@stratum-hq/control-plane 0.2.4 → 0.4.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Christian Crank
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,66 @@
+# @stratum-hq/control-plane
+
+The [Stratum](https://github.com/stratum-hq/Stratum) control plane — a [Fastify](https://fastify.dev) REST API server that exposes tenant, config, permission, API-key, webhook, audit, consent, region, and ABAC management over HTTP. Pair it with `@stratum-hq/sdk` for polyglot stacks or service separation.
+
+## Installation
+
+```bash
+npm install @stratum-hq/control-plane
+```
+
+Most deployments run it as a standalone service rather than importing it. A container image and Compose file ship with the [Stratum repo](https://github.com/stratum-hq/Stratum).
+
+## Running
+
+```bash
+DATABASE_URL=postgres://stratum:stratum_dev@localhost:5432/stratum \
+JWT_SECRET=your-secret \
+node dist/index.js
+```
+
+On startup the server runs database migrations, then listens on `PORT` (default `3001`). It handles `SIGTERM`/`SIGINT` for graceful shutdown. OpenAPI docs are served via `@fastify/swagger-ui`.
+
+## Configuration
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `PORT` | `3001` | Listen port |
+| `DATABASE_URL` | `postgres://stratum:stratum_dev@localhost:5432/stratum` | PostgreSQL connection string |
+| `JWT_SECRET` | dev fallback | JWT signing secret — **required** in production/staging (server refuses to start without it) |
+| `ALLOWED_ORIGINS` | `localhost:3000,3300` | Comma-separated CORS allowlist |
+| `RATE_LIMIT_MAX` | `100` | Requests per window |
+| `RATE_LIMIT_WINDOW` | `1 minute` | Rate-limit window |
+| `REDIS_URL` | — | Optional; enables distributed rate limiting |
+| `NODE_ENV` | `development` | Environment |
+
+Security middleware (`@fastify/helmet`, CORS, rate limiting) is enabled by default.
+
+## API Surface
+
+All routes are versioned under `/api/v1`:
+
+| Prefix | Resource |
+|--------|----------|
+| `/api/v1/tenants` | Tenant CRUD + hierarchy |
+| `/api/v1/tenants/:id/config` | Config entries |
+| `/api/v1/tenants/:id/permissions` | Permission policies |
+| `/api/v1/tenants/:tenantId/abac-policies` | ABAC policies |
+| `/api/v1/tenants/:tenantId/consent` | GDPR consent records |
+| `/api/v1/api-keys` | API-key management |
+| `/api/v1/webhooks` | Webhook subscriptions |
+| `/api/v1/audit-logs` | Audit log queries |
+| `/api/v1/regions` | Multi-region config |
+| `/api/v1/roles` | RBAC roles |
+| `/api/v1/config` | Config diff |
+| `/api/v1/maintenance` | Retention / purge tasks |
+
+A `/health` endpoint reports server and Redis status.
+
+## Links
+
+- Documentation: https://docs.stratum-hq.org
+- GitHub: https://github.com/stratum-hq/Stratum
+
+## License
+
+MIT © Christian Crank

package/dist/__tests__/admin-scope-query-string.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=admin-scope-query-string.test.d.ts.map

package/dist/__tests__/admin-scope-query-string.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-scope-query-string.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/admin-scope-query-string.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/admin-scope-query-string.test.js

@@ -0,0 +1,69 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+const test_helpers_js_1 = require("./test-helpers.js");
+/**
+ * Admin-scope enforcement must depend on the resolved request PATH only, not on
+ * the raw URL. A query string appended to an admin-only route must not change
+ * which scope the route requires.
+ */
+(0, vitest_1.describe)("admin scope is enforced independent of the query string", () => {
+    let app;
+    let stratum;
+    const id = test_helpers_js_1.SAMPLE_TENANT.id;
+    (0, vitest_1.beforeEach)(async () => {
+        stratum = (0, test_helpers_js_1.createMockStratum)();
+        stratum.getTenant.mockResolvedValue(test_helpers_js_1.SAMPLE_TENANT);
+        stratum.purgeTenant.mockResolvedValue(undefined);
+        // getTenantContext is not stubbed by the shared helper; add it locally.
+        stratum.getTenantContext = vitest_1.vi
+            .fn()
+            .mockResolvedValue({ tenant: test_helpers_js_1.SAMPLE_TENANT });
+        app = await (0, test_helpers_js_1.buildTestApp)(stratum);
+    });
+    (0, vitest_1.afterEach)(async () => {
+        await app.close();
+    });
+    (0, vitest_1.it)("write-scope key is refused on an admin route (baseline, no query string)", async () => {
+        (0, test_helpers_js_1.setupWriteApiKey)(stratum);
+        const res = await app.inject({
+            method: "POST",
+            url: `/api/v1/tenants/${id}/purge`,
+            headers: (0, test_helpers_js_1.authHeaders)(),
+        });
+        (0, vitest_1.expect)(res.statusCode).toBe(403);
+        (0, vitest_1.expect)(stratum.purgeTenant).not.toHaveBeenCalled();
+    });
+    (0, vitest_1.it)("write-scope key stays refused on an admin route carrying a query string", async () => {
+        (0, test_helpers_js_1.setupWriteApiKey)(stratum);
+        const res = await app.inject({
+            method: "POST",
+            url: `/api/v1/tenants/${id}/purge?probe=1`,
+            headers: (0, test_helpers_js_1.authHeaders)(),
+        });
+        (0, vitest_1.expect)(res.statusCode).toBe(403);
+        (0, vitest_1.expect)(stratum.purgeTenant).not.toHaveBeenCalled();
+    });
+    (0, vitest_1.it)("read-scope key stays refused on an admin GET route carrying a query string", async () => {
+        (0, test_helpers_js_1.setupReadOnlyApiKey)(stratum);
+        const res = await app.inject({
+            method: "GET",
+            url: `/api/v1/tenants/${id}/context?probe=1`,
+            headers: (0, test_helpers_js_1.authHeaders)(),
+        });
+        (0, vitest_1.expect)(res.statusCode).toBe(403);
+        (0, vitest_1.expect)(stratum
+            .getTenantContext).not.toHaveBeenCalled();
+    });
+    (0, vitest_1.it)("admin-scope key is still allowed on an admin route with a query string", async () => {
+        (0, test_helpers_js_1.setupAdminApiKey)(stratum);
+        const res = await app.inject({
+            method: "POST",
+            url: `/api/v1/tenants/${id}/purge?probe=1`,
+            headers: (0, test_helpers_js_1.authHeaders)(),
+        });
+        (0, vitest_1.expect)(res.statusCode).toBe(204);
+        (0, vitest_1.expect)(stratum.purgeTenant).toHaveBeenCalled();
+    });
+});
+//# sourceMappingURL=admin-scope-query-string.test.js.map

package/dist/__tests__/admin-scope-query-string.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-scope-query-string.test.js","sourceRoot":"","sources":["../../src/__tests__/admin-scope-query-string.test.ts"],"names":[],"mappings":";;AAAA,mCAAyE;AAGzE,uDAQ2B;AAE3B;;;;GAIG;AACH,IAAA,iBAAQ,EAAC,yDAAyD,EAAE,GAAG,EAAE;IACvE,IAAI,GAAoB,CAAC;IACzB,IAAI,OAAgB,CAAC;IACrB,MAAM,EAAE,GAAG,+BAAa,CAAC,EAAE,CAAC;IAE5B,IAAA,mBAAU,EAAC,KAAK,IAAI,EAAE;QACpB,OAAO,GAAG,IAAA,mCAAiB,GAAE,CAAC;QAC7B,OAAO,CAAC,SAAsC,CAAC,iBAAiB,CAC/D,+BAAa,CACd,CAAC;QACD,OAAO,CAAC,WAAwC,CAAC,iBAAiB,CACjE,SAAS,CACV,CAAC;QACF,wEAAwE;QACvE,OAA8C,CAAC,gBAAgB,GAAG,WAAE;aAClE,EAAE,EAAE;aACJ,iBAAiB,CAAC,EAAE,MAAM,EAAE,+BAAa,EAAE,CAAC,CAAC;QAChD,GAAG,GAAG,MAAM,IAAA,8BAAY,EAAC,OAAO,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,IAAA,kBAAS,EAAC,KAAK,IAAI,EAAE;QACnB,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,IAAA,kCAAgB,EAAC,OAAO,CAAC,CAAC;QAE1B,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;YAC3B,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,mBAAmB,EAAE,QAAQ;YAClC,OAAO,EAAE,IAAA,6BAAW,GAAE;SACvB,CAAC,CAAC;QAEH,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,IAAA,kCAAgB,EAAC,OAAO,CAAC,CAAC;QAE1B,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;YAC3B,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,mBAAmB,EAAE,gBAAgB;YAC1C,OAAO,EAAE,IAAA,6BAAW,GAAE;SACvB,CAAC,CAAC;QAEH,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,4EAA4E,EAAE,KAAK,IAAI,EAAE;QAC1F,IAAA,qCAAmB,EAAC,OAAO,CAAC,CAAC;QAE7B,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;YAC3B,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,mBAAmB,EAAE,kBAAkB;YAC5C,OAAO,EAAE,IAAA,6BAAW,GAAE;SACvB,CAAC,CAAC;QAEH,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EACH,OAAqE;aACnE,gBAAgB,CACpB,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;QACtF,IAAA,kCAAgB,EAAC,OAAO,CAAC,CAAC;QAE1B,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;YAC3B,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,mBAAmB,EAAE,gBAAgB;YAC1C,OAAO,EAAE,IAAA,6BAAW,GAAE;SACvB,CAAC,CAAC;QAEH,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,WAAW,CAAC,CAAC,gBAAgB,EAAE,CAAC;IACjD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/configdiff-roles-scope.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=configdiff-roles-scope.test.d.ts.map

package/dist/__tests__/configdiff-roles-scope.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"configdiff-roles-scope.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/configdiff-roles-scope.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/configdiff-roles-scope.test.js

@@ -0,0 +1,246 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+const test_helpers_js_1 = require("./test-helpers.js");
+/**
+ * Regression tests for cross-tenant authorization on the config-diff and role
+ * administration routes.
+ *
+ * Both route groups were declared "global" for the default-deny enforcer, which
+ * is behavior-preserving but performs no per-tenant check. That left a
+ * tenant-scoped API key able to reach tenants outside its own subtree:
+ *  - config diff compares two tenants read from the query string;
+ *  - role routes read/mutate roles owned by an arbitrary tenant.
+ *
+ * A scoped key must be confined to its own tenant and descendants. Global
+ * operator keys (tenant_id === null) keep unrestricted access.
+ */
+const ATTACKER = "11111111-1111-4111-8111-111111111111";
+const ATTACKER_CHILD = "22222222-2222-4222-8222-222222222222";
+const VICTIM = "99999999-9999-4999-8999-999999999999";
+// ancestry_path holds a tenant's ANCESTORS and excludes self, so a root is "".
+const TENANTS = {
+    [ATTACKER]: { id: ATTACKER, ancestry_path: "", status: "active" },
+    [ATTACKER_CHILD]: { id: ATTACKER_CHILD, ancestry_path: ATTACKER, status: "active" },
+    [VICTIM]: { id: VICTIM, ancestry_path: "", status: "active" },
+};
+const ROLE_OWN = "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa";
+const ROLE_FOREIGN = "bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb";
+const ROLE_GLOBAL = "cccccccc-cccc-4ccc-8ccc-cccccccccccc";
+const ROLES = {
+    [ROLE_OWN]: { id: ROLE_OWN, name: "own", description: null, scopes: ["read"], tenant_id: ATTACKER },
+    [ROLE_FOREIGN]: { id: ROLE_FOREIGN, name: "foreign", description: null, scopes: ["read"], tenant_id: VICTIM },
+    [ROLE_GLOBAL]: { id: ROLE_GLOBAL, name: "global", description: null, scopes: ["read"], tenant_id: null },
+};
+const OWN_KEY = "own-key-id";
+const FOREIGN_KEY = "foreign-key-id";
+const KEYS = {
+    [OWN_KEY]: { id: OWN_KEY, tenant_id: ATTACKER },
+    [FOREIGN_KEY]: { id: FOREIGN_KEY, tenant_id: VICTIM },
+};
+let app;
+let stratum;
+function wireCommonMocks() {
+    stratum.getTenant.mockImplementation(async (id) => {
+        const row = TENANTS[id];
+        if (!row)
+            throw new Error(`Tenant ${id} not found`);
+        return row;
+    });
+    stratum.diffConfig.mockResolvedValue({ added: {}, removed: {}, changed: {} });
+    stratum.getRole.mockImplementation(async (id) => ROLES[id] ?? null);
+    // Without a tenant filter, listing returns every tenant's roles: this is the leak.
+    stratum.listRoles.mockImplementation(async (tenantId) => {
+        const all = Object.values(ROLES);
+        if (!tenantId)
+            return all;
+        return all.filter((r) => r.tenant_id === tenantId || r.tenant_id === null);
+    });
+    stratum.createRole.mockImplementation(async (input) => ({
+        id: "new-role",
+        description: null,
+        ...input,
+    }));
+    stratum.updateRole.mockImplementation(async (id) => ROLES[id] ?? null);
+    stratum.deleteRole.mockResolvedValue(true);
+    stratum.assignRoleToKey.mockResolvedValue(true);
+    stratum.removeRoleFromKey.mockResolvedValue(true);
+    stratum.getApiKey.mockImplementation(async (id) => KEYS[id] ?? null);
+}
+async function diff(tenantA, tenantB) {
+    return app.inject({
+        method: "GET",
+        url: `/api/v1/config/diff?tenant_a=${tenantA}&tenant_b=${tenantB}`,
+        headers: (0, test_helpers_js_1.authHeaders)(),
+    });
+}
+(0, vitest_1.describe)("config diff scopes both compared tenants to the caller's subtree", () => {
+    (0, vitest_1.beforeEach)(async () => {
+        stratum = (0, test_helpers_js_1.createMockStratum)();
+        stratum.validateApiKey.mockResolvedValue({
+            key_id: "attacker-key",
+            tenant_id: ATTACKER,
+            scopes: ["read", "write", "admin"],
+            rate_limit_max: null,
+            rate_limit_window: null,
+        });
+        wireCommonMocks();
+        app = await (0, test_helpers_js_1.buildTestApp)(stratum);
+    });
+    (0, vitest_1.it)("refuses diffing against an unrelated tenant", async () => {
+        const res = await diff(ATTACKER, VICTIM);
+        (0, vitest_1.expect)(res.statusCode).toBe(403);
+        (0, vitest_1.expect)(stratum.diffConfig).not.toHaveBeenCalled();
+    });
+    (0, vitest_1.it)("refuses when the first tenant is unrelated", async () => {
+        const res = await diff(VICTIM, ATTACKER);
+        (0, vitest_1.expect)(res.statusCode).toBe(403);
+        (0, vitest_1.expect)(stratum.diffConfig).not.toHaveBeenCalled();
+    });
+    (0, vitest_1.it)("allows diffing entirely within the caller's subtree", async () => {
+        const res = await diff(ATTACKER, ATTACKER_CHILD);
+        (0, vitest_1.expect)(res.statusCode).toBe(200);
+        (0, vitest_1.expect)(stratum.diffConfig).toHaveBeenCalledWith(ATTACKER, ATTACKER_CHILD);
+    });
+});
+(0, vitest_1.describe)("role routes scope to the caller's subtree", () => {
+    (0, vitest_1.beforeEach)(async () => {
+        stratum = (0, test_helpers_js_1.createMockStratum)();
+        stratum.validateApiKey.mockResolvedValue({
+            key_id: "attacker-key",
+            tenant_id: ATTACKER,
+            scopes: ["read", "write", "admin"],
+            rate_limit_max: null,
+            rate_limit_window: null,
+        });
+        wireCommonMocks();
+        app = await (0, test_helpers_js_1.buildTestApp)(stratum);
+    });
+    (0, vitest_1.it)("does not enumerate other tenants' roles when listing without a filter", async () => {
+        const res = await app.inject({ method: "GET", url: "/api/v1/roles", headers: (0, test_helpers_js_1.authHeaders)() });
+        (0, vitest_1.expect)(res.statusCode).toBe(200);
+        const ids = res.json().map((r) => r.id);
+        (0, vitest_1.expect)(ids).not.toContain(ROLE_FOREIGN);
+        (0, vitest_1.expect)(ids).toContain(ROLE_OWN);
+    });
+    (0, vitest_1.it)("refuses listing a foreign tenant's roles by explicit filter", async () => {
+        const res = await app.inject({
+            method: "GET",
+            url: `/api/v1/roles?tenant_id=${VICTIM}`,
+            headers: (0, test_helpers_js_1.authHeaders)(),
+        });
+        (0, vitest_1.expect)(res.statusCode).toBe(403);
+        (0, vitest_1.expect)(stratum.listRoles).not.toHaveBeenCalled();
+    });
+    (0, vitest_1.it)("refuses reading a foreign tenant's role", async () => {
+        const res = await app.inject({ method: "GET", url: `/api/v1/roles/${ROLE_FOREIGN}`, headers: (0, test_helpers_js_1.authHeaders)() });
+        (0, vitest_1.expect)(res.statusCode).toBe(403);
+    });
+    (0, vitest_1.it)("allows reading a role in the caller's own tenant", async () => {
+        const res = await app.inject({ method: "GET", url: `/api/v1/roles/${ROLE_OWN}`, headers: (0, test_helpers_js_1.authHeaders)() });
+        (0, vitest_1.expect)(res.statusCode).toBe(200);
+    });
+    (0, vitest_1.it)("refuses updating a foreign tenant's role", async () => {
+        const res = await app.inject({
+            method: "PATCH",
+            url: `/api/v1/roles/${ROLE_FOREIGN}`,
+            headers: { ...(0, test_helpers_js_1.authHeaders)(), "content-type": "application/json" },
+            payload: { name: "hijacked" },
+        });
+        (0, vitest_1.expect)(res.statusCode).toBe(403);
+        (0, vitest_1.expect)(stratum.updateRole).not.toHaveBeenCalled();
+    });
+    (0, vitest_1.it)("refuses deleting a foreign tenant's role", async () => {
+        const res = await app.inject({ method: "DELETE", url: `/api/v1/roles/${ROLE_FOREIGN}`, headers: (0, test_helpers_js_1.authHeaders)() });
+        (0, vitest_1.expect)(res.statusCode).toBe(403);
+        (0, vitest_1.expect)(stratum.deleteRole).not.toHaveBeenCalled();
+    });
+    (0, vitest_1.it)("refuses creating a role in a foreign tenant", async () => {
+        const res = await app.inject({
+            method: "POST",
+            url: "/api/v1/roles",
+            headers: { ...(0, test_helpers_js_1.authHeaders)(), "content-type": "application/json" },
+            payload: { name: "planted", scopes: ["read"], tenant_id: VICTIM },
+        });
+        (0, vitest_1.expect)(res.statusCode).toBe(403);
+        (0, vitest_1.expect)(stratum.createRole).not.toHaveBeenCalled();
+    });
+    (0, vitest_1.it)("refuses assigning a foreign tenant's role to an own key", async () => {
+        const res = await app.inject({
+            method: "POST",
+            url: `/api/v1/roles/assign/${OWN_KEY}`,
+            headers: { ...(0, test_helpers_js_1.authHeaders)(), "content-type": "application/json" },
+            payload: { role_id: ROLE_FOREIGN },
+        });
+        (0, vitest_1.expect)(res.statusCode).toBe(403);
+        (0, vitest_1.expect)(stratum.assignRoleToKey).not.toHaveBeenCalled();
+    });
+    (0, vitest_1.it)("refuses assigning a role to a key in another tenant", async () => {
+        const res = await app.inject({
+            method: "POST",
+            url: `/api/v1/roles/assign/${FOREIGN_KEY}`,
+            headers: { ...(0, test_helpers_js_1.authHeaders)(), "content-type": "application/json" },
+            payload: { role_id: ROLE_OWN },
+        });
+        (0, vitest_1.expect)(res.statusCode).toBe(403);
+        (0, vitest_1.expect)(stratum.assignRoleToKey).not.toHaveBeenCalled();
+    });
+    (0, vitest_1.it)("refuses removing a role from a key in another tenant", async () => {
+        const res = await app.inject({
+            method: "DELETE",
+            url: `/api/v1/roles/assign/${FOREIGN_KEY}`,
+            headers: (0, test_helpers_js_1.authHeaders)(),
+        });
+        (0, vitest_1.expect)(res.statusCode).toBe(403);
+        (0, vitest_1.expect)(stratum.removeRoleFromKey).not.toHaveBeenCalled();
+    });
+    (0, vitest_1.it)("allows assigning an own role to an own key", async () => {
+        const res = await app.inject({
+            method: "POST",
+            url: `/api/v1/roles/assign/${OWN_KEY}`,
+            headers: { ...(0, test_helpers_js_1.authHeaders)(), "content-type": "application/json" },
+            payload: { role_id: ROLE_OWN },
+        });
+        (0, vitest_1.expect)(res.statusCode).toBe(200);
+        (0, vitest_1.expect)(stratum.assignRoleToKey).toHaveBeenCalledWith(OWN_KEY, ROLE_OWN);
+    });
+});
+(0, vitest_1.describe)("global operator keys keep full access", () => {
+    (0, vitest_1.beforeEach)(async () => {
+        stratum = (0, test_helpers_js_1.createMockStratum)();
+        stratum.validateApiKey.mockResolvedValue({
+            key_id: "global-key",
+            tenant_id: null,
+            scopes: ["read", "write", "admin"],
+            rate_limit_max: null,
+            rate_limit_window: null,
+        });
+        wireCommonMocks();
+        app = await (0, test_helpers_js_1.buildTestApp)(stratum);
+    });
+    (0, vitest_1.it)("still diffs any two tenants", async () => {
+        const res = await diff(ATTACKER, VICTIM);
+        (0, vitest_1.expect)(res.statusCode).toBe(200);
+        (0, vitest_1.expect)(stratum.diffConfig).toHaveBeenCalledWith(ATTACKER, VICTIM);
+    });
+    (0, vitest_1.it)("still enumerates every tenant's roles", async () => {
+        const res = await app.inject({ method: "GET", url: "/api/v1/roles", headers: (0, test_helpers_js_1.authHeaders)() });
+        (0, vitest_1.expect)(res.statusCode).toBe(200);
+        (0, vitest_1.expect)(res.json().map((r) => r.id)).toContain(ROLE_FOREIGN);
+    });
+    (0, vitest_1.it)("still reads any tenant's role", async () => {
+        const res = await app.inject({ method: "GET", url: `/api/v1/roles/${ROLE_FOREIGN}`, headers: (0, test_helpers_js_1.authHeaders)() });
+        (0, vitest_1.expect)(res.statusCode).toBe(200);
+    });
+    (0, vitest_1.it)("still assigns any role to any key", async () => {
+        const res = await app.inject({
+            method: "POST",
+            url: `/api/v1/roles/assign/${FOREIGN_KEY}`,
+            headers: { ...(0, test_helpers_js_1.authHeaders)(), "content-type": "application/json" },
+            payload: { role_id: ROLE_FOREIGN },
+        });
+        (0, vitest_1.expect)(res.statusCode).toBe(200);
+        (0, vitest_1.expect)(stratum.assignRoleToKey).toHaveBeenCalledWith(FOREIGN_KEY, ROLE_FOREIGN);
+    });
+});
+//# sourceMappingURL=configdiff-roles-scope.test.js.map

package/dist/__tests__/configdiff-roles-scope.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"configdiff-roles-scope.test.js","sourceRoot":"","sources":["../../src/__tests__/configdiff-roles-scope.test.ts"],"names":[],"mappings":";;AAAA,mCAA8D;AAG9D,uDAAiF;AAEjF;;;;;;;;;;;;GAYG;AAEH,MAAM,QAAQ,GAAG,sCAAsC,CAAC;AACxD,MAAM,cAAc,GAAG,sCAAsC,CAAC;AAC9D,MAAM,MAAM,GAAG,sCAAsC,CAAC;AAItD,+EAA+E;AAC/E,MAAM,OAAO,GAAwB;IACnC,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE;IACjE,CAAC,cAAc,CAAC,EAAE,EAAE,EAAE,EAAE,cAAc,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE;IACnF,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE;CAC9D,CAAC;AAEF,MAAM,QAAQ,GAAG,sCAAsC,CAAC;AACxD,MAAM,YAAY,GAAG,sCAAsC,CAAC;AAC5D,MAAM,WAAW,GAAG,sCAAsC,CAAC;AAI3D,MAAM,KAAK,GAA4B;IACrC,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE;IACnG,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE;IAC7G,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE;CACzG,CAAC;AAEF,MAAM,OAAO,GAAG,YAAY,CAAC;AAC7B,MAAM,WAAW,GAAG,gBAAgB,CAAC;AAErC,MAAM,IAAI,GAA6D;IACrE,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE;IAC/C,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE;CACtD,CAAC;AAEF,IAAI,GAAoB,CAAC;AACzB,IAAI,OAAgB,CAAC;AAErB,SAAS,eAAe;IACrB,OAAO,CAAC,SAAsC,CAAC,kBAAkB,CAAC,KAAK,EAAE,EAAU,EAAE,EAAE;QACtF,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;QACxB,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QACpD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC,CAAC;IACF,OAAO,CAAC,UAAuC,CAAC,iBAAiB,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;IAC3G,OAAO,CAAC,OAAoC,CAAC,kBAAkB,CAAC,KAAK,EAAE,EAAU,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC;IAC1G,mFAAmF;IAClF,OAAO,CAAC,SAAsC,CAAC,kBAAkB,CAAC,KAAK,EAAE,QAAiB,EAAE,EAAE;QAC7F,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,CAAC,QAAQ;YAAE,OAAO,GAAG,CAAC;QAC1B,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;IACF,OAAO,CAAC,UAAuC,CAAC,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACpF,EAAE,EAAE,UAAU;QACd,WAAW,EAAE,IAAI;QACjB,GAAG,KAAK;KACT,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,UAAuC,CAAC,kBAAkB,CAAC,KAAK,EAAE,EAAU,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC;IAC5G,OAAO,CAAC,UAAuC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACxE,OAAO,CAAC,eAA4C,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC7E,OAAO,CAAC,iBAA8C,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC/E,OAAO,CAAC,SAAsC,CAAC,kBAAkB,CAAC,KAAK,EAAE,EAAU,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC;AAC7G,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,OAAe,EAAE,OAAe;IAClD,OAAO,GAAG,CAAC,MAAM,CAAC;QAChB,MAAM,EAAE,KAAK;QACb,GAAG,EAAE,gCAAgC,OAAO,aAAa,OAAO,EAAE;QAClE,OAAO,EAAE,IAAA,6BAAW,GAAE;KACvB,CAAC,CAAC;AACL,CAAC;AAED,IAAA,iBAAQ,EAAC,kEAAkE,EAAE,GAAG,EAAE;IAChF,IAAA,mBAAU,EAAC,KAAK,IAAI,EAAE;QACpB,OAAO,GAAG,IAAA,mCAAiB,GAAE,CAAC;QAC7B,OAAO,CAAC,cAA2C,CAAC,iBAAiB,CAAC;YACrE,MAAM,EAAE,cAAc;YACtB,SAAS,EAAE,QAAQ;YACnB,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC;YAClC,cAAc,EAAE,IAAI;YACpB,iBAAiB,EAAE,IAAI;SACxB,CAAC,CAAC;QACH,eAAe,EAAE,CAAC;QAClB,GAAG,GAAG,MAAM,IAAA,8BAAY,EAAC,OAAO,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACzC,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACzC,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;QACjD,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,UAAU,CAAC,CAAC,oBAAoB,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,iBAAQ,EAAC,2CAA2C,EAAE,GAAG,EAAE;IACzD,IAAA,mBAAU,EAAC,KAAK,IAAI,EAAE;QACpB,OAAO,GAAG,IAAA,mCAAiB,GAAE,CAAC;QAC7B,OAAO,CAAC,cAA2C,CAAC,iBAAiB,CAAC;YACrE,MAAM,EAAE,cAAc;YACtB,SAAS,EAAE,QAAQ;YACnB,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC;YAClC,cAAc,EAAE,IAAI;YACpB,iBAAiB,EAAE,IAAI;SACxB,CAAC,CAAC;QACH,eAAe,EAAE,CAAC;QAClB,GAAG,GAAG,MAAM,IAAA,8BAAY,EAAC,OAAO,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,eAAe,EAAE,OAAO,EAAE,IAAA,6BAAW,GAAE,EAAE,CAAC,CAAC;QAC9F,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,GAAG,GAAI,GAAG,CAAC,IAAI,EAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACvD,IAAA,eAAM,EAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QACxC,IAAA,eAAM,EAAC,GAAG,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;YAC3B,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,2BAA2B,MAAM,EAAE;YACxC,OAAO,EAAE,IAAA,6BAAW,GAAE;SACvB,CAAC,CAAC;QACH,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,iBAAiB,YAAY,EAAE,EAAE,OAAO,EAAE,IAAA,6BAAW,GAAE,EAAE,CAAC,CAAC;QAC9G,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,iBAAiB,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAA,6BAAW,GAAE,EAAE,CAAC,CAAC;QAC1G,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;YAC3B,MAAM,EAAE,OAAO;YACf,GAAG,EAAE,iBAAiB,YAAY,EAAE;YACpC,OAAO,EAAE,EAAE,GAAG,IAAA,6BAAW,GAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YACjE,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;SAC9B,CAAC,CAAC;QACH,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,iBAAiB,YAAY,EAAE,EAAE,OAAO,EAAE,IAAA,6BAAW,GAAE,EAAE,CAAC,CAAC;QACjH,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;YAC3B,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,eAAe;YACpB,OAAO,EAAE,EAAE,GAAG,IAAA,6BAAW,GAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YACjE,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE;SAClE,CAAC,CAAC;QACH,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;YAC3B,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,wBAAwB,OAAO,EAAE;YACtC,OAAO,EAAE,EAAE,GAAG,IAAA,6BAAW,GAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YACjE,OAAO,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE;SACnC,CAAC,CAAC;QACH,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;YAC3B,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,wBAAwB,WAAW,EAAE;YAC1C,OAAO,EAAE,EAAE,GAAG,IAAA,6BAAW,GAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YACjE,OAAO,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE;SAC/B,CAAC,CAAC;QACH,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;YAC3B,MAAM,EAAE,QAAQ;YAChB,GAAG,EAAE,wBAAwB,WAAW,EAAE;YAC1C,OAAO,EAAE,IAAA,6BAAW,GAAE;SACvB,CAAC,CAAC;QACH,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;YAC3B,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,wBAAwB,OAAO,EAAE;YACtC,OAAO,EAAE,EAAE,GAAG,IAAA,6BAAW,GAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YACjE,OAAO,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE;SAC/B,CAAC,CAAC;QACH,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,eAAe,CAAC,CAAC,oBAAoB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,iBAAQ,EAAC,uCAAuC,EAAE,GAAG,EAAE;IACrD,IAAA,mBAAU,EAAC,KAAK,IAAI,EAAE;QACpB,OAAO,GAAG,IAAA,mCAAiB,GAAE,CAAC;QAC7B,OAAO,CAAC,cAA2C,CAAC,iBAAiB,CAAC;YACrE,MAAM,EAAE,YAAY;YACpB,SAAS,EAAE,IAAI;YACf,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC;YAClC,cAAc,EAAE,IAAI;YACpB,iBAAiB,EAAE,IAAI;SACxB,CAAC,CAAC;QACH,eAAe,EAAE,CAAC;QAClB,GAAG,GAAG,MAAM,IAAA,8BAAY,EAAC,OAAO,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,6BAA6B,EAAE,KAAK,IAAI,EAAE;QAC3C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACzC,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,UAAU,CAAC,CAAC,oBAAoB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,eAAe,EAAE,OAAO,EAAE,IAAA,6BAAW,GAAE,EAAE,CAAC,CAAC;QAC9F,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAE,GAAG,CAAC,IAAI,EAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,iBAAiB,YAAY,EAAE,EAAE,OAAO,EAAE,IAAA,6BAAW,GAAE,EAAE,CAAC,CAAC;QAC9G,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;QACjD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;YAC3B,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,wBAAwB,WAAW,EAAE;YAC1C,OAAO,EAAE,EAAE,GAAG,IAAA,6BAAW,GAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YACjE,OAAO,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE;SACnC,CAAC,CAAC;QACH,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,eAAe,CAAC,CAAC,oBAAoB,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/default-deny.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=default-deny.test.d.ts.map

package/dist/__tests__/default-deny.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"default-deny.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/default-deny.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/default-deny.test.js

@@ -0,0 +1,92 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+const fastify_1 = __importDefault(require("fastify"));
+const auth_js_1 = require("../middleware/auth.js");
+const authorize_js_1 = require("../middleware/authorize.js");
+const tenant_scope_js_1 = require("../middleware/tenant-scope.js");
+const error_handler_js_1 = require("../middleware/error-handler.js");
+const test_helpers_js_1 = require("./test-helpers.js");
+/**
+ * Control-plane authorization must be default-deny: a route that does not
+ * declare a tenant scope is refused, so a route added without a guard fails
+ * closed instead of silently serving data.
+ */
+const SCOPED_TENANT = "11111111-1111-4111-8111-111111111111";
+const OTHER_TENANT = "99999999-9999-4999-8999-999999999999";
+let stratum;
+(0, vitest_1.beforeEach)(() => {
+    stratum = (0, test_helpers_js_1.createMockStratum)();
+    stratum.validateApiKey.mockResolvedValue({
+        key_id: "scoped-key",
+        tenant_id: SCOPED_TENANT,
+        scopes: ["read", "write", "admin"],
+        rate_limit_max: null,
+        rate_limit_window: null,
+    });
+    // Both tenants are roots (empty ancestry), so neither is a descendant of the
+    // other: a scoped key may reach only its own.
+    stratum.getTenant.mockImplementation(async (id) => ({ id, ancestry_path: "", status: "active" }));
+});
+/**
+ * Build an app wired exactly like the production control plane: authenticate,
+ * authorize by scope, then enforce tenant scope. The caller registers routes.
+ */
+async function buildApp(register) {
+    const app = (0, fastify_1.default)({ logger: false });
+    app.addHook("preHandler", (0, auth_js_1.createAuthMiddleware)(stratum));
+    app.addHook("preHandler", (0, authorize_js_1.createAuthorizeMiddleware)());
+    app.addHook("preHandler", (0, tenant_scope_js_1.createTenantScopeEnforcer)(stratum));
+    app.setErrorHandler(error_handler_js_1.errorHandler);
+    await register(app);
+    await app.ready();
+    return app;
+}
+(0, vitest_1.describe)("default-deny authorization", () => {
+    (0, vitest_1.it)("denies a route that declares no tenant scope", async () => {
+        const app = await buildApp((app) => {
+            // A control-plane route that ships without any tenant-scope declaration.
+            app.get("/api/v1/unguarded/:id", async (_req, reply) => reply.status(200).send({ reached: true }));
+        });
+        const res = await app.inject({
+            method: "GET",
+            url: `/api/v1/unguarded/${OTHER_TENANT}`,
+            headers: (0, test_helpers_js_1.authHeaders)(),
+        });
+        (0, vitest_1.expect)(res.statusCode).toBe(403);
+    });
+    (0, vitest_1.it)("admits a route explicitly declared as global", async () => {
+        const app = await buildApp((app) => {
+            (0, tenant_scope_js_1.declareTenantScope)(app, "global");
+            app.get("/api/v1/ops", async (_req, reply) => reply.status(200).send({ ok: true }));
+        });
+        const res = await app.inject({
+            method: "GET",
+            url: "/api/v1/ops",
+            headers: (0, test_helpers_js_1.authHeaders)(),
+        });
+        (0, vitest_1.expect)(res.statusCode).toBe(200);
+    });
+    (0, vitest_1.it)("enforces a declared extractor: own tenant allowed, others denied", async () => {
+        const app = await buildApp((app) => {
+            (0, tenant_scope_js_1.declareTenantScope)(app, tenant_scope_js_1.fromParamId);
+            app.get("/api/v1/tenants/:id/thing", async (_req, reply) => reply.status(200).send({ ok: true }));
+        });
+        const own = await app.inject({
+            method: "GET",
+            url: `/api/v1/tenants/${SCOPED_TENANT}/thing`,
+            headers: (0, test_helpers_js_1.authHeaders)(),
+        });
+        const other = await app.inject({
+            method: "GET",
+            url: `/api/v1/tenants/${OTHER_TENANT}/thing`,
+            headers: (0, test_helpers_js_1.authHeaders)(),
+        });
+        (0, vitest_1.expect)(own.statusCode).toBe(200);
+        (0, vitest_1.expect)(other.statusCode).toBe(403);
+    });
+});
+//# sourceMappingURL=default-deny.test.js.map

package/dist/__tests__/default-deny.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"default-deny.test.js","sourceRoot":"","sources":["../../src/__tests__/default-deny.test.ts"],"names":[],"mappings":";;;;;AAAA,mCAA8D;AAC9D,sDAAmD;AAEnD,mDAA6D;AAC7D,6DAAuE;AACvE,mEAIuC;AACvC,qEAA8D;AAC9D,uDAAmE;AAEnE;;;;GAIG;AAEH,MAAM,aAAa,GAAG,sCAAsC,CAAC;AAC7D,MAAM,YAAY,GAAG,sCAAsC,CAAC;AAE5D,IAAI,OAAgB,CAAC;AAErB,IAAA,mBAAU,EAAC,GAAG,EAAE;IACd,OAAO,GAAG,IAAA,mCAAiB,GAAE,CAAC;IAC7B,OAAO,CAAC,cAA2C,CAAC,iBAAiB,CAAC;QACrE,MAAM,EAAE,YAAY;QACpB,SAAS,EAAE,aAAa;QACxB,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC;QAClC,cAAc,EAAE,IAAI;QACpB,iBAAiB,EAAE,IAAI;KACxB,CAAC,CAAC;IACH,6EAA6E;IAC7E,8CAA8C;IAC7C,OAAO,CAAC,SAAsC,CAAC,kBAAkB,CAChE,KAAK,EAAE,EAAU,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CACpE,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH;;;GAGG;AACH,KAAK,UAAU,QAAQ,CACrB,QAAwD;IAExD,MAAM,GAAG,GAAG,IAAA,iBAAO,EAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACvC,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,IAAA,8BAAoB,EAAC,OAAO,CAAC,CAAC,CAAC;IACzD,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,IAAA,wCAAyB,GAAE,CAAC,CAAC;IACvD,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,IAAA,2CAAyB,EAAC,OAAO,CAAC,CAAC,CAAC;IAC9D,GAAG,CAAC,eAAe,CAAC,+BAAY,CAAC,CAAC;IAClC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;IACpB,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;IAClB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,IAAA,iBAAQ,EAAC,4BAA4B,EAAE,GAAG,EAAE;IAC1C,IAAA,WAAE,EAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,CAAC,GAAG,EAAE,EAAE;YACjC,yEAAyE;YACzE,GAAG,CAAC,GAAG,CACL,uBAAuB,EACvB,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CACjE,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;YAC3B,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,qBAAqB,YAAY,EAAE;YACxC,OAAO,EAAE,IAAA,6BAAW,GAAE;SACvB,CAAC,CAAC;QAEH,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,CAAC,GAAG,EAAE,EAAE;YACjC,IAAA,oCAAkB,EAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAClC,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAC3C,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CACrC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;YAC3B,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,aAAa;YAClB,OAAO,EAAE,IAAA,6BAAW,GAAE;SACvB,CAAC,CAAC;QAEH,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,CAAC,GAAG,EAAE,EAAE;YACjC,IAAA,oCAAkB,EAAC,GAAG,EAAE,6BAAW,CAAC,CAAC;YACrC,GAAG,CAAC,GAAG,CACL,2BAA2B,EAC3B,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAC5D,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;YAC3B,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,mBAAmB,aAAa,QAAQ;YAC7C,OAAO,EAAE,IAAA,6BAAW,GAAE;SACvB,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;YAC7B,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,mBAAmB,YAAY,QAAQ;YAC5C,OAAO,EAAE,IAAA,6BAAW,GAAE;SACvB,CAAC,CAAC;QAEH,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/tenant-create-scope.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=tenant-create-scope.test.d.ts.map

package/dist/__tests__/tenant-create-scope.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-create-scope.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/tenant-create-scope.test.ts"],"names":[],"mappings":""}