@shipfox/api-auth 18.0.0 → 20.0.0

package/dist/presentation/routes/administration.js

@@ -1,12 +1,12 @@
 import { randomUUID } from 'node:crypto';
 import { AUTH_USER, adoptAdministrationActorGuard, requireAdministrationActor } from '@shipfox/api-auth-context';
-import { adminBootstrapStateSchema, administratorUserLookupQuerySchema, administratorUserMutationResponseSchema, administratorUserSummarySchema, bootstrapAdminOwnerBodySchema, bootstrapAdminOwnerResponseSchema, grantAdminRoleBodySchema, grantAdminRoleResponseSchema, impersonateResponseSchema, impersonateUserBodySchema, listAdminGrantsQuerySchema, listAdminGrantsResponseSchema, reactivateAdministratorUserBodySchema, revokeAdminGrantBodySchema, revokeAdminGrantResponseSchema, revokeAdministratorUserSessionsBodySchema, revokeAdministratorUserSessionsResponseSchema, suspendAdministratorUserBodySchema } from '@shipfox/api-auth-dto';
+import { adminBootstrapStateSchema, administratorUserDirectoryQuerySchema, administratorUserDirectoryResponseSchema, administratorUserLookupQuerySchema, administratorUserMutationResponseSchema, administratorUserSummarySchema, bootstrapAdminOwnerBodySchema, bootstrapAdminOwnerResponseSchema, grantAdminRoleBodySchema, grantAdminRoleResponseSchema, impersonateResponseSchema, impersonateUserBodySchema, listAdminGrantsQuerySchema, listAdminGrantsResponseSchema, reactivateAdministratorUserBodySchema, revokeAdminGrantBodySchema, revokeAdminGrantResponseSchema, revokeAdministratorUserSessionsBodySchema, revokeAdministratorUserSessionsResponseSchema, suspendAdministratorUserBodySchema } from '@shipfox/api-auth-dto';
 import { decodeTimestampIdCursor, encodeTimestampIdCursor } from '@shipfox/node-drizzle';
 import { ClientError, defineRoute } from '@shipfox/node-fastify';
 import { z } from 'zod';
 import { requireAdminRole } from '#core/admin-role.js';
-import { bootstrapFirstAdminOwner, findAdministratorUserSummary, getAdminBootstrapState, grantAdministratorRole, impersonateUser, listAdministratorGrantSummaries, reactivateAdministratorUser, revokeAdministratorGrant, revokeAdministratorUserSessions, suspendAdministratorUser } from '#core/administration.js';
-import { AdminBootstrapClosedError, AdminGrantAlreadyExistsError, AdminGrantNotFoundError, AdminIdempotencyKeyReuseError, AdminRoleRequiredError, CannotImpersonateAdministratorError, CannotImpersonateSelfError, EmailNotVerifiedError, ImpersonationDisabledError, ImpersonationExpiredError, ImpersonationTargetNotActiveError, InvalidAdminBootstrapTokenError, InvalidCredentialsError, LastAdminOwnerError, UserNotFoundError } from '#core/errors.js';
+import { bootstrapFirstAdminOwner, findAdministratorUserSummary, getAdminBootstrapState, grantAdministratorRole, impersonateUser, listAdministratorGrantSummaries, listAdministratorUsers, reactivateAdministratorUser, revokeAdministratorGrant, revokeAdministratorUserSessions, suspendAdministratorUser } from '#core/administration.js';
+import { AdminBootstrapClosedError, AdminGrantAlreadyExistsError, AdminGrantNotFoundError, AdminIdempotencyKeyReuseError, AdminRoleRequiredError, CannotImpersonateAdministratorError, CannotImpersonateSelfError, EmailNotVerifiedError, ImpersonationDisabledError, ImpersonationExpiredError, ImpersonationTargetNotActiveError, InvalidAdminBootstrapTokenError, InvalidAdministratorUserDirectoryFilterError, InvalidCredentialsError, LastAdminOwnerError, UserNotFoundError } from '#core/errors.js';
 import { getClientContext } from '#presentation/auth/jwt-auth.js';
 import { toUserDto } from '#presentation/dto/user.js';
 import { createAuthActorRateLimitPreHandler, createAuthIpRateLimitPreHandler } from './rate-limit.js';
@@ -72,7 +72,50 @@ function toAdministratorUserMutationDto(result) {
         correlation_id: result.correlationId
     };
 }
+function directoryResultCountBucket(count) {
+    if (count === 0) return '0';
+    if (count <= 10) return '1-10';
+    if (count <= 50) return '11-50';
+    return '51-100';
+}
+function logAdministratorUserDirectoryRead(params) {
+    try {
+        params.request.log.info({
+            actorId: params.actorId,
+            requiredRole: 'admin-observer',
+            targetType: 'user-directory',
+            requestId: params.request.id,
+            result: params.outcome,
+            outcome: params.outcome,
+            durationMs: params.durationMs,
+            resultCountBucket: directoryResultCountBucket(params.resultCount),
+            filterPresence: params.filterPresence,
+            nextPagePresent: params.nextPagePresent
+        }, 'Listed administrator user directory');
+    } catch  {
+    // Logging must not change the directory read outcome.
+    }
+}
+function translateImpersonationEligibilityError(error) {
+    // The mint primitive re-checks login eligibility on the row it reads, and a
+    // concurrent suspension or unverification between the in-transaction ladder
+    // read and that read surfaces these errors. Map them to the same documented
+    // client error instead of a generic 500.
+    if (error instanceof EmailNotVerifiedError || error instanceof InvalidCredentialsError) {
+        return new ClientError('User cannot be impersonated', 'impersonation-target-not-active', {
+            status: 403
+        });
+    }
+    if (error instanceof ImpersonationExpiredError) {
+        return new ClientError('Impersonation session has expired', 'impersonation-expired', {
+            status: 410
+        });
+    }
+    return undefined;
+}
 function translateAdministrationError(error) {
+    const impersonationEligibilityError = translateImpersonationEligibilityError(error);
+    if (impersonationEligibilityError) throw impersonationEligibilityError;
     if (error instanceof AdminRoleRequiredError) {
         throw new ClientError('Administrator role required', 'forbidden', {
             status: 403,
@@ -81,6 +124,11 @@ function translateAdministrationError(error) {
             }
         });
     }
+    if (error instanceof InvalidAdministratorUserDirectoryFilterError) {
+        throw new ClientError(error.message, 'validation-error', {
+            status: 400
+        });
+    }
     if (error instanceof InvalidAdminBootstrapTokenError) {
         throw new ClientError('Bootstrap token is invalid', 'bootstrap-token-invalid', {
             status: 403
@@ -136,20 +184,6 @@ function translateAdministrationError(error) {
             status: 403
         });
     }
-    // The mint primitive re-checks login eligibility (active, verified) on the
-    // row it reads, and a concurrent suspension or unverification between the
-    // in-transaction ladder read and that read surfaces these errors. Map them
-    // to the same documented client error instead of a generic 500.
-    if (error instanceof EmailNotVerifiedError || error instanceof InvalidCredentialsError) {
-        throw new ClientError('User cannot be impersonated', 'impersonation-target-not-active', {
-            status: 403
-        });
-    }
-    if (error instanceof ImpersonationExpiredError) {
-        throw new ClientError('Impersonation session has expired', 'impersonation-expired', {
-            status: 410
-        });
-    }
     throw error;
 }
 const bootstrapRoute = defineRoute({
@@ -242,17 +276,85 @@ const userLookupRoute = defineRoute({
         const { id, user_id: userId, email } = request.query;
         const lookupId = id ?? userId;
         const actorId = requireActorId(request);
-        const user = lookupId ? await findAdministratorUserSummary({
+        let user;
+        if (lookupId) user = await findAdministratorUserSummary({
             actorId,
             id: lookupId
-        }) : email ? await findAdministratorUserSummary({
+        });
+        else if (email) user = await findAdministratorUserSummary({
             actorId,
             email
-        }) : undefined;
+        });
         if (!user) throw new UserNotFoundError(lookupId ?? email ?? 'unknown');
         return toAdministratorUserSummaryDto(user);
     }
 });
+const userDirectoryRoute = defineRoute({
+    method: 'GET',
+    path: '/directory',
+    description: 'List bounded administrator-safe user summaries for directory browsing.',
+    schema: {
+        querystring: administratorUserDirectoryQuerySchema,
+        response: {
+            200: administratorUserDirectoryResponseSchema
+        }
+    },
+    preHandler: createAuthActorRateLimitPreHandler('directory'),
+    errorHandler: translateAdministrationError,
+    handler: async (request)=>{
+        const actorId = requireActorId(request);
+        const startedAt = performance.now();
+        const { search, status, impersonation_eligible: impersonationEligible, limit, cursor } = request.query;
+        let resultCount = 0;
+        let nextPagePresent = false;
+        let outcome = 'failed';
+        try {
+            const decodedCursor = decodeTimestampIdCursor(cursor);
+            if (cursor && !decodedCursor) {
+                throw new ClientError('Invalid cursor', 'invalid-cursor', {
+                    status: 400
+                });
+            }
+            const result = await listAdministratorUsers({
+                actorId,
+                limit,
+                ...decodedCursor ? {
+                    cursor: decodedCursor
+                } : {},
+                ...search !== undefined ? {
+                    search
+                } : {},
+                ...status !== undefined ? {
+                    status
+                } : {},
+                ...impersonationEligible !== undefined ? {
+                    eligible: impersonationEligible
+                } : {}
+            });
+            resultCount = result.users.length;
+            nextPagePresent = result.nextCursor !== null;
+            outcome = 'succeeded';
+            return {
+                users: result.users.map(toAdministratorUserSummaryDto),
+                next_cursor: result.nextCursor ? encodeTimestampIdCursor(result.nextCursor) : null
+            };
+        } finally{
+            logAdministratorUserDirectoryRead({
+                request,
+                actorId,
+                outcome,
+                durationMs: Math.round(performance.now() - startedAt),
+                resultCount,
+                filterPresence: {
+                    search: search !== undefined,
+                    status: status !== undefined,
+                    impersonationEligible: impersonationEligible !== undefined
+                },
+                nextPagePresent
+            });
+        }
+    }
+});
 const suspendUserRoute = defineRoute({
     method: 'POST',
     path: '/:userId/suspend',
@@ -465,6 +567,7 @@ export function createAdministrationUserRoutes(workspaces) {
             prefix: '/admin/auth/users',
             auth: AUTH_USER,
             routes: [
+                userDirectoryRoute,
                 userLookupRoute,
                 suspendUserRoute,
                 reactivateUserRoute,

package/dist/presentation/routes/administration.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/presentation/routes/administration.ts"],"sourcesContent":["import {randomUUID} from 'node:crypto';\nimport {\n  AUTH_USER,\n  adoptAdministrationActorGuard,\n  requireAdministrationActor,\n} from '@shipfox/api-auth-context';\nimport {\n  adminBootstrapStateSchema,\n  administratorUserLookupQuerySchema,\n  administratorUserMutationResponseSchema,\n  administratorUserSummarySchema,\n  bootstrapAdminOwnerBodySchema,\n  bootstrapAdminOwnerResponseSchema,\n  grantAdminRoleBodySchema,\n  grantAdminRoleResponseSchema,\n  impersonateResponseSchema,\n  impersonateUserBodySchema,\n  listAdminGrantsQuerySchema,\n  listAdminGrantsResponseSchema,\n  reactivateAdministratorUserBodySchema,\n  revokeAdminGrantBodySchema,\n  revokeAdminGrantResponseSchema,\n  revokeAdministratorUserSessionsBodySchema,\n  revokeAdministratorUserSessionsResponseSchema,\n  suspendAdministratorUserBodySchema,\n} from '@shipfox/api-auth-dto';\nimport type {WorkspacesInterModuleClient} from '@shipfox/api-workspaces-dto/inter-module';\nimport {decodeTimestampIdCursor, encodeTimestampIdCursor} from '@shipfox/node-drizzle';\nimport {ClientError, defineRoute, type RouteGroup} from '@shipfox/node-fastify';\nimport type {FastifyRequest} from 'fastify';\nimport {z} from 'zod';\nimport {requireAdminRole} from '#core/admin-role.js';\nimport {\n  bootstrapFirstAdminOwner,\n  findAdministratorUserSummary,\n  getAdminBootstrapState,\n  grantAdministratorRole,\n  impersonateUser,\n  listAdministratorGrantSummaries,\n  reactivateAdministratorUser,\n  revokeAdministratorGrant,\n  revokeAdministratorUserSessions,\n  suspendAdministratorUser,\n} from '#core/administration.js';\nimport type {AdminGrant} from '#core/entities/admin-grant.js';\nimport type {\n  AdministratorGrantSummary,\n  AdministratorUserSummary,\n} from '#core/entities/administrator-read-model.js';\nimport {\n  AdminBootstrapClosedError,\n  AdminGrantAlreadyExistsError,\n  AdminGrantNotFoundError,\n  AdminIdempotencyKeyReuseError,\n  AdminRoleRequiredError,\n  CannotImpersonateAdministratorError,\n  CannotImpersonateSelfError,\n  EmailNotVerifiedError,\n  ImpersonationDisabledError,\n  ImpersonationExpiredError,\n  ImpersonationTargetNotActiveError,\n  InvalidAdminBootstrapTokenError,\n  InvalidCredentialsError,\n  LastAdminOwnerError,\n  UserNotFoundError,\n} from '#core/errors.js';\nimport {getClientContext} from '#presentation/auth/jwt-auth.js';\nimport {toUserDto} from '#presentation/dto/user.js';\nimport {createAuthActorRateLimitPreHandler, createAuthIpRateLimitPreHandler} from './rate-limit.js';\n\nconst idempotencyKeyMaxLength = 256;\n\nfunction requireActorId(request: FastifyRequest): string {\n  const client = getClientContext(request);\n  if (!client) {\n    throw new ClientError('Authentication required', 'unauthorized', {status: 401});\n  }\n  return client.userId;\n}\n\nfunction requireIdempotencyKey(request: FastifyRequest): string {\n  const value = request.headers['idempotency-key'];\n  const key = Array.isArray(value) ? value[0] : value;\n  if (!key || key.trim().length === 0 || key.length > idempotencyKeyMaxLength) {\n    throw new ClientError('Idempotency-Key header is required', 'idempotency-key-required', {\n      status: 400,\n    });\n  }\n  return key;\n}\n\nasync function requireAdministratorObserver(request: FastifyRequest): Promise<void> {\n  await requireAdminRole({userId: requireActorId(request), minimumRole: 'admin-observer'});\n}\n\nfunction toAdminGrantDto(grant: AdminGrant) {\n  return {\n    id: grant.id,\n    user_id: grant.userId,\n    role: grant.role,\n    revoked_at: grant.revokedAt?.toISOString() ?? null,\n    created_at: grant.createdAt.toISOString(),\n    updated_at: grant.updatedAt.toISOString(),\n  };\n}\n\nfunction toAdministratorUserSummaryDto(user: AdministratorUserSummary) {\n  return {\n    id: user.id,\n    email: user.email,\n    name: user.name,\n    status: user.status,\n    email_verified_at: user.emailVerifiedAt?.toISOString() ?? null,\n    created_at: user.createdAt.toISOString(),\n    admin_role: user.adminRole,\n  };\n}\n\nfunction toAdministratorGrantSummaryDto(grant: AdministratorGrantSummary) {\n  return {\n    grant_id: grant.grantId,\n    role: grant.role,\n    created_at: grant.createdAt.toISOString(),\n    revoked_at: grant.revokedAt?.toISOString() ?? null,\n    user: grant.user,\n  };\n}\n\nfunction toAdministratorUserMutationDto(result: {\n  user: AdministratorUserSummary;\n  correlationId: string;\n}) {\n  return {\n    ...toAdministratorUserSummaryDto(result.user),\n    correlation_id: result.correlationId,\n  };\n}\n\nfunction translateAdministrationError(error: unknown): never {\n  if (error instanceof AdminRoleRequiredError) {\n    throw new ClientError('Administrator role required', 'forbidden', {\n      status: 403,\n      details: {required_role: error.minimumRole},\n    });\n  }\n  if (error instanceof InvalidAdminBootstrapTokenError) {\n    throw new ClientError('Bootstrap token is invalid', 'bootstrap-token-invalid', {\n      status: 403,\n    });\n  }\n  if (error instanceof AdminBootstrapClosedError) {\n    throw new ClientError('First administrator owner already exists', 'bootstrap-closed', {\n      status: 409,\n    });\n  }\n  if (error instanceof AdminGrantAlreadyExistsError) {\n    throw new ClientError('Administrator grant already exists', 'grant-already-exists', {\n      status: 409,\n    });\n  }\n  if (error instanceof AdminGrantNotFoundError) {\n    throw new ClientError('Administrator grant not found', 'not-found', {status: 404});\n  }\n  if (error instanceof UserNotFoundError) {\n    throw new ClientError('User not found', 'not-found', {status: 404});\n  }\n  if (error instanceof LastAdminOwnerError) {\n    throw new ClientError('Cannot remove the final active administrator owner', 'last-owner', {\n      status: 409,\n    });\n  }\n  if (error instanceof AdminIdempotencyKeyReuseError) {\n    throw new ClientError(\n      'Idempotency-Key was already used for a different command',\n      'idempotency-key-reused',\n      {status: 409},\n    );\n  }\n  if (error instanceof ImpersonationDisabledError) {\n    throw new ClientError('Impersonation is disabled', 'impersonation-disabled', {status: 403});\n  }\n  if (error instanceof CannotImpersonateSelfError) {\n    throw new ClientError('Cannot impersonate yourself', 'cannot-impersonate-self', {\n      status: 403,\n    });\n  }\n  if (error instanceof CannotImpersonateAdministratorError) {\n    throw new ClientError(\n      'Cannot impersonate an administrator',\n      'cannot-impersonate-administrator',\n      {status: 403},\n    );\n  }\n  if (error instanceof ImpersonationTargetNotActiveError) {\n    throw new ClientError('User cannot be impersonated', 'impersonation-target-not-active', {\n      status: 403,\n    });\n  }\n  // The mint primitive re-checks login eligibility (active, verified) on the\n  // row it reads, and a concurrent suspension or unverification between the\n  // in-transaction ladder read and that read surfaces these errors. Map them\n  // to the same documented client error instead of a generic 500.\n  if (error instanceof EmailNotVerifiedError || error instanceof InvalidCredentialsError) {\n    throw new ClientError('User cannot be impersonated', 'impersonation-target-not-active', {\n      status: 403,\n    });\n  }\n  if (error instanceof ImpersonationExpiredError) {\n    throw new ClientError('Impersonation session has expired', 'impersonation-expired', {\n      status: 410,\n    });\n  }\n  throw error;\n}\n\nconst bootstrapRoute = defineRoute({\n  method: 'POST',\n  path: '/bootstrap',\n  description: 'Claim the first administrator owner role with the deployment bootstrap token.',\n  schema: {\n    body: bootstrapAdminOwnerBodySchema,\n    response: {201: bootstrapAdminOwnerResponseSchema},\n  },\n  preHandler: createAuthIpRateLimitPreHandler('bootstrap'),\n  errorHandler: translateAdministrationError,\n  handler: async (request, reply) => {\n    const actorId = requireActorId(request);\n    const grant = await bootstrapFirstAdminOwner({\n      actorId,\n      bootstrapToken: request.body.bootstrap_token,\n      idempotencyKey: requireIdempotencyKey(request),\n      correlationId: request.id,\n    });\n    reply.code(201);\n    return toAdminGrantDto(grant);\n  },\n});\n\nconst bootstrapStateRoute = defineRoute({\n  method: 'GET',\n  path: '/bootstrap-state',\n  description: 'Read whether first administrator owner bootstrap is available.',\n  schema: {response: {200: adminBootstrapStateSchema}},\n  preHandler: createAuthIpRateLimitPreHandler('bootstrap-state'),\n  errorHandler: translateAdministrationError,\n  handler: async () => ({state: await getAdminBootstrapState()}),\n});\n\nconst listRoute = defineRoute({\n  method: 'GET',\n  path: '/',\n  description: 'List bounded local administrator grant summaries.',\n  schema: {\n    querystring: listAdminGrantsQuerySchema,\n    response: {200: listAdminGrantsResponseSchema},\n  },\n  errorHandler: translateAdministrationError,\n  handler: async (request) => {\n    const {limit, cursor} = request.query;\n    const decodedCursor = decodeTimestampIdCursor(cursor);\n    if (cursor && !decodedCursor) {\n      throw new ClientError('Invalid cursor', 'invalid-cursor', {status: 400});\n    }\n\n    const result = await listAdministratorGrantSummaries({\n      actorId: requireActorId(request),\n      limit,\n      ...(decodedCursor ? {cursor: decodedCursor} : {}),\n    });\n    return {\n      grants: result.grants.map(toAdministratorGrantSummaryDto),\n      next_cursor: result.nextCursor ? encodeTimestampIdCursor(result.nextCursor) : null,\n    };\n  },\n});\n\nconst userLookupRoute = defineRoute({\n  method: 'GET',\n  path: '/',\n  description: 'Find one administrator-safe user summary by exact ID or email.',\n  schema: {\n    querystring: administratorUserLookupQuerySchema,\n    response: {200: administratorUserSummarySchema},\n  },\n  preHandler: [requireAdministratorObserver, createAuthIpRateLimitPreHandler('lookup')],\n  errorHandler: translateAdministrationError,\n  handler: async (request) => {\n    const {id, user_id: userId, email} = request.query;\n    const lookupId = id ?? userId;\n    const actorId = requireActorId(request);\n    const user = lookupId\n      ? await findAdministratorUserSummary({actorId, id: lookupId})\n      : email\n        ? await findAdministratorUserSummary({actorId, email})\n        : undefined;\n    if (!user) throw new UserNotFoundError(lookupId ?? email ?? 'unknown');\n    return toAdministratorUserSummaryDto(user);\n  },\n});\n\nconst suspendUserRoute = defineRoute({\n  method: 'POST',\n  path: '/:userId/suspend',\n  description: 'Suspend a user and revoke all of its active sessions.',\n  schema: {\n    params: z.object({userId: z.string().uuid()}),\n    body: suspendAdministratorUserBodySchema,\n    response: {200: administratorUserMutationResponseSchema},\n  },\n  errorHandler: translateAdministrationError,\n  handler: async (request) => {\n    const result = await suspendAdministratorUser({\n      actorId: requireActorId(request),\n      userId: request.params.userId,\n      reason: request.body.reason,\n      idempotencyKey: requireIdempotencyKey(request),\n      correlationId: request.id,\n    });\n    return toAdministratorUserMutationDto(result);\n  },\n});\n\nconst reactivateUserRoute = defineRoute({\n  method: 'POST',\n  path: '/:userId/reactivate',\n  description: 'Reactivate a suspended user without restoring revoked sessions.',\n  schema: {\n    params: z.object({userId: z.string().uuid()}),\n    body: reactivateAdministratorUserBodySchema,\n    response: {200: administratorUserMutationResponseSchema},\n  },\n  errorHandler: translateAdministrationError,\n  handler: async (request) => {\n    const result = await reactivateAdministratorUser({\n      actorId: requireActorId(request),\n      userId: request.params.userId,\n      ...(request.body.reason ? {reason: request.body.reason} : {}),\n      idempotencyKey: requireIdempotencyKey(request),\n      correlationId: request.id,\n    });\n    return toAdministratorUserMutationDto(result);\n  },\n});\n\nconst revokeUserSessionsRoute = defineRoute({\n  method: 'POST',\n  path: '/:userId/revoke-sessions',\n  description: 'Revoke all active sessions for a user without changing account status.',\n  schema: {\n    params: z.object({userId: z.string().uuid()}),\n    body: revokeAdministratorUserSessionsBodySchema,\n    response: {200: revokeAdministratorUserSessionsResponseSchema},\n  },\n  errorHandler: translateAdministrationError,\n  handler: async (request) => {\n    const result = await revokeAdministratorUserSessions({\n      actorId: requireActorId(request),\n      userId: request.params.userId,\n      ...(request.body.reason ? {reason: request.body.reason} : {}),\n      idempotencyKey: requireIdempotencyKey(request),\n      correlationId: request.id,\n    });\n    return {\n      ...toAdministratorUserMutationDto(result),\n      sessions_revoked: result.sessionsRevoked,\n    };\n  },\n});\n\nconst grantRoute = defineRoute({\n  method: 'POST',\n  path: '/',\n  description: 'Grant a local administrator role to an active user.',\n  schema: {\n    body: grantAdminRoleBodySchema,\n    response: {201: grantAdminRoleResponseSchema},\n  },\n  errorHandler: translateAdministrationError,\n  handler: async (request, reply) => {\n    const actorId = requireActorId(request);\n    const grant = await grantAdministratorRole({\n      actorId,\n      userId: request.body.user_id,\n      role: request.body.role,\n      reason: request.body.reason,\n      idempotencyKey: requireIdempotencyKey(request),\n      correlationId: request.id,\n    });\n    reply.code(201);\n    return toAdminGrantDto(grant);\n  },\n});\n\nconst revokeRoute = defineRoute({\n  method: 'DELETE',\n  path: '/:grantId',\n  description: 'Revoke a local administrator grant.',\n  schema: {\n    params: z.object({grantId: z.string().uuid()}),\n    body: revokeAdminGrantBodySchema,\n    response: {200: revokeAdminGrantResponseSchema},\n  },\n  errorHandler: translateAdministrationError,\n  handler: async (request) => {\n    const grant = await revokeAdministratorGrant({\n      actorId: requireActorId(request),\n      grantId: request.params.grantId,\n      reason: request.body.reason,\n      idempotencyKey: requireIdempotencyKey(request),\n      correlationId: request.id,\n    });\n    return toAdminGrantDto(grant);\n  },\n});\n\nexport const administrationRoutes: RouteGroup = adoptAdministrationActorGuard({\n  prefix: '/admin/auth/admin-grants',\n  auth: AUTH_USER,\n  routes: [bootstrapRoute, listRoute, grantRoute, revokeRoute],\n});\n\nexport const administrationBootstrapRoutes: RouteGroup = adoptAdministrationActorGuard({\n  prefix: '/admin/auth',\n  auth: AUTH_USER,\n  routes: [bootstrapStateRoute],\n});\n\nfunction createImpersonateUserRoute(workspaces: WorkspacesInterModuleClient) {\n  return defineRoute({\n    method: 'POST',\n    path: '/:userId/impersonate',\n    description:\n      'Mint a short-lived, marked, audited impersonated session for an active, verified, non-administrator user.',\n    schema: {\n      params: z.object({userId: z.string().uuid()}),\n      body: impersonateUserBodySchema,\n      response: {200: impersonateResponseSchema},\n    },\n    // The limiter runs ahead of the impersonated-session rejection: a request\n    // carrying an already-issued impersonated token must consume the\n    // `impersonate` IP and actor buckets instead of being rejected by the\n    // guard first, or marked-session probes would bypass the limiter entirely.\n    // The guard still runs before the authorization inside the command.\n    preHandler: [\n      createAuthActorRateLimitPreHandler('impersonate'),\n      (request) => {\n        requireAdministrationActor(request);\n        return undefined;\n      },\n    ],\n    errorHandler: translateAdministrationError,\n    handler: async (request) => {\n      const client = getClientContext(request);\n      const result = await impersonateUser({\n        actorId: requireActorId(request),\n        ...(client?.impersonatorId ? {actorImpersonatorId: client.impersonatorId} : {}),\n        targetUserId: request.params.userId,\n        reason: request.body.reason,\n        idempotencyKey: requireIdempotencyKey(request),\n        // Fastify's default request IDs are process-local counters that reset\n        // after a redeploy, so a replay could collide with an earlier mint's\n        // ID and suppress the required failure event in the ambiguous-COMMIT\n        // reconciliation. The correlation is a fresh process-independent UUID\n        // per invocation.\n        correlationId: randomUUID(),\n        workspaces,\n      });\n      // `server_time` is the issuer's clock at response time: the banner\n      // derives its countdown and Extend availability from this anchor.\n      return {\n        token: result.token,\n        expires_at: result.expiresAt.toISOString(),\n        server_time: new Date().toISOString(),\n        impersonator_id: result.impersonatorId,\n        user: toUserDto(result.user),\n      };\n    },\n  });\n}\n\nexport function createAdministrationUserRoutes(\n  workspaces: WorkspacesInterModuleClient,\n): RouteGroup[] {\n  return [\n    adoptAdministrationActorGuard({\n      prefix: '/admin/auth/users',\n      auth: AUTH_USER,\n      routes: [userLookupRoute, suspendUserRoute, reactivateUserRoute, revokeUserSessionsRoute],\n    }),\n    // The impersonate route mounts outside the adopted guard on purpose: its\n    // limiter must run before the impersonated-session rejection (see\n    // `createImpersonateUserRoute`), so the guard is applied positionally\n    // there. Every other route under `/admin/auth/users` keeps the adoption.\n    {\n      prefix: '/admin/auth/users',\n      auth: AUTH_USER,\n      routes: [createImpersonateUserRoute(workspaces)],\n    },\n  ];\n}\n"],"names":["randomUUID","AUTH_USER","adoptAdministrationActorGuard","requireAdministrationActor","adminBootstrapStateSchema","administratorUserLookupQuerySchema","administratorUserMutationResponseSchema","administratorUserSummarySchema","bootstrapAdminOwnerBodySchema","bootstrapAdminOwnerResponseSchema","grantAdminRoleBodySchema","grantAdminRoleResponseSchema","impersonateResponseSchema","impersonateUserBodySchema","listAdminGrantsQuerySchema","listAdminGrantsResponseSchema","reactivateAdministratorUserBodySchema","revokeAdminGrantBodySchema","revokeAdminGrantResponseSchema","revokeAdministratorUserSessionsBodySchema","revokeAdministratorUserSessionsResponseSchema","suspendAdministratorUserBodySchema","decodeTimestampIdCursor","encodeTimestampIdCursor","ClientError","defineRoute","z","requireAdminRole","bootstrapFirstAdminOwner","findAdministratorUserSummary","getAdminBootstrapState","grantAdministratorRole","impersonateUser","listAdministratorGrantSummaries","reactivateAdministratorUser","revokeAdministratorGrant","revokeAdministratorUserSessions","suspendAdministratorUser","AdminBootstrapClosedError","AdminGrantAlreadyExistsError","AdminGrantNotFoundError","AdminIdempotencyKeyReuseError","AdminRoleRequiredError","CannotImpersonateAdministratorError","CannotImpersonateSelfError","EmailNotVerifiedError","ImpersonationDisabledError","ImpersonationExpiredError","ImpersonationTargetNotActiveError","InvalidAdminBootstrapTokenError","InvalidCredentialsError","LastAdminOwnerError","UserNotFoundError","getClientContext","toUserDto","createAuthActorRateLimitPreHandler","createAuthIpRateLimitPreHandler","idempotencyKeyMaxLength","requireActorId","request","client","status","userId","requireIdempotencyKey","value","headers","key","Array","isArray","trim","length","requireAdministratorObserver","minimumRole","toAdminGrantDto","grant","id","user_id","role","revoked_at","revokedAt","toISOString","created_at","createdAt","updated_at","updatedAt","toAdministratorUserSummaryDto","user","email","name","email_verified_at","emailVerifiedAt","admin_role","adminRole","toAdministratorGrantSummaryDto","grant_id","grantId","toAdministratorUserMutationDto","result","correlation_id","correlationId","translateAdministrationError","error","details","required_role","bootstrapRoute","method","path","description","schema","body","response","preHandler","errorHandler","handler","reply","actorId","bootstrapToken","bootstrap_token","idempotencyKey","code","bootstrapStateRoute","state","listRoute","querystring","limit","cursor","query","decodedCursor","grants","map","next_cursor","nextCursor","userLookupRoute","lookupId","undefined","suspendUserRoute","params","object","string","uuid","reason","reactivateUserRoute","revokeUserSessionsRoute","sessions_revoked","sessionsRevoked","grantRoute","revokeRoute","administrationRoutes","prefix","auth","routes","administrationBootstrapRoutes","createImpersonateUserRoute","workspaces","impersonatorId","actorImpersonatorId","targetUserId","token","expires_at","expiresAt","server_time","Date","impersonator_id","createAdministrationUserRoutes"],"mappings":"AAAA,SAAQA,UAAU,QAAO,cAAc;AACvC,SACEC,SAAS,EACTC,6BAA6B,EAC7BC,0BAA0B,QACrB,4BAA4B;AACnC,SACEC,yBAAyB,EACzBC,kCAAkC,EAClCC,uCAAuC,EACvCC,8BAA8B,EAC9BC,6BAA6B,EAC7BC,iCAAiC,EACjCC,wBAAwB,EACxBC,4BAA4B,EAC5BC,yBAAyB,EACzBC,yBAAyB,EACzBC,0BAA0B,EAC1BC,6BAA6B,EAC7BC,qCAAqC,EACrCC,0BAA0B,EAC1BC,8BAA8B,EAC9BC,yCAAyC,EACzCC,6CAA6C,EAC7CC,kCAAkC,QAC7B,wBAAwB;AAE/B,SAAQC,uBAAuB,EAAEC,uBAAuB,QAAO,wBAAwB;AACvF,SAAQC,WAAW,EAAEC,WAAW,QAAwB,wBAAwB;AAEhF,SAAQC,CAAC,QAAO,MAAM;AACtB,SAAQC,gBAAgB,QAAO,sBAAsB;AACrD,SACEC,wBAAwB,EACxBC,4BAA4B,EAC5BC,sBAAsB,EACtBC,sBAAsB,EACtBC,eAAe,EACfC,+BAA+B,EAC/BC,2BAA2B,EAC3BC,wBAAwB,EACxBC,+BAA+B,EAC/BC,wBAAwB,QACnB,0BAA0B;AAMjC,SACEC,yBAAyB,EACzBC,4BAA4B,EAC5BC,uBAAuB,EACvBC,6BAA6B,EAC7BC,sBAAsB,EACtBC,mCAAmC,EACnCC,0BAA0B,EAC1BC,qBAAqB,EACrBC,0BAA0B,EAC1BC,yBAAyB,EACzBC,iCAAiC,EACjCC,+BAA+B,EAC/BC,uBAAuB,EACvBC,mBAAmB,EACnBC,iBAAiB,QACZ,kBAAkB;AACzB,SAAQC,gBAAgB,QAAO,iCAAiC;AAChE,SAAQC,SAAS,QAAO,4BAA4B;AACpD,SAAQC,kCAAkC,EAAEC,+BAA+B,QAAO,kBAAkB;AAEpG,MAAMC,0BAA0B;AAEhC,SAASC,eAAeC,OAAuB;IAC7C,MAAMC,SAASP,iBAAiBM;IAChC,IAAI,CAACC,QAAQ;QACX,MAAM,IAAIpC,YAAY,2BAA2B,gBAAgB;YAACqC,QAAQ;QAAG;IAC/E;IACA,OAAOD,OAAOE,MAAM;AACtB;AAEA,SAASC,sBAAsBJ,OAAuB;IACpD,MAAMK,QAAQL,QAAQM,OAAO,CAAC,kBAAkB;IAChD,MAAMC,MAAMC,MAAMC,OAAO,CAACJ,SAASA,KAAK,CAAC,EAAE,GAAGA;IAC9C,IAAI,CAACE,OAAOA,IAAIG,IAAI,GAAGC,MAAM,KAAK,KAAKJ,IAAII,MAAM,GAAGb,yBAAyB;QAC3E,MAAM,IAAIjC,YAAY,sCAAsC,4BAA4B;YACtFqC,QAAQ;QACV;IACF;IACA,OAAOK;AACT;AAEA,eAAeK,6BAA6BZ,OAAuB;IACjE,MAAMhC,iBAAiB;QAACmC,QAAQJ,eAAeC;QAAUa,aAAa;IAAgB;AACxF;AAEA,SAASC,gBAAgBC,KAAiB;IACxC,OAAO;QACLC,IAAID,MAAMC,EAAE;QACZC,SAASF,MAAMZ,MAAM;QACrBe,MAAMH,MAAMG,IAAI;QAChBC,YAAYJ,MAAMK,SAAS,EAAEC,iBAAiB;QAC9CC,YAAYP,MAAMQ,SAAS,CAACF,WAAW;QACvCG,YAAYT,MAAMU,SAAS,CAACJ,WAAW;IACzC;AACF;AAEA,SAASK,8BAA8BC,IAA8B;IACnE,OAAO;QACLX,IAAIW,KAAKX,EAAE;QACXY,OAAOD,KAAKC,KAAK;QACjBC,MAAMF,KAAKE,IAAI;QACf3B,QAAQyB,KAAKzB,MAAM;QACnB4B,mBAAmBH,KAAKI,eAAe,EAAEV,iBAAiB;QAC1DC,YAAYK,KAAKJ,SAAS,CAACF,WAAW;QACtCW,YAAYL,KAAKM,SAAS;IAC5B;AACF;AAEA,SAASC,+BAA+BnB,KAAgC;IACtE,OAAO;QACLoB,UAAUpB,MAAMqB,OAAO;QACvBlB,MAAMH,MAAMG,IAAI;QAChBI,YAAYP,MAAMQ,SAAS,CAACF,WAAW;QACvCF,YAAYJ,MAAMK,SAAS,EAAEC,iBAAiB;QAC9CM,MAAMZ,MAAMY,IAAI;IAClB;AACF;AAEA,SAASU,+BAA+BC,MAGvC;IACC,OAAO;QACL,GAAGZ,8BAA8BY,OAAOX,IAAI,CAAC;QAC7CY,gBAAgBD,OAAOE,aAAa;IACtC;AACF;AAEA,SAASC,6BAA6BC,KAAc;IAClD,IAAIA,iBAAiB3D,wBAAwB;QAC3C,MAAM,IAAIlB,YAAY,+BAA+B,aAAa;YAChEqC,QAAQ;YACRyC,SAAS;gBAACC,eAAeF,MAAM7B,WAAW;YAAA;QAC5C;IACF;IACA,IAAI6B,iBAAiBpD,iCAAiC;QACpD,MAAM,IAAIzB,YAAY,8BAA8B,2BAA2B;YAC7EqC,QAAQ;QACV;IACF;IACA,IAAIwC,iBAAiB/D,2BAA2B;QAC9C,MAAM,IAAId,YAAY,4CAA4C,oBAAoB;YACpFqC,QAAQ;QACV;IACF;IACA,IAAIwC,iBAAiB9D,8BAA8B;QACjD,MAAM,IAAIf,YAAY,sCAAsC,wBAAwB;YAClFqC,QAAQ;QACV;IACF;IACA,IAAIwC,iBAAiB7D,yBAAyB;QAC5C,MAAM,IAAIhB,YAAY,iCAAiC,aAAa;YAACqC,QAAQ;QAAG;IAClF;IACA,IAAIwC,iBAAiBjD,mBAAmB;QACtC,MAAM,IAAI5B,YAAY,kBAAkB,aAAa;YAACqC,QAAQ;QAAG;IACnE;IACA,IAAIwC,iBAAiBlD,qBAAqB;QACxC,MAAM,IAAI3B,YAAY,sDAAsD,cAAc;YACxFqC,QAAQ;QACV;IACF;IACA,IAAIwC,iBAAiB5D,+BAA+B;QAClD,MAAM,IAAIjB,YACR,4DACA,0BACA;YAACqC,QAAQ;QAAG;IAEhB;IACA,IAAIwC,iBAAiBvD,4BAA4B;QAC/C,MAAM,IAAItB,YAAY,6BAA6B,0BAA0B;YAACqC,QAAQ;QAAG;IAC3F;IACA,IAAIwC,iBAAiBzD,4BAA4B;QAC/C,MAAM,IAAIpB,YAAY,+BAA+B,2BAA2B;YAC9EqC,QAAQ;QACV;IACF;IACA,IAAIwC,iBAAiB1D,qCAAqC;QACxD,MAAM,IAAInB,YACR,uCACA,oCACA;YAACqC,QAAQ;QAAG;IAEhB;IACA,IAAIwC,iBAAiBrD,mCAAmC;QACtD,MAAM,IAAIxB,YAAY,+BAA+B,mCAAmC;YACtFqC,QAAQ;QACV;IACF;IACA,2EAA2E;IAC3E,0EAA0E;IAC1E,2EAA2E;IAC3E,gEAAgE;IAChE,IAAIwC,iBAAiBxD,yBAAyBwD,iBAAiBnD,yBAAyB;QACtF,MAAM,IAAI1B,YAAY,+BAA+B,mCAAmC;YACtFqC,QAAQ;QACV;IACF;IACA,IAAIwC,iBAAiBtD,2BAA2B;QAC9C,MAAM,IAAIvB,YAAY,qCAAqC,yBAAyB;YAClFqC,QAAQ;QACV;IACF;IACA,MAAMwC;AACR;AAEA,MAAMG,iBAAiB/E,YAAY;IACjCgF,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,QAAQ;QACNC,MAAMrG;QACNsG,UAAU;YAAC,KAAKrG;QAAiC;IACnD;IACAsG,YAAYvD,gCAAgC;IAC5CwD,cAAcZ;IACda,SAAS,OAAOtD,SAASuD;QACvB,MAAMC,UAAUzD,eAAeC;QAC/B,MAAMe,QAAQ,MAAM9C,yBAAyB;YAC3CuF;YACAC,gBAAgBzD,QAAQkD,IAAI,CAACQ,eAAe;YAC5CC,gBAAgBvD,sBAAsBJ;YACtCwC,eAAexC,QAAQgB,EAAE;QAC3B;QACAuC,MAAMK,IAAI,CAAC;QACX,OAAO9C,gBAAgBC;IACzB;AACF;AAEA,MAAM8C,sBAAsB/F,YAAY;IACtCgF,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,QAAQ;QAACE,UAAU;YAAC,KAAK1G;QAAyB;IAAC;IACnD2G,YAAYvD,gCAAgC;IAC5CwD,cAAcZ;IACda,SAAS,UAAa,CAAA;YAACQ,OAAO,MAAM3F;QAAwB,CAAA;AAC9D;AAEA,MAAM4F,YAAYjG,YAAY;IAC5BgF,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,QAAQ;QACNe,aAAa7G;QACbgG,UAAU;YAAC,KAAK/F;QAA6B;IAC/C;IACAiG,cAAcZ;IACda,SAAS,OAAOtD;QACd,MAAM,EAACiE,KAAK,EAAEC,MAAM,EAAC,GAAGlE,QAAQmE,KAAK;QACrC,MAAMC,gBAAgBzG,wBAAwBuG;QAC9C,IAAIA,UAAU,CAACE,eAAe;YAC5B,MAAM,IAAIvG,YAAY,kBAAkB,kBAAkB;gBAACqC,QAAQ;YAAG;QACxE;QAEA,MAAMoC,SAAS,MAAMhE,gCAAgC;YACnDkF,SAASzD,eAAeC;YACxBiE;YACA,GAAIG,gBAAgB;gBAACF,QAAQE;YAAa,IAAI,CAAC,CAAC;QAClD;QACA,OAAO;YACLC,QAAQ/B,OAAO+B,MAAM,CAACC,GAAG,CAACpC;YAC1BqC,aAAajC,OAAOkC,UAAU,GAAG5G,wBAAwB0E,OAAOkC,UAAU,IAAI;QAChF;IACF;AACF;AAEA,MAAMC,kBAAkB3G,YAAY;IAClCgF,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,QAAQ;QACNe,aAAatH;QACbyG,UAAU;YAAC,KAAKvG;QAA8B;IAChD;IACAwG,YAAY;QAACxC;QAA8Bf,gCAAgC;KAAU;IACrFwD,cAAcZ;IACda,SAAS,OAAOtD;QACd,MAAM,EAACgB,EAAE,EAAEC,SAASd,MAAM,EAAEyB,KAAK,EAAC,GAAG5B,QAAQmE,KAAK;QAClD,MAAMO,WAAW1D,MAAMb;QACvB,MAAMqD,UAAUzD,eAAeC;QAC/B,MAAM2B,OAAO+C,WACT,MAAMxG,6BAA6B;YAACsF;YAASxC,IAAI0D;QAAQ,KACzD9C,QACE,MAAM1D,6BAA6B;YAACsF;YAAS5B;QAAK,KAClD+C;QACN,IAAI,CAAChD,MAAM,MAAM,IAAIlC,kBAAkBiF,YAAY9C,SAAS;QAC5D,OAAOF,8BAA8BC;IACvC;AACF;AAEA,MAAMiD,mBAAmB9G,YAAY;IACnCgF,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,QAAQ;QACN4B,QAAQ9G,EAAE+G,MAAM,CAAC;YAAC3E,QAAQpC,EAAEgH,MAAM,GAAGC,IAAI;QAAE;QAC3C9B,MAAMxF;QACNyF,UAAU;YAAC,KAAKxG;QAAuC;IACzD;IACA0G,cAAcZ;IACda,SAAS,OAAOtD;QACd,MAAMsC,SAAS,MAAM5D,yBAAyB;YAC5C8E,SAASzD,eAAeC;YACxBG,QAAQH,QAAQ6E,MAAM,CAAC1E,MAAM;YAC7B8E,QAAQjF,QAAQkD,IAAI,CAAC+B,MAAM;YAC3BtB,gBAAgBvD,sBAAsBJ;YACtCwC,eAAexC,QAAQgB,EAAE;QAC3B;QACA,OAAOqB,+BAA+BC;IACxC;AACF;AAEA,MAAM4C,sBAAsBpH,YAAY;IACtCgF,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,QAAQ;QACN4B,QAAQ9G,EAAE+G,MAAM,CAAC;YAAC3E,QAAQpC,EAAEgH,MAAM,GAAGC,IAAI;QAAE;QAC3C9B,MAAM7F;QACN8F,UAAU;YAAC,KAAKxG;QAAuC;IACzD;IACA0G,cAAcZ;IACda,SAAS,OAAOtD;QACd,MAAMsC,SAAS,MAAM/D,4BAA4B;YAC/CiF,SAASzD,eAAeC;YACxBG,QAAQH,QAAQ6E,MAAM,CAAC1E,MAAM;YAC7B,GAAIH,QAAQkD,IAAI,CAAC+B,MAAM,GAAG;gBAACA,QAAQjF,QAAQkD,IAAI,CAAC+B,MAAM;YAAA,IAAI,CAAC,CAAC;YAC5DtB,gBAAgBvD,sBAAsBJ;YACtCwC,eAAexC,QAAQgB,EAAE;QAC3B;QACA,OAAOqB,+BAA+BC;IACxC;AACF;AAEA,MAAM6C,0BAA0BrH,YAAY;IAC1CgF,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,QAAQ;QACN4B,QAAQ9G,EAAE+G,MAAM,CAAC;YAAC3E,QAAQpC,EAAEgH,MAAM,GAAGC,IAAI;QAAE;QAC3C9B,MAAM1F;QACN2F,UAAU;YAAC,KAAK1F;QAA6C;IAC/D;IACA4F,cAAcZ;IACda,SAAS,OAAOtD;QACd,MAAMsC,SAAS,MAAM7D,gCAAgC;YACnD+E,SAASzD,eAAeC;YACxBG,QAAQH,QAAQ6E,MAAM,CAAC1E,MAAM;YAC7B,GAAIH,QAAQkD,IAAI,CAAC+B,MAAM,GAAG;gBAACA,QAAQjF,QAAQkD,IAAI,CAAC+B,MAAM;YAAA,IAAI,CAAC,CAAC;YAC5DtB,gBAAgBvD,sBAAsBJ;YACtCwC,eAAexC,QAAQgB,EAAE;QAC3B;QACA,OAAO;YACL,GAAGqB,+BAA+BC,OAAO;YACzC8C,kBAAkB9C,OAAO+C,eAAe;QAC1C;IACF;AACF;AAEA,MAAMC,aAAaxH,YAAY;IAC7BgF,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,QAAQ;QACNC,MAAMnG;QACNoG,UAAU;YAAC,KAAKnG;QAA4B;IAC9C;IACAqG,cAAcZ;IACda,SAAS,OAAOtD,SAASuD;QACvB,MAAMC,UAAUzD,eAAeC;QAC/B,MAAMe,QAAQ,MAAM3C,uBAAuB;YACzCoF;YACArD,QAAQH,QAAQkD,IAAI,CAACjC,OAAO;YAC5BC,MAAMlB,QAAQkD,IAAI,CAAChC,IAAI;YACvB+D,QAAQjF,QAAQkD,IAAI,CAAC+B,MAAM;YAC3BtB,gBAAgBvD,sBAAsBJ;YACtCwC,eAAexC,QAAQgB,EAAE;QAC3B;QACAuC,MAAMK,IAAI,CAAC;QACX,OAAO9C,gBAAgBC;IACzB;AACF;AAEA,MAAMwE,cAAczH,YAAY;IAC9BgF,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,QAAQ;QACN4B,QAAQ9G,EAAE+G,MAAM,CAAC;YAAC1C,SAASrE,EAAEgH,MAAM,GAAGC,IAAI;QAAE;QAC5C9B,MAAM5F;QACN6F,UAAU;YAAC,KAAK5F;QAA8B;IAChD;IACA8F,cAAcZ;IACda,SAAS,OAAOtD;QACd,MAAMe,QAAQ,MAAMvC,yBAAyB;YAC3CgF,SAASzD,eAAeC;YACxBoC,SAASpC,QAAQ6E,MAAM,CAACzC,OAAO;YAC/B6C,QAAQjF,QAAQkD,IAAI,CAAC+B,MAAM;YAC3BtB,gBAAgBvD,sBAAsBJ;YACtCwC,eAAexC,QAAQgB,EAAE;QAC3B;QACA,OAAOF,gBAAgBC;IACzB;AACF;AAEA,OAAO,MAAMyE,uBAAmCjJ,8BAA8B;IAC5EkJ,QAAQ;IACRC,MAAMpJ;IACNqJ,QAAQ;QAAC9C;QAAgBkB;QAAWuB;QAAYC;KAAY;AAC9D,GAAG;AAEH,OAAO,MAAMK,gCAA4CrJ,8BAA8B;IACrFkJ,QAAQ;IACRC,MAAMpJ;IACNqJ,QAAQ;QAAC9B;KAAoB;AAC/B,GAAG;AAEH,SAASgC,2BAA2BC,UAAuC;IACzE,OAAOhI,YAAY;QACjBgF,QAAQ;QACRC,MAAM;QACNC,aACE;QACFC,QAAQ;YACN4B,QAAQ9G,EAAE+G,MAAM,CAAC;gBAAC3E,QAAQpC,EAAEgH,MAAM,GAAGC,IAAI;YAAE;YAC3C9B,MAAMhG;YACNiG,UAAU;gBAAC,KAAKlG;YAAyB;QAC3C;QACA,0EAA0E;QAC1E,iEAAiE;QACjE,sEAAsE;QACtE,2EAA2E;QAC3E,oEAAoE;QACpEmG,YAAY;YACVxD,mCAAmC;YACnC,CAACI;gBACCxD,2BAA2BwD;gBAC3B,OAAO2E;YACT;SACD;QACDtB,cAAcZ;QACda,SAAS,OAAOtD;YACd,MAAMC,SAASP,iBAAiBM;YAChC,MAAMsC,SAAS,MAAMjE,gBAAgB;gBACnCmF,SAASzD,eAAeC;gBACxB,GAAIC,QAAQ8F,iBAAiB;oBAACC,qBAAqB/F,OAAO8F,cAAc;gBAAA,IAAI,CAAC,CAAC;gBAC9EE,cAAcjG,QAAQ6E,MAAM,CAAC1E,MAAM;gBACnC8E,QAAQjF,QAAQkD,IAAI,CAAC+B,MAAM;gBAC3BtB,gBAAgBvD,sBAAsBJ;gBACtC,sEAAsE;gBACtE,qEAAqE;gBACrE,qEAAqE;gBACrE,sEAAsE;gBACtE,kBAAkB;gBAClBwC,eAAenG;gBACfyJ;YACF;YACA,mEAAmE;YACnE,kEAAkE;YAClE,OAAO;gBACLI,OAAO5D,OAAO4D,KAAK;gBACnBC,YAAY7D,OAAO8D,SAAS,CAAC/E,WAAW;gBACxCgF,aAAa,IAAIC,OAAOjF,WAAW;gBACnCkF,iBAAiBjE,OAAOyD,cAAc;gBACtCpE,MAAMhC,UAAU2C,OAAOX,IAAI;YAC7B;QACF;IACF;AACF;AAEA,OAAO,SAAS6E,+BACdV,UAAuC;IAEvC,OAAO;QACLvJ,8BAA8B;YAC5BkJ,QAAQ;YACRC,MAAMpJ;YACNqJ,QAAQ;gBAAClB;gBAAiBG;gBAAkBM;gBAAqBC;aAAwB;QAC3F;QACA,yEAAyE;QACzE,kEAAkE;QAClE,sEAAsE;QACtE,yEAAyE;QACzE;YACEM,QAAQ;YACRC,MAAMpJ;YACNqJ,QAAQ;gBAACE,2BAA2BC;aAAY;QAClD;KACD;AACH"}
+{"version":3,"sources":["../../../src/presentation/routes/administration.ts"],"sourcesContent":["import {randomUUID} from 'node:crypto';\nimport {\n  AUTH_USER,\n  adoptAdministrationActorGuard,\n  requireAdministrationActor,\n} from '@shipfox/api-auth-context';\nimport {\n  adminBootstrapStateSchema,\n  administratorUserDirectoryQuerySchema,\n  administratorUserDirectoryResponseSchema,\n  administratorUserLookupQuerySchema,\n  administratorUserMutationResponseSchema,\n  administratorUserSummarySchema,\n  bootstrapAdminOwnerBodySchema,\n  bootstrapAdminOwnerResponseSchema,\n  grantAdminRoleBodySchema,\n  grantAdminRoleResponseSchema,\n  impersonateResponseSchema,\n  impersonateUserBodySchema,\n  listAdminGrantsQuerySchema,\n  listAdminGrantsResponseSchema,\n  reactivateAdministratorUserBodySchema,\n  revokeAdminGrantBodySchema,\n  revokeAdminGrantResponseSchema,\n  revokeAdministratorUserSessionsBodySchema,\n  revokeAdministratorUserSessionsResponseSchema,\n  suspendAdministratorUserBodySchema,\n} from '@shipfox/api-auth-dto';\nimport type {WorkspacesInterModuleClient} from '@shipfox/api-workspaces-dto/inter-module';\nimport {decodeTimestampIdCursor, encodeTimestampIdCursor} from '@shipfox/node-drizzle';\nimport {ClientError, defineRoute, type RouteGroup} from '@shipfox/node-fastify';\nimport type {FastifyRequest} from 'fastify';\nimport {z} from 'zod';\nimport {requireAdminRole} from '#core/admin-role.js';\nimport {\n  bootstrapFirstAdminOwner,\n  findAdministratorUserSummary,\n  getAdminBootstrapState,\n  grantAdministratorRole,\n  impersonateUser,\n  listAdministratorGrantSummaries,\n  listAdministratorUsers,\n  reactivateAdministratorUser,\n  revokeAdministratorGrant,\n  revokeAdministratorUserSessions,\n  suspendAdministratorUser,\n} from '#core/administration.js';\nimport type {AdminGrant} from '#core/entities/admin-grant.js';\nimport type {\n  AdministratorGrantSummary,\n  AdministratorUserSummary,\n} from '#core/entities/administrator-read-model.js';\nimport {\n  AdminBootstrapClosedError,\n  AdminGrantAlreadyExistsError,\n  AdminGrantNotFoundError,\n  AdminIdempotencyKeyReuseError,\n  AdminRoleRequiredError,\n  CannotImpersonateAdministratorError,\n  CannotImpersonateSelfError,\n  EmailNotVerifiedError,\n  ImpersonationDisabledError,\n  ImpersonationExpiredError,\n  ImpersonationTargetNotActiveError,\n  InvalidAdminBootstrapTokenError,\n  InvalidAdministratorUserDirectoryFilterError,\n  InvalidCredentialsError,\n  LastAdminOwnerError,\n  UserNotFoundError,\n} from '#core/errors.js';\nimport {getClientContext} from '#presentation/auth/jwt-auth.js';\nimport {toUserDto} from '#presentation/dto/user.js';\nimport {createAuthActorRateLimitPreHandler, createAuthIpRateLimitPreHandler} from './rate-limit.js';\n\nconst idempotencyKeyMaxLength = 256;\n\nfunction requireActorId(request: FastifyRequest): string {\n  const client = getClientContext(request);\n  if (!client) {\n    throw new ClientError('Authentication required', 'unauthorized', {status: 401});\n  }\n  return client.userId;\n}\n\nfunction requireIdempotencyKey(request: FastifyRequest): string {\n  const value = request.headers['idempotency-key'];\n  const key = Array.isArray(value) ? value[0] : value;\n  if (!key || key.trim().length === 0 || key.length > idempotencyKeyMaxLength) {\n    throw new ClientError('Idempotency-Key header is required', 'idempotency-key-required', {\n      status: 400,\n    });\n  }\n  return key;\n}\n\nasync function requireAdministratorObserver(request: FastifyRequest): Promise<void> {\n  await requireAdminRole({userId: requireActorId(request), minimumRole: 'admin-observer'});\n}\n\nfunction toAdminGrantDto(grant: AdminGrant) {\n  return {\n    id: grant.id,\n    user_id: grant.userId,\n    role: grant.role,\n    revoked_at: grant.revokedAt?.toISOString() ?? null,\n    created_at: grant.createdAt.toISOString(),\n    updated_at: grant.updatedAt.toISOString(),\n  };\n}\n\nfunction toAdministratorUserSummaryDto(user: AdministratorUserSummary) {\n  return {\n    id: user.id,\n    email: user.email,\n    name: user.name,\n    status: user.status,\n    email_verified_at: user.emailVerifiedAt?.toISOString() ?? null,\n    created_at: user.createdAt.toISOString(),\n    admin_role: user.adminRole,\n  };\n}\n\nfunction toAdministratorGrantSummaryDto(grant: AdministratorGrantSummary) {\n  return {\n    grant_id: grant.grantId,\n    role: grant.role,\n    created_at: grant.createdAt.toISOString(),\n    revoked_at: grant.revokedAt?.toISOString() ?? null,\n    user: grant.user,\n  };\n}\n\nfunction toAdministratorUserMutationDto(result: {\n  user: AdministratorUserSummary;\n  correlationId: string;\n}) {\n  return {\n    ...toAdministratorUserSummaryDto(result.user),\n    correlation_id: result.correlationId,\n  };\n}\n\nfunction directoryResultCountBucket(count: number): '0' | '1-10' | '11-50' | '51-100' {\n  if (count === 0) return '0';\n  if (count <= 10) return '1-10';\n  if (count <= 50) return '11-50';\n  return '51-100';\n}\n\nfunction logAdministratorUserDirectoryRead(params: {\n  request: FastifyRequest;\n  actorId: string;\n  outcome: 'succeeded' | 'failed';\n  durationMs: number;\n  resultCount: number;\n  filterPresence: {\n    search: boolean;\n    status: boolean;\n    impersonationEligible: boolean;\n  };\n  nextPagePresent: boolean;\n}): void {\n  try {\n    params.request.log.info(\n      {\n        actorId: params.actorId,\n        requiredRole: 'admin-observer',\n        targetType: 'user-directory',\n        requestId: params.request.id,\n        result: params.outcome,\n        outcome: params.outcome,\n        durationMs: params.durationMs,\n        resultCountBucket: directoryResultCountBucket(params.resultCount),\n        filterPresence: params.filterPresence,\n        nextPagePresent: params.nextPagePresent,\n      },\n      'Listed administrator user directory',\n    );\n  } catch {\n    // Logging must not change the directory read outcome.\n  }\n}\n\nfunction translateImpersonationEligibilityError(error: unknown): ClientError | undefined {\n  // The mint primitive re-checks login eligibility on the row it reads, and a\n  // concurrent suspension or unverification between the in-transaction ladder\n  // read and that read surfaces these errors. Map them to the same documented\n  // client error instead of a generic 500.\n  if (error instanceof EmailNotVerifiedError || error instanceof InvalidCredentialsError) {\n    return new ClientError('User cannot be impersonated', 'impersonation-target-not-active', {\n      status: 403,\n    });\n  }\n  if (error instanceof ImpersonationExpiredError) {\n    return new ClientError('Impersonation session has expired', 'impersonation-expired', {\n      status: 410,\n    });\n  }\n  return undefined;\n}\n\nfunction translateAdministrationError(error: unknown): never {\n  const impersonationEligibilityError = translateImpersonationEligibilityError(error);\n  if (impersonationEligibilityError) throw impersonationEligibilityError;\n  if (error instanceof AdminRoleRequiredError) {\n    throw new ClientError('Administrator role required', 'forbidden', {\n      status: 403,\n      details: {required_role: error.minimumRole},\n    });\n  }\n  if (error instanceof InvalidAdministratorUserDirectoryFilterError) {\n    throw new ClientError(error.message, 'validation-error', {status: 400});\n  }\n  if (error instanceof InvalidAdminBootstrapTokenError) {\n    throw new ClientError('Bootstrap token is invalid', 'bootstrap-token-invalid', {\n      status: 403,\n    });\n  }\n  if (error instanceof AdminBootstrapClosedError) {\n    throw new ClientError('First administrator owner already exists', 'bootstrap-closed', {\n      status: 409,\n    });\n  }\n  if (error instanceof AdminGrantAlreadyExistsError) {\n    throw new ClientError('Administrator grant already exists', 'grant-already-exists', {\n      status: 409,\n    });\n  }\n  if (error instanceof AdminGrantNotFoundError) {\n    throw new ClientError('Administrator grant not found', 'not-found', {status: 404});\n  }\n  if (error instanceof UserNotFoundError) {\n    throw new ClientError('User not found', 'not-found', {status: 404});\n  }\n  if (error instanceof LastAdminOwnerError) {\n    throw new ClientError('Cannot remove the final active administrator owner', 'last-owner', {\n      status: 409,\n    });\n  }\n  if (error instanceof AdminIdempotencyKeyReuseError) {\n    throw new ClientError(\n      'Idempotency-Key was already used for a different command',\n      'idempotency-key-reused',\n      {status: 409},\n    );\n  }\n  if (error instanceof ImpersonationDisabledError) {\n    throw new ClientError('Impersonation is disabled', 'impersonation-disabled', {status: 403});\n  }\n  if (error instanceof CannotImpersonateSelfError) {\n    throw new ClientError('Cannot impersonate yourself', 'cannot-impersonate-self', {\n      status: 403,\n    });\n  }\n  if (error instanceof CannotImpersonateAdministratorError) {\n    throw new ClientError(\n      'Cannot impersonate an administrator',\n      'cannot-impersonate-administrator',\n      {status: 403},\n    );\n  }\n  if (error instanceof ImpersonationTargetNotActiveError) {\n    throw new ClientError('User cannot be impersonated', 'impersonation-target-not-active', {\n      status: 403,\n    });\n  }\n  throw error;\n}\n\nconst bootstrapRoute = defineRoute({\n  method: 'POST',\n  path: '/bootstrap',\n  description: 'Claim the first administrator owner role with the deployment bootstrap token.',\n  schema: {\n    body: bootstrapAdminOwnerBodySchema,\n    response: {201: bootstrapAdminOwnerResponseSchema},\n  },\n  preHandler: createAuthIpRateLimitPreHandler('bootstrap'),\n  errorHandler: translateAdministrationError,\n  handler: async (request, reply) => {\n    const actorId = requireActorId(request);\n    const grant = await bootstrapFirstAdminOwner({\n      actorId,\n      bootstrapToken: request.body.bootstrap_token,\n      idempotencyKey: requireIdempotencyKey(request),\n      correlationId: request.id,\n    });\n    reply.code(201);\n    return toAdminGrantDto(grant);\n  },\n});\n\nconst bootstrapStateRoute = defineRoute({\n  method: 'GET',\n  path: '/bootstrap-state',\n  description: 'Read whether first administrator owner bootstrap is available.',\n  schema: {response: {200: adminBootstrapStateSchema}},\n  preHandler: createAuthIpRateLimitPreHandler('bootstrap-state'),\n  errorHandler: translateAdministrationError,\n  handler: async () => ({state: await getAdminBootstrapState()}),\n});\n\nconst listRoute = defineRoute({\n  method: 'GET',\n  path: '/',\n  description: 'List bounded local administrator grant summaries.',\n  schema: {\n    querystring: listAdminGrantsQuerySchema,\n    response: {200: listAdminGrantsResponseSchema},\n  },\n  errorHandler: translateAdministrationError,\n  handler: async (request) => {\n    const {limit, cursor} = request.query;\n    const decodedCursor = decodeTimestampIdCursor(cursor);\n    if (cursor && !decodedCursor) {\n      throw new ClientError('Invalid cursor', 'invalid-cursor', {status: 400});\n    }\n\n    const result = await listAdministratorGrantSummaries({\n      actorId: requireActorId(request),\n      limit,\n      ...(decodedCursor ? {cursor: decodedCursor} : {}),\n    });\n    return {\n      grants: result.grants.map(toAdministratorGrantSummaryDto),\n      next_cursor: result.nextCursor ? encodeTimestampIdCursor(result.nextCursor) : null,\n    };\n  },\n});\n\nconst userLookupRoute = defineRoute({\n  method: 'GET',\n  path: '/',\n  description: 'Find one administrator-safe user summary by exact ID or email.',\n  schema: {\n    querystring: administratorUserLookupQuerySchema,\n    response: {200: administratorUserSummarySchema},\n  },\n  preHandler: [requireAdministratorObserver, createAuthIpRateLimitPreHandler('lookup')],\n  errorHandler: translateAdministrationError,\n  handler: async (request) => {\n    const {id, user_id: userId, email} = request.query;\n    const lookupId = id ?? userId;\n    const actorId = requireActorId(request);\n    let user: Awaited<ReturnType<typeof findAdministratorUserSummary>>;\n    if (lookupId) user = await findAdministratorUserSummary({actorId, id: lookupId});\n    else if (email) user = await findAdministratorUserSummary({actorId, email});\n    if (!user) throw new UserNotFoundError(lookupId ?? email ?? 'unknown');\n    return toAdministratorUserSummaryDto(user);\n  },\n});\n\nconst userDirectoryRoute = defineRoute({\n  method: 'GET',\n  path: '/directory',\n  description: 'List bounded administrator-safe user summaries for directory browsing.',\n  schema: {\n    querystring: administratorUserDirectoryQuerySchema,\n    response: {200: administratorUserDirectoryResponseSchema},\n  },\n  preHandler: createAuthActorRateLimitPreHandler('directory'),\n  errorHandler: translateAdministrationError,\n  handler: async (request) => {\n    const actorId = requireActorId(request);\n    const startedAt = performance.now();\n    const {\n      search,\n      status,\n      impersonation_eligible: impersonationEligible,\n      limit,\n      cursor,\n    } = request.query;\n    let resultCount = 0;\n    let nextPagePresent = false;\n    let outcome: 'succeeded' | 'failed' = 'failed';\n\n    try {\n      const decodedCursor = decodeTimestampIdCursor(cursor);\n      if (cursor && !decodedCursor) {\n        throw new ClientError('Invalid cursor', 'invalid-cursor', {status: 400});\n      }\n\n      const result = await listAdministratorUsers({\n        actorId,\n        limit,\n        ...(decodedCursor ? {cursor: decodedCursor} : {}),\n        ...(search !== undefined ? {search} : {}),\n        ...(status !== undefined ? {status} : {}),\n        ...(impersonationEligible !== undefined ? {eligible: impersonationEligible} : {}),\n      });\n      resultCount = result.users.length;\n      nextPagePresent = result.nextCursor !== null;\n      outcome = 'succeeded';\n\n      return {\n        users: result.users.map(toAdministratorUserSummaryDto),\n        next_cursor: result.nextCursor ? encodeTimestampIdCursor(result.nextCursor) : null,\n      };\n    } finally {\n      logAdministratorUserDirectoryRead({\n        request,\n        actorId,\n        outcome,\n        durationMs: Math.round(performance.now() - startedAt),\n        resultCount,\n        filterPresence: {\n          search: search !== undefined,\n          status: status !== undefined,\n          impersonationEligible: impersonationEligible !== undefined,\n        },\n        nextPagePresent,\n      });\n    }\n  },\n});\n\nconst suspendUserRoute = defineRoute({\n  method: 'POST',\n  path: '/:userId/suspend',\n  description: 'Suspend a user and revoke all of its active sessions.',\n  schema: {\n    params: z.object({userId: z.string().uuid()}),\n    body: suspendAdministratorUserBodySchema,\n    response: {200: administratorUserMutationResponseSchema},\n  },\n  errorHandler: translateAdministrationError,\n  handler: async (request) => {\n    const result = await suspendAdministratorUser({\n      actorId: requireActorId(request),\n      userId: request.params.userId,\n      reason: request.body.reason,\n      idempotencyKey: requireIdempotencyKey(request),\n      correlationId: request.id,\n    });\n    return toAdministratorUserMutationDto(result);\n  },\n});\n\nconst reactivateUserRoute = defineRoute({\n  method: 'POST',\n  path: '/:userId/reactivate',\n  description: 'Reactivate a suspended user without restoring revoked sessions.',\n  schema: {\n    params: z.object({userId: z.string().uuid()}),\n    body: reactivateAdministratorUserBodySchema,\n    response: {200: administratorUserMutationResponseSchema},\n  },\n  errorHandler: translateAdministrationError,\n  handler: async (request) => {\n    const result = await reactivateAdministratorUser({\n      actorId: requireActorId(request),\n      userId: request.params.userId,\n      ...(request.body.reason ? {reason: request.body.reason} : {}),\n      idempotencyKey: requireIdempotencyKey(request),\n      correlationId: request.id,\n    });\n    return toAdministratorUserMutationDto(result);\n  },\n});\n\nconst revokeUserSessionsRoute = defineRoute({\n  method: 'POST',\n  path: '/:userId/revoke-sessions',\n  description: 'Revoke all active sessions for a user without changing account status.',\n  schema: {\n    params: z.object({userId: z.string().uuid()}),\n    body: revokeAdministratorUserSessionsBodySchema,\n    response: {200: revokeAdministratorUserSessionsResponseSchema},\n  },\n  errorHandler: translateAdministrationError,\n  handler: async (request) => {\n    const result = await revokeAdministratorUserSessions({\n      actorId: requireActorId(request),\n      userId: request.params.userId,\n      ...(request.body.reason ? {reason: request.body.reason} : {}),\n      idempotencyKey: requireIdempotencyKey(request),\n      correlationId: request.id,\n    });\n    return {\n      ...toAdministratorUserMutationDto(result),\n      sessions_revoked: result.sessionsRevoked,\n    };\n  },\n});\n\nconst grantRoute = defineRoute({\n  method: 'POST',\n  path: '/',\n  description: 'Grant a local administrator role to an active user.',\n  schema: {\n    body: grantAdminRoleBodySchema,\n    response: {201: grantAdminRoleResponseSchema},\n  },\n  errorHandler: translateAdministrationError,\n  handler: async (request, reply) => {\n    const actorId = requireActorId(request);\n    const grant = await grantAdministratorRole({\n      actorId,\n      userId: request.body.user_id,\n      role: request.body.role,\n      reason: request.body.reason,\n      idempotencyKey: requireIdempotencyKey(request),\n      correlationId: request.id,\n    });\n    reply.code(201);\n    return toAdminGrantDto(grant);\n  },\n});\n\nconst revokeRoute = defineRoute({\n  method: 'DELETE',\n  path: '/:grantId',\n  description: 'Revoke a local administrator grant.',\n  schema: {\n    params: z.object({grantId: z.string().uuid()}),\n    body: revokeAdminGrantBodySchema,\n    response: {200: revokeAdminGrantResponseSchema},\n  },\n  errorHandler: translateAdministrationError,\n  handler: async (request) => {\n    const grant = await revokeAdministratorGrant({\n      actorId: requireActorId(request),\n      grantId: request.params.grantId,\n      reason: request.body.reason,\n      idempotencyKey: requireIdempotencyKey(request),\n      correlationId: request.id,\n    });\n    return toAdminGrantDto(grant);\n  },\n});\n\nexport const administrationRoutes: RouteGroup = adoptAdministrationActorGuard({\n  prefix: '/admin/auth/admin-grants',\n  auth: AUTH_USER,\n  routes: [bootstrapRoute, listRoute, grantRoute, revokeRoute],\n});\n\nexport const administrationBootstrapRoutes: RouteGroup = adoptAdministrationActorGuard({\n  prefix: '/admin/auth',\n  auth: AUTH_USER,\n  routes: [bootstrapStateRoute],\n});\n\nfunction createImpersonateUserRoute(workspaces: WorkspacesInterModuleClient) {\n  return defineRoute({\n    method: 'POST',\n    path: '/:userId/impersonate',\n    description:\n      'Mint a short-lived, marked, audited impersonated session for an active, verified, non-administrator user.',\n    schema: {\n      params: z.object({userId: z.string().uuid()}),\n      body: impersonateUserBodySchema,\n      response: {200: impersonateResponseSchema},\n    },\n    // The limiter runs ahead of the impersonated-session rejection: a request\n    // carrying an already-issued impersonated token must consume the\n    // `impersonate` IP and actor buckets instead of being rejected by the\n    // guard first, or marked-session probes would bypass the limiter entirely.\n    // The guard still runs before the authorization inside the command.\n    preHandler: [\n      createAuthActorRateLimitPreHandler('impersonate'),\n      (request) => {\n        requireAdministrationActor(request);\n        return undefined;\n      },\n    ],\n    errorHandler: translateAdministrationError,\n    handler: async (request) => {\n      const client = getClientContext(request);\n      const result = await impersonateUser({\n        actorId: requireActorId(request),\n        ...(client?.impersonatorId ? {actorImpersonatorId: client.impersonatorId} : {}),\n        targetUserId: request.params.userId,\n        reason: request.body.reason,\n        idempotencyKey: requireIdempotencyKey(request),\n        // Fastify's default request IDs are process-local counters that reset\n        // after a redeploy, so a replay could collide with an earlier mint's\n        // ID and suppress the required failure event in the ambiguous-COMMIT\n        // reconciliation. The correlation is a fresh process-independent UUID\n        // per invocation.\n        correlationId: randomUUID(),\n        workspaces,\n      });\n      // `server_time` is the issuer's clock at response time: the banner\n      // derives its countdown and Extend availability from this anchor.\n      return {\n        token: result.token,\n        expires_at: result.expiresAt.toISOString(),\n        server_time: new Date().toISOString(),\n        impersonator_id: result.impersonatorId,\n        user: toUserDto(result.user),\n      };\n    },\n  });\n}\n\nexport function createAdministrationUserRoutes(\n  workspaces: WorkspacesInterModuleClient,\n): RouteGroup[] {\n  return [\n    adoptAdministrationActorGuard({\n      prefix: '/admin/auth/users',\n      auth: AUTH_USER,\n      routes: [\n        userDirectoryRoute,\n        userLookupRoute,\n        suspendUserRoute,\n        reactivateUserRoute,\n        revokeUserSessionsRoute,\n      ],\n    }),\n    // The impersonate route mounts outside the adopted guard on purpose: its\n    // limiter must run before the impersonated-session rejection (see\n    // `createImpersonateUserRoute`), so the guard is applied positionally\n    // there. Every other route under `/admin/auth/users` keeps the adoption.\n    {\n      prefix: '/admin/auth/users',\n      auth: AUTH_USER,\n      routes: [createImpersonateUserRoute(workspaces)],\n    },\n  ];\n}\n"],"names":["randomUUID","AUTH_USER","adoptAdministrationActorGuard","requireAdministrationActor","adminBootstrapStateSchema","administratorUserDirectoryQuerySchema","administratorUserDirectoryResponseSchema","administratorUserLookupQuerySchema","administratorUserMutationResponseSchema","administratorUserSummarySchema","bootstrapAdminOwnerBodySchema","bootstrapAdminOwnerResponseSchema","grantAdminRoleBodySchema","grantAdminRoleResponseSchema","impersonateResponseSchema","impersonateUserBodySchema","listAdminGrantsQuerySchema","listAdminGrantsResponseSchema","reactivateAdministratorUserBodySchema","revokeAdminGrantBodySchema","revokeAdminGrantResponseSchema","revokeAdministratorUserSessionsBodySchema","revokeAdministratorUserSessionsResponseSchema","suspendAdministratorUserBodySchema","decodeTimestampIdCursor","encodeTimestampIdCursor","ClientError","defineRoute","z","requireAdminRole","bootstrapFirstAdminOwner","findAdministratorUserSummary","getAdminBootstrapState","grantAdministratorRole","impersonateUser","listAdministratorGrantSummaries","listAdministratorUsers","reactivateAdministratorUser","revokeAdministratorGrant","revokeAdministratorUserSessions","suspendAdministratorUser","AdminBootstrapClosedError","AdminGrantAlreadyExistsError","AdminGrantNotFoundError","AdminIdempotencyKeyReuseError","AdminRoleRequiredError","CannotImpersonateAdministratorError","CannotImpersonateSelfError","EmailNotVerifiedError","ImpersonationDisabledError","ImpersonationExpiredError","ImpersonationTargetNotActiveError","InvalidAdminBootstrapTokenError","InvalidAdministratorUserDirectoryFilterError","InvalidCredentialsError","LastAdminOwnerError","UserNotFoundError","getClientContext","toUserDto","createAuthActorRateLimitPreHandler","createAuthIpRateLimitPreHandler","idempotencyKeyMaxLength","requireActorId","request","client","status","userId","requireIdempotencyKey","value","headers","key","Array","isArray","trim","length","requireAdministratorObserver","minimumRole","toAdminGrantDto","grant","id","user_id","role","revoked_at","revokedAt","toISOString","created_at","createdAt","updated_at","updatedAt","toAdministratorUserSummaryDto","user","email","name","email_verified_at","emailVerifiedAt","admin_role","adminRole","toAdministratorGrantSummaryDto","grant_id","grantId","toAdministratorUserMutationDto","result","correlation_id","correlationId","directoryResultCountBucket","count","logAdministratorUserDirectoryRead","params","log","info","actorId","requiredRole","targetType","requestId","outcome","durationMs","resultCountBucket","resultCount","filterPresence","nextPagePresent","translateImpersonationEligibilityError","error","undefined","translateAdministrationError","impersonationEligibilityError","details","required_role","message","bootstrapRoute","method","path","description","schema","body","response","preHandler","errorHandler","handler","reply","bootstrapToken","bootstrap_token","idempotencyKey","code","bootstrapStateRoute","state","listRoute","querystring","limit","cursor","query","decodedCursor","grants","map","next_cursor","nextCursor","userLookupRoute","lookupId","userDirectoryRoute","startedAt","performance","now","search","impersonation_eligible","impersonationEligible","eligible","users","Math","round","suspendUserRoute","object","string","uuid","reason","reactivateUserRoute","revokeUserSessionsRoute","sessions_revoked","sessionsRevoked","grantRoute","revokeRoute","administrationRoutes","prefix","auth","routes","administrationBootstrapRoutes","createImpersonateUserRoute","workspaces","impersonatorId","actorImpersonatorId","targetUserId","token","expires_at","expiresAt","server_time","Date","impersonator_id","createAdministrationUserRoutes"],"mappings":"AAAA,SAAQA,UAAU,QAAO,cAAc;AACvC,SACEC,SAAS,EACTC,6BAA6B,EAC7BC,0BAA0B,QACrB,4BAA4B;AACnC,SACEC,yBAAyB,EACzBC,qCAAqC,EACrCC,wCAAwC,EACxCC,kCAAkC,EAClCC,uCAAuC,EACvCC,8BAA8B,EAC9BC,6BAA6B,EAC7BC,iCAAiC,EACjCC,wBAAwB,EACxBC,4BAA4B,EAC5BC,yBAAyB,EACzBC,yBAAyB,EACzBC,0BAA0B,EAC1BC,6BAA6B,EAC7BC,qCAAqC,EACrCC,0BAA0B,EAC1BC,8BAA8B,EAC9BC,yCAAyC,EACzCC,6CAA6C,EAC7CC,kCAAkC,QAC7B,wBAAwB;AAE/B,SAAQC,uBAAuB,EAAEC,uBAAuB,QAAO,wBAAwB;AACvF,SAAQC,WAAW,EAAEC,WAAW,QAAwB,wBAAwB;AAEhF,SAAQC,CAAC,QAAO,MAAM;AACtB,SAAQC,gBAAgB,QAAO,sBAAsB;AACrD,SACEC,wBAAwB,EACxBC,4BAA4B,EAC5BC,sBAAsB,EACtBC,sBAAsB,EACtBC,eAAe,EACfC,+BAA+B,EAC/BC,sBAAsB,EACtBC,2BAA2B,EAC3BC,wBAAwB,EACxBC,+BAA+B,EAC/BC,wBAAwB,QACnB,0BAA0B;AAMjC,SACEC,yBAAyB,EACzBC,4BAA4B,EAC5BC,uBAAuB,EACvBC,6BAA6B,EAC7BC,sBAAsB,EACtBC,mCAAmC,EACnCC,0BAA0B,EAC1BC,qBAAqB,EACrBC,0BAA0B,EAC1BC,yBAAyB,EACzBC,iCAAiC,EACjCC,+BAA+B,EAC/BC,4CAA4C,EAC5CC,uBAAuB,EACvBC,mBAAmB,EACnBC,iBAAiB,QACZ,kBAAkB;AACzB,SAAQC,gBAAgB,QAAO,iCAAiC;AAChE,SAAQC,SAAS,QAAO,4BAA4B;AACpD,SAAQC,kCAAkC,EAAEC,+BAA+B,QAAO,kBAAkB;AAEpG,MAAMC,0BAA0B;AAEhC,SAASC,eAAeC,OAAuB;IAC7C,MAAMC,SAASP,iBAAiBM;IAChC,IAAI,CAACC,QAAQ;QACX,MAAM,IAAItC,YAAY,2BAA2B,gBAAgB;YAACuC,QAAQ;QAAG;IAC/E;IACA,OAAOD,OAAOE,MAAM;AACtB;AAEA,SAASC,sBAAsBJ,OAAuB;IACpD,MAAMK,QAAQL,QAAQM,OAAO,CAAC,kBAAkB;IAChD,MAAMC,MAAMC,MAAMC,OAAO,CAACJ,SAASA,KAAK,CAAC,EAAE,GAAGA;IAC9C,IAAI,CAACE,OAAOA,IAAIG,IAAI,GAAGC,MAAM,KAAK,KAAKJ,IAAII,MAAM,GAAGb,yBAAyB;QAC3E,MAAM,IAAInC,YAAY,sCAAsC,4BAA4B;YACtFuC,QAAQ;QACV;IACF;IACA,OAAOK;AACT;AAEA,eAAeK,6BAA6BZ,OAAuB;IACjE,MAAMlC,iBAAiB;QAACqC,QAAQJ,eAAeC;QAAUa,aAAa;IAAgB;AACxF;AAEA,SAASC,gBAAgBC,KAAiB;IACxC,OAAO;QACLC,IAAID,MAAMC,EAAE;QACZC,SAASF,MAAMZ,MAAM;QACrBe,MAAMH,MAAMG,IAAI;QAChBC,YAAYJ,MAAMK,SAAS,EAAEC,iBAAiB;QAC9CC,YAAYP,MAAMQ,SAAS,CAACF,WAAW;QACvCG,YAAYT,MAAMU,SAAS,CAACJ,WAAW;IACzC;AACF;AAEA,SAASK,8BAA8BC,IAA8B;IACnE,OAAO;QACLX,IAAIW,KAAKX,EAAE;QACXY,OAAOD,KAAKC,KAAK;QACjBC,MAAMF,KAAKE,IAAI;QACf3B,QAAQyB,KAAKzB,MAAM;QACnB4B,mBAAmBH,KAAKI,eAAe,EAAEV,iBAAiB;QAC1DC,YAAYK,KAAKJ,SAAS,CAACF,WAAW;QACtCW,YAAYL,KAAKM,SAAS;IAC5B;AACF;AAEA,SAASC,+BAA+BnB,KAAgC;IACtE,OAAO;QACLoB,UAAUpB,MAAMqB,OAAO;QACvBlB,MAAMH,MAAMG,IAAI;QAChBI,YAAYP,MAAMQ,SAAS,CAACF,WAAW;QACvCF,YAAYJ,MAAMK,SAAS,EAAEC,iBAAiB;QAC9CM,MAAMZ,MAAMY,IAAI;IAClB;AACF;AAEA,SAASU,+BAA+BC,MAGvC;IACC,OAAO;QACL,GAAGZ,8BAA8BY,OAAOX,IAAI,CAAC;QAC7CY,gBAAgBD,OAAOE,aAAa;IACtC;AACF;AAEA,SAASC,2BAA2BC,KAAa;IAC/C,IAAIA,UAAU,GAAG,OAAO;IACxB,IAAIA,SAAS,IAAI,OAAO;IACxB,IAAIA,SAAS,IAAI,OAAO;IACxB,OAAO;AACT;AAEA,SAASC,kCAAkCC,MAY1C;IACC,IAAI;QACFA,OAAO5C,OAAO,CAAC6C,GAAG,CAACC,IAAI,CACrB;YACEC,SAASH,OAAOG,OAAO;YACvBC,cAAc;YACdC,YAAY;YACZC,WAAWN,OAAO5C,OAAO,CAACgB,EAAE;YAC5BsB,QAAQM,OAAOO,OAAO;YACtBA,SAASP,OAAOO,OAAO;YACvBC,YAAYR,OAAOQ,UAAU;YAC7BC,mBAAmBZ,2BAA2BG,OAAOU,WAAW;YAChEC,gBAAgBX,OAAOW,cAAc;YACrCC,iBAAiBZ,OAAOY,eAAe;QACzC,GACA;IAEJ,EAAE,OAAM;IACN,sDAAsD;IACxD;AACF;AAEA,SAASC,uCAAuCC,KAAc;IAC5D,4EAA4E;IAC5E,4EAA4E;IAC5E,4EAA4E;IAC5E,yCAAyC;IACzC,IAAIA,iBAAiBzE,yBAAyByE,iBAAiBnE,yBAAyB;QACtF,OAAO,IAAI5B,YAAY,+BAA+B,mCAAmC;YACvFuC,QAAQ;QACV;IACF;IACA,IAAIwD,iBAAiBvE,2BAA2B;QAC9C,OAAO,IAAIxB,YAAY,qCAAqC,yBAAyB;YACnFuC,QAAQ;QACV;IACF;IACA,OAAOyD;AACT;AAEA,SAASC,6BAA6BF,KAAc;IAClD,MAAMG,gCAAgCJ,uCAAuCC;IAC7E,IAAIG,+BAA+B,MAAMA;IACzC,IAAIH,iBAAiB5E,wBAAwB;QAC3C,MAAM,IAAInB,YAAY,+BAA+B,aAAa;YAChEuC,QAAQ;YACR4D,SAAS;gBAACC,eAAeL,MAAM7C,WAAW;YAAA;QAC5C;IACF;IACA,IAAI6C,iBAAiBpE,8CAA8C;QACjE,MAAM,IAAI3B,YAAY+F,MAAMM,OAAO,EAAE,oBAAoB;YAAC9D,QAAQ;QAAG;IACvE;IACA,IAAIwD,iBAAiBrE,iCAAiC;QACpD,MAAM,IAAI1B,YAAY,8BAA8B,2BAA2B;YAC7EuC,QAAQ;QACV;IACF;IACA,IAAIwD,iBAAiBhF,2BAA2B;QAC9C,MAAM,IAAIf,YAAY,4CAA4C,oBAAoB;YACpFuC,QAAQ;QACV;IACF;IACA,IAAIwD,iBAAiB/E,8BAA8B;QACjD,MAAM,IAAIhB,YAAY,sCAAsC,wBAAwB;YAClFuC,QAAQ;QACV;IACF;IACA,IAAIwD,iBAAiB9E,yBAAyB;QAC5C,MAAM,IAAIjB,YAAY,iCAAiC,aAAa;YAACuC,QAAQ;QAAG;IAClF;IACA,IAAIwD,iBAAiBjE,mBAAmB;QACtC,MAAM,IAAI9B,YAAY,kBAAkB,aAAa;YAACuC,QAAQ;QAAG;IACnE;IACA,IAAIwD,iBAAiBlE,qBAAqB;QACxC,MAAM,IAAI7B,YAAY,sDAAsD,cAAc;YACxFuC,QAAQ;QACV;IACF;IACA,IAAIwD,iBAAiB7E,+BAA+B;QAClD,MAAM,IAAIlB,YACR,4DACA,0BACA;YAACuC,QAAQ;QAAG;IAEhB;IACA,IAAIwD,iBAAiBxE,4BAA4B;QAC/C,MAAM,IAAIvB,YAAY,6BAA6B,0BAA0B;YAACuC,QAAQ;QAAG;IAC3F;IACA,IAAIwD,iBAAiB1E,4BAA4B;QAC/C,MAAM,IAAIrB,YAAY,+BAA+B,2BAA2B;YAC9EuC,QAAQ;QACV;IACF;IACA,IAAIwD,iBAAiB3E,qCAAqC;QACxD,MAAM,IAAIpB,YACR,uCACA,oCACA;YAACuC,QAAQ;QAAG;IAEhB;IACA,IAAIwD,iBAAiBtE,mCAAmC;QACtD,MAAM,IAAIzB,YAAY,+BAA+B,mCAAmC;YACtFuC,QAAQ;QACV;IACF;IACA,MAAMwD;AACR;AAEA,MAAMO,iBAAiBrG,YAAY;IACjCsG,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,QAAQ;QACNC,MAAM3H;QACN4H,UAAU;YAAC,KAAK3H;QAAiC;IACnD;IACA4H,YAAY3E,gCAAgC;IAC5C4E,cAAcb;IACdc,SAAS,OAAO1E,SAAS2E;QACvB,MAAM5B,UAAUhD,eAAeC;QAC/B,MAAMe,QAAQ,MAAMhD,yBAAyB;YAC3CgF;YACA6B,gBAAgB5E,QAAQsE,IAAI,CAACO,eAAe;YAC5CC,gBAAgB1E,sBAAsBJ;YACtCwC,eAAexC,QAAQgB,EAAE;QAC3B;QACA2D,MAAMI,IAAI,CAAC;QACX,OAAOjE,gBAAgBC;IACzB;AACF;AAEA,MAAMiE,sBAAsBpH,YAAY;IACtCsG,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,QAAQ;QAACE,UAAU;YAAC,KAAKlI;QAAyB;IAAC;IACnDmI,YAAY3E,gCAAgC;IAC5C4E,cAAcb;IACdc,SAAS,UAAa,CAAA;YAACO,OAAO,MAAMhH;QAAwB,CAAA;AAC9D;AAEA,MAAMiH,YAAYtH,YAAY;IAC5BsG,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,QAAQ;QACNc,aAAalI;QACbsH,UAAU;YAAC,KAAKrH;QAA6B;IAC/C;IACAuH,cAAcb;IACdc,SAAS,OAAO1E;QACd,MAAM,EAACoF,KAAK,EAAEC,MAAM,EAAC,GAAGrF,QAAQsF,KAAK;QACrC,MAAMC,gBAAgB9H,wBAAwB4H;QAC9C,IAAIA,UAAU,CAACE,eAAe;YAC5B,MAAM,IAAI5H,YAAY,kBAAkB,kBAAkB;gBAACuC,QAAQ;YAAG;QACxE;QAEA,MAAMoC,SAAS,MAAMlE,gCAAgC;YACnD2E,SAAShD,eAAeC;YACxBoF;YACA,GAAIG,gBAAgB;gBAACF,QAAQE;YAAa,IAAI,CAAC,CAAC;QAClD;QACA,OAAO;YACLC,QAAQlD,OAAOkD,MAAM,CAACC,GAAG,CAACvD;YAC1BwD,aAAapD,OAAOqD,UAAU,GAAGjI,wBAAwB4E,OAAOqD,UAAU,IAAI;QAChF;IACF;AACF;AAEA,MAAMC,kBAAkBhI,YAAY;IAClCsG,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,QAAQ;QACNc,aAAa3I;QACb+H,UAAU;YAAC,KAAK7H;QAA8B;IAChD;IACA8H,YAAY;QAAC5D;QAA8Bf,gCAAgC;KAAU;IACrF4E,cAAcb;IACdc,SAAS,OAAO1E;QACd,MAAM,EAACgB,EAAE,EAAEC,SAASd,MAAM,EAAEyB,KAAK,EAAC,GAAG5B,QAAQsF,KAAK;QAClD,MAAMO,WAAW7E,MAAMb;QACvB,MAAM4C,UAAUhD,eAAeC;QAC/B,IAAI2B;QACJ,IAAIkE,UAAUlE,OAAO,MAAM3D,6BAA6B;YAAC+E;YAAS/B,IAAI6E;QAAQ;aACzE,IAAIjE,OAAOD,OAAO,MAAM3D,6BAA6B;YAAC+E;YAASnB;QAAK;QACzE,IAAI,CAACD,MAAM,MAAM,IAAIlC,kBAAkBoG,YAAYjE,SAAS;QAC5D,OAAOF,8BAA8BC;IACvC;AACF;AAEA,MAAMmE,qBAAqBlI,YAAY;IACrCsG,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,QAAQ;QACNc,aAAa7I;QACbiI,UAAU;YAAC,KAAKhI;QAAwC;IAC1D;IACAiI,YAAY5E,mCAAmC;IAC/C6E,cAAcb;IACdc,SAAS,OAAO1E;QACd,MAAM+C,UAAUhD,eAAeC;QAC/B,MAAM+F,YAAYC,YAAYC,GAAG;QACjC,MAAM,EACJC,MAAM,EACNhG,MAAM,EACNiG,wBAAwBC,qBAAqB,EAC7ChB,KAAK,EACLC,MAAM,EACP,GAAGrF,QAAQsF,KAAK;QACjB,IAAIhC,cAAc;QAClB,IAAIE,kBAAkB;QACtB,IAAIL,UAAkC;QAEtC,IAAI;YACF,MAAMoC,gBAAgB9H,wBAAwB4H;YAC9C,IAAIA,UAAU,CAACE,eAAe;gBAC5B,MAAM,IAAI5H,YAAY,kBAAkB,kBAAkB;oBAACuC,QAAQ;gBAAG;YACxE;YAEA,MAAMoC,SAAS,MAAMjE,uBAAuB;gBAC1C0E;gBACAqC;gBACA,GAAIG,gBAAgB;oBAACF,QAAQE;gBAAa,IAAI,CAAC,CAAC;gBAChD,GAAIW,WAAWvC,YAAY;oBAACuC;gBAAM,IAAI,CAAC,CAAC;gBACxC,GAAIhG,WAAWyD,YAAY;oBAACzD;gBAAM,IAAI,CAAC,CAAC;gBACxC,GAAIkG,0BAA0BzC,YAAY;oBAAC0C,UAAUD;gBAAqB,IAAI,CAAC,CAAC;YAClF;YACA9C,cAAchB,OAAOgE,KAAK,CAAC3F,MAAM;YACjC6C,kBAAkBlB,OAAOqD,UAAU,KAAK;YACxCxC,UAAU;YAEV,OAAO;gBACLmD,OAAOhE,OAAOgE,KAAK,CAACb,GAAG,CAAC/D;gBACxBgE,aAAapD,OAAOqD,UAAU,GAAGjI,wBAAwB4E,OAAOqD,UAAU,IAAI;YAChF;QACF,SAAU;YACRhD,kCAAkC;gBAChC3C;gBACA+C;gBACAI;gBACAC,YAAYmD,KAAKC,KAAK,CAACR,YAAYC,GAAG,KAAKF;gBAC3CzC;gBACAC,gBAAgB;oBACd2C,QAAQA,WAAWvC;oBACnBzD,QAAQA,WAAWyD;oBACnByC,uBAAuBA,0BAA0BzC;gBACnD;gBACAH;YACF;QACF;IACF;AACF;AAEA,MAAMiD,mBAAmB7I,YAAY;IACnCsG,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,QAAQ;QACNzB,QAAQ/E,EAAE6I,MAAM,CAAC;YAACvG,QAAQtC,EAAE8I,MAAM,GAAGC,IAAI;QAAE;QAC3CtC,MAAM9G;QACN+G,UAAU;YAAC,KAAK9H;QAAuC;IACzD;IACAgI,cAAcb;IACdc,SAAS,OAAO1E;QACd,MAAMsC,SAAS,MAAM7D,yBAAyB;YAC5CsE,SAAShD,eAAeC;YACxBG,QAAQH,QAAQ4C,MAAM,CAACzC,MAAM;YAC7B0G,QAAQ7G,QAAQsE,IAAI,CAACuC,MAAM;YAC3B/B,gBAAgB1E,sBAAsBJ;YACtCwC,eAAexC,QAAQgB,EAAE;QAC3B;QACA,OAAOqB,+BAA+BC;IACxC;AACF;AAEA,MAAMwE,sBAAsBlJ,YAAY;IACtCsG,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,QAAQ;QACNzB,QAAQ/E,EAAE6I,MAAM,CAAC;YAACvG,QAAQtC,EAAE8I,MAAM,GAAGC,IAAI;QAAE;QAC3CtC,MAAMnH;QACNoH,UAAU;YAAC,KAAK9H;QAAuC;IACzD;IACAgI,cAAcb;IACdc,SAAS,OAAO1E;QACd,MAAMsC,SAAS,MAAMhE,4BAA4B;YAC/CyE,SAAShD,eAAeC;YACxBG,QAAQH,QAAQ4C,MAAM,CAACzC,MAAM;YAC7B,GAAIH,QAAQsE,IAAI,CAACuC,MAAM,GAAG;gBAACA,QAAQ7G,QAAQsE,IAAI,CAACuC,MAAM;YAAA,IAAI,CAAC,CAAC;YAC5D/B,gBAAgB1E,sBAAsBJ;YACtCwC,eAAexC,QAAQgB,EAAE;QAC3B;QACA,OAAOqB,+BAA+BC;IACxC;AACF;AAEA,MAAMyE,0BAA0BnJ,YAAY;IAC1CsG,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,QAAQ;QACNzB,QAAQ/E,EAAE6I,MAAM,CAAC;YAACvG,QAAQtC,EAAE8I,MAAM,GAAGC,IAAI;QAAE;QAC3CtC,MAAMhH;QACNiH,UAAU;YAAC,KAAKhH;QAA6C;IAC/D;IACAkH,cAAcb;IACdc,SAAS,OAAO1E;QACd,MAAMsC,SAAS,MAAM9D,gCAAgC;YACnDuE,SAAShD,eAAeC;YACxBG,QAAQH,QAAQ4C,MAAM,CAACzC,MAAM;YAC7B,GAAIH,QAAQsE,IAAI,CAACuC,MAAM,GAAG;gBAACA,QAAQ7G,QAAQsE,IAAI,CAACuC,MAAM;YAAA,IAAI,CAAC,CAAC;YAC5D/B,gBAAgB1E,sBAAsBJ;YACtCwC,eAAexC,QAAQgB,EAAE;QAC3B;QACA,OAAO;YACL,GAAGqB,+BAA+BC,OAAO;YACzC0E,kBAAkB1E,OAAO2E,eAAe;QAC1C;IACF;AACF;AAEA,MAAMC,aAAatJ,YAAY;IAC7BsG,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,QAAQ;QACNC,MAAMzH;QACN0H,UAAU;YAAC,KAAKzH;QAA4B;IAC9C;IACA2H,cAAcb;IACdc,SAAS,OAAO1E,SAAS2E;QACvB,MAAM5B,UAAUhD,eAAeC;QAC/B,MAAMe,QAAQ,MAAM7C,uBAAuB;YACzC6E;YACA5C,QAAQH,QAAQsE,IAAI,CAACrD,OAAO;YAC5BC,MAAMlB,QAAQsE,IAAI,CAACpD,IAAI;YACvB2F,QAAQ7G,QAAQsE,IAAI,CAACuC,MAAM;YAC3B/B,gBAAgB1E,sBAAsBJ;YACtCwC,eAAexC,QAAQgB,EAAE;QAC3B;QACA2D,MAAMI,IAAI,CAAC;QACX,OAAOjE,gBAAgBC;IACzB;AACF;AAEA,MAAMoG,cAAcvJ,YAAY;IAC9BsG,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,QAAQ;QACNzB,QAAQ/E,EAAE6I,MAAM,CAAC;YAACtE,SAASvE,EAAE8I,MAAM,GAAGC,IAAI;QAAE;QAC5CtC,MAAMlH;QACNmH,UAAU;YAAC,KAAKlH;QAA8B;IAChD;IACAoH,cAAcb;IACdc,SAAS,OAAO1E;QACd,MAAMe,QAAQ,MAAMxC,yBAAyB;YAC3CwE,SAAShD,eAAeC;YACxBoC,SAASpC,QAAQ4C,MAAM,CAACR,OAAO;YAC/ByE,QAAQ7G,QAAQsE,IAAI,CAACuC,MAAM;YAC3B/B,gBAAgB1E,sBAAsBJ;YACtCwC,eAAexC,QAAQgB,EAAE;QAC3B;QACA,OAAOF,gBAAgBC;IACzB;AACF;AAEA,OAAO,MAAMqG,uBAAmCjL,8BAA8B;IAC5EkL,QAAQ;IACRC,MAAMpL;IACNqL,QAAQ;QAACtD;QAAgBiB;QAAWgC;QAAYC;KAAY;AAC9D,GAAG;AAEH,OAAO,MAAMK,gCAA4CrL,8BAA8B;IACrFkL,QAAQ;IACRC,MAAMpL;IACNqL,QAAQ;QAACvC;KAAoB;AAC/B,GAAG;AAEH,SAASyC,2BAA2BC,UAAuC;IACzE,OAAO9J,YAAY;QACjBsG,QAAQ;QACRC,MAAM;QACNC,aACE;QACFC,QAAQ;YACNzB,QAAQ/E,EAAE6I,MAAM,CAAC;gBAACvG,QAAQtC,EAAE8I,MAAM,GAAGC,IAAI;YAAE;YAC3CtC,MAAMtH;YACNuH,UAAU;gBAAC,KAAKxH;YAAyB;QAC3C;QACA,0EAA0E;QAC1E,iEAAiE;QACjE,sEAAsE;QACtE,2EAA2E;QAC3E,oEAAoE;QACpEyH,YAAY;YACV5E,mCAAmC;YACnC,CAACI;gBACC5D,2BAA2B4D;gBAC3B,OAAO2D;YACT;SACD;QACDc,cAAcb;QACdc,SAAS,OAAO1E;YACd,MAAMC,SAASP,iBAAiBM;YAChC,MAAMsC,SAAS,MAAMnE,gBAAgB;gBACnC4E,SAAShD,eAAeC;gBACxB,GAAIC,QAAQ0H,iBAAiB;oBAACC,qBAAqB3H,OAAO0H,cAAc;gBAAA,IAAI,CAAC,CAAC;gBAC9EE,cAAc7H,QAAQ4C,MAAM,CAACzC,MAAM;gBACnC0G,QAAQ7G,QAAQsE,IAAI,CAACuC,MAAM;gBAC3B/B,gBAAgB1E,sBAAsBJ;gBACtC,sEAAsE;gBACtE,qEAAqE;gBACrE,qEAAqE;gBACrE,sEAAsE;gBACtE,kBAAkB;gBAClBwC,eAAevG;gBACfyL;YACF;YACA,mEAAmE;YACnE,kEAAkE;YAClE,OAAO;gBACLI,OAAOxF,OAAOwF,KAAK;gBACnBC,YAAYzF,OAAO0F,SAAS,CAAC3G,WAAW;gBACxC4G,aAAa,IAAIC,OAAO7G,WAAW;gBACnC8G,iBAAiB7F,OAAOqF,cAAc;gBACtChG,MAAMhC,UAAU2C,OAAOX,IAAI;YAC7B;QACF;IACF;AACF;AAEA,OAAO,SAASyG,+BACdV,UAAuC;IAEvC,OAAO;QACLvL,8BAA8B;YAC5BkL,QAAQ;YACRC,MAAMpL;YACNqL,QAAQ;gBACNzB;gBACAF;gBACAa;gBACAK;gBACAC;aACD;QACH;QACA,yEAAyE;QACzE,kEAAkE;QAClE,sEAAsE;QACtE,yEAAyE;QACzE;YACEM,QAAQ;YACRC,MAAMpL;YACNqL,QAAQ;gBAACE,2BAA2BC;aAAY;QAClD;KACD;AACH"}

package/dist/presentation/routes/email-verification/verify-email-resend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify-email-resend.d.ts","sourceRoot":"","sources":["../../../../src/presentation/routes/email-verification/verify-email-resend.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,sBAAsB,iDAiCjC,CAAC"}
+{"version":3,"file":"verify-email-resend.d.ts","sourceRoot":"","sources":["../../../../src/presentation/routes/email-verification/verify-email-resend.ts"],"names":[],"mappings":"AAYA,eAAO,MAAM,sBAAsB,iDAiCjC,CAAC"}

package/dist/presentation/routes/email-verification/verify-email-resend.js

@@ -3,6 +3,11 @@ import { EmailChallengeError } from '@shipfox/api-email-challenges';
 import { ClientError, defineRoute } from '@shipfox/node-fastify';
 import { resendEmailVerification } from '#core/auth.js';
 import { createAuthRateLimitPreHandler } from '#presentation/routes/rate-limit.js';
+function emailChallengeStatus(code) {
+    if (code === 'limited') return 429;
+    if (code === 'expired') return 410;
+    return 400;
+}
 export const verifyEmailResendRoute = defineRoute({
     method: 'POST',
     path: '/verify-email/resend',
@@ -17,7 +22,7 @@ export const verifyEmailResendRoute = defineRoute({
     errorHandler: (error)=>{
         if (error instanceof EmailChallengeError) {
             throw new ClientError(error.message, `email-challenge-${error.code}`, {
-                status: error.code === 'limited' ? 429 : error.code === 'expired' ? 410 : 400,
+                status: emailChallengeStatus(error.code),
                 ...error.retryAt ? {
                     details: {
                         retry_at: error.retryAt.toISOString()

package/dist/presentation/routes/email-verification/verify-email-resend.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/presentation/routes/email-verification/verify-email-resend.ts"],"sourcesContent":["import {verifyEmailResendBodySchema, verifyEmailResendResponseSchema} from '@shipfox/api-auth-dto';\nimport {EmailChallengeError} from '@shipfox/api-email-challenges';\nimport {ClientError, defineRoute} from '@shipfox/node-fastify';\nimport {resendEmailVerification} from '#core/auth.js';\nimport {createAuthRateLimitPreHandler} from '#presentation/routes/rate-limit.js';\n\nexport const verifyEmailResendRoute = defineRoute({\n  method: 'POST',\n  path: '/verify-email/resend',\n  description: 'Send a new email verification code if the account can be verified.',\n  schema: {\n    body: verifyEmailResendBodySchema,\n    response: {\n      200: verifyEmailResendResponseSchema,\n    },\n  },\n  preHandler: createAuthRateLimitPreHandler('email-send'),\n  errorHandler: (error) => {\n    if (error instanceof EmailChallengeError) {\n      throw new ClientError(error.message, `email-challenge-${error.code}`, {\n        status: error.code === 'limited' ? 429 : error.code === 'expired' ? 410 : 400,\n        ...(error.retryAt ? {details: {retry_at: error.retryAt.toISOString()}} : {}),\n      });\n    }\n    throw error;\n  },\n  handler: async (request, reply) => {\n    const {email, challenge_id} = request.body;\n\n    const result = await resendEmailVerification({\n      email,\n      challengeId: challenge_id,\n      sourceIp: request.ip,\n    });\n\n    reply.code(200).send({\n      next_resend_available_at: result.nextResendAvailableAt.toISOString(),\n    });\n  },\n});\n"],"names":["verifyEmailResendBodySchema","verifyEmailResendResponseSchema","EmailChallengeError","ClientError","defineRoute","resendEmailVerification","createAuthRateLimitPreHandler","verifyEmailResendRoute","method","path","description","schema","body","response","preHandler","errorHandler","error","message","code","status","retryAt","details","retry_at","toISOString","handler","request","reply","email","challenge_id","result","challengeId","sourceIp","ip","send","next_resend_available_at","nextResendAvailableAt"],"mappings":"AAAA,SAAQA,2BAA2B,EAAEC,+BAA+B,QAAO,wBAAwB;AACnG,SAAQC,mBAAmB,QAAO,gCAAgC;AAClE,SAAQC,WAAW,EAAEC,WAAW,QAAO,wBAAwB;AAC/D,SAAQC,uBAAuB,QAAO,gBAAgB;AACtD,SAAQC,6BAA6B,QAAO,qCAAqC;AAEjF,OAAO,MAAMC,yBAAyBH,YAAY;IAChDI,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,QAAQ;QACNC,MAAMZ;QACNa,UAAU;YACR,KAAKZ;QACP;IACF;IACAa,YAAYR,8BAA8B;IAC1CS,cAAc,CAACC;QACb,IAAIA,iBAAiBd,qBAAqB;YACxC,MAAM,IAAIC,YAAYa,MAAMC,OAAO,EAAE,CAAC,gBAAgB,EAAED,MAAME,IAAI,EAAE,EAAE;gBACpEC,QAAQH,MAAME,IAAI,KAAK,YAAY,MAAMF,MAAME,IAAI,KAAK,YAAY,MAAM;gBAC1E,GAAIF,MAAMI,OAAO,GAAG;oBAACC,SAAS;wBAACC,UAAUN,MAAMI,OAAO,CAACG,WAAW;oBAAE;gBAAC,IAAI,CAAC,CAAC;YAC7E;QACF;QACA,MAAMP;IACR;IACAQ,SAAS,OAAOC,SAASC;QACvB,MAAM,EAACC,KAAK,EAAEC,YAAY,EAAC,GAAGH,QAAQb,IAAI;QAE1C,MAAMiB,SAAS,MAAMxB,wBAAwB;YAC3CsB;YACAG,aAAaF;YACbG,UAAUN,QAAQO,EAAE;QACtB;QAEAN,MAAMR,IAAI,CAAC,KAAKe,IAAI,CAAC;YACnBC,0BAA0BL,OAAOM,qBAAqB,CAACZ,WAAW;QACpE;IACF;AACF,GAAG"}
+{"version":3,"sources":["../../../../src/presentation/routes/email-verification/verify-email-resend.ts"],"sourcesContent":["import {verifyEmailResendBodySchema, verifyEmailResendResponseSchema} from '@shipfox/api-auth-dto';\nimport {EmailChallengeError} from '@shipfox/api-email-challenges';\nimport {ClientError, defineRoute} from '@shipfox/node-fastify';\nimport {resendEmailVerification} from '#core/auth.js';\nimport {createAuthRateLimitPreHandler} from '#presentation/routes/rate-limit.js';\n\nfunction emailChallengeStatus(code: EmailChallengeError['code']): 400 | 410 | 429 {\n  if (code === 'limited') return 429;\n  if (code === 'expired') return 410;\n  return 400;\n}\n\nexport const verifyEmailResendRoute = defineRoute({\n  method: 'POST',\n  path: '/verify-email/resend',\n  description: 'Send a new email verification code if the account can be verified.',\n  schema: {\n    body: verifyEmailResendBodySchema,\n    response: {\n      200: verifyEmailResendResponseSchema,\n    },\n  },\n  preHandler: createAuthRateLimitPreHandler('email-send'),\n  errorHandler: (error) => {\n    if (error instanceof EmailChallengeError) {\n      throw new ClientError(error.message, `email-challenge-${error.code}`, {\n        status: emailChallengeStatus(error.code),\n        ...(error.retryAt ? {details: {retry_at: error.retryAt.toISOString()}} : {}),\n      });\n    }\n    throw error;\n  },\n  handler: async (request, reply) => {\n    const {email, challenge_id} = request.body;\n\n    const result = await resendEmailVerification({\n      email,\n      challengeId: challenge_id,\n      sourceIp: request.ip,\n    });\n\n    reply.code(200).send({\n      next_resend_available_at: result.nextResendAvailableAt.toISOString(),\n    });\n  },\n});\n"],"names":["verifyEmailResendBodySchema","verifyEmailResendResponseSchema","EmailChallengeError","ClientError","defineRoute","resendEmailVerification","createAuthRateLimitPreHandler","emailChallengeStatus","code","verifyEmailResendRoute","method","path","description","schema","body","response","preHandler","errorHandler","error","message","status","retryAt","details","retry_at","toISOString","handler","request","reply","email","challenge_id","result","challengeId","sourceIp","ip","send","next_resend_available_at","nextResendAvailableAt"],"mappings":"AAAA,SAAQA,2BAA2B,EAAEC,+BAA+B,QAAO,wBAAwB;AACnG,SAAQC,mBAAmB,QAAO,gCAAgC;AAClE,SAAQC,WAAW,EAAEC,WAAW,QAAO,wBAAwB;AAC/D,SAAQC,uBAAuB,QAAO,gBAAgB;AACtD,SAAQC,6BAA6B,QAAO,qCAAqC;AAEjF,SAASC,qBAAqBC,IAAiC;IAC7D,IAAIA,SAAS,WAAW,OAAO;IAC/B,IAAIA,SAAS,WAAW,OAAO;IAC/B,OAAO;AACT;AAEA,OAAO,MAAMC,yBAAyBL,YAAY;IAChDM,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,QAAQ;QACNC,MAAMd;QACNe,UAAU;YACR,KAAKd;QACP;IACF;IACAe,YAAYV,8BAA8B;IAC1CW,cAAc,CAACC;QACb,IAAIA,iBAAiBhB,qBAAqB;YACxC,MAAM,IAAIC,YAAYe,MAAMC,OAAO,EAAE,CAAC,gBAAgB,EAAED,MAAMV,IAAI,EAAE,EAAE;gBACpEY,QAAQb,qBAAqBW,MAAMV,IAAI;gBACvC,GAAIU,MAAMG,OAAO,GAAG;oBAACC,SAAS;wBAACC,UAAUL,MAAMG,OAAO,CAACG,WAAW;oBAAE;gBAAC,IAAI,CAAC,CAAC;YAC7E;QACF;QACA,MAAMN;IACR;IACAO,SAAS,OAAOC,SAASC;QACvB,MAAM,EAACC,KAAK,EAAEC,YAAY,EAAC,GAAGH,QAAQZ,IAAI;QAE1C,MAAMgB,SAAS,MAAMzB,wBAAwB;YAC3CuB;YACAG,aAAaF;YACbG,UAAUN,QAAQO,EAAE;QACtB;QAEAN,MAAMnB,IAAI,CAAC,KAAK0B,IAAI,CAAC;YACnBC,0BAA0BL,OAAOM,qBAAqB,CAACZ,WAAW;QACpE;IACF;AACF,GAAG"}

package/dist/presentation/routes/oauth.d.ts

@@ -0,0 +1,9 @@
+import { type RouteGroup } from '@shipfox/node-fastify';
+export interface CreateOAuthRoutesOptions {
+    /** Validated here and deliberately injected until production composition. */
+    apiPublicUrl: string;
+}
+export declare function createOAuthMetadataRoutes(options: CreateOAuthRoutesOptions): RouteGroup;
+export declare function createOAuthClientIdentificationRoutes(): RouteGroup;
+export declare function createOAuthRoutes(options: CreateOAuthRoutesOptions): RouteGroup;
+//# sourceMappingURL=oauth.d.ts.map

package/dist/presentation/routes/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../src/presentation/routes/oauth.ts"],"names":[],"mappings":"AAOA,OAAO,EAA2B,KAAK,UAAU,EAAC,MAAM,uBAAuB,CAAC;AAWhF,MAAM,WAAW,wBAAwB;IACvC,6EAA6E;IAC7E,YAAY,EAAE,MAAM,CAAC;CACtB;AAoGD,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,wBAAwB,GAAG,UAAU,CASvF;AAED,wBAAgB,qCAAqC,IAAI,UAAU,CAElE;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,GAAG,UAAU,CAO/E"}

package/dist/presentation/routes/oauth.js

@@ -0,0 +1,150 @@
+import { oauthAuthorizationServerMetadataSchema, oauthDynamicClientRegistrationRequestSchema, oauthDynamicClientRegistrationResponseSchema, oauthProtectedResourceMetadataSchema } from '@shipfox/api-auth-dto';
+import { ClientError, defineRoute } from '@shipfox/node-fastify';
+import { InvalidOAuthClientMetadataError, InvalidOAuthConfigurationError, OAuthMetadataFetchError, OAuthRedirectUriNotRegisteredError } from '#core/errors.js';
+import { validateOAuthPublicOrigin } from '#core/oauth-client.js';
+import { registerOAuthClient } from '#core/oauth-client-resolver.js';
+import { createAuthIpRateLimitPreHandler } from './rate-limit.js';
+function apiPublicOrigin(options) {
+    return validateOAuthPublicOrigin(options.apiPublicUrl);
+}
+function translateOAuthError(error) {
+    if (error instanceof InvalidOAuthClientMetadataError || error instanceof OAuthMetadataFetchError || error instanceof OAuthRedirectUriNotRegisteredError) {
+        throw new ClientError('OAuth client metadata is invalid', 'invalid-client-metadata', {
+            status: 400
+        });
+    }
+    if (error instanceof InvalidOAuthConfigurationError) {
+        throw new ClientError('OAuth configuration is invalid', 'oauth-configuration-invalid', {
+            status: 500
+        });
+    }
+    throw error;
+}
+function registrationResponse(result) {
+    return {
+        client_id: result.metadata.clientId,
+        client_name: result.metadata.clientName,
+        redirect_uris: result.metadata.redirectUris,
+        grant_types: result.metadata.grantTypes,
+        response_types: result.metadata.responseTypes,
+        token_endpoint_auth_method: result.metadata.tokenEndpointAuthMethod,
+        scope: result.metadata.scope
+    };
+}
+function createProtectedResourceMetadataRoute(origin) {
+    return defineRoute({
+        method: 'GET',
+        path: '/.well-known/oauth-protected-resource',
+        description: 'Describe the protected MCP resource and its authorization server.',
+        schema: {
+            response: {
+                200: oauthProtectedResourceMetadataSchema
+            }
+        },
+        handler: ()=>({
+                resource: `${origin}/mcp`,
+                authorization_servers: [
+                    origin
+                ],
+                scopes_supported: [
+                    'read'
+                ]
+            })
+    });
+}
+function createAuthorizationServerMetadataRoute(origin) {
+    return defineRoute({
+        method: 'GET',
+        path: '/.well-known/oauth-authorization-server',
+        description: 'Describe the MCP OAuth authorization server.',
+        schema: {
+            response: {
+                200: oauthAuthorizationServerMetadataSchema
+            }
+        },
+        handler: ()=>({
+                issuer: origin,
+                authorization_endpoint: `${origin}/oauth/authorize`,
+                token_endpoint: `${origin}/oauth/token`,
+                registration_endpoint: `${origin}/oauth/register`,
+                response_types_supported: [
+                    'code'
+                ],
+                grant_types_supported: [
+                    'authorization_code',
+                    'refresh_token'
+                ],
+                code_challenge_methods_supported: [
+                    'S256'
+                ],
+                token_endpoint_auth_methods_supported: [
+                    'none'
+                ],
+                scopes_supported: [
+                    'read'
+                ],
+                client_id_metadata_document_supported: true
+            })
+    });
+}
+function createDynamicRegistrationRoute() {
+    return defineRoute({
+        method: 'POST',
+        path: '/oauth/register',
+        description: 'Register a public OAuth client for MCP access.',
+        options: {
+            bodyLimit: 32 * 1024
+        },
+        schema: {
+            body: oauthDynamicClientRegistrationRequestSchema,
+            response: {
+                201: oauthDynamicClientRegistrationResponseSchema
+            }
+        },
+        preHandler: createAuthIpRateLimitPreHandler('oauth-register'),
+        errorHandler: translateOAuthError,
+        handler: async (request, reply)=>{
+            const result = await registerOAuthClient({
+                clientName: request.body.client_name,
+                redirectUris: request.body.redirect_uris,
+                grantTypes: request.body.grant_types,
+                responseTypes: request.body.response_types,
+                tokenEndpointAuthMethod: request.body.token_endpoint_auth_method,
+                scope: request.body.scope
+            });
+            reply.code(201);
+            return registrationResponse(result);
+        }
+    });
+}
+export function createOAuthMetadataRoutes(options) {
+    const origin = apiPublicOrigin(options);
+    return {
+        prefix: '',
+        routes: [
+            createProtectedResourceMetadataRoute(origin),
+            createAuthorizationServerMetadataRoute(origin)
+        ]
+    };
+}
+export function createOAuthClientIdentificationRoutes() {
+    return {
+        prefix: '',
+        routes: [
+            createDynamicRegistrationRoute()
+        ]
+    };
+}
+export function createOAuthRoutes(options) {
+    const metadataRoutes = createOAuthMetadataRoutes(options);
+    const clientIdentificationRoutes = createOAuthClientIdentificationRoutes();
+    return {
+        prefix: '',
+        routes: [
+            ...metadataRoutes.routes,
+            ...clientIdentificationRoutes.routes
+        ]
+    };
+}
+
+//# sourceMappingURL=oauth.js.map

package/dist/presentation/routes/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/presentation/routes/oauth.ts"],"sourcesContent":["import {\n  type OAuthDynamicClientRegistrationResponseDto,\n  oauthAuthorizationServerMetadataSchema,\n  oauthDynamicClientRegistrationRequestSchema,\n  oauthDynamicClientRegistrationResponseSchema,\n  oauthProtectedResourceMetadataSchema,\n} from '@shipfox/api-auth-dto';\nimport {ClientError, defineRoute, type RouteGroup} from '@shipfox/node-fastify';\nimport {\n  InvalidOAuthClientMetadataError,\n  InvalidOAuthConfigurationError,\n  OAuthMetadataFetchError,\n  OAuthRedirectUriNotRegisteredError,\n} from '#core/errors.js';\nimport {validateOAuthPublicOrigin} from '#core/oauth-client.js';\nimport {registerOAuthClient} from '#core/oauth-client-resolver.js';\nimport {createAuthIpRateLimitPreHandler} from './rate-limit.js';\n\nexport interface CreateOAuthRoutesOptions {\n  /** Validated here and deliberately injected until production composition. */\n  apiPublicUrl: string;\n}\n\nfunction apiPublicOrigin(options: CreateOAuthRoutesOptions): string {\n  return validateOAuthPublicOrigin(options.apiPublicUrl);\n}\n\nfunction translateOAuthError(error: unknown): never {\n  if (\n    error instanceof InvalidOAuthClientMetadataError ||\n    error instanceof OAuthMetadataFetchError ||\n    error instanceof OAuthRedirectUriNotRegisteredError\n  ) {\n    throw new ClientError('OAuth client metadata is invalid', 'invalid-client-metadata', {\n      status: 400,\n    });\n  }\n  if (error instanceof InvalidOAuthConfigurationError) {\n    throw new ClientError('OAuth configuration is invalid', 'oauth-configuration-invalid', {\n      status: 500,\n    });\n  }\n  throw error;\n}\n\nfunction registrationResponse(\n  result: Awaited<ReturnType<typeof registerOAuthClient>>,\n): OAuthDynamicClientRegistrationResponseDto {\n  return {\n    client_id: result.metadata.clientId,\n    client_name: result.metadata.clientName,\n    redirect_uris: result.metadata.redirectUris,\n    grant_types: result.metadata.grantTypes,\n    response_types: result.metadata.responseTypes,\n    token_endpoint_auth_method: result.metadata.tokenEndpointAuthMethod,\n    scope: result.metadata.scope,\n  };\n}\n\nfunction createProtectedResourceMetadataRoute(origin: string) {\n  return defineRoute({\n    method: 'GET',\n    path: '/.well-known/oauth-protected-resource',\n    description: 'Describe the protected MCP resource and its authorization server.',\n    schema: {response: {200: oauthProtectedResourceMetadataSchema}},\n    handler: () => ({\n      resource: `${origin}/mcp`,\n      authorization_servers: [origin],\n      scopes_supported: ['read'],\n    }),\n  });\n}\n\nfunction createAuthorizationServerMetadataRoute(origin: string) {\n  return defineRoute({\n    method: 'GET',\n    path: '/.well-known/oauth-authorization-server',\n    description: 'Describe the MCP OAuth authorization server.',\n    schema: {response: {200: oauthAuthorizationServerMetadataSchema}},\n    handler: () => ({\n      issuer: origin,\n      authorization_endpoint: `${origin}/oauth/authorize`,\n      token_endpoint: `${origin}/oauth/token`,\n      registration_endpoint: `${origin}/oauth/register`,\n      response_types_supported: ['code'],\n      grant_types_supported: ['authorization_code', 'refresh_token'],\n      code_challenge_methods_supported: ['S256'],\n      token_endpoint_auth_methods_supported: ['none'],\n      scopes_supported: ['read'],\n      client_id_metadata_document_supported: true,\n    }),\n  });\n}\n\nfunction createDynamicRegistrationRoute() {\n  return defineRoute({\n    method: 'POST',\n    path: '/oauth/register',\n    description: 'Register a public OAuth client for MCP access.',\n    options: {bodyLimit: 32 * 1024},\n    schema: {\n      body: oauthDynamicClientRegistrationRequestSchema,\n      response: {201: oauthDynamicClientRegistrationResponseSchema},\n    },\n    preHandler: createAuthIpRateLimitPreHandler('oauth-register'),\n    errorHandler: translateOAuthError,\n    handler: async (request, reply) => {\n      const result = await registerOAuthClient({\n        clientName: request.body.client_name,\n        redirectUris: request.body.redirect_uris,\n        grantTypes: request.body.grant_types,\n        responseTypes: request.body.response_types,\n        tokenEndpointAuthMethod: request.body.token_endpoint_auth_method,\n        scope: request.body.scope,\n      });\n      reply.code(201);\n      return registrationResponse(result);\n    },\n  });\n}\n\nexport function createOAuthMetadataRoutes(options: CreateOAuthRoutesOptions): RouteGroup {\n  const origin = apiPublicOrigin(options);\n  return {\n    prefix: '',\n    routes: [\n      createProtectedResourceMetadataRoute(origin),\n      createAuthorizationServerMetadataRoute(origin),\n    ],\n  };\n}\n\nexport function createOAuthClientIdentificationRoutes(): RouteGroup {\n  return {prefix: '', routes: [createDynamicRegistrationRoute()]};\n}\n\nexport function createOAuthRoutes(options: CreateOAuthRoutesOptions): RouteGroup {\n  const metadataRoutes = createOAuthMetadataRoutes(options);\n  const clientIdentificationRoutes = createOAuthClientIdentificationRoutes();\n  return {\n    prefix: '',\n    routes: [...metadataRoutes.routes, ...clientIdentificationRoutes.routes],\n  };\n}\n"],"names":["oauthAuthorizationServerMetadataSchema","oauthDynamicClientRegistrationRequestSchema","oauthDynamicClientRegistrationResponseSchema","oauthProtectedResourceMetadataSchema","ClientError","defineRoute","InvalidOAuthClientMetadataError","InvalidOAuthConfigurationError","OAuthMetadataFetchError","OAuthRedirectUriNotRegisteredError","validateOAuthPublicOrigin","registerOAuthClient","createAuthIpRateLimitPreHandler","apiPublicOrigin","options","apiPublicUrl","translateOAuthError","error","status","registrationResponse","result","client_id","metadata","clientId","client_name","clientName","redirect_uris","redirectUris","grant_types","grantTypes","response_types","responseTypes","token_endpoint_auth_method","tokenEndpointAuthMethod","scope","createProtectedResourceMetadataRoute","origin","method","path","description","schema","response","handler","resource","authorization_servers","scopes_supported","createAuthorizationServerMetadataRoute","issuer","authorization_endpoint","token_endpoint","registration_endpoint","response_types_supported","grant_types_supported","code_challenge_methods_supported","token_endpoint_auth_methods_supported","client_id_metadata_document_supported","createDynamicRegistrationRoute","bodyLimit","body","preHandler","errorHandler","request","reply","code","createOAuthMetadataRoutes","prefix","routes","createOAuthClientIdentificationRoutes","createOAuthRoutes","metadataRoutes","clientIdentificationRoutes"],"mappings":"AAAA,SAEEA,sCAAsC,EACtCC,2CAA2C,EAC3CC,4CAA4C,EAC5CC,oCAAoC,QAC/B,wBAAwB;AAC/B,SAAQC,WAAW,EAAEC,WAAW,QAAwB,wBAAwB;AAChF,SACEC,+BAA+B,EAC/BC,8BAA8B,EAC9BC,uBAAuB,EACvBC,kCAAkC,QAC7B,kBAAkB;AACzB,SAAQC,yBAAyB,QAAO,wBAAwB;AAChE,SAAQC,mBAAmB,QAAO,iCAAiC;AACnE,SAAQC,+BAA+B,QAAO,kBAAkB;AAOhE,SAASC,gBAAgBC,OAAiC;IACxD,OAAOJ,0BAA0BI,QAAQC,YAAY;AACvD;AAEA,SAASC,oBAAoBC,KAAc;IACzC,IACEA,iBAAiBX,mCACjBW,iBAAiBT,2BACjBS,iBAAiBR,oCACjB;QACA,MAAM,IAAIL,YAAY,oCAAoC,2BAA2B;YACnFc,QAAQ;QACV;IACF;IACA,IAAID,iBAAiBV,gCAAgC;QACnD,MAAM,IAAIH,YAAY,kCAAkC,+BAA+B;YACrFc,QAAQ;QACV;IACF;IACA,MAAMD;AACR;AAEA,SAASE,qBACPC,MAAuD;IAEvD,OAAO;QACLC,WAAWD,OAAOE,QAAQ,CAACC,QAAQ;QACnCC,aAAaJ,OAAOE,QAAQ,CAACG,UAAU;QACvCC,eAAeN,OAAOE,QAAQ,CAACK,YAAY;QAC3CC,aAAaR,OAAOE,QAAQ,CAACO,UAAU;QACvCC,gBAAgBV,OAAOE,QAAQ,CAACS,aAAa;QAC7CC,4BAA4BZ,OAAOE,QAAQ,CAACW,uBAAuB;QACnEC,OAAOd,OAAOE,QAAQ,CAACY,KAAK;IAC9B;AACF;AAEA,SAASC,qCAAqCC,MAAc;IAC1D,OAAO/B,YAAY;QACjBgC,QAAQ;QACRC,MAAM;QACNC,aAAa;QACbC,QAAQ;YAACC,UAAU;gBAAC,KAAKtC;YAAoC;QAAC;QAC9DuC,SAAS,IAAO,CAAA;gBACdC,UAAU,GAAGP,OAAO,IAAI,CAAC;gBACzBQ,uBAAuB;oBAACR;iBAAO;gBAC/BS,kBAAkB;oBAAC;iBAAO;YAC5B,CAAA;IACF;AACF;AAEA,SAASC,uCAAuCV,MAAc;IAC5D,OAAO/B,YAAY;QACjBgC,QAAQ;QACRC,MAAM;QACNC,aAAa;QACbC,QAAQ;YAACC,UAAU;gBAAC,KAAKzC;YAAsC;QAAC;QAChE0C,SAAS,IAAO,CAAA;gBACdK,QAAQX;gBACRY,wBAAwB,GAAGZ,OAAO,gBAAgB,CAAC;gBACnDa,gBAAgB,GAAGb,OAAO,YAAY,CAAC;gBACvCc,uBAAuB,GAAGd,OAAO,eAAe,CAAC;gBACjDe,0BAA0B;oBAAC;iBAAO;gBAClCC,uBAAuB;oBAAC;oBAAsB;iBAAgB;gBAC9DC,kCAAkC;oBAAC;iBAAO;gBAC1CC,uCAAuC;oBAAC;iBAAO;gBAC/CT,kBAAkB;oBAAC;iBAAO;gBAC1BU,uCAAuC;YACzC,CAAA;IACF;AACF;AAEA,SAASC;IACP,OAAOnD,YAAY;QACjBgC,QAAQ;QACRC,MAAM;QACNC,aAAa;QACbzB,SAAS;YAAC2C,WAAW,KAAK;QAAI;QAC9BjB,QAAQ;YACNkB,MAAMzD;YACNwC,UAAU;gBAAC,KAAKvC;YAA4C;QAC9D;QACAyD,YAAY/C,gCAAgC;QAC5CgD,cAAc5C;QACd0B,SAAS,OAAOmB,SAASC;YACvB,MAAM1C,SAAS,MAAMT,oBAAoB;gBACvCc,YAAYoC,QAAQH,IAAI,CAAClC,WAAW;gBACpCG,cAAckC,QAAQH,IAAI,CAAChC,aAAa;gBACxCG,YAAYgC,QAAQH,IAAI,CAAC9B,WAAW;gBACpCG,eAAe8B,QAAQH,IAAI,CAAC5B,cAAc;gBAC1CG,yBAAyB4B,QAAQH,IAAI,CAAC1B,0BAA0B;gBAChEE,OAAO2B,QAAQH,IAAI,CAACxB,KAAK;YAC3B;YACA4B,MAAMC,IAAI,CAAC;YACX,OAAO5C,qBAAqBC;QAC9B;IACF;AACF;AAEA,OAAO,SAAS4C,0BAA0BlD,OAAiC;IACzE,MAAMsB,SAASvB,gBAAgBC;IAC/B,OAAO;QACLmD,QAAQ;QACRC,QAAQ;YACN/B,qCAAqCC;YACrCU,uCAAuCV;SACxC;IACH;AACF;AAEA,OAAO,SAAS+B;IACd,OAAO;QAACF,QAAQ;QAAIC,QAAQ;YAACV;SAAiC;IAAA;AAChE;AAEA,OAAO,SAASY,kBAAkBtD,OAAiC;IACjE,MAAMuD,iBAAiBL,0BAA0BlD;IACjD,MAAMwD,6BAA6BH;IACnC,OAAO;QACLF,QAAQ;QACRC,QAAQ;eAAIG,eAAeH,MAAM;eAAKI,2BAA2BJ,MAAM;SAAC;IAC1E;AACF"}

package/dist/presentation/routes/rate-limit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../../src/presentation/routes/rate-limit.ts"],"names":[],"mappings":"AACA,OAAO,EAAc,KAAK,YAAY,EAAE,KAAK,cAAc,EAAC,MAAM,uBAAuB,CAAC;AAE1F,OAAO,EACL,KAAK,mBAAmB,EAIzB,MAAM,qBAAqB,CAAC;AAmC7B,UAAU,SAAS;IACjB,KAAK,EAAE,MAAM,CAAC;CACf;AAgDD,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,mBAAmB,aAChD,cAAc,CAAC;IAAC,IAAI,EAAE,SAAS,CAAA;CAAC,CAAC,SAAS,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAiB9F;AAED,wBAAgB,+BAA+B,CAAC,MAAM,EAAE,mBAAmB,aAClD,cAAc,SAAS,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAS3E;AAED;;;;;;GAMG;AACH,wBAAgB,kCAAkC,CAAC,MAAM,EAAE,mBAAmB,aACrD,cAAc,SAAS,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAmB3E"}
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../../src/presentation/routes/rate-limit.ts"],"names":[],"mappings":"AACA,OAAO,EAAc,KAAK,YAAY,EAAE,KAAK,cAAc,EAAC,MAAM,uBAAuB,CAAC;AAE1F,OAAO,EACL,KAAK,mBAAmB,EAIzB,MAAM,qBAAqB,CAAC;AAmD7B,UAAU,SAAS;IACjB,KAAK,EAAE,MAAM,CAAC;CACf;AAgDD,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,mBAAmB,aAChD,cAAc,CAAC;IAAC,IAAI,EAAE,SAAS,CAAA;CAAC,CAAC,SAAS,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAiB9F;AAED,wBAAgB,+BAA+B,CAAC,MAAM,EAAE,mBAAmB,aAClD,cAAc,SAAS,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAS3E;AAED;;;;;;GAMG;AACH,wBAAgB,kCAAkC,CAAC,MAAM,EAAE,mBAAmB,aACrD,cAAc,SAAS,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAmB3E"}