, collection: string, action: 'read' | 'create' | 'update' | 'delete'): string | null;
+/**
+ * Check that the request's auth context permits `action` on `collection`.
+ * - Session-authenticated requests fall through to `requireRole` semantics:
+ *   write actions require WRITE_ROLES.
+ * - API-key-authenticated requests must have an explicit scope match.
+ */
+export declare function requireCollectionScope(session: AuthSession, collection: string, action: 'read' | 'create' | 'update' | 'delete'): Response | null;
+export declare function requireGlobalScope(session: AuthSession, slug: string): Response | null;
+export declare function requireMediaScope(session: AuthSession): Response | null;
+export declare function requireAdminScope(session: AuthSession): Response | null;
+export declare function buildActionContext(session: {
+    userId: string;
+    role: string;
+}, db: PrentaDB, locale?: string): ActionContext;
+export declare const WRITE_ROLES: Set<string>;
+export declare const ADMIN_ROLES: Set<string>;
+export declare function requireRole(role: string, allowedRoles: Set<string>): Response | null;
+/**
+ * Build the shared {@link TeamOptions} for the Users endpoints from config +
+ * session: the workspace domain (for external-domain detection) and the seat
+ * cap (config-provided; null = unlimited until billing exists).
+ */
+export declare function teamOptionsFor(session: AuthSession): TeamOptions;
+/**
+ * DB-aware variant of {@link isEmailConfigured} — also true when a provider
+ * is configured through Settings > Email.
+ */
+export declare function isEmailConfiguredAsync(db?: unknown): Promise<boolean>;
+export declare const loginLimiter: import("../../security/rate-limit.js").RateLimiter;
+export declare const loginUnknownLimiter: import("../../security/rate-limit.js").RateLimiter;
+/** Per-email-hash login limiter so account protection does not depend on IP. */
+export declare const loginEmailLimiter: import("../../security/rate-limit.js").RateLimiter;
+export declare const inviteLimiter: import("../../security/rate-limit.js").RateLimiter;
+export declare const totpLimiter: import("../../security/rate-limit.js").RateLimiter;
+export declare const emailTestLimiter: import("../../security/rate-limit.js").RateLimiter;
+export declare const aiGenerateLimiter: import("../../security/rate-limit.js").RateLimiter;
+export declare const uploadLimiter: import("../../security/rate-limit.js").RateLimiter;
+export declare const aiAnalysisLimiter: import("../../security/rate-limit.js").RateLimiter;
+export declare const AI_ANALYSIS_MAX_CHARS = 50000;
+export declare const linkHealthLimiter: import("../../security/rate-limit.js").RateLimiter;
+export declare const seoAuditLimiter: import("../../security/rate-limit.js").RateLimiter;
+export declare const searchConsoleTestLimiter: import("../../security/rate-limit.js").RateLimiter;
+export declare const searchSyncLimiter: import("../../security/rate-limit.js").RateLimiter;
+export declare const digestTestSendLimiter: import("../../security/rate-limit.js").RateLimiter;
+export declare function checkRateLimitAsync(limiter: {
+    check: (key: string) => Promise<{
+        allowed: boolean;
+    }>;
+}, key: string): Promise<boolean>;
+/**
+ * Resolve the client IP from trusted-proxy headers (Vercel first, then x-real-ip,
+ * then x-forwarded-for only when PRENTA_TRUST_PROXY=1). Returns 'unknown' when
+ * no trustworthy source is available — callers MUST treat that case as a hard
+ * failure for security-sensitive decisions like rate-limit keys and IP allowlists.
+ */
+export declare function clientIp(request: Request): string;
+/**
+ * Compute a before/after diff of top-level scalar (string/number/boolean) keys
+ * between a stored record and an incoming patch. Used to audit settings changes
+ * without ever logging nested objects (which may hold secret blobs).
+ */
+export declare function diffScalarKeys(previous: Record<string, unknown>, next: Record<string, unknown>): Array<{
+    key: string;
+    from: unknown;
+    to: unknown;
+}>;
+/**
+ * After a successful primary-credential check, prune the user's active sessions
+ * down to the configured concurrent maximum (default 5; configurable via
+ * `auth.maxConcurrentSessions`). Strategy is "revoke oldest" so a user can
+ * always sign in.
+ */
+export declare function enforceSessionLimitsForUser(d: any, userId: string): Promise<void>;
+/** Revoke every live API key for a user. Called with session revocation. */
+export declare function revokeUserApiKeys(d: any, userId: string): Promise<number>;
+export declare function getAdminPath(): string;
+/**
+ * Gate a per-document read for endpoints (e.g. SEO analysis) that fetch a
+ * document directly rather than through the collection CRUD routes. Enforces
+ * both the API-key collection scope and the collection's `access.read` rule
+ * so an AUTHOR scoped to one collection cannot read another's content.
+ * Returns a `Response` to short-circuit with, or `null` when allowed.
+ */
+export declare function enforceDocumentReadAccess(session: AuthSession, collection: string): Promise<Response | null>;
+//# sourceMappingURL=auth.d.ts.map

package/dist/api/route-helpers/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/api/route-helpers/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAIrD,OAAO,EAA0B,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAQ7E,OAAO,EAOL,KAAK,WAAW,EACjB,MAAM,oCAAoC,CAAA;AAG3C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAA;AAOxD,wBAAgB,gBAAgB,IAAI,MAAM,CAuBzC;AAED,wBAAgB,eAAe,IAAI,OAAO,CAQzC;AAED;;;;;GAKG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,CAAC,EAAE;QACP,EAAE,EAAE,MAAM,CAAA;QACV,MAAM,EAAE,WAAW,CAAA;KACpB,CAAA;CACF,CAAA;AAED,wBAAsB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAsFlF;AAED,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAS9E;AAED;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CA0B1B;AAED,wBAAsB,WAAW,CAC/B,OAAO,EAAE,OAAO,GACf,OAAO,CAAC;IAAE,OAAO,EAAE,WAAW,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAE,GAAG;IAAE,OAAO,CAAC,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,QAAQ,CAAA;CAAE,CAAC,CAkBzF;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,WAAW,EACpB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAC9C,MAAM,GAAG,IAAI,CAKf;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,WAAW,EACpB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAC9C,QAAQ,GAAG,IAAI,CAOjB;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAOtF;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,WAAW,GAAG,QAAQ,GAAG,IAAI,CAOvE;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,WAAW,GAAG,QAAQ,GAAG,IAAI,CAQvE;AAED,wBAAgB,kBAAkB,CAChC,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EACzC,EAAE,EAAE,QAAQ,EACZ,MAAM,CAAC,EAAE,MAAM,GACd,aAAa,CAOf;AAED,eAAO,MAAM,WAAW,aAAkD,CAAA;AAE1E,eAAO,MAAM,WAAW,aAA8B,CAAA;AAEtD,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,QAAQ,GAAG,IAAI,CAKpF;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,WAAW,GAAG,WAAW,CAehE;AASD;;;GAGG;AACH,wBAAsB,sBAAsB,CAAC,EAAE,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAI3E;AAED,eAAO,MAAM,YAAY,oDAIvB,CAAA;AAQF,eAAO,MAAM,mBAAmB,oDAI9B,CAAA;AAEF,gFAAgF;AAChF,eAAO,MAAM,iBAAiB,oDAI5B,CAAA;AAIF,eAAO,MAAM,aAAa,oDAAmE,CAAA;AAE7F,eAAO,MAAM,WAAW,oDAItB,CAAA;AAIF,eAAO,MAAM,gBAAgB,oDAAmE,CAAA;AAEhG,eAAO,MAAM,iBAAiB,oDAI5B,CAAA;AAIF,eAAO,MAAM,aAAa,oDAIxB,CAAA;AAIF,eAAO,MAAM,iBAAiB,oDAI5B,CAAA;AAIF,eAAO,MAAM,qBAAqB,QAAS,CAAA;AAE3C,eAAO,MAAM,iBAAiB,oDAAkE,CAAA;AAEhG,eAAO,MAAM,eAAe,oDAAmE,CAAA;AAI/F,eAAO,MAAM,wBAAwB,oDAInC,CAAA;AAIF,eAAO,MAAM,iBAAiB,oDAI5B,CAAA;AAGF,eAAO,MAAM,qBAAqB,oDAIhC,CAAA;AAEF,wBAAsB,mBAAmB,CACvC,OAAO,EAAE;IAAE,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;CAAE,EAClE,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,OAAO,CAAC,CAWlB;AAED;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAEjD;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,KAAK,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAC;IAAC,EAAE,EAAE,OAAO,CAAA;CAAE,CAAC,CAapD;AAID;;;;;GAKG;AACH,wBAAsB,2BAA2B,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA8CvF;AAED,4EAA4E;AAC5E,wBAAsB,iBAAiB,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAO/E;AAED,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAED;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,WAAW,EACpB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAY1B"}

package/dist/api/route-helpers/auth.js

@@ -0,0 +1,505 @@
+import { assertCollectionAccess } from '../../actions.js';
+import { verifySession } from '../../auth/session.js';
+import { resolveEmailSender } from '../../email/sender.js';
+import { workspaceDomainFromUrl } from '../../auth/team.js';
+import { getDB } from '../../db.js';
+import { createRateLimiter } from '../../security/rate-limit.js';
+import { bindRequestLogUser } from '../../diagnostics/logger.js';
+import { getClientIp } from '../../security/client-ip.js';
+import { enforceSessionLimits } from '../../security/session-limits.js';
+import { verifyReauth } from '../../security/reauth.js';
+import { getPrentaConfig } from '../../config/runtime.js';
+import { hashApiKey, looksLikeApiKey, validateApiKeyScope, validateApiKeyGlobalScope, validateApiKeyMediaScope, validateApiKeyIp, } from '../../security/api-key-enhanced.js';
+import { guardedDb } from '../guarded-db.js';
+import { SECURITY_HEADERS } from '../security-headers.js';
+import { logger, json, errorResponse, hasModel } from './http.js';
+let _secretMissing = false;
+let _secretWarningLogged = false;
+export function getSessionSecret() {
+    const secret = process.env.CMS_SECRET ?? process.env.CMS_SESSION_SECRET ?? getPrentaConfig()?.secret;
+    if (!secret) {
+        _secretMissing = true;
+        if (!_secretWarningLogged) {
+            _secretWarningLogged = true;
+            logger.error('Missing CMS secret. Set CMS_SECRET (min 32 characters) or pass secret in prenta.config.ts. Authenticated routes return 503 until it is set.');
+        }
+        throw new Error('CMS secret not configured');
+    }
+    if (secret.length < 32) {
+        throw new Error('[Prenta CMS] CMS secret must be at least 32 characters (got ' +
+            secret.length +
+            '). ' +
+            "Generate a secure value with: node -e \"console.log(require('crypto').randomBytes(32).toString('hex'))\"");
+    }
+    _secretMissing = false;
+    return secret;
+}
+export function isSecretMissing() {
+    if (_secretMissing)
+        return true;
+    try {
+        getSessionSecret();
+        return false;
+    }
+    catch {
+        return true;
+    }
+}
+export async function extractSession(request) {
+    if (isSecretMissing())
+        return null;
+    let token;
+    const authHeader = request.headers.get('Authorization');
+    if (authHeader?.startsWith('Bearer ')) {
+        token = authHeader.slice(7);
+    }
+    if (!token) {
+        const cookieHeader = request.headers.get('cookie') ?? '';
+        const cookies = parseCookieHeader(cookieHeader);
+        token = cookies['prenta_session'];
+    }
+    if (!token)
+        return null;
+    // API key path. Keys are recognized by the `act_sk_` prefix and looked up
+    // by SHA-256 hash. We never JWT-verify these tokens — they are opaque
+    // random secrets stored as hashes in `prenta_api_keys`.
+    if (looksLikeApiKey(token)) {
+        try {
+            const d = getDB();
+            if (!hasModel(d, 'apiKey'))
+                return null;
+            const hash = await hashApiKey(token);
+            const apiKey = await d.apiKey.findUnique({ where: { keyHash: hash } });
+            if (!apiKey)
+                return null;
+            if (apiKey.revokedAt)
+                return null;
+            if (apiKey.expiresAt && new Date(apiKey.expiresAt).getTime() < Date.now())
+                return null;
+            const ipRestrictions = Array.isArray(apiKey.ipRestrictions)
+                ? apiKey.ipRestrictions
+                : apiKey.ipRestrictions
+                    ? (apiKey.ipRestrictions.allow ?? null)
+                    : null;
+            if (ipRestrictions && ipRestrictions.length > 0) {
+                const ip = getClientIp(request);
+                if (!validateApiKeyIp(ipRestrictions, ip))
+                    return null;
+            }
+            // Keys inherit the owner's current lifecycle + role. Suspension, lock,
+            // deactivation, or a demotion must take effect immediately — the key
+            // cannot outrank the user who minted it (CRIT-1).
+            if (!hasModel(d, 'user'))
+                return null;
+            const owner = await d.user.findUnique({
+                where: { id: apiKey.userId },
+                select: { id: true, role: true, isActive: true, suspendedAt: true, lockedAt: true },
+            });
+            if (!owner)
+                return null;
+            if (owner.isActive === false || owner.suspendedAt || owner.lockedAt)
+                return null;
+            const scopes = apiKey.scopes ?? {};
+            // Fire-and-forget lastUsedAt update; never block the request on it.
+            void d.apiKey
+                .update({ where: { id: apiKey.id }, data: { lastUsedAt: new Date() } })
+                .catch(() => { });
+            bindRequestLogUser(apiKey.userId);
+            return {
+                userId: apiKey.userId,
+                role: scopes.admin ? String(owner.role || 'ADMIN') : 'API_KEY',
+                sessionId: apiKey.id,
+                apiKey: { id: apiKey.id, scopes },
+            };
+        }
+        catch {
+            return null;
+        }
+    }
+    // Session JWT path.
+    try {
+        const payload = await verifySession(token, { secret: getSessionSecret() });
+        const d = getDB();
+        if (hasModel(d, 'session')) {
+            const dbSession = await d.session.findUnique({
+                where: { id: payload.sessionId },
+                select: { revokedAt: true },
+            });
+            if (!dbSession || dbSession.revokedAt)
+                return null;
+        }
+        if (payload.userId)
+            bindRequestLogUser(payload.userId);
+        return payload;
+    }
+    catch {
+        return null;
+    }
+}
+export function parseCookieHeader(cookieHeader) {
+    const cookies = {};
+    for (const pair of cookieHeader.split(';')) {
+        const [key, ...rest] = pair.split('=');
+        if (key) {
+            cookies[key.trim()] = rest.join('=').trim();
+        }
+    }
+    return cookies;
+}
+/**
+ * Verify a password (or "current password") posted in the X-Reauth-Password
+ * header against the authenticated user. Returns an error Response when the
+ * header is missing or the password is wrong; returns null on success.
+ *
+ * Use this for high-impact account changes (TOTP enable/disable, role change,
+ * delete user, etc.) so a stolen session alone cannot perform them.
+ */
+export async function requirePasswordReauth(request, userId) {
+    const password = request.headers.get('x-reauth-password');
+    if (!password) {
+        return new Response(JSON.stringify({
+            error: 'Re-authentication required for this action.',
+            code: 'REAUTH_REQUIRED',
+            method: 'password',
+        }), { status: 401, headers: { ...SECURITY_HEADERS } });
+    }
+    try {
+        const { getDB } = await import('../../db.js');
+        const ok = await verifyReauth(userId, password, 'password', getDB());
+        if (!ok) {
+            return errorResponse('Re-authentication failed.', 401);
+        }
+        return null;
+    }
+    catch (err) {
+        logger.error('reauth verify failed', {
+            error: err instanceof Error ? err.message : String(err),
+        });
+        return errorResponse('Re-authentication failed.', 401);
+    }
+}
+export async function requireAuth(request) {
+    if (isSecretMissing()) {
+        return {
+            error: json({
+                error: 'CMS secret not configured. Set CMS_SECRET or CMS_SESSION_SECRET environment variable (min 32 characters).',
+                code: 'MISSING_SECRET',
+            }, 503),
+        };
+    }
+    const session = await extractSession(request);
+    if (!session) {
+        return { error: errorResponse('Unauthorized', 401) };
+    }
+    return { session };
+}
+/**
+ * API-key collection-scope check as a plain denial reason (`null` = allowed).
+ * JWT sessions are never denied here — role checks are the route's job. Use
+ * this where the collection is only known deep inside a service (e.g. an SEO
+ * fix that writes a document) and a `Response` cannot be returned directly.
+ */
+export function apiKeyCollectionScopeDenial(session, collection, action) {
+    if (!session.apiKey)
+        return null;
+    return validateApiKeyScope(session.apiKey.scopes, collection, action)
+        ? null
+        : `API key does not have permission to ${action} on collection "${collection}"`;
+}
+/**
+ * Check that the request's auth context permits `action` on `collection`.
+ * - Session-authenticated requests fall through to `requireRole` semantics:
+ *   write actions require WRITE_ROLES.
+ * - API-key-authenticated requests must have an explicit scope match.
+ */
+export function requireCollectionScope(session, collection, action) {
+    if (session.apiKey) {
+        const denial = apiKeyCollectionScopeDenial(session, collection, action);
+        return denial ? errorResponse(denial, 403) : null;
+    }
+    if (action === 'read')
+        return null;
+    return requireRole(session.role, WRITE_ROLES);
+}
+export function requireGlobalScope(session, slug) {
+    if (session.apiKey) {
+        if (!validateApiKeyGlobalScope(session.apiKey.scopes, slug)) {
+            return errorResponse(`API key does not have permission for global "${slug}"`, 403);
+        }
+    }
+    return null;
+}
+export function requireMediaScope(session) {
+    if (session.apiKey) {
+        if (!validateApiKeyMediaScope(session.apiKey.scopes)) {
+            return errorResponse('API key does not have media scope', 403);
+        }
+    }
+    return null;
+}
+export function requireAdminScope(session) {
+    if (session.apiKey) {
+        if (!session.apiKey.scopes.admin) {
+            return errorResponse('API key does not have admin scope', 403);
+        }
+        return null;
+    }
+    return requireRole(session.role, ADMIN_ROLES);
+}
+export function buildActionContext(session, db, locale) {
+    return {
+        userId: session.userId,
+        role: session.role,
+        locale,
+        db,
+    };
+}
+export const WRITE_ROLES = new Set(['OWNER', 'ADMIN', 'EDITOR', 'AUTHOR']);
+export const ADMIN_ROLES = new Set(['OWNER', 'ADMIN']);
+export function requireRole(role, allowedRoles) {
+    if (!allowedRoles.has(role)) {
+        return errorResponse('Insufficient permissions', 403);
+    }
+    return null;
+}
+/**
+ * Build the shared {@link TeamOptions} for the Users endpoints from config +
+ * session: the workspace domain (for external-domain detection) and the seat
+ * cap (config-provided; null = unlimited until billing exists).
+ */
+export function teamOptionsFor(session) {
+    const cfg = getPrentaConfig();
+    const siteUrl = process.env.NEXT_PUBLIC_SITE_URL ??
+        cfg?.seo?.siteUrl ??
+        null;
+    const seatLimit = cfg?.users?.seatLimit ??
+        cfg?.admin?.seatLimit ??
+        null;
+    return {
+        workspaceDomain: workspaceDomainFromUrl(siteUrl),
+        seatLimit,
+        currentUserId: session.userId,
+    };
+}
+/** Whether the configured email provider can actually send mail. */
+function isEmailConfigured() {
+    const cfg = getPrentaConfig();
+    if (cfg?.platform?.email)
+        return true;
+    return !!resolveEmailSender();
+}
+/**
+ * DB-aware variant of {@link isEmailConfigured} — also true when a provider
+ * is configured through Settings > Email.
+ */
+export async function isEmailConfiguredAsync(db) {
+    if (isEmailConfigured())
+        return true;
+    const { resolveEmailSenderAsync } = await import('../../email/resolve.js');
+    return Boolean(await resolveEmailSenderAsync(db));
+}
+export const loginLimiter = createRateLimiter({
+    maxRequests: 5,
+    windowMs: 15 * 60 * 1000,
+    failClosed: true,
+});
+// Fallback limiter for auth requests whose client IP can't be resolved (no
+// trusted proxy header) — those all share ONE bucket. The strict 5/15min
+// `loginLimiter` there would let a handful of anonymous requests lock every
+// user out of login (see #536), so the shared "unknown" bucket gets a much
+// higher ceiling. The real fix is resolving IPs (PRENTA_TRUST_PROXY); this
+// just bounds abuse without turning a mis-config into a global outage.
+export const loginUnknownLimiter = createRateLimiter({
+    maxRequests: 100,
+    windowMs: 15 * 60 * 1000,
+    failClosed: true,
+});
+/** Per-email-hash login limiter so account protection does not depend on IP. */
+export const loginEmailLimiter = createRateLimiter({
+    maxRequests: 5,
+    windowMs: 15 * 60 * 1000,
+    failClosed: true,
+});
+// Admin-gated, but bounds invitation-email volume (and accidental loops) per
+// admin: enough to onboard a team, low enough to deter abuse.
+export const inviteLimiter = createRateLimiter({ maxRequests: 20, windowMs: 60 * 60 * 1000 });
+export const totpLimiter = createRateLimiter({
+    maxRequests: 10,
+    windowMs: 15 * 60 * 1000,
+    failClosed: true,
+});
+// Admin-gated test sends from Settings > Email — enough to debug a provider
+// setup, low enough that a compromised admin session can't spray mail.
+export const emailTestLimiter = createRateLimiter({ maxRequests: 10, windowMs: 60 * 60 * 1000 });
+export const aiGenerateLimiter = createRateLimiter({
+    maxRequests: 20,
+    windowMs: 60 * 60 * 1000,
+    failClosed: true,
+});
+// Strict per-user upload cap (security rule: uploads strict at 20/hour) — guards
+// storage cost and optimization abuse beyond the global per-IP API bucket.
+export const uploadLimiter = createRateLimiter({
+    maxRequests: 20,
+    windowMs: 60 * 60 * 1000,
+    failClosed: true,
+});
+// Deterministic (no provider) AI-adjacent routes that scan/iterate documents.
+// Cheaper than the generation budget but still bounded against cost/DoS.
+export const aiAnalysisLimiter = createRateLimiter({
+    maxRequests: 60,
+    windowMs: 60 * 60 * 1000,
+    failClosed: true,
+});
+// Upper bound on free-text inputs to the deterministic analysis routes
+// (document body / link-candidate content) — caps memory + scan work.
+export const AI_ANALYSIS_MAX_CHARS = 50_000;
+export const linkHealthLimiter = createRateLimiter({ maxRequests: 4, windowMs: 60 * 60 * 1000 });
+export const seoAuditLimiter = createRateLimiter({ maxRequests: 10, windowMs: 60 * 60 * 1000 });
+// Admin-gated live checks against the Google Search Console API ("Test
+// connection") — enough to debug a setup, bounded against key-guessing.
+export const searchConsoleTestLimiter = createRateLimiter({
+    maxRequests: 10,
+    windowMs: 60 * 60 * 1000,
+    failClosed: true,
+});
+// Manual search-data syncs hit Google quotas and write big row sets; the
+// nightly cron is the normal path, so the manual button is strictly bounded.
+export const searchSyncLimiter = createRateLimiter({
+    maxRequests: 5,
+    windowMs: 60 * 60 * 1000,
+    failClosed: true,
+});
+// Digest test-sends dispatch real email to the caller — strictly bounded.
+export const digestTestSendLimiter = createRateLimiter({
+    maxRequests: 5,
+    windowMs: 60 * 60 * 1000,
+    failClosed: true,
+});
+export async function checkRateLimitAsync(limiter, key) {
+    // Explicit, environment-gated bypass for test harnesses. Production never
+    // sets this — Vercel + the deploy guide both omit it. We deliberately do
+    // NOT key off `NODE_ENV === 'test'` because Next.js builds run with
+    // NODE_ENV=test in some CI configurations and we want rate limiting
+    // exercised by unit tests that explicitly opt in.
+    if (process.env.PRENTA_DISABLE_RATE_LIMIT === '1') {
+        return true;
+    }
+    const result = await limiter.check(key);
+    return result.allowed;
+}
+/**
+ * Resolve the client IP from trusted-proxy headers (Vercel first, then x-real-ip,
+ * then x-forwarded-for only when PRENTA_TRUST_PROXY=1). Returns 'unknown' when
+ * no trustworthy source is available — callers MUST treat that case as a hard
+ * failure for security-sensitive decisions like rate-limit keys and IP allowlists.
+ */
+export function clientIp(request) {
+    return getClientIp(request);
+}
+/**
+ * Compute a before/after diff of top-level scalar (string/number/boolean) keys
+ * between a stored record and an incoming patch. Used to audit settings changes
+ * without ever logging nested objects (which may hold secret blobs).
+ */
+export function diffScalarKeys(previous, next) {
+    const isScalar = (v) => typeof v === 'string' || typeof v === 'number' || typeof v === 'boolean' || v === null;
+    const changes = [];
+    for (const key of Object.keys(next)) {
+        const to = next[key];
+        if (!isScalar(to))
+            continue;
+        const from = previous[key];
+        if (isScalar(from) && from === to)
+            continue;
+        if (!isScalar(from) && from !== undefined)
+            continue;
+        changes.push({ key, from: isScalar(from) ? from : undefined, to });
+    }
+    return changes;
+}
+const MAX_CONCURRENT_SESSIONS = 5;
+/**
+ * After a successful primary-credential check, prune the user's active sessions
+ * down to the configured concurrent maximum (default 5; configurable via
+ * `auth.maxConcurrentSessions`). Strategy is "revoke oldest" so a user can
+ * always sign in.
+ */
+export async function enforceSessionLimitsForUser(d, userId) {
+    if (!hasModel(d, 'session'))
+        return;
+    // Precedence: explicitly-saved Security setting (database) ▸ auth config ▸
+    // default. We read the stored value directly (rather than the parsed
+    // defaults) so an unsaved policy doesn't shadow a config-provided override.
+    let storedMax;
+    try {
+        if (hasModel(d, 'document')) {
+            const row = await d.document.findFirst({
+                where: { collection: 'settings', deletedAt: null },
+                select: { data: true },
+            });
+            const stored = row?.data?.security;
+            const v = stored?.session?.maxConcurrentSessions;
+            if (typeof v === 'number' && Number.isInteger(v) && v >= 0)
+                storedMax = v;
+        }
+    }
+    catch {
+        /* fall back to config/default below */
+    }
+    const auth = getPrentaConfig()?.auth;
+    const max = storedMax !== undefined
+        ? storedMax
+        : typeof auth?.maxConcurrentSessions === 'number' && auth.maxConcurrentSessions > 0
+            ? auth.maxConcurrentSessions
+            : MAX_CONCURRENT_SESSIONS;
+    // 0 ⇒ unlimited: skip pruning entirely.
+    if (max <= 0)
+        return;
+    const active = await d.session.findMany({
+        where: { userId, revokedAt: null, expiresAt: { gt: new Date() } },
+        select: { id: true, createdAt: true },
+    });
+    const decision = enforceSessionLimits(active.map((s) => ({ sessionId: s.id, userId, createdAt: s.createdAt })), { maxConcurrentSessions: max, strategy: 'revoke_oldest' });
+    if (decision.sessionsToRevoke.length > 0) {
+        await d.session.updateMany({
+            where: { id: { in: decision.sessionsToRevoke } },
+            data: { revokedAt: new Date() },
+        });
+    }
+}
+/** Revoke every live API key for a user. Called with session revocation. */
+export async function revokeUserApiKeys(d, userId) {
+    if (!hasModel(d, 'apiKey'))
+        return 0;
+    const result = await d.apiKey.updateMany({
+        where: { userId, revokedAt: null },
+        data: { revokedAt: new Date() },
+    });
+    return typeof result?.count === 'number' ? result.count : 0;
+}
+export function getAdminPath() {
+    return process.env.PRENTA_ADMIN_PATH ?? getPrentaConfig()?.admin?.path ?? '/admin';
+}
+/**
+ * Gate a per-document read for endpoints (e.g. SEO analysis) that fetch a
+ * document directly rather than through the collection CRUD routes. Enforces
+ * both the API-key collection scope and the collection's `access.read` rule
+ * so an AUTHOR scoped to one collection cannot read another's content.
+ * Returns a `Response` to short-circuit with, or `null` when allowed.
+ */
+export async function enforceDocumentReadAccess(session, collection) {
+    const scopeErr = requireCollectionScope(session, collection, 'read');
+    if (scopeErr)
+        return scopeErr;
+    try {
+        await assertCollectionAccess(collection, 'read', buildActionContext(session, guardedDb()));
+    }
+    catch (err) {
+        if (err instanceof Error && err.message.includes('Access denied')) {
+            return errorResponse('Insufficient permissions', 403);
+        }
+        throw err;
+    }
+    return null;
+}
+//# sourceMappingURL=auth.js.map