@stratum-hq/control-plane 0.1.0

package/dist/middleware/auth.js

@@ -0,0 +1,70 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAuthMiddleware = void 0;
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+const config_js_1 = require("../config.js");
+const core_1 = require("@stratum-hq/core");
+function createAuthMiddleware(stratum) {
+    return async function authMiddleware(request, reply) {
+        // Skip auth for health and documentation endpoints
+        if (request.url === "/api/v1/health" ||
+            request.url.startsWith("/api/v1/health?") ||
+            request.url.startsWith("/api/docs")) {
+            return;
+        }
+        // Try API key first
+        const apiKeyHeader = request.headers["x-api-key"];
+        if (apiKeyHeader && typeof apiKeyHeader === "string") {
+            const result = await stratum.validateApiKey(apiKeyHeader);
+            if (!result) {
+                throw new core_1.UnauthorizedError("Invalid or revoked API key");
+            }
+            request.apiKey = {
+                id: result.key_id,
+                tenant_id: result.tenant_id,
+                key_hash: "",
+                name: "",
+                created_at: new Date(),
+                scopes: result.scopes,
+                rate_limit_max: result.rate_limit_max,
+                rate_limit_window: result.rate_limit_window,
+            };
+            request.authMethod = "api_key";
+            return;
+        }
+        // Try JWT Bearer token
+        const authHeader = request.headers["authorization"];
+        if (authHeader && typeof authHeader === "string" && authHeader.startsWith("Bearer ")) {
+            const token = authHeader.slice(7);
+            try {
+                const payload = jsonwebtoken_1.default.verify(token, config_js_1.config.jwtSecret, { algorithms: ["HS256"] });
+                // Store a synthetic api key record from JWT claims
+                // Extract scopes from JWT claims; default to full access for backward compat
+                const jwtScopes = Array.isArray(payload.scopes)
+                    ? payload.scopes.filter((s) => typeof s === "string" && ["read", "write", "admin"].includes(s))
+                    : ["read"];
+                request.apiKey = {
+                    id: payload.sub ?? "",
+                    tenant_id: payload.tenant_id ?? null,
+                    key_hash: "",
+                    name: payload.name ?? "jwt",
+                    created_at: new Date(),
+                    scopes: jwtScopes,
+                    rate_limit_max: null,
+                    rate_limit_window: null,
+                };
+                request.authMethod = "jwt";
+                return;
+            }
+            catch {
+                throw new core_1.UnauthorizedError("Invalid or expired token");
+            }
+        }
+        throw new core_1.UnauthorizedError("Authentication required. Provide X-API-Key or Authorization: Bearer header");
+    };
+}
+exports.createAuthMiddleware = createAuthMiddleware;
+//# sourceMappingURL=auth.js.map

package/dist/middleware/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":";;;;;;AACA,gEAA+B;AAC/B,4CAAsC;AACtC,2CAAqD;AAqBrD,SAAgB,oBAAoB,CAAC,OAAgB;IACnD,OAAO,KAAK,UAAU,cAAc,CAClC,OAAuB,EACvB,KAAmB;QAEnB,mDAAmD;QACnD,IACE,OAAO,CAAC,GAAG,KAAK,gBAAgB;YAChC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,iBAAiB,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,EACnC,CAAC;YACD,OAAO;QACT,CAAC;QAED,oBAAoB;QACpB,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAClD,IAAI,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;YAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,wBAAiB,CAAC,4BAA4B,CAAC,CAAC;YAC5D,CAAC;YACD,OAAO,CAAC,MAAM,GAAG;gBACf,EAAE,EAAE,MAAM,CAAC,MAAM;gBACjB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,QAAQ,EAAE,EAAE;gBACZ,IAAI,EAAE,EAAE;gBACR,UAAU,EAAE,IAAI,IAAI,EAAE;gBACtB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;aAC5C,CAAC;YACF,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC;YAC/B,OAAO;QACT,CAAC;QAED,uBAAuB;QACvB,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QACpD,IAAI,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACrF,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,kBAAM,CAAC,SAAS,EAAE,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,CAAmB,CAAC;gBACjG,mDAAmD;gBACnD,6EAA6E;gBAC7E,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;oBAC7C,CAAC,CAAE,OAAO,CAAC,MAAoB,CAAC,MAAM,CAClC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CACpF;oBACH,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;gBACb,OAAO,CAAC,MAAM,GAAG;oBACf,EAAE,EAAE,OAAO,CAAC,GAAG,IAAI,EAAE;oBACrB,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;oBACpC,QAAQ,EAAE,EAAE;oBACZ,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,KAAK;oBAC3B,UAAU,EAAE,IAAI,IAAI,EAAE;oBACtB,MAAM,EAAE,SAAS;oBACjB,cAAc,EAAE,IAAI;oBACpB,iBAAiB,EAAE,IAAI;iBACxB,CAAC;gBACF,OAAO,CAAC,UAAU,GAAG,KAAK,CAAC;gBAC3B,OAAO;YACT,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,wBAAiB,CAAC,0BAA0B,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;QAED,MAAM,IAAI,wBAAiB,CAAC,4EAA4E,CAAC,CAAC;IAC5G,CAAC,CAAC;AACJ,CAAC;AAnED,oDAmEC"}

package/dist/middleware/authorize.d.ts

@@ -0,0 +1,3 @@
+import { FastifyRequest, FastifyReply } from "fastify";
+export declare function createAuthorizeMiddleware(): (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
+//# sourceMappingURL=authorize.d.ts.map

package/dist/middleware/authorize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../src/middleware/authorize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAqCvD,wBAAgB,yBAAyB,cAE5B,cAAc,SAChB,YAAY,KAClB,QAAQ,IAAI,CAAC,CAsBjB"}

package/dist/middleware/authorize.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAuthorizeMiddleware = void 0;
+const core_1 = require("@stratum-hq/core");
+function methodToScope(method) {
+    switch (method.toUpperCase()) {
+        case "GET":
+        case "HEAD":
+        case "OPTIONS":
+            return "read";
+        default:
+            return "write";
+    }
+}
+// Route patterns that require admin scope for ALL methods
+const ADMIN_ROUTES = [
+    /^\/api\/v1\/api-keys/,
+    /^\/api\/v1\/audit-logs/,
+    /^\/api\/v1\/maintenance/,
+    /^\/api\/v1\/regions/,
+    /^\/api\/v1\/tenants\/[^/]+\/purge$/,
+    /^\/api\/v1\/tenants\/[^/]+\/export$/,
+    /^\/api\/v1\/tenants\/[^/]+\/migrate-region$/,
+    /^\/api\/v1\/tenants\/[^/]+\/context$/,
+];
+function getRequiredScope(method, url) {
+    for (const pattern of ADMIN_ROUTES) {
+        if (pattern.test(url)) {
+            return "admin";
+        }
+    }
+    return methodToScope(method);
+}
+function createAuthorizeMiddleware() {
+    return async function authorizeMiddleware(request, reply) {
+        // Skip for health and documentation endpoints
+        if (request.url === "/api/v1/health" ||
+            request.url.startsWith("/api/v1/health?") ||
+            request.url.startsWith("/api/docs")) {
+            return;
+        }
+        // If no apiKey, auth middleware should have rejected — fail closed
+        if (!request.apiKey) {
+            throw new core_1.UnauthorizedError("Authentication required");
+        }
+        const requiredScope = getRequiredScope(request.method, request.url);
+        const scopes = request.apiKey.scopes ?? ["read"];
+        if (!scopes.includes(requiredScope)) {
+            throw new core_1.ForbiddenError("Insufficient permissions for this operation");
+        }
+    };
+}
+exports.createAuthorizeMiddleware = createAuthorizeMiddleware;
+//# sourceMappingURL=authorize.js.map

package/dist/middleware/authorize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.js","sourceRoot":"","sources":["../../src/middleware/authorize.ts"],"names":[],"mappings":";;;AACA,2CAAqE;AAIrE,SAAS,aAAa,CAAC,MAAc;IACnC,QAAQ,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;QAC7B,KAAK,KAAK,CAAC;QACX,KAAK,MAAM,CAAC;QACZ,KAAK,SAAS;YACZ,OAAO,MAAM,CAAC;QAChB;YACE,OAAO,OAAO,CAAC;IACnB,CAAC;AACH,CAAC;AAED,0DAA0D;AAC1D,MAAM,YAAY,GAAG;IACnB,sBAAsB;IACtB,wBAAwB;IACxB,yBAAyB;IACzB,qBAAqB;IACrB,oCAAoC;IACpC,qCAAqC;IACrC,6CAA6C;IAC7C,sCAAsC;CACvC,CAAC;AAEF,SAAS,gBAAgB,CAAC,MAAc,EAAE,GAAW;IACnD,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;QACnC,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,SAAgB,yBAAyB;IACvC,OAAO,KAAK,UAAU,mBAAmB,CACvC,OAAuB,EACvB,KAAmB;QAEnB,8CAA8C;QAC9C,IACE,OAAO,CAAC,GAAG,KAAK,gBAAgB;YAChC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,iBAAiB,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,EACnC,CAAC;YACD,OAAO;QACT,CAAC;QAED,mEAAmE;QACnE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,MAAM,IAAI,wBAAiB,CAAC,yBAAyB,CAAC,CAAC;QACzD,CAAC;QAED,MAAM,aAAa,GAAG,gBAAgB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC;QAEjD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,qBAAc,CAAC,6CAA6C,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AA1BD,8DA0BC"}

package/dist/middleware/error-handler.d.ts

@@ -0,0 +1,3 @@
+import { FastifyRequest, FastifyReply, FastifyError } from "fastify";
+export declare function errorHandler(error: FastifyError | Error, request: FastifyRequest, reply: FastifyReply): void;
+//# sourceMappingURL=error-handler.d.ts.map

package/dist/middleware/error-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-handler.d.ts","sourceRoot":"","sources":["../../src/middleware/error-handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAKrE,wBAAgB,YAAY,CAC1B,KAAK,EAAE,YAAY,GAAG,KAAK,EAC3B,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,YAAY,GAClB,IAAI,CA2CN"}

package/dist/middleware/error-handler.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.errorHandler = void 0;
+const zod_1 = require("zod");
+const core_1 = require("@stratum-hq/core");
+const config_js_1 = require("../config.js");
+function errorHandler(error, request, reply) {
+    if (config_js_1.config.nodeEnv === "development") {
+        console.error("[error]", error);
+    }
+    if (error instanceof core_1.StratumError) {
+        reply.status(error.statusCode).send(error.toJSON());
+        return;
+    }
+    if (error instanceof zod_1.ZodError) {
+        reply.status(400).send({
+            error: {
+                code: "VALIDATION_ERROR",
+                message: "Validation failed",
+                issues: error.issues.map((issue) => ({
+                    path: issue.path,
+                    message: issue.message,
+                    code: issue.code,
+                })),
+            },
+        });
+        return;
+    }
+    // Fastify validation errors (e.g. schema validation)
+    const fastifyError = error;
+    if (fastifyError.statusCode && fastifyError.statusCode < 500) {
+        reply.status(fastifyError.statusCode).send({
+            error: {
+                code: "VALIDATION_ERROR",
+                message: error.message,
+            },
+        });
+        return;
+    }
+    reply.status(500).send({
+        error: {
+            code: "INTERNAL_SERVER_ERROR",
+            message: "An unexpected error occurred",
+        },
+    });
+}
+exports.errorHandler = errorHandler;
+//# sourceMappingURL=error-handler.js.map

package/dist/middleware/error-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-handler.js","sourceRoot":"","sources":["../../src/middleware/error-handler.ts"],"names":[],"mappings":";;;AACA,6BAA+B;AAC/B,2CAAgD;AAChD,4CAAsC;AAEtC,SAAgB,YAAY,CAC1B,KAA2B,EAC3B,OAAuB,EACvB,KAAmB;IAEnB,IAAI,kBAAM,CAAC,OAAO,KAAK,aAAa,EAAE,CAAC;QACrC,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;IAED,IAAI,KAAK,YAAY,mBAAY,EAAE,CAAC;QAClC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACpD,OAAO;IACT,CAAC;IAED,IAAI,KAAK,YAAY,cAAQ,EAAE,CAAC;QAC9B,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACrB,KAAK,EAAE;gBACL,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,mBAAmB;gBAC5B,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;oBACnC,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,IAAI,EAAE,KAAK,CAAC,IAAI;iBACjB,CAAC,CAAC;aACJ;SACF,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,qDAAqD;IACrD,MAAM,YAAY,GAAG,KAAqB,CAAC;IAC3C,IAAI,YAAY,CAAC,UAAU,IAAI,YAAY,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC;QAC7D,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC;YACzC,KAAK,EAAE;gBACL,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB;SACF,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;QACrB,KAAK,EAAE;YACL,IAAI,EAAE,uBAAuB;YAC7B,OAAO,EAAE,8BAA8B;SACxC;KACF,CAAC,CAAC;AACL,CAAC;AA/CD,oCA+CC"}

package/dist/middleware/per-key-rate-limit.d.ts

@@ -0,0 +1,3 @@
+import { FastifyRequest, FastifyReply } from "fastify";
+export declare function createPerKeyRateLimitMiddleware(): (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
+//# sourceMappingURL=per-key-rate-limit.d.ts.map

package/dist/middleware/per-key-rate-limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"per-key-rate-limit.d.ts","sourceRoot":"","sources":["../../src/middleware/per-key-rate-limit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAqCvD,wBAAgB,+BAA+B,cAKlC,cAAc,SAChB,YAAY,KAClB,QAAQ,IAAI,CAAC,CA2CjB"}

package/dist/middleware/per-key-rate-limit.js

@@ -0,0 +1,62 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createPerKeyRateLimitMiddleware = void 0;
+const config_js_1 = require("../config.js");
+const keyLimits = new Map();
+/** Parse a duration string like "1 minute", "30 seconds", "1 hour" into milliseconds. */
+function parseWindow(window) {
+    const match = window.match(/^(\d+)\s*(second|minute|hour|day)s?$/i);
+    if (!match)
+        return 60_000; // default 1 minute
+    const value = parseInt(match[1], 10);
+    switch (match[2].toLowerCase()) {
+        case "second": return value * 1_000;
+        case "minute": return value * 60_000;
+        case "hour": return value * 3_600_000;
+        case "day": return value * 86_400_000;
+        default: return 60_000;
+    }
+}
+function createPerKeyRateLimitMiddleware() {
+    const globalMax = config_js_1.config.rateLimitMax;
+    const globalWindowMs = parseWindow(config_js_1.config.rateLimitWindow);
+    return async function perKeyRateLimitMiddleware(request, reply) {
+        // Skip for unauthenticated requests (health endpoint)
+        if (!request.apiKey)
+            return;
+        const keyId = request.apiKey.id;
+        const max = request.apiKey.rate_limit_max ?? globalMax;
+        const windowMs = request.apiKey.rate_limit_window
+            ? parseWindow(request.apiKey.rate_limit_window)
+            : globalWindowMs;
+        let entry = keyLimits.get(keyId);
+        if (!entry || entry.max !== max || entry.windowMs !== windowMs) {
+            entry = { timestamps: [], windowMs, max };
+            keyLimits.set(keyId, entry);
+        }
+        const now = Date.now();
+        const cutoff = now - windowMs;
+        // Prune expired timestamps
+        entry.timestamps = entry.timestamps.filter((t) => t > cutoff);
+        if (entry.timestamps.length >= max) {
+            const retryAfter = Math.ceil((entry.timestamps[0] + windowMs - now) / 1000);
+            reply.header("Retry-After", String(retryAfter));
+            reply.header("X-RateLimit-Limit", String(max));
+            reply.header("X-RateLimit-Remaining", "0");
+            reply.header("X-RateLimit-Reset", new Date(entry.timestamps[0] + windowMs).toISOString());
+            reply.status(429).send({
+                error: {
+                    code: "RATE_LIMITED",
+                    message: `Rate limit exceeded. Try again in ${retryAfter} seconds.`,
+                },
+            });
+            return;
+        }
+        entry.timestamps.push(now);
+        // Set rate limit headers on all responses
+        reply.header("X-RateLimit-Limit", String(max));
+        reply.header("X-RateLimit-Remaining", String(max - entry.timestamps.length));
+    };
+}
+exports.createPerKeyRateLimitMiddleware = createPerKeyRateLimitMiddleware;
+//# sourceMappingURL=per-key-rate-limit.js.map

package/dist/middleware/per-key-rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"per-key-rate-limit.js","sourceRoot":"","sources":["../../src/middleware/per-key-rate-limit.ts"],"names":[],"mappings":";;;AACA,4CAAsC;AAoBtC,MAAM,SAAS,GAAG,IAAI,GAAG,EAA0B,CAAC;AAEpD,yFAAyF;AACzF,SAAS,WAAW,CAAC,MAAc;IACjC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;IACpE,IAAI,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC,CAAC,mBAAmB;IAC9C,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACrC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QAC/B,KAAK,QAAQ,CAAC,CAAC,OAAO,KAAK,GAAG,KAAK,CAAC;QACpC,KAAK,QAAQ,CAAC,CAAC,OAAO,KAAK,GAAG,MAAM,CAAC;QACrC,KAAK,MAAM,CAAC,CAAG,OAAO,KAAK,GAAG,SAAS,CAAC;QACxC,KAAK,KAAK,CAAC,CAAI,OAAO,KAAK,GAAG,UAAU,CAAC;QACzC,OAAO,CAAC,CAAO,OAAO,MAAM,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,SAAgB,+BAA+B;IAC7C,MAAM,SAAS,GAAG,kBAAM,CAAC,YAAY,CAAC;IACtC,MAAM,cAAc,GAAG,WAAW,CAAC,kBAAM,CAAC,eAAe,CAAC,CAAC;IAE3D,OAAO,KAAK,UAAU,yBAAyB,CAC7C,OAAuB,EACvB,KAAmB;QAEnB,sDAAsD;QACtD,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,OAAO;QAE5B,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,cAAc,IAAI,SAAS,CAAC;QACvD,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,iBAAiB;YAC/C,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC;YAC/C,CAAC,CAAC,cAAc,CAAC;QAEnB,IAAI,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,GAAG,KAAK,GAAG,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC/D,KAAK,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;YAC1C,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC9B,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,GAAG,GAAG,QAAQ,CAAC;QAE9B,2BAA2B;QAC3B,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;QAE9D,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YACnC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,QAAQ,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;YAC5E,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;YAChD,KAAK,CAAC,MAAM,CAAC,mBAAmB,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/C,KAAK,CAAC,MAAM,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;YAC3C,KAAK,CAAC,MAAM,CAAC,mBAAmB,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YAC1F,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACrB,KAAK,EAAE;oBACL,IAAI,EAAE,cAAc;oBACpB,OAAO,EAAE,qCAAqC,UAAU,WAAW;iBACpE;aACF,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAE3B,0CAA0C;QAC1C,KAAK,CAAC,MAAM,CAAC,mBAAmB,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/C,KAAK,CAAC,MAAM,CAAC,uBAAuB,EAAE,MAAM,CAAC,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/E,CAAC,CAAC;AACJ,CAAC;AAlDD,0EAkDC"}

package/dist/middleware/rate-limit-redis.d.ts

@@ -0,0 +1,16 @@
+import { FastifyRequest, FastifyReply } from "fastify";
+import type Redis from "ioredis";
+export interface RedisRateLimitConfig {
+    /** Maximum number of requests allowed in the window. */
+    maxRequests: number;
+    /** Window duration in milliseconds. */
+    windowMs: number;
+}
+/**
+ * Create a Redis-backed per-key rate limiter.
+ *
+ * Returns a Fastify preHandler hook. If Redis is unavailable or slow (>500ms)
+ * the request is allowed through (fail-open).
+ */
+export declare function createRedisRateLimiter(redis: Redis, defaults: RedisRateLimitConfig): (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
+//# sourceMappingURL=rate-limit-redis.d.ts.map

package/dist/middleware/rate-limit-redis.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit-redis.d.ts","sourceRoot":"","sources":["../../src/middleware/rate-limit-redis.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvD,OAAO,KAAK,KAAK,MAAM,SAAS,CAAC;AAEjC,MAAM,WAAW,oBAAoB;IACnC,wDAAwD;IACxD,WAAW,EAAE,MAAM,CAAC;IACpB,uCAAuC;IACvC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAwBD;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,KAAK,EACZ,QAAQ,EAAE,oBAAoB,aAcnB,cAAc,SAChB,YAAY,KAClB,QAAQ,IAAI,CAAC,CA+CjB"}

package/dist/middleware/rate-limit-redis.js

@@ -0,0 +1,118 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createRedisRateLimiter = void 0;
+/**
+ * Lua script implementing a sliding-window counter.
+ *
+ * Keys[1] = the rate-limit key
+ * ARGV[1] = window TTL in seconds
+ * ARGV[2] = current timestamp in seconds (integer)
+ *
+ * The key is of the form  stratum:ratelimit:{api_key_id}:{window_start}
+ * where window_start is computed on the caller side so the key naturally
+ * rotates every window.
+ *
+ * The script INCRs the key, sets a TTL on first creation, and returns the
+ * current count.
+ */
+const SLIDING_WINDOW_LUA = `
+local current = redis.call('INCR', KEYS[1])
+if current == 1 then
+  redis.call('EXPIRE', KEYS[1], ARGV[1])
+end
+return current
+`;
+/**
+ * Create a Redis-backed per-key rate limiter.
+ *
+ * Returns a Fastify preHandler hook. If Redis is unavailable or slow (>500ms)
+ * the request is allowed through (fail-open).
+ */
+function createRedisRateLimiter(redis, defaults) {
+    // Pre-load the Lua script so subsequent calls use EVALSHA
+    let scriptSha = null;
+    redis
+        .script("LOAD", SLIDING_WINDOW_LUA)
+        .then((sha) => {
+        scriptSha = sha;
+    })
+        .catch(() => {
+        // Will fall back to EVAL on each call
+    });
+    return async function redisRateLimitHook(request, reply) {
+        // Skip for unauthenticated requests (health, docs)
+        if (!request.apiKey)
+            return;
+        const keyId = request.apiKey.id;
+        const max = request.apiKey.rate_limit_max ?? defaults.maxRequests;
+        const windowMs = request.apiKey.rate_limit_window
+            ? parseWindowStr(request.apiKey.rate_limit_window)
+            : defaults.windowMs;
+        const now = Date.now();
+        const windowStart = Math.floor(now / windowMs) * windowMs;
+        const windowTtlSec = Math.ceil(windowMs / 1000);
+        const redisKey = `stratum:ratelimit:${keyId}:${windowStart}`;
+        // The window resets at windowStart + windowMs
+        const resetAt = new Date(windowStart + windowMs);
+        let currentCount;
+        try {
+            currentCount = await withTimeout(evalScript(redis, scriptSha, redisKey, windowTtlSec), 500);
+        }
+        catch {
+            // Redis unavailable or slow — fail-open
+            return;
+        }
+        // Set rate-limit headers on every response
+        const remaining = Math.max(0, max - currentCount);
+        reply.header("X-RateLimit-Limit", String(max));
+        reply.header("X-RateLimit-Remaining", String(remaining));
+        reply.header("X-RateLimit-Reset", resetAt.toISOString());
+        if (currentCount > max) {
+            const retryAfterSec = Math.ceil((windowStart + windowMs - now) / 1000);
+            reply.header("Retry-After", String(retryAfterSec));
+            reply.status(429).send({
+                error: {
+                    code: "RATE_LIMITED",
+                    message: `Rate limit exceeded. Try again in ${retryAfterSec} seconds.`,
+                },
+            });
+        }
+    };
+}
+exports.createRedisRateLimiter = createRedisRateLimiter;
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+async function evalScript(redis, sha, key, ttlSec) {
+    const now = Math.floor(Date.now() / 1000);
+    try {
+        if (sha) {
+            return (await redis.evalsha(sha, 1, key, String(ttlSec), String(now)));
+        }
+    }
+    catch {
+        // NOSCRIPT or other error — fall through to EVAL
+    }
+    return (await redis.eval(SLIDING_WINDOW_LUA, 1, key, String(ttlSec), String(now)));
+}
+function withTimeout(promise, ms) {
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(() => reject(new Error("Redis timeout")), ms);
+        promise.then((val) => { clearTimeout(timer); resolve(val); }, (err) => { clearTimeout(timer); reject(err); });
+    });
+}
+/** Parse a duration string like "1 minute" into milliseconds. */
+function parseWindowStr(window) {
+    const match = window.match(/^(\d+)\s*(second|minute|hour|day)s?$/i);
+    if (!match)
+        return 60_000;
+    const value = parseInt(match[1], 10);
+    switch (match[2].toLowerCase()) {
+        case "second": return value * 1_000;
+        case "minute": return value * 60_000;
+        case "hour": return value * 3_600_000;
+        case "day": return value * 86_400_000;
+        default: return 60_000;
+    }
+}
+//# sourceMappingURL=rate-limit-redis.js.map

package/dist/middleware/rate-limit-redis.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit-redis.js","sourceRoot":"","sources":["../../src/middleware/rate-limit-redis.ts"],"names":[],"mappings":";;;AAUA;;;;;;;;;;;;;GAaG;AACH,MAAM,kBAAkB,GAAG;;;;;;CAM1B,CAAC;AAEF;;;;;GAKG;AACH,SAAgB,sBAAsB,CACpC,KAAY,EACZ,QAA8B;IAE9B,0DAA0D;IAC1D,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,KAAK;SACF,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC;SAClC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;QACZ,SAAS,GAAG,GAAa,CAAC;IAC5B,CAAC,CAAC;SACD,KAAK,CAAC,GAAG,EAAE;QACV,sCAAsC;IACxC,CAAC,CAAC,CAAC;IAEL,OAAO,KAAK,UAAU,kBAAkB,CACtC,OAAuB,EACvB,KAAmB;QAEnB,mDAAmD;QACnD,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,OAAO;QAE5B,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,cAAc,IAAI,QAAQ,CAAC,WAAW,CAAC;QAClE,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,iBAAiB;YAC/C,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC;YAClD,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAEtB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,QAAQ,CAAC,GAAG,QAAQ,CAAC;QAC1D,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,qBAAqB,KAAK,IAAI,WAAW,EAAE,CAAC;QAE7D,8CAA8C;QAC9C,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,WAAW,GAAG,QAAQ,CAAC,CAAC;QAEjD,IAAI,YAAoB,CAAC;QAEzB,IAAI,CAAC;YACH,YAAY,GAAG,MAAM,WAAW,CAC9B,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,CAAC,EACpD,GAAG,CACJ,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,wCAAwC;YACxC,OAAO;QACT,CAAC;QAED,2CAA2C;QAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,GAAG,YAAY,CAAC,CAAC;QAClD,KAAK,CAAC,MAAM,CAAC,mBAAmB,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/C,KAAK,CAAC,MAAM,CAAC,uBAAuB,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QACzD,KAAK,CAAC,MAAM,CAAC,mBAAmB,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;QAEzD,IAAI,YAAY,GAAG,GAAG,EAAE,CAAC;YACvB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,WAAW,GAAG,QAAQ,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;YACvE,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;YACnD,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACrB,KAAK,EAAE;oBACL,IAAI,EAAE,cAAc;oBACpB,OAAO,EAAE,qCAAqC,aAAa,WAAW;iBACvE;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAjED,wDAiEC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,KAAK,UAAU,UAAU,CACvB,KAAY,EACZ,GAAkB,EAClB,GAAW,EACX,MAAc;IAEd,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,IAAI,CAAC;QACH,IAAI,GAAG,EAAE,CAAC;YACR,OAAO,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAW,CAAC;QACnF,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,iDAAiD;IACnD,CAAC;IACD,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAW,CAAC;AAC/F,CAAC;AAED,SAAS,WAAW,CAAI,OAAmB,EAAE,EAAU;IACrD,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACvE,OAAO,CAAC,IAAI,CACV,CAAC,GAAG,EAAE,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAC/C,CAAC,GAAG,EAAE,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAC/C,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,iEAAiE;AACjE,SAAS,cAAc,CAAC,MAAc;IACpC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;IACpE,IAAI,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACrC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QAC/B,KAAK,QAAQ,CAAC,CAAC,OAAO,KAAK,GAAG,KAAK,CAAC;QACpC,KAAK,QAAQ,CAAC,CAAC,OAAO,KAAK,GAAG,MAAM,CAAC;QACrC,KAAK,MAAM,CAAC,CAAG,OAAO,KAAK,GAAG,SAAS,CAAC;QACxC,KAAK,KAAK,CAAC,CAAI,OAAO,KAAK,GAAG,UAAU,CAAC;QACzC,OAAO,CAAC,CAAO,OAAO,MAAM,CAAC;IAC/B,CAAC;AACH,CAAC"}

package/dist/middleware/telemetry.d.ts

@@ -0,0 +1,14 @@
+/**
+ * OpenTelemetry Fastify middleware for the Stratum control plane.
+ *
+ * Creates a span per HTTP request and records standard HTTP + Stratum
+ * attributes. Gracefully no-ops when @opentelemetry/api is not installed.
+ */
+import type { FastifyInstance } from "fastify";
+/**
+ * Register the telemetry onRequest / onResponse hooks on a Fastify instance.
+ *
+ * If @opentelemetry/api is not installed, this is a no-op.
+ */
+export declare function registerTelemetryHooks(app: FastifyInstance): void;
+//# sourceMappingURL=telemetry.d.ts.map

package/dist/middleware/telemetry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry.d.ts","sourceRoot":"","sources":["../../src/middleware/telemetry.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAe7E;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,eAAe,GAAG,IAAI,CA4DjE"}

package/dist/middleware/telemetry.js

@@ -0,0 +1,81 @@
+"use strict";
+/**
+ * OpenTelemetry Fastify middleware for the Stratum control plane.
+ *
+ * Creates a span per HTTP request and records standard HTTP + Stratum
+ * attributes. Gracefully no-ops when @opentelemetry/api is not installed.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerTelemetryHooks = void 0;
+// Lazy-loaded OTel API — stays `null` when the package is absent.
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+let otel = null;
+try {
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    otel = require("@opentelemetry/api");
+}
+catch {
+    // @opentelemetry/api is not installed — telemetry is a no-op.
+}
+const TRACER_NAME = "@stratum-hq/control-plane";
+/**
+ * Register the telemetry onRequest / onResponse hooks on a Fastify instance.
+ *
+ * If @opentelemetry/api is not installed, this is a no-op.
+ */
+function registerTelemetryHooks(app) {
+    if (!otel)
+        return;
+    const tracer = otel.trace.getTracer(TRACER_NAME);
+    const { SpanStatusCode, SpanKind } = otel;
+    // Store spans keyed by request id so the onResponse hook can close them.
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const inflightSpans = new Map();
+    app.addHook("onRequest", async (request, _reply) => {
+        const span = tracer.startSpan(`HTTP ${request.method} ${request.routeOptions?.url ?? request.url}`, {
+            kind: SpanKind.SERVER,
+            attributes: {
+                "http.method": request.method,
+                "http.url": request.url,
+                "http.route": request.routeOptions?.url ?? request.url,
+                "http.request_id": request.id,
+            },
+        });
+        // Attach tenant_id from the authenticated key if available
+        if (request.apiKey?.tenant_id) {
+            span.setAttribute("stratum.tenant_id", request.apiKey.tenant_id);
+        }
+        inflightSpans.set(request.id, span);
+    });
+    app.addHook("onResponse", async (request, reply) => {
+        const span = inflightSpans.get(request.id);
+        if (!span)
+            return;
+        inflightSpans.delete(request.id);
+        span.setAttribute("http.status_code", reply.statusCode);
+        if (reply.statusCode >= 400) {
+            span.setStatus({
+                code: SpanStatusCode.ERROR,
+                message: `HTTP ${reply.statusCode}`,
+            });
+        }
+        else {
+            span.setStatus({ code: SpanStatusCode.OK });
+        }
+        span.end();
+    });
+    // Safety net: if the request errors out before onResponse fires
+    app.addHook("onError", async (request, _reply, error) => {
+        const span = inflightSpans.get(request.id);
+        if (!span)
+            return;
+        span.setStatus({
+            code: SpanStatusCode.ERROR,
+            message: error.message,
+        });
+        span.recordException(error);
+        // Don't end here — onResponse will still fire and end the span.
+    });
+}
+exports.registerTelemetryHooks = registerTelemetryHooks;
+//# sourceMappingURL=telemetry.js.map

package/dist/middleware/telemetry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry.js","sourceRoot":"","sources":["../../src/middleware/telemetry.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAIH,kEAAkE;AAClE,8DAA8D;AAC9D,IAAI,IAAI,GAAQ,IAAI,CAAC;AAErB,IAAI,CAAC;IACH,iEAAiE;IACjE,IAAI,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;AACvC,CAAC;AAAC,MAAM,CAAC;IACP,8DAA8D;AAChE,CAAC;AAED,MAAM,WAAW,GAAG,2BAA2B,CAAC;AAEhD;;;;GAIG;AACH,SAAgB,sBAAsB,CAAC,GAAoB;IACzD,IAAI,CAAC,IAAI;QAAE,OAAO;IAElB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IACjD,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IAE1C,yEAAyE;IACzE,8DAA8D;IAC9D,MAAM,aAAa,GAAG,IAAI,GAAG,EAAe,CAAC;IAE7C,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,OAAuB,EAAE,MAAoB,EAAE,EAAE;QAC/E,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,QAAQ,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,YAAY,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE;YAClG,IAAI,EAAE,QAAQ,CAAC,MAAM;YACrB,UAAU,EAAE;gBACV,aAAa,EAAE,OAAO,CAAC,MAAM;gBAC7B,UAAU,EAAE,OAAO,CAAC,GAAG;gBACvB,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG;gBACtD,iBAAiB,EAAE,OAAO,CAAC,EAAY;aACxC;SACF,CAAC,CAAC;QAEH,2DAA2D;QAC3D,IAAI,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC;YAC9B,IAAI,CAAC,YAAY,CAAC,mBAAmB,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACnE,CAAC;QAED,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAY,EAAE,IAAI,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAC/E,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAY,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,EAAY,CAAC,CAAC;QAE3C,IAAI,CAAC,YAAY,CAAC,kBAAkB,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QAExD,IAAI,KAAK,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;YAC5B,IAAI,CAAC,SAAS,CAAC;gBACb,IAAI,EAAE,cAAc,CAAC,KAAK;gBAC1B,OAAO,EAAE,QAAQ,KAAK,CAAC,UAAU,EAAE;aACpC,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9C,CAAC;QAED,IAAI,CAAC,GAAG,EAAE,CAAC;IACb,CAAC,CAAC,CAAC;IAEH,gEAAgE;IAChE,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,OAAuB,EAAE,MAAoB,EAAE,KAAY,EAAE,EAAE;QAC3F,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAY,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI;YAAE,OAAO;QAElB,IAAI,CAAC,SAAS,CAAC;YACb,IAAI,EAAE,cAAc,CAAC,KAAK;YAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC,CAAC;QACH,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAC5B,gEAAgE;IAClE,CAAC,CAAC,CAAC;AACL,CAAC;AA5DD,wDA4DC"}

package/dist/middleware/tenant-scope.d.ts

@@ -0,0 +1,20 @@
+import { FastifyRequest, FastifyReply } from "fastify";
+import { Stratum } from "@stratum-hq/lib";
+/**
+ * Tenant-scope enforcement middleware.
+ *
+ * Ensures that tenant-scoped API keys can only access data belonging
+ * to their own tenant or its descendants in the hierarchy.
+ *
+ * Global keys (tenant_id === null) have unrestricted access.
+ */
+export declare function createTenantScopeGuard(stratum: Stratum, extractTenantId: (req: FastifyRequest) => string | null): (request: FastifyRequest, _reply: FastifyReply) => Promise<void>;
+/** Extract :id param (tenant routes, config routes, permission routes) */
+export declare function fromParamId(req: FastifyRequest): string | null;
+/** Extract :tenantId param (consent routes) */
+export declare function fromParamTenantId(req: FastifyRequest): string | null;
+/** Extract tenant_id from query string */
+export declare function fromQueryTenantId(req: FastifyRequest): string | null;
+/** Extract tenant_id from request body */
+export declare function fromBodyTenantId(req: FastifyRequest): string | null;
+//# sourceMappingURL=tenant-scope.d.ts.map

package/dist/middleware/tenant-scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-scope.d.ts","sourceRoot":"","sources":["../../src/middleware/tenant-scope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvD,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAE1C;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,OAAO,EAChB,eAAe,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,MAAM,GAAG,IAAI,aAG5C,cAAc,UACf,YAAY,KACnB,QAAQ,IAAI,CAAC,CA0BjB;AAID,0EAA0E;AAC1E,wBAAgB,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,MAAM,GAAG,IAAI,CAE9D;AAED,+CAA+C;AAC/C,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,cAAc,GAAG,MAAM,GAAG,IAAI,CAEpE;AAED,0CAA0C;AAC1C,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,cAAc,GAAG,MAAM,GAAG,IAAI,CAEpE;AAED,0CAA0C;AAC1C,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,MAAM,GAAG,IAAI,CAEnE"}

package/dist/middleware/tenant-scope.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fromBodyTenantId = exports.fromQueryTenantId = exports.fromParamTenantId = exports.fromParamId = exports.createTenantScopeGuard = void 0;
+const core_1 = require("@stratum-hq/core");
+/**
+ * Tenant-scope enforcement middleware.
+ *
+ * Ensures that tenant-scoped API keys can only access data belonging
+ * to their own tenant or its descendants in the hierarchy.
+ *
+ * Global keys (tenant_id === null) have unrestricted access.
+ */
+function createTenantScopeGuard(stratum, extractTenantId) {
+    return async function tenantScopeGuard(request, _reply) {
+        const apiKey = request.apiKey;
+        if (!apiKey || apiKey.tenant_id === null)
+            return;
+        const targetTenantId = extractTenantId(request);
+        if (!targetTenantId)
+            return;
+        // Fast path: exact match
+        if (apiKey.tenant_id === targetTenantId)
+            return;
+        // Hierarchy check: target must be a descendant of the key's tenant
+        try {
+            const target = await stratum.getTenant(targetTenantId);
+            const ancestorIds = target.ancestry_path.split("/").filter(Boolean);
+            if (ancestorIds.includes(apiKey.tenant_id))
+                return;
+        }
+        catch {
+            // Tenant not found — fail closed for scoped keys
+            throw new core_1.ForbiddenError("API key tenant scope does not grant access to this tenant");
+        }
+        throw new core_1.ForbiddenError("API key tenant scope does not grant access to this tenant");
+    };
+}
+exports.createTenantScopeGuard = createTenantScopeGuard;
+// --- Extractors ---
+/** Extract :id param (tenant routes, config routes, permission routes) */
+function fromParamId(req) {
+    return req.params.id ?? null;
+}
+exports.fromParamId = fromParamId;
+/** Extract :tenantId param (consent routes) */
+function fromParamTenantId(req) {
+    return req.params.tenantId ?? null;
+}
+exports.fromParamTenantId = fromParamTenantId;
+/** Extract tenant_id from query string */
+function fromQueryTenantId(req) {
+    return req.query.tenant_id ?? null;
+}
+exports.fromQueryTenantId = fromQueryTenantId;
+/** Extract tenant_id from request body */
+function fromBodyTenantId(req) {
+    return req.body?.tenant_id ?? null;
+}
+exports.fromBodyTenantId = fromBodyTenantId;
+//# sourceMappingURL=tenant-scope.js.map

package/dist/middleware/tenant-scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-scope.js","sourceRoot":"","sources":["../../src/middleware/tenant-scope.ts"],"names":[],"mappings":";;;AACA,2CAAkD;AAGlD;;;;;;;GAOG;AACH,SAAgB,sBAAsB,CACpC,OAAgB,EAChB,eAAuD;IAEvD,OAAO,KAAK,UAAU,gBAAgB,CACpC,OAAuB,EACvB,MAAoB;QAEpB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI;YAAE,OAAO;QAEjD,MAAM,cAAc,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,cAAc;YAAE,OAAO;QAE5B,yBAAyB;QACzB,IAAI,MAAM,CAAC,SAAS,KAAK,cAAc;YAAE,OAAO;QAEhD,mEAAmE;QACnE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;YACvD,MAAM,WAAW,GAAG,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACpE,IAAI,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;gBAAE,OAAO;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,iDAAiD;YACjD,MAAM,IAAI,qBAAc,CACtB,2DAA2D,CAC5D,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,qBAAc,CACtB,2DAA2D,CAC5D,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAjCD,wDAiCC;AAED,qBAAqB;AAErB,0EAA0E;AAC1E,SAAgB,WAAW,CAAC,GAAmB;IAC7C,OAAQ,GAAG,CAAC,MAAiC,CAAC,EAAE,IAAI,IAAI,CAAC;AAC3D,CAAC;AAFD,kCAEC;AAED,+CAA+C;AAC/C,SAAgB,iBAAiB,CAAC,GAAmB;IACnD,OAAQ,GAAG,CAAC,MAAiC,CAAC,QAAQ,IAAI,IAAI,CAAC;AACjE,CAAC;AAFD,8CAEC;AAED,0CAA0C;AAC1C,SAAgB,iBAAiB,CAAC,GAAmB;IACnD,OAAQ,GAAG,CAAC,KAAgC,CAAC,SAAS,IAAI,IAAI,CAAC;AACjE,CAAC;AAFD,8CAEC;AAED,0CAA0C;AAC1C,SAAgB,gBAAgB,CAAC,GAAmB;IAClD,OAAQ,GAAG,CAAC,IAAsC,EAAE,SAAS,IAAI,IAAI,CAAC;AACxE,CAAC;AAFD,4CAEC"}

package/dist/openapi.d.ts

@@ -0,0 +1,3 @@
+import { FastifyInstance } from "fastify";
+export declare function registerOpenApi(app: FastifyInstance): Promise<void>;
+//# sourceMappingURL=openapi.d.ts.map

package/dist/openapi.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openapi.d.ts","sourceRoot":"","sources":["../src/openapi.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAI1C,wBAAsB,eAAe,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAkCzE"}