@stratum-hq/control-plane 0.3.0 → 0.4.0

package/dist/__tests__/tenant-move-scope.test.js

@@ -0,0 +1,113 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+const test_helpers_js_1 = require("./test-helpers.js");
+/**
+ * Regression tests for a critical cross-tenant authorization flaw in the move route.
+ *
+ * The bug: createTenantScopeGuard was registered with the `fromParamId` extractor,
+ * which reads only `:id`, the tenant being MOVED. Nothing authorized
+ * `body.new_parent_id`, the move DESTINATION.
+ *
+ * A key scoped to its own tenant therefore passed the guard on the fast path
+ * (`apiKey.tenant_id === targetTenantId`) and could graft itself under any tenant
+ * in the system. Because Stratum resolves config by walking UP the ancestry path,
+ * the attacker's tenant then inherits the victim's config, including `sensitive`
+ * values, which are decrypted on resolve, plus the victim's delegated permissions.
+ *
+ * The library's moveTenant is not at fault: it locks both rows, rejects archived
+ * tenants and detects cycles. Authorization is the control plane's job.
+ */
+const ATTACKER = "11111111-1111-4111-8111-111111111111";
+const ATTACKER_CHILD = "22222222-2222-4222-8222-222222222222";
+const ATTACKER_GRANDCHILD = "33333333-3333-4333-8333-333333333333";
+const VICTIM = "99999999-9999-4999-8999-999999999999";
+// ancestry_path holds a tenant's ANCESTORS and excludes self, so a root is "".
+const TENANTS = {
+    [ATTACKER]: { id: ATTACKER, ancestry_path: "", status: "active" },
+    [ATTACKER_CHILD]: {
+        id: ATTACKER_CHILD,
+        ancestry_path: ATTACKER,
+        status: "active",
+    },
+    [ATTACKER_GRANDCHILD]: {
+        id: ATTACKER_GRANDCHILD,
+        ancestry_path: `${ATTACKER}/${ATTACKER_CHILD}`,
+        status: "active",
+    },
+    [VICTIM]: { id: VICTIM, ancestry_path: "", status: "active" },
+};
+let app;
+let stratum;
+(0, vitest_1.beforeEach)(async () => {
+    stratum = (0, test_helpers_js_1.createMockStratum)();
+    // A key scoped to the attacker's own tenant. Not a global key.
+    stratum.validateApiKey.mockResolvedValue({
+        key_id: "attacker-key",
+        tenant_id: ATTACKER,
+        scopes: ["read", "write", "admin"],
+        rate_limit_max: null,
+        rate_limit_window: null,
+    });
+    stratum.getTenant.mockImplementation(async (id) => {
+        const row = TENANTS[id];
+        if (!row)
+            throw new Error(`Tenant ${id} not found`);
+        return row;
+    });
+    stratum.moveTenant.mockImplementation(async (id) => TENANTS[id]);
+    app = await (0, test_helpers_js_1.buildTestApp)(stratum);
+});
+async function move(id, newParentId) {
+    return app.inject({
+        method: "POST",
+        url: `/api/v1/tenants/${id}/move`,
+        headers: { ...(0, test_helpers_js_1.authHeaders)(), "content-type": "application/json" },
+        payload: { new_parent_id: newParentId },
+    });
+}
+(0, vitest_1.describe)("move route authorizes the destination parent, not just the moved tenant", () => {
+    (0, vitest_1.it)("refuses grafting your own tenant under an unrelated tenant", async () => {
+        const res = await move(ATTACKER, VICTIM);
+        (0, vitest_1.expect)(res.statusCode).toBe(403);
+        (0, vitest_1.expect)(stratum.moveTenant).not.toHaveBeenCalled();
+    });
+    (0, vitest_1.it)("refuses grafting a tenant you do own under a tenant you do not", async () => {
+        const res = await move(ATTACKER_CHILD, VICTIM);
+        (0, vitest_1.expect)(res.statusCode).toBe(403);
+        (0, vitest_1.expect)(stratum.moveTenant).not.toHaveBeenCalled();
+    });
+    (0, vitest_1.it)("allows reorganizing entirely inside your own subtree", async () => {
+        const res = await move(ATTACKER_GRANDCHILD, ATTACKER_CHILD);
+        (0, vitest_1.expect)(res.statusCode).toBe(200);
+        (0, vitest_1.expect)(stratum.moveTenant).toHaveBeenCalledWith(ATTACKER_GRANDCHILD, ATTACKER_CHILD, vitest_1.expect.anything());
+    });
+    (0, vitest_1.it)("allows moving a descendant up to your own root", async () => {
+        const res = await move(ATTACKER_GRANDCHILD, ATTACKER);
+        (0, vitest_1.expect)(res.statusCode).toBe(200);
+        (0, vitest_1.expect)(stratum.moveTenant).toHaveBeenCalled();
+    });
+    (0, vitest_1.it)("fails closed when the destination tenant cannot be loaded", async () => {
+        const res = await move(ATTACKER, "44444444-4444-4444-8444-444444444444");
+        (0, vitest_1.expect)(res.statusCode).toBe(403);
+        (0, vitest_1.expect)(stratum.moveTenant).not.toHaveBeenCalled();
+    });
+});
+(0, vitest_1.describe)("global keys are unaffected", () => {
+    (0, vitest_1.beforeEach)(async () => {
+        stratum.validateApiKey.mockResolvedValue({
+            key_id: "global-key",
+            tenant_id: null,
+            scopes: ["read", "write", "admin"],
+            rate_limit_max: null,
+            rate_limit_window: null,
+        });
+        app = await (0, test_helpers_js_1.buildTestApp)(stratum);
+    });
+    (0, vitest_1.it)("still permits an operator key to move a tenant anywhere", async () => {
+        const res = await move(ATTACKER, VICTIM);
+        (0, vitest_1.expect)(res.statusCode).toBe(200);
+        (0, vitest_1.expect)(stratum.moveTenant).toHaveBeenCalled();
+    });
+});
+//# sourceMappingURL=tenant-move-scope.test.js.map

package/dist/__tests__/tenant-move-scope.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-move-scope.test.js","sourceRoot":"","sources":["../../src/__tests__/tenant-move-scope.test.ts"],"names":[],"mappings":";;AAAA,mCAA8D;AAG9D,uDAAiF;AAEjF;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,QAAQ,GAAG,sCAAsC,CAAC;AACxD,MAAM,cAAc,GAAG,sCAAsC,CAAC;AAC9D,MAAM,mBAAmB,GAAG,sCAAsC,CAAC;AACnE,MAAM,MAAM,GAAG,sCAAsC,CAAC;AAItD,+EAA+E;AAC/E,MAAM,OAAO,GAAwB;IACnC,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE;IACjE,CAAC,cAAc,CAAC,EAAE;QAChB,EAAE,EAAE,cAAc;QAClB,aAAa,EAAE,QAAQ;QACvB,MAAM,EAAE,QAAQ;KACjB;IACD,CAAC,mBAAmB,CAAC,EAAE;QACrB,EAAE,EAAE,mBAAmB;QACvB,aAAa,EAAE,GAAG,QAAQ,IAAI,cAAc,EAAE;QAC9C,MAAM,EAAE,QAAQ;KACjB;IACD,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE;CAC9D,CAAC;AAEF,IAAI,GAAoB,CAAC;AACzB,IAAI,OAAgB,CAAC;AAErB,IAAA,mBAAU,EAAC,KAAK,IAAI,EAAE;IACpB,OAAO,GAAG,IAAA,mCAAiB,GAAE,CAAC;IAE9B,+DAA+D;IAC9D,OAAO,CAAC,cAA2C,CAAC,iBAAiB,CAAC;QACrE,MAAM,EAAE,cAAc;QACtB,SAAS,EAAE,QAAQ;QACnB,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC;QAClC,cAAc,EAAE,IAAI;QACpB,iBAAiB,EAAE,IAAI;KACxB,CAAC,CAAC;IAEF,OAAO,CAAC,SAAsC,CAAC,kBAAkB,CAChE,KAAK,EAAE,EAAU,EAAE,EAAE;QACnB,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;QACxB,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QACpD,OAAO,GAAG,CAAC;IACb,CAAC,CACF,CAAC;IAED,OAAO,CAAC,UAAuC,CAAC,kBAAkB,CACjE,KAAK,EAAE,EAAU,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAClC,CAAC;IAEF,GAAG,GAAG,MAAM,IAAA,8BAAY,EAAC,OAAO,CAAC,CAAC;AACpC,CAAC,CAAC,CAAC;AAEH,KAAK,UAAU,IAAI,CAAC,EAAU,EAAE,WAAmB;IACjD,OAAO,GAAG,CAAC,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM;QACd,GAAG,EAAE,mBAAmB,EAAE,OAAO;QACjC,OAAO,EAAE,EAAE,GAAG,IAAA,6BAAW,GAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QACjE,OAAO,EAAE,EAAE,aAAa,EAAE,WAAW,EAAE;KACxC,CAAC,CAAC;AACL,CAAC;AAED,IAAA,iBAAQ,EAAC,yEAAyE,EAAE,GAAG,EAAE;IACvF,IAAA,WAAE,EAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAEzC,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;QAE/C,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,cAAc,CAAC,CAAC;QAE5D,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,UAAU,CAAC,CAAC,oBAAoB,CAC7C,mBAAmB,EACnB,cAAc,EACd,eAAM,CAAC,QAAQ,EAAE,CAClB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,QAAQ,CAAC,CAAC;QAEtD,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,UAAU,CAAC,CAAC,gBAAgB,EAAE,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,sCAAsC,CAAC,CAAC;QAEzE,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACpD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,iBAAQ,EAAC,4BAA4B,EAAE,GAAG,EAAE;IAC1C,IAAA,mBAAU,EAAC,KAAK,IAAI,EAAE;QACnB,OAAO,CAAC,cAA2C,CAAC,iBAAiB,CAAC;YACrE,MAAM,EAAE,YAAY;YACpB,SAAS,EAAE,IAAI;YACf,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC;YAClC,cAAc,EAAE,IAAI;YACpB,iBAAiB,EAAE,IAAI;SACxB,CAAC,CAAC;QACH,GAAG,GAAG,MAAM,IAAA,8BAAY,EAAC,OAAO,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAEzC,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,UAAU,CAAC,CAAC,gBAAgB,EAAE,CAAC;IAChD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/test-helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"test-helpers.d.ts","sourceRoot":"","sources":["../../src/__tests__/test-helpers.ts"],"names":[],"mappings":"AAAA,OAAgB,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAWnD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAG/C,eAAO,MAAM,eAAe,mCAAmC,CAAC;AAEhE;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAoC3C;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,eAAe,CAAC,CAkB7E;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,MAAM,GAAE,MAA4B,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAExF;AAED;;GAEG;AACH,wBAAgB,UAAU,CACxB,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,EACrC,MAAM,GAAE,MAAwB,GAC/B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAYxB;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAQvD;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAQ1D;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAQvD;AAED,iDAAiD;AACjD,eAAO,MAAM,aAAa;;;;;;;;;;;;;CAazB,CAAC;AAEF,qCAAqC;AACrC,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;CAa/B,CAAC"}
+{"version":3,"file":"test-helpers.d.ts","sourceRoot":"","sources":["../../src/__tests__/test-helpers.ts"],"names":[],"mappings":"AAAA,OAAgB,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAanD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAG/C,eAAO,MAAM,eAAe,mCAAmC,CAAC;AAEhE;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CA8C3C;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,eAAe,CAAC,CAoB7E;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,MAAM,GAAE,MAA4B,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAExF;AAED;;GAEG;AACH,wBAAgB,UAAU,CACxB,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,EACrC,MAAM,GAAE,MAAwB,GAC/B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAYxB;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAQvD;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAQ1D;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAQvD;AAED,iDAAiD;AACjD,eAAO,MAAM,aAAa;;;;;;;;;;;;;CAazB,CAAC;AAEF,qCAAqC;AACrC,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;CAa/B,CAAC"}

package/dist/__tests__/test-helpers.js

@@ -17,11 +17,13 @@ const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
 const error_handler_js_1 = require("../middleware/error-handler.js");
 const auth_js_1 = require("../middleware/auth.js");
 const authorize_js_1 = require("../middleware/authorize.js");
+const tenant_scope_js_1 = require("../middleware/tenant-scope.js");
 const health_js_1 = require("../routes/health.js");
 const tenants_js_1 = require("../routes/tenants.js");
 const config_js_1 = require("../routes/config.js");
 const api_keys_js_1 = require("../routes/api-keys.js");
 const config_diff_js_1 = require("../routes/config-diff.js");
+const roles_js_1 = require("../routes/roles.js");
 // Must match the JWT_SECRET env var set in vitest.config.ts
 exports.TEST_JWT_SECRET = "test-jwt-secret-for-unit-tests";
 /**
@@ -59,7 +61,16 @@ function createMockStratum() {
         revokeApiKey: vitest_1.vi.fn(),
         rotateApiKey: vitest_1.vi.fn(),
         listApiKeys: vitest_1.vi.fn(),
+        getApiKey: vitest_1.vi.fn(),
         listDormantKeys: vitest_1.vi.fn(),
+        // Role methods
+        createRole: vitest_1.vi.fn(),
+        getRole: vitest_1.vi.fn(),
+        listRoles: vitest_1.vi.fn(),
+        updateRole: vitest_1.vi.fn(),
+        deleteRole: vitest_1.vi.fn(),
+        assignRoleToKey: vitest_1.vi.fn(),
+        removeRoleFromKey: vitest_1.vi.fn(),
     };
 }
 /**
@@ -74,6 +85,7 @@ async function buildTestApp(stratum) {
     // Wire up the same middleware chain as the real app
     app.addHook("preHandler", (0, auth_js_1.createAuthMiddleware)(stratum));
     app.addHook("preHandler", (0, authorize_js_1.createAuthorizeMiddleware)());
+    app.addHook("preHandler", (0, tenant_scope_js_1.createTenantScopeEnforcer)(stratum));
     app.setErrorHandler(error_handler_js_1.errorHandler);
     // Register routes (pass a stub Redis health checker — Redis is not used in tests)
     const noopRedisHealth = async () => "not_configured";
@@ -82,6 +94,7 @@ async function buildTestApp(stratum) {
     await app.register((0, config_js_1.createConfigRoutes)(stratum), { prefix: "/api/v1/tenants/:id/config" });
     await app.register((0, api_keys_js_1.createApiKeyRoutes)(stratum), { prefix: "/api/v1/api-keys" });
     await app.register((0, config_diff_js_1.createConfigDiffRoutes)(stratum), { prefix: "/api/v1/config" });
+    await app.register((0, roles_js_1.createRoleRoutes)(stratum), { prefix: "/api/v1/roles" });
     await app.ready();
     return app;
 }

package/dist/__tests__/test-helpers.js.map

@@ -1 +1 @@
-{"version":3,"file":"test-helpers.js","sourceRoot":"","sources":["../../src/__tests__/test-helpers.ts"],"names":[],"mappings":";;;;;;AAoBA,8CAoCC;AASD,oCAkBC;AAMD,kCAEC;AAKD,gCAeC;AAMD,4CAQC;AAMD,kDAQC;AAMD,4CAQC;AAzJD,sDAAmD;AACnD,mCAA4B;AAC5B,gEAA+B;AAC/B,qEAA8D;AAC9D,mDAA6D;AAC7D,6DAAuE;AACvE,mDAAmD;AACnD,qDAA0D;AAC1D,mDAAyD;AACzD,uDAA2D;AAC3D,6DAAkE;AAGlE,4DAA4D;AAC/C,QAAA,eAAe,GAAG,gCAAgC,CAAC;AAEhE;;;GAGG;AACH,SAAgB,iBAAiB;IAC/B,OAAO;QACL,iBAAiB;QACjB,YAAY,EAAE,WAAE,CAAC,EAAE,EAAE;QACrB,SAAS,EAAE,WAAE,CAAC,EAAE,EAAE;QAClB,WAAW,EAAE,WAAE,CAAC,EAAE,EAAE;QACpB,YAAY,EAAE,WAAE,CAAC,EAAE,EAAE;QACrB,YAAY,EAAE,WAAE,CAAC,EAAE,EAAE;QACrB,kBAAkB,EAAE,WAAE,CAAC,EAAE,EAAE;QAC3B,UAAU,EAAE,WAAE,CAAC,EAAE,EAAE;QACnB,YAAY,EAAE,WAAE,CAAC,EAAE,EAAE;QACrB,cAAc,EAAE,WAAE,CAAC,EAAE,EAAE;QACvB,WAAW,EAAE,WAAE,CAAC,EAAE,EAAE;QACpB,WAAW,EAAE,WAAE,CAAC,EAAE,EAAE;QACpB,gBAAgB,EAAE,WAAE,CAAC,EAAE,EAAE;QACzB,aAAa,EAAE,WAAE,CAAC,EAAE,EAAE;QAEtB,iBAAiB;QACjB,aAAa,EAAE,WAAE,CAAC,EAAE,EAAE;QACtB,SAAS,EAAE,WAAE,CAAC,EAAE,EAAE;QAClB,YAAY,EAAE,WAAE,CAAC,EAAE,EAAE;QACrB,cAAc,EAAE,WAAE,CAAC,EAAE,EAAE;QACvB,wBAAwB,EAAE,WAAE,CAAC,EAAE,EAAE;QACjC,UAAU,EAAE,WAAE,CAAC,EAAE,EAAE;QAEnB,qBAAqB;QACrB,kBAAkB,EAAE,WAAE,CAAC,EAAE,EAAE;QAE3B,kBAAkB;QAClB,YAAY,EAAE,WAAE,CAAC,EAAE,EAAE;QACrB,cAAc,EAAE,WAAE,CAAC,EAAE,EAAE;QACvB,YAAY,EAAE,WAAE,CAAC,EAAE,EAAE;QACrB,YAAY,EAAE,WAAE,CAAC,EAAE,EAAE;QACrB,WAAW,EAAE,WAAE,CAAC,EAAE,EAAE;QACpB,eAAe,EAAE,WAAE,CAAC,EAAE,EAAE;KACH,CAAC;AAC1B,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,YAAY,CAAC,OAAgB;IACjD,MAAM,GAAG,GAAG,IAAA,iBAAO,EAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAEvC,oDAAoD;IACpD,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,IAAA,8BAAoB,EAAC,OAAO,CAAC,CAAC,CAAC;IACzD,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,IAAA,wCAAyB,GAAE,CAAC,CAAC;IACvD,GAAG,CAAC,eAAe,CAAC,+BAAY,CAAC,CAAC;IAElC,kFAAkF;IAClF,MAAM,eAAe,GAAG,KAAK,IAAI,EAAE,CAAC,gBAAyB,CAAC;IAC9D,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAA,wBAAY,EAAC,eAAe,CAAC,CAAC,CAAC;IAClD,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAA,+BAAkB,EAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC/E,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAA,8BAAkB,EAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC,CAAC;IAC1F,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAA,gCAAkB,EAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAChF,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAA,uCAAsB,EAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAElF,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;IAClB,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,SAAgB,WAAW,CAAC,SAAiB,mBAAmB;IAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;AACjC,CAAC;AAED;;GAEG;AACH,SAAgB,UAAU,CACxB,UAAmC,EAAE,EACrC,SAAiB,uBAAe;IAEhC,MAAM,KAAK,GAAG,sBAAG,CAAC,IAAI,CACpB;QACE,GAAG,EAAE,cAAc;QACnB,SAAS,EAAE,qBAAa,CAAC,EAAE;QAC3B,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC;QAClC,GAAG,OAAO;KACX,EACD,MAAM,EACN,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CACxC,CAAC;IACF,OAAO,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,SAAgB,gBAAgB,CAAC,OAAgB;IAC9C,OAAO,CAAC,cAA2C,CAAC,iBAAiB,CAAC;QACrE,MAAM,EAAE,aAAa;QACrB,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC;QAClC,cAAc,EAAE,IAAI;QACpB,iBAAiB,EAAE,IAAI;KACxB,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,SAAgB,mBAAmB,CAAC,OAAgB;IACjD,OAAO,CAAC,cAA2C,CAAC,iBAAiB,CAAC;QACrE,MAAM,EAAE,sBAAsB;QAC9B,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,CAAC,MAAM,CAAC;QAChB,cAAc,EAAE,IAAI;QACpB,iBAAiB,EAAE,IAAI;KACxB,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,SAAgB,gBAAgB,CAAC,OAAgB;IAC9C,OAAO,CAAC,cAA2C,CAAC,iBAAiB,CAAC;QACrE,MAAM,EAAE,mBAAmB;QAC3B,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;QACzB,cAAc,EAAE,IAAI;QACpB,iBAAiB,EAAE,IAAI;KACxB,CAAC,CAAC;AACL,CAAC;AAED,iDAAiD;AACpC,QAAA,aAAa,GAAG;IAC3B,EAAE,EAAE,sCAAsC;IAC1C,IAAI,EAAE,WAAW;IACjB,IAAI,EAAE,WAAW;IACjB,SAAS,EAAE,IAAI;IACf,aAAa,EAAE,uCAAuC;IACtD,KAAK,EAAE,CAAC;IACR,QAAQ,EAAE,EAAE;IACZ,kBAAkB,EAAE,YAAY;IAChC,SAAS,EAAE,IAAI;IACf,UAAU,EAAE,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE;IAChD,UAAU,EAAE,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE;IAChD,UAAU,EAAE,IAAI;CACjB,CAAC;AAEF,qCAAqC;AACxB,QAAA,mBAAmB,GAAG;IACjC,EAAE,EAAE,sCAAsC;IAC1C,IAAI,EAAE,eAAe;IACrB,IAAI,EAAE,eAAe;IACrB,SAAS,EAAE,sCAAsC;IACjD,aAAa,EAAE,4EAA4E;IAC3F,KAAK,EAAE,CAAC;IACR,QAAQ,EAAE,EAAE;IACZ,kBAAkB,EAAE,YAAY;IAChC,SAAS,EAAE,IAAI;IACf,UAAU,EAAE,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE;IAChD,UAAU,EAAE,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE;IAChD,UAAU,EAAE,IAAI;CACjB,CAAC"}
+{"version":3,"file":"test-helpers.js","sourceRoot":"","sources":["../../src/__tests__/test-helpers.ts"],"names":[],"mappings":";;;;;;AAsBA,8CA8CC;AASD,oCAoBC;AAMD,kCAEC;AAKD,gCAeC;AAMD,4CAQC;AAMD,kDAQC;AAMD,4CAQC;AAvKD,sDAAmD;AACnD,mCAA4B;AAC5B,gEAA+B;AAC/B,qEAA8D;AAC9D,mDAA6D;AAC7D,6DAAuE;AACvE,mEAA0E;AAC1E,mDAAmD;AACnD,qDAA0D;AAC1D,mDAAyD;AACzD,uDAA2D;AAC3D,6DAAkE;AAClE,iDAAsD;AAGtD,4DAA4D;AAC/C,QAAA,eAAe,GAAG,gCAAgC,CAAC;AAEhE;;;GAGG;AACH,SAAgB,iBAAiB;IAC/B,OAAO;QACL,iBAAiB;QACjB,YAAY,EAAE,WAAE,CAAC,EAAE,EAAE;QACrB,SAAS,EAAE,WAAE,CAAC,EAAE,EAAE;QAClB,WAAW,EAAE,WAAE,CAAC,EAAE,EAAE;QACpB,YAAY,EAAE,WAAE,CAAC,EAAE,EAAE;QACrB,YAAY,EAAE,WAAE,CAAC,EAAE,EAAE;QACrB,kBAAkB,EAAE,WAAE,CAAC,EAAE,EAAE;QAC3B,UAAU,EAAE,WAAE,CAAC,EAAE,EAAE;QACnB,YAAY,EAAE,WAAE,CAAC,EAAE,EAAE;QACrB,cAAc,EAAE,WAAE,CAAC,EAAE,EAAE;QACvB,WAAW,EAAE,WAAE,CAAC,EAAE,EAAE;QACpB,WAAW,EAAE,WAAE,CAAC,EAAE,EAAE;QACpB,gBAAgB,EAAE,WAAE,CAAC,EAAE,EAAE;QACzB,aAAa,EAAE,WAAE,CAAC,EAAE,EAAE;QAEtB,iBAAiB;QACjB,aAAa,EAAE,WAAE,CAAC,EAAE,EAAE;QACtB,SAAS,EAAE,WAAE,CAAC,EAAE,EAAE;QAClB,YAAY,EAAE,WAAE,CAAC,EAAE,EAAE;QACrB,cAAc,EAAE,WAAE,CAAC,EAAE,EAAE;QACvB,wBAAwB,EAAE,WAAE,CAAC,EAAE,EAAE;QACjC,UAAU,EAAE,WAAE,CAAC,EAAE,EAAE;QAEnB,qBAAqB;QACrB,kBAAkB,EAAE,WAAE,CAAC,EAAE,EAAE;QAE3B,kBAAkB;QAClB,YAAY,EAAE,WAAE,CAAC,EAAE,EAAE;QACrB,cAAc,EAAE,WAAE,CAAC,EAAE,EAAE;QACvB,YAAY,EAAE,WAAE,CAAC,EAAE,EAAE;QACrB,YAAY,EAAE,WAAE,CAAC,EAAE,EAAE;QACrB,WAAW,EAAE,WAAE,CAAC,EAAE,EAAE;QACpB,SAAS,EAAE,WAAE,CAAC,EAAE,EAAE;QAClB,eAAe,EAAE,WAAE,CAAC,EAAE,EAAE;QAExB,eAAe;QACf,UAAU,EAAE,WAAE,CAAC,EAAE,EAAE;QACnB,OAAO,EAAE,WAAE,CAAC,EAAE,EAAE;QAChB,SAAS,EAAE,WAAE,CAAC,EAAE,EAAE;QAClB,UAAU,EAAE,WAAE,CAAC,EAAE,EAAE;QACnB,UAAU,EAAE,WAAE,CAAC,EAAE,EAAE;QACnB,eAAe,EAAE,WAAE,CAAC,EAAE,EAAE;QACxB,iBAAiB,EAAE,WAAE,CAAC,EAAE,EAAE;KACL,CAAC;AAC1B,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,YAAY,CAAC,OAAgB;IACjD,MAAM,GAAG,GAAG,IAAA,iBAAO,EAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAEvC,oDAAoD;IACpD,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,IAAA,8BAAoB,EAAC,OAAO,CAAC,CAAC,CAAC;IACzD,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,IAAA,wCAAyB,GAAE,CAAC,CAAC;IACvD,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,IAAA,2CAAyB,EAAC,OAAO,CAAC,CAAC,CAAC;IAC9D,GAAG,CAAC,eAAe,CAAC,+BAAY,CAAC,CAAC;IAElC,kFAAkF;IAClF,MAAM,eAAe,GAAG,KAAK,IAAI,EAAE,CAAC,gBAAyB,CAAC;IAC9D,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAA,wBAAY,EAAC,eAAe,CAAC,CAAC,CAAC;IAClD,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAA,+BAAkB,EAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC/E,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAA,8BAAkB,EAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC,CAAC;IAC1F,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAA,gCAAkB,EAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAChF,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAA,uCAAsB,EAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAClF,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAA,2BAAgB,EAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;IAE3E,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;IAClB,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,SAAgB,WAAW,CAAC,SAAiB,mBAAmB;IAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;AACjC,CAAC;AAED;;GAEG;AACH,SAAgB,UAAU,CACxB,UAAmC,EAAE,EACrC,SAAiB,uBAAe;IAEhC,MAAM,KAAK,GAAG,sBAAG,CAAC,IAAI,CACpB;QACE,GAAG,EAAE,cAAc;QACnB,SAAS,EAAE,qBAAa,CAAC,EAAE;QAC3B,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC;QAClC,GAAG,OAAO;KACX,EACD,MAAM,EACN,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CACxC,CAAC;IACF,OAAO,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,SAAgB,gBAAgB,CAAC,OAAgB;IAC9C,OAAO,CAAC,cAA2C,CAAC,iBAAiB,CAAC;QACrE,MAAM,EAAE,aAAa;QACrB,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC;QAClC,cAAc,EAAE,IAAI;QACpB,iBAAiB,EAAE,IAAI;KACxB,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,SAAgB,mBAAmB,CAAC,OAAgB;IACjD,OAAO,CAAC,cAA2C,CAAC,iBAAiB,CAAC;QACrE,MAAM,EAAE,sBAAsB;QAC9B,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,CAAC,MAAM,CAAC;QAChB,cAAc,EAAE,IAAI;QACpB,iBAAiB,EAAE,IAAI;KACxB,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,SAAgB,gBAAgB,CAAC,OAAgB;IAC9C,OAAO,CAAC,cAA2C,CAAC,iBAAiB,CAAC;QACrE,MAAM,EAAE,mBAAmB;QAC3B,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;QACzB,cAAc,EAAE,IAAI;QACpB,iBAAiB,EAAE,IAAI;KACxB,CAAC,CAAC;AACL,CAAC;AAED,iDAAiD;AACpC,QAAA,aAAa,GAAG;IAC3B,EAAE,EAAE,sCAAsC;IAC1C,IAAI,EAAE,WAAW;IACjB,IAAI,EAAE,WAAW;IACjB,SAAS,EAAE,IAAI;IACf,aAAa,EAAE,uCAAuC;IACtD,KAAK,EAAE,CAAC;IACR,QAAQ,EAAE,EAAE;IACZ,kBAAkB,EAAE,YAAY;IAChC,SAAS,EAAE,IAAI;IACf,UAAU,EAAE,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE;IAChD,UAAU,EAAE,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE;IAChD,UAAU,EAAE,IAAI;CACjB,CAAC;AAEF,qCAAqC;AACxB,QAAA,mBAAmB,GAAG;IACjC,EAAE,EAAE,sCAAsC;IAC1C,IAAI,EAAE,eAAe;IACrB,IAAI,EAAE,eAAe;IACrB,SAAS,EAAE,sCAAsC;IACjD,aAAa,EAAE,4EAA4E;IAC3F,KAAK,EAAE,CAAC;IACR,QAAQ,EAAE,EAAE;IACZ,kBAAkB,EAAE,YAAY;IAChC,SAAS,EAAE,IAAI;IACf,UAAU,EAAE,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE;IAChD,UAAU,EAAE,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE;IAChD,UAAU,EAAE,IAAI;CACjB,CAAC"}

package/dist/app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AACA,OAAgB,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AA2CnD,wBAAsB,QAAQ,IAAI,OAAO,CAAC,eAAe,CAAC,CA0EzD"}
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AACA,OAAgB,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AA4CnD,wBAAsB,QAAQ,IAAI,OAAO,CAAC,eAAe,CAAC,CA4EzD"}

package/dist/app.js

@@ -14,6 +14,7 @@ const openapi_js_1 = require("./openapi.js");
 const error_handler_js_1 = require("./middleware/error-handler.js");
 const auth_js_1 = require("./middleware/auth.js");
 const authorize_js_1 = require("./middleware/authorize.js");
+const tenant_scope_js_1 = require("./middleware/tenant-scope.js");
 const per_key_rate_limit_js_1 = require("./middleware/per-key-rate-limit.js");
 const rate_limit_redis_js_1 = require("./middleware/rate-limit-redis.js");
 const redis_js_1 = require("./redis.js");
@@ -82,6 +83,8 @@ async function buildApp() {
     await (0, openapi_js_1.registerOpenApi)(app);
     app.addHook("preHandler", (0, auth_js_1.createAuthMiddleware)(stratum));
     app.addHook("preHandler", (0, authorize_js_1.createAuthorizeMiddleware)());
+    // Default-deny: a route that declares no tenant scope is refused.
+    app.addHook("preHandler", (0, tenant_scope_js_1.createTenantScopeEnforcer)(stratum));
     // Use Redis-backed rate limiting when REDIS_URL is configured, otherwise in-memory
     const redisClient = (0, redis_js_1.createRedisClient)();
     if (redisClient) {

package/dist/app.js.map

@@ -1 +1 @@
-{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":";;;;;AA4CA,4BA0EC;AAtHD,8DAAiC;AACjC,sDAAmD;AACnD,yDAAiC;AACjC,qEAA4C;AAC5C,6DAAqC;AACrC,yCAA0C;AAC1C,6CAA+C;AAC/C,oEAA6D;AAC7D,kDAA4D;AAC5D,4DAAsE;AACtE,8EAAqF;AACrF,0EAA0E;AAC1E,yCAAiE;AACjE,kDAAkD;AAClD,oDAAyD;AACzD,kDAAwD;AACxD,4DAAiE;AACjE,sDAA0D;AAC1D,sDAA2D;AAC3D,0DAA8D;AAC9D,oDAA0D;AAC1D,4DAAkE;AAClE,oDAAyD;AACzD,gDAAqD;AACrD,4DAAiE;AACjE,8CAAoD;AACpD,4DAAmE;AACnE,2CAAqC;AACrC,sDAA6C;AAE7C,iEAAiE;AACjE,SAAS,iBAAiB,CAAC,MAAc;IACvC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;IACpE,IAAI,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACrC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QAC/B,KAAK,QAAQ,CAAC,CAAC,OAAO,KAAK,GAAG,KAAK,CAAC;QACpC,KAAK,QAAQ,CAAC,CAAC,OAAO,KAAK,GAAG,MAAM,CAAC;QACrC,KAAK,MAAM,CAAC,CAAG,OAAO,KAAK,GAAG,SAAS,CAAC;QACxC,KAAK,KAAK,CAAC,CAAI,OAAO,KAAK,GAAG,UAAU,CAAC;QACzC,OAAO,CAAC,CAAO,OAAO,MAAM,CAAC;IAC/B,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,QAAQ;IAC5B,MAAM,GAAG,GAAG,IAAA,iBAAO,EAAC;QAClB,MAAM,EAAE;YACN,KAAK,EAAE,kBAAM,CAAC,OAAO,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;YACzD,MAAM,EAAE,CAAC,2BAA2B,EAAE,0BAA0B,CAAC;SAClE;QACD,QAAQ,EAAE,GAAG,EAAE,CAAC,qBAAM,CAAC,UAAU,EAAE;KACpC,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,IAAI,aAAO,CAAC;QAC1B,IAAI,EAAE,IAAA,uBAAO,GAAE;QACf,SAAS,EAAE,kBAAM,CAAC,OAAO,KAAK,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU;KACrE,CAAC,CAAC;IAEH,MAAM,GAAG,CAAC,QAAQ,CAAC,gBAAa,EAAE;QAChC,qBAAqB,EAAE;YACrB,UAAU,EAAE;gBACV,UAAU,EAAE,CAAC,QAAQ,CAAC;gBACtB,SAAS,EAAE,CAAC,QAAQ,EAAE,iBAAiB,CAAC;gBACxC,QAAQ,EAAE,CAAC,QAAQ,EAAE,iBAAiB,CAAC;gBACvC,MAAM,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,qBAAqB,CAAC;aACnD;SACF;KACF,CAAC,CAAC;IACH,MAAM,GAAG,CAAC,QAAQ,CAAC,cAAW,EAAE;QAC9B,MAAM,EAAE,kBAAM,CAAC,cAAc;QAC7B,WAAW,EAAE,IAAI;KAClB,CAAC,CAAC;IACH,MAAM,GAAG,CAAC,QAAQ,CAAC,oBAAgB,EAAE;QACnC,GAAG,EAAE,kBAAM,CAAC,YAAY;QACxB,UAAU,EAAE,kBAAM,CAAC,eAAe;KACnC,CAAC,CAAC;IAEH,wEAAwE;IACxE,IAAA,qCAAsB,EAAC,GAAG,CAAC,CAAC;IAE5B,MAAM,IAAA,4BAAe,EAAC,GAAG,CAAC,CAAC;IAC3B,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,IAAA,8BAAoB,EAAC,OAAO,CAAC,CAAC,CAAC;IACzD,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,IAAA,wCAAyB,GAAE,CAAC,CAAC;IAEvD,mFAAmF;IACnF,MAAM,WAAW,GAAG,IAAA,4BAAiB,GAAE,CAAC;IACxC,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,QAAQ,GAAG,iBAAiB,CAAC,kBAAM,CAAC,eAAe,CAAC,CAAC;QAC3D,GAAG,CAAC,OAAO,CACT,YAAY,EACZ,IAAA,4CAAsB,EAAC,WAAW,EAAE;YAClC,WAAW,EAAE,kBAAM,CAAC,YAAY;YAChC,QAAQ;SACT,CAAC,CACH,CAAC;QACF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;IAC7E,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,IAAA,uDAA+B,GAAE,CAAC,CAAC;QAC7D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;IAClE,CAAC;IAED,GAAG,CAAC,eAAe,CAAC,+BAAY,CAAC,CAAC;IAElC,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAA,wBAAY,EAAC,2BAAgB,CAAC,CAAC,CAAC;IACnD,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAA,+BAAkB,EAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC/E,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAA,8BAAkB,EAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC,CAAC;IAC1F,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAA,uCAAsB,EAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC,CAAC;IACnG,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAA,gCAAkB,EAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAChF,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAA,iCAAmB,EAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC;IACjF,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAA,oCAAoB,EAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;IACpF,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAA,gCAAmB,EAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC,CAAC;IAClG,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAA,+BAAkB,EAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC/E,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAA,2BAAgB,EAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;IAC3E,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAA,wCAAuB,EAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC;IACxF,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAA,uCAAsB,EAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAClF,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAA,0BAAgB,EAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,yCAAyC,EAAE,CAAC,CAAC;IAErG,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":";;;;;AA6CA,4BA4EC;AAzHD,8DAAiC;AACjC,sDAAmD;AACnD,yDAAiC;AACjC,qEAA4C;AAC5C,6DAAqC;AACrC,yCAA0C;AAC1C,6CAA+C;AAC/C,oEAA6D;AAC7D,kDAA4D;AAC5D,4DAAsE;AACtE,kEAAyE;AACzE,8EAAqF;AACrF,0EAA0E;AAC1E,yCAAiE;AACjE,kDAAkD;AAClD,oDAAyD;AACzD,kDAAwD;AACxD,4DAAiE;AACjE,sDAA0D;AAC1D,sDAA2D;AAC3D,0DAA8D;AAC9D,oDAA0D;AAC1D,4DAAkE;AAClE,oDAAyD;AACzD,gDAAqD;AACrD,4DAAiE;AACjE,8CAAoD;AACpD,4DAAmE;AACnE,2CAAqC;AACrC,sDAA6C;AAE7C,iEAAiE;AACjE,SAAS,iBAAiB,CAAC,MAAc;IACvC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;IACpE,IAAI,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACrC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QAC/B,KAAK,QAAQ,CAAC,CAAC,OAAO,KAAK,GAAG,KAAK,CAAC;QACpC,KAAK,QAAQ,CAAC,CAAC,OAAO,KAAK,GAAG,MAAM,CAAC;QACrC,KAAK,MAAM,CAAC,CAAG,OAAO,KAAK,GAAG,SAAS,CAAC;QACxC,KAAK,KAAK,CAAC,CAAI,OAAO,KAAK,GAAG,UAAU,CAAC;QACzC,OAAO,CAAC,CAAO,OAAO,MAAM,CAAC;IAC/B,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,QAAQ;IAC5B,MAAM,GAAG,GAAG,IAAA,iBAAO,EAAC;QAClB,MAAM,EAAE;YACN,KAAK,EAAE,kBAAM,CAAC,OAAO,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;YACzD,MAAM,EAAE,CAAC,2BAA2B,EAAE,0BAA0B,CAAC;SAClE;QACD,QAAQ,EAAE,GAAG,EAAE,CAAC,qBAAM,CAAC,UAAU,EAAE;KACpC,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,IAAI,aAAO,CAAC;QAC1B,IAAI,EAAE,IAAA,uBAAO,GAAE;QACf,SAAS,EAAE,kBAAM,CAAC,OAAO,KAAK,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU;KACrE,CAAC,CAAC;IAEH,MAAM,GAAG,CAAC,QAAQ,CAAC,gBAAa,EAAE;QAChC,qBAAqB,EAAE;YACrB,UAAU,EAAE;gBACV,UAAU,EAAE,CAAC,QAAQ,CAAC;gBACtB,SAAS,EAAE,CAAC,QAAQ,EAAE,iBAAiB,CAAC;gBACxC,QAAQ,EAAE,CAAC,QAAQ,EAAE,iBAAiB,CAAC;gBACvC,MAAM,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,qBAAqB,CAAC;aACnD;SACF;KACF,CAAC,CAAC;IACH,MAAM,GAAG,CAAC,QAAQ,CAAC,cAAW,EAAE;QAC9B,MAAM,EAAE,kBAAM,CAAC,cAAc;QAC7B,WAAW,EAAE,IAAI;KAClB,CAAC,CAAC;IACH,MAAM,GAAG,CAAC,QAAQ,CAAC,oBAAgB,EAAE;QACnC,GAAG,EAAE,kBAAM,CAAC,YAAY;QACxB,UAAU,EAAE,kBAAM,CAAC,eAAe;KACnC,CAAC,CAAC;IAEH,wEAAwE;IACxE,IAAA,qCAAsB,EAAC,GAAG,CAAC,CAAC;IAE5B,MAAM,IAAA,4BAAe,EAAC,GAAG,CAAC,CAAC;IAC3B,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,IAAA,8BAAoB,EAAC,OAAO,CAAC,CAAC,CAAC;IACzD,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,IAAA,wCAAyB,GAAE,CAAC,CAAC;IACvD,kEAAkE;IAClE,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,IAAA,2CAAyB,EAAC,OAAO,CAAC,CAAC,CAAC;IAE9D,mFAAmF;IACnF,MAAM,WAAW,GAAG,IAAA,4BAAiB,GAAE,CAAC;IACxC,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,QAAQ,GAAG,iBAAiB,CAAC,kBAAM,CAAC,eAAe,CAAC,CAAC;QAC3D,GAAG,CAAC,OAAO,CACT,YAAY,EACZ,IAAA,4CAAsB,EAAC,WAAW,EAAE;YAClC,WAAW,EAAE,kBAAM,CAAC,YAAY;YAChC,QAAQ;SACT,CAAC,CACH,CAAC;QACF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;IAC7E,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,IAAA,uDAA+B,GAAE,CAAC,CAAC;QAC7D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;IAClE,CAAC;IAED,GAAG,CAAC,eAAe,CAAC,+BAAY,CAAC,CAAC;IAElC,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAA,wBAAY,EAAC,2BAAgB,CAAC,CAAC,CAAC;IACnD,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAA,+BAAkB,EAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC/E,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAA,8BAAkB,EAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC,CAAC;IAC1F,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAA,uCAAsB,EAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC,CAAC;IACnG,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAA,gCAAkB,EAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAChF,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAA,iCAAmB,EAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC;IACjF,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAA,oCAAoB,EAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;IACpF,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAA,gCAAmB,EAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC,CAAC;IAClG,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAA,+BAAkB,EAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC/E,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAA,2BAAgB,EAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;IAC3E,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAA,wCAAuB,EAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC;IACxF,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAA,uCAAsB,EAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAClF,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAA,0BAAgB,EAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,yCAAyC,EAAE,CAAC,CAAC;IAErG,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/middleware/authorize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../src/middleware/authorize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAqCvD,wBAAgB,yBAAyB,KAErC,SAAS,cAAc,EACvB,OAAO,YAAY,KAClB,OAAO,CAAC,IAAI,CAAC,CAsBjB"}
+{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../src/middleware/authorize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAwCvD,wBAAgB,yBAAyB,KAErC,SAAS,cAAc,EACvB,OAAO,YAAY,KAClB,OAAO,CAAC,IAAI,CAAC,CAsBjB"}

package/dist/middleware/authorize.js

@@ -24,8 +24,11 @@ const ADMIN_ROUTES = [
     /^\/api\/v1\/tenants\/[^/]+\/context$/,
 ];
 function getRequiredScope(method, url) {
+    // Match on the request path. Take everything before the first "?" so the
+    // route match is evaluated on the normalized path alone.
+    const path = url.split("?", 1)[0];
     for (const pattern of ADMIN_ROUTES) {
-        if (pattern.test(url)) {
+        if (pattern.test(path)) {
             return "admin";
         }
     }

package/dist/middleware/authorize.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorize.js","sourceRoot":"","sources":["../../src/middleware/authorize.ts"],"names":[],"mappings":";;AAqCA,8DA0BC;AA9DD,2CAAqE;AAIrE,SAAS,aAAa,CAAC,MAAc;IACnC,QAAQ,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;QAC7B,KAAK,KAAK,CAAC;QACX,KAAK,MAAM,CAAC;QACZ,KAAK,SAAS;YACZ,OAAO,MAAM,CAAC;QAChB;YACE,OAAO,OAAO,CAAC;IACnB,CAAC;AACH,CAAC;AAED,0DAA0D;AAC1D,MAAM,YAAY,GAAG;IACnB,sBAAsB;IACtB,wBAAwB;IACxB,yBAAyB;IACzB,qBAAqB;IACrB,oCAAoC;IACpC,qCAAqC;IACrC,6CAA6C;IAC7C,sCAAsC;CACvC,CAAC;AAEF,SAAS,gBAAgB,CAAC,MAAc,EAAE,GAAW;IACnD,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;QACnC,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,SAAgB,yBAAyB;IACvC,OAAO,KAAK,UAAU,mBAAmB,CACvC,OAAuB,EACvB,KAAmB;QAEnB,8CAA8C;QAC9C,IACE,OAAO,CAAC,GAAG,KAAK,gBAAgB;YAChC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,iBAAiB,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,EACnC,CAAC;YACD,OAAO;QACT,CAAC;QAED,mEAAmE;QACnE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,MAAM,IAAI,wBAAiB,CAAC,yBAAyB,CAAC,CAAC;QACzD,CAAC;QAED,MAAM,aAAa,GAAG,gBAAgB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC;QAEjD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,qBAAc,CAAC,6CAA6C,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"authorize.js","sourceRoot":"","sources":["../../src/middleware/authorize.ts"],"names":[],"mappings":";;AAwCA,8DA0BC;AAjED,2CAAqE;AAIrE,SAAS,aAAa,CAAC,MAAc;IACnC,QAAQ,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;QAC7B,KAAK,KAAK,CAAC;QACX,KAAK,MAAM,CAAC;QACZ,KAAK,SAAS;YACZ,OAAO,MAAM,CAAC;QAChB;YACE,OAAO,OAAO,CAAC;IACnB,CAAC;AACH,CAAC;AAED,0DAA0D;AAC1D,MAAM,YAAY,GAAG;IACnB,sBAAsB;IACtB,wBAAwB;IACxB,yBAAyB;IACzB,qBAAqB;IACrB,oCAAoC;IACpC,qCAAqC;IACrC,6CAA6C;IAC7C,sCAAsC;CACvC,CAAC;AAEF,SAAS,gBAAgB,CAAC,MAAc,EAAE,GAAW;IACnD,yEAAyE;IACzE,yDAAyD;IACzD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;QACnC,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,SAAgB,yBAAyB;IACvC,OAAO,KAAK,UAAU,mBAAmB,CACvC,OAAuB,EACvB,KAAmB;QAEnB,8CAA8C;QAC9C,IACE,OAAO,CAAC,GAAG,KAAK,gBAAgB;YAChC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,iBAAiB,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,EACnC,CAAC;YACD,OAAO;QACT,CAAC;QAED,mEAAmE;QACnE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,MAAM,IAAI,wBAAiB,CAAC,yBAAyB,CAAC,CAAC;QACzD,CAAC;QAED,MAAM,aAAa,GAAG,gBAAgB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC;QAEjD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,qBAAc,CAAC,6CAA6C,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/tenant-scope.d.ts

@@ -1,20 +1,84 @@
-import { FastifyRequest, FastifyReply } from "fastify";
+import { FastifyRequest, FastifyReply, FastifyInstance } from "fastify";
 import { Stratum } from "@stratum-hq/lib";
+/** Reads the target tenant id from a request, or null when there is none to check. */
+export type TenantIdExtractor = (req: FastifyRequest) => string | null;
 /**
- * Tenant-scope enforcement middleware.
+ * A route's tenant-scope declaration:
+ *  - an extractor: enforce that the caller's key may reach the extracted tenant;
+ *  - "global": operator-level route with no single tenant target, or one that
+ *    scopes itself in its handler. The middleware performs no tenant check.
+ */
+export type TenantScopeDeclaration = TenantIdExtractor | "global";
+declare module "fastify" {
+    interface FastifyContextConfig {
+        tenantScope?: TenantScopeDeclaration;
+    }
+}
+/**
+ * Core tenant-scope check for a single, already-resolved tenant id.
+ *
+ * Ensures that tenant-scoped API keys can only access data belonging to their
+ * own tenant or its descendants in the hierarchy. Global keys (tenant_id ===
+ * null) have unrestricted access. A null `tenantId` means there is no tenant to
+ * check (for example a global role, or an omitted optional filter) and passes.
+ *
+ * Exported for routes whose target tenant is not present in the request and
+ * must be resolved first (for example a role's owning tenant, looked up by id).
+ */
+export declare function assertTenantInScope(stratum: Stratum, request: FastifyRequest, tenantId: string | null): Promise<void>;
+/**
+ * Tenant-scope enforcement middleware for a single extractor.
+ *
+ * Retained for routes that must authorize a second tenant beyond the one the
+ * global enforcer already covers (for example, a move's destination parent).
+ */
+export declare function createTenantScopeGuard(stratum: Stratum, extractTenantId: TenantIdExtractor): (request: FastifyRequest, _reply: FastifyReply) => Promise<void>;
+/**
+ * Guard for POST /tenants: constrain a scoped key's new tenant to its subtree.
+ */
+export declare function createTenantCreateGuard(stratum: Stratum): (request: FastifyRequest, _reply: FastifyReply) => Promise<void>;
+/**
+ * Guard for POST /tenants/batch: every tenant in the batch is authorized the
+ * same way a single create is, so the batch route cannot sidestep the subtree
+ * constraint.
+ */
+export declare function createTenantBatchCreateGuard(stratum: Stratum): (request: FastifyRequest, _reply: FastifyReply) => Promise<void>;
+/**
+ * Declare the tenant scope for every route registered in the current plugin.
  *
- * Ensures that tenant-scoped API keys can only access data belonging
- * to their own tenant or its descendants in the hierarchy.
+ * Stamps the declaration onto each route's config so the global enforcer can
+ * read it. A route may still set its own `config.tenantScope`, which wins.
+ */
+export declare function declareTenantScope(app: FastifyInstance, declaration: TenantScopeDeclaration): void;
+/**
+ * Default-deny authorization enforcer, registered once as a global preHandler.
  *
- * Global keys (tenant_id === null) have unrestricted access.
+ * Every route must declare its tenant scope (see {@link declareTenantScope}). A
+ * route that declares none is refused, so a route added without a guard fails
+ * closed rather than silently serving data.
  */
-export declare function createTenantScopeGuard(stratum: Stratum, extractTenantId: (req: FastifyRequest) => string | null): (request: FastifyRequest, _reply: FastifyReply) => Promise<void>;
+export declare function createTenantScopeEnforcer(stratum: Stratum): (request: FastifyRequest, _reply: FastifyReply) => Promise<void>;
 /** Extract :id param (tenant routes, config routes, permission routes) */
 export declare function fromParamId(req: FastifyRequest): string | null;
 /** Extract :tenantId param (consent routes) */
 export declare function fromParamTenantId(req: FastifyRequest): string | null;
 /** Extract tenant_id from query string */
 export declare function fromQueryTenantId(req: FastifyRequest): string | null;
+/** Extract tenant_a from query string (config diff, first operand) */
+export declare function fromQueryTenantA(req: FastifyRequest): string | null;
+/** Extract tenant_b from query string (config diff, second operand) */
+export declare function fromQueryTenantB(req: FastifyRequest): string | null;
 /** Extract tenant_id from request body */
 export declare function fromBodyTenantId(req: FastifyRequest): string | null;
+/**
+ * Extract new_parent_id from a move request body: the move DESTINATION.
+ *
+ * A move has two tenants to authorize, not one. The route-level `:id` guard
+ * only covers the tenant being moved, which a scoped key already owns, so it
+ * passes on the fast path. Without authorizing the destination as well, a
+ * tenant can graft itself under any other tenant and inherit that tenant's
+ * resolved config (including decrypted `sensitive` values) and delegated
+ * permissions, because resolution walks UP the ancestry path.
+ */
+export declare function fromBodyNewParentId(req: FastifyRequest): string | null;
 //# sourceMappingURL=tenant-scope.d.ts.map

package/dist/middleware/tenant-scope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tenant-scope.d.ts","sourceRoot":"","sources":["../../src/middleware/tenant-scope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvD,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAE1C;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,OAAO,EAChB,eAAe,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,MAAM,GAAG,IAAI,IAGrD,SAAS,cAAc,EACvB,QAAQ,YAAY,KACnB,OAAO,CAAC,IAAI,CAAC,CAkCjB;AAID,0EAA0E;AAC1E,wBAAgB,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,MAAM,GAAG,IAAI,CAE9D;AAED,+CAA+C;AAC/C,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,cAAc,GAAG,MAAM,GAAG,IAAI,CAEpE;AAED,0CAA0C;AAC1C,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,cAAc,GAAG,MAAM,GAAG,IAAI,CAEpE;AAED,0CAA0C;AAC1C,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,MAAM,GAAG,IAAI,CAEnE"}
+{"version":3,"file":"tenant-scope.d.ts","sourceRoot":"","sources":["../../src/middleware/tenant-scope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAExE,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAE1C,sFAAsF;AACtF,MAAM,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE,cAAc,KAAK,MAAM,GAAG,IAAI,CAAC;AAEvE;;;;;GAKG;AACH,MAAM,MAAM,sBAAsB,GAAG,iBAAiB,GAAG,QAAQ,CAAC;AAElE,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,oBAAoB;QAC5B,WAAW,CAAC,EAAE,sBAAsB,CAAC;KACtC;CACF;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,cAAc,EACvB,QAAQ,EAAE,MAAM,GAAG,IAAI,GACtB,OAAO,CAAC,IAAI,CAAC,CAgCf;AAaD;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,OAAO,EAChB,eAAe,EAAE,iBAAiB,IAGhC,SAAS,cAAc,EACvB,QAAQ,YAAY,KACnB,OAAO,CAAC,IAAI,CAAC,CAGjB;AA6BD;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,IAEpD,SAAS,cAAc,EACvB,QAAQ,YAAY,KACnB,OAAO,CAAC,IAAI,CAAC,CAIjB;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,OAAO,IAEzD,SAAS,cAAc,EACvB,QAAQ,YAAY,KACnB,OAAO,CAAC,IAAI,CAAC,CASjB;AAYD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,eAAe,EACpB,WAAW,EAAE,sBAAsB,GAClC,IAAI,CAON;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,OAAO,IAEtD,SAAS,cAAc,EACvB,QAAQ,YAAY,KACnB,OAAO,CAAC,IAAI,CAAC,CAWjB;AAID,0EAA0E;AAC1E,wBAAgB,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,MAAM,GAAG,IAAI,CAE9D;AAED,+CAA+C;AAC/C,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,cAAc,GAAG,MAAM,GAAG,IAAI,CAEpE;AAED,0CAA0C;AAC1C,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,cAAc,GAAG,MAAM,GAAG,IAAI,CAEpE;AAED,sEAAsE;AACtE,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,MAAM,GAAG,IAAI,CAEnE;AAED,uEAAuE;AACvE,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,MAAM,GAAG,IAAI,CAEnE;AAED,0CAA0C;AAC1C,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,MAAM,GAAG,IAAI,CAEnE;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,cAAc,GAAG,MAAM,GAAG,IAAI,CAEtE"}

package/dist/middleware/tenant-scope.js

@@ -1,50 +1,159 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertTenantInScope = assertTenantInScope;
 exports.createTenantScopeGuard = createTenantScopeGuard;
+exports.createTenantCreateGuard = createTenantCreateGuard;
+exports.createTenantBatchCreateGuard = createTenantBatchCreateGuard;
+exports.declareTenantScope = declareTenantScope;
+exports.createTenantScopeEnforcer = createTenantScopeEnforcer;
 exports.fromParamId = fromParamId;
 exports.fromParamTenantId = fromParamTenantId;
 exports.fromQueryTenantId = fromQueryTenantId;
+exports.fromQueryTenantA = fromQueryTenantA;
+exports.fromQueryTenantB = fromQueryTenantB;
 exports.fromBodyTenantId = fromBodyTenantId;
+exports.fromBodyNewParentId = fromBodyNewParentId;
 const core_1 = require("@stratum-hq/core");
 /**
- * Tenant-scope enforcement middleware.
+ * Core tenant-scope check for a single, already-resolved tenant id.
  *
- * Ensures that tenant-scoped API keys can only access data belonging
- * to their own tenant or its descendants in the hierarchy.
+ * Ensures that tenant-scoped API keys can only access data belonging to their
+ * own tenant or its descendants in the hierarchy. Global keys (tenant_id ===
+ * null) have unrestricted access. A null `tenantId` means there is no tenant to
+ * check (for example a global role, or an omitted optional filter) and passes.
  *
- * Global keys (tenant_id === null) have unrestricted access.
+ * Exported for routes whose target tenant is not present in the request and
+ * must be resolved first (for example a role's owning tenant, looked up by id).
+ */
+async function assertTenantInScope(stratum, request, tenantId) {
+    const apiKey = request.apiKey;
+    if (!apiKey)
+        return;
+    // Only API keys may have global (null tenant_id) access.
+    // JWT auth should never reach here with null tenant_id after the auth middleware
+    // fix, but guard defensively anyway.
+    if (apiKey.tenant_id === null) {
+        if (request.authMethod === "api_key")
+            return;
+        throw new core_1.ForbiddenError("JWT authentication requires a tenant scope");
+    }
+    if (!tenantId)
+        return;
+    // Fast path: exact match
+    if (apiKey.tenant_id === tenantId)
+        return;
+    // Hierarchy check: target must be a descendant of the key's tenant
+    try {
+        const target = await stratum.getTenant(tenantId);
+        const ancestorIds = target.ancestry_path.split("/").filter(Boolean);
+        if (ancestorIds.includes(apiKey.tenant_id))
+            return;
+    }
+    catch {
+        // Tenant not found: fail closed for scoped keys
+        throw new core_1.ForbiddenError("API key tenant scope does not grant access to this tenant");
+    }
+    throw new core_1.ForbiddenError("API key tenant scope does not grant access to this tenant");
+}
+/**
+ * Core tenant-scope check for a tenant id read from the request by `extractTenantId`.
+ */
+async function checkTenantScope(stratum, request, extractTenantId) {
+    await assertTenantInScope(stratum, request, extractTenantId(request));
+}
+/**
+ * Tenant-scope enforcement middleware for a single extractor.
+ *
+ * Retained for routes that must authorize a second tenant beyond the one the
+ * global enforcer already covers (for example, a move's destination parent).
  */
 function createTenantScopeGuard(stratum, extractTenantId) {
     return async function tenantScopeGuard(request, _reply) {
-        const apiKey = request.apiKey;
-        if (!apiKey)
-            return;
-        // Only API keys may have global (null tenant_id) access.
-        // JWT auth should never reach here with null tenant_id after the auth middleware
-        // fix, but guard defensively anyway.
-        if (apiKey.tenant_id === null) {
-            if (request.authMethod === "api_key")
-                return;
-            throw new core_1.ForbiddenError("JWT authentication requires a tenant scope");
+        await checkTenantScope(stratum, request, extractTenantId);
+    };
+}
+/**
+ * Authorize a single tenant CREATE against the caller's key scope.
+ *
+ * A scoped key may only create tenants within its own subtree, so the new
+ * tenant's parent must be the key's own tenant or a descendant of it. A scoped
+ * key may not create a new root (a tenant with no parent). Global (operator)
+ * keys are unrestricted and may create roots anywhere.
+ */
+async function authorizeCreateUnder(stratum, request, parentId) {
+    const apiKey = request.apiKey;
+    if (!apiKey)
+        return;
+    // Only global API keys (null tenant_id) may create roots or create anywhere.
+    if (apiKey.tenant_id === null && request.authMethod === "api_key")
+        return;
+    if (!parentId) {
+        throw new core_1.ForbiddenError("API key tenant scope may not create root tenants");
+    }
+    await checkTenantScope(stratum, request, () => parentId);
+}
+/**
+ * Guard for POST /tenants: constrain a scoped key's new tenant to its subtree.
+ */
+function createTenantCreateGuard(stratum) {
+    return async function tenantCreateGuard(request, _reply) {
+        const body = request.body;
+        await authorizeCreateUnder(stratum, request, body?.parent_id ?? null);
+    };
+}
+/**
+ * Guard for POST /tenants/batch: every tenant in the batch is authorized the
+ * same way a single create is, so the batch route cannot sidestep the subtree
+ * constraint.
+ */
+function createTenantBatchCreateGuard(stratum) {
+    return async function tenantBatchCreateGuard(request, _reply) {
+        const body = request.body;
+        const tenants = Array.isArray(body?.tenants) ? body.tenants : [];
+        for (const tenant of tenants) {
+            await authorizeCreateUnder(stratum, request, tenant?.parent_id ?? null);
         }
-        const targetTenantId = extractTenantId(request);
-        if (!targetTenantId)
-            return;
-        // Fast path: exact match
-        if (apiKey.tenant_id === targetTenantId)
+    };
+}
+// Endpoints that carry no authentication and therefore no tenant scope.
+// Kept in step with the same skip list in the auth and authorize middleware.
+function isUnauthenticatedPath(url) {
+    return (url === "/api/v1/health" ||
+        url.startsWith("/api/v1/health?") ||
+        url.startsWith("/api/docs"));
+}
+/**
+ * Declare the tenant scope for every route registered in the current plugin.
+ *
+ * Stamps the declaration onto each route's config so the global enforcer can
+ * read it. A route may still set its own `config.tenantScope`, which wins.
+ */
+function declareTenantScope(app, declaration) {
+    app.addHook("onRoute", (routeOptions) => {
+        routeOptions.config = {
+            ...routeOptions.config,
+            tenantScope: routeOptions.config?.tenantScope ?? declaration,
+        };
+    });
+}
+/**
+ * Default-deny authorization enforcer, registered once as a global preHandler.
+ *
+ * Every route must declare its tenant scope (see {@link declareTenantScope}). A
+ * route that declares none is refused, so a route added without a guard fails
+ * closed rather than silently serving data.
+ */
+function createTenantScopeEnforcer(stratum) {
+    return async function tenantScopeEnforcer(request, _reply) {
+        if (isUnauthenticatedPath(request.url))
             return;
-        // Hierarchy check: target must be a descendant of the key's tenant
-        try {
-            const target = await stratum.getTenant(targetTenantId);
-            const ancestorIds = target.ancestry_path.split("/").filter(Boolean);
-            if (ancestorIds.includes(apiKey.tenant_id))
-                return;
-        }
-        catch {
-            // Tenant not found — fail closed for scoped keys
-            throw new core_1.ForbiddenError("API key tenant scope does not grant access to this tenant");
+        const declaration = request.routeOptions?.config?.tenantScope;
+        if (declaration === undefined) {
+            throw new core_1.ForbiddenError("Route has no tenant-scope declaration");
         }
-        throw new core_1.ForbiddenError("API key tenant scope does not grant access to this tenant");
+        if (declaration === "global")
+            return;
+        await checkTenantScope(stratum, request, declaration);
     };
 }
 // --- Extractors ---
@@ -60,8 +169,29 @@ function fromParamTenantId(req) {
 function fromQueryTenantId(req) {
     return req.query.tenant_id ?? null;
 }
+/** Extract tenant_a from query string (config diff, first operand) */
+function fromQueryTenantA(req) {
+    return req.query.tenant_a ?? null;
+}
+/** Extract tenant_b from query string (config diff, second operand) */
+function fromQueryTenantB(req) {
+    return req.query.tenant_b ?? null;
+}
 /** Extract tenant_id from request body */
 function fromBodyTenantId(req) {
     return req.body?.tenant_id ?? null;
 }
+/**
+ * Extract new_parent_id from a move request body: the move DESTINATION.
+ *
+ * A move has two tenants to authorize, not one. The route-level `:id` guard
+ * only covers the tenant being moved, which a scoped key already owns, so it
+ * passes on the fast path. Without authorizing the destination as well, a
+ * tenant can graft itself under any other tenant and inherit that tenant's
+ * resolved config (including decrypted `sensitive` values) and delegated
+ * permissions, because resolution walks UP the ancestry path.
+ */
+function fromBodyNewParentId(req) {
+    return req.body?.new_parent_id ?? null;
+}
 //# sourceMappingURL=tenant-scope.js.map

package/dist/middleware/tenant-scope.js.map

@@ -1 +1 @@
-{"version":3,"file":"tenant-scope.js","sourceRoot":"","sources":["../../src/middleware/tenant-scope.ts"],"names":[],"mappings":";;AAYA,wDAyCC;AAKD,kCAEC;AAGD,8CAEC;AAGD,8CAEC;AAGD,4CAEC;AA1ED,2CAAkD;AAGlD;;;;;;;GAOG;AACH,SAAgB,sBAAsB,CACpC,OAAgB,EAChB,eAAuD;IAEvD,OAAO,KAAK,UAAU,gBAAgB,CACpC,OAAuB,EACvB,MAAoB;QAEpB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,IAAI,CAAC,MAAM;YAAE,OAAO;QAEpB,yDAAyD;QACzD,iFAAiF;QACjF,qCAAqC;QACrC,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAC9B,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS;gBAAE,OAAO;YAC7C,MAAM,IAAI,qBAAc,CAAC,4CAA4C,CAAC,CAAC;QACzE,CAAC;QAED,MAAM,cAAc,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,cAAc;YAAE,OAAO;QAE5B,yBAAyB;QACzB,IAAI,MAAM,CAAC,SAAS,KAAK,cAAc;YAAE,OAAO;QAEhD,mEAAmE;QACnE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;YACvD,MAAM,WAAW,GAAG,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACpE,IAAI,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;gBAAE,OAAO;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,iDAAiD;YACjD,MAAM,IAAI,qBAAc,CACtB,2DAA2D,CAC5D,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,qBAAc,CACtB,2DAA2D,CAC5D,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,qBAAqB;AAErB,0EAA0E;AAC1E,SAAgB,WAAW,CAAC,GAAmB;IAC7C,OAAQ,GAAG,CAAC,MAAiC,CAAC,EAAE,IAAI,IAAI,CAAC;AAC3D,CAAC;AAED,+CAA+C;AAC/C,SAAgB,iBAAiB,CAAC,GAAmB;IACnD,OAAQ,GAAG,CAAC,MAAiC,CAAC,QAAQ,IAAI,IAAI,CAAC;AACjE,CAAC;AAED,0CAA0C;AAC1C,SAAgB,iBAAiB,CAAC,GAAmB;IACnD,OAAQ,GAAG,CAAC,KAAgC,CAAC,SAAS,IAAI,IAAI,CAAC;AACjE,CAAC;AAED,0CAA0C;AAC1C,SAAgB,gBAAgB,CAAC,GAAmB;IAClD,OAAQ,GAAG,CAAC,IAAsC,EAAE,SAAS,IAAI,IAAI,CAAC;AACxE,CAAC"}
+{"version":3,"file":"tenant-scope.js","sourceRoot":"","sources":["../../src/middleware/tenant-scope.ts"],"names":[],"mappings":";;AAgCA,kDAoCC;AAmBD,wDAUC;AAgCD,0DAQC;AAOD,oEAaC;AAkBD,gDAUC;AASD,8DAeC;AAKD,kCAEC;AAGD,8CAEC;AAGD,8CAEC;AAGD,4CAEC;AAGD,4CAEC;AAGD,4CAEC;AAYD,kDAEC;AA9PD,2CAAkD;AAoBlD;;;;;;;;;;GAUG;AACI,KAAK,UAAU,mBAAmB,CACvC,OAAgB,EAChB,OAAuB,EACvB,QAAuB;IAEvB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,IAAI,CAAC,MAAM;QAAE,OAAO;IAEpB,yDAAyD;IACzD,iFAAiF;IACjF,qCAAqC;IACrC,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAC9B,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS;YAAE,OAAO;QAC7C,MAAM,IAAI,qBAAc,CAAC,4CAA4C,CAAC,CAAC;IACzE,CAAC;IAED,IAAI,CAAC,QAAQ;QAAE,OAAO;IAEtB,yBAAyB;IACzB,IAAI,MAAM,CAAC,SAAS,KAAK,QAAQ;QAAE,OAAO;IAE1C,mEAAmE;IACnE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACjD,MAAM,WAAW,GAAG,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpE,IAAI,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;YAAE,OAAO;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,gDAAgD;QAChD,MAAM,IAAI,qBAAc,CACtB,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,qBAAc,CACtB,2DAA2D,CAC5D,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,gBAAgB,CAC7B,OAAgB,EAChB,OAAuB,EACvB,eAAkC;IAElC,MAAM,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;AACxE,CAAC;AAED;;;;;GAKG;AACH,SAAgB,sBAAsB,CACpC,OAAgB,EAChB,eAAkC;IAElC,OAAO,KAAK,UAAU,gBAAgB,CACpC,OAAuB,EACvB,MAAoB;QAEpB,MAAM,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC;IAC5D,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,oBAAoB,CACjC,OAAgB,EAChB,OAAuB,EACvB,QAAuB;IAEvB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,IAAI,CAAC,MAAM;QAAE,OAAO;IAEpB,6EAA6E;IAC7E,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO;IAE1E,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,qBAAc,CACtB,kDAAkD,CACnD,CAAC;IACJ,CAAC;IACD,MAAM,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC;AAC3D,CAAC;AAED;;GAEG;AACH,SAAgB,uBAAuB,CAAC,OAAgB;IACtD,OAAO,KAAK,UAAU,iBAAiB,CACrC,OAAuB,EACvB,MAAoB;QAEpB,MAAM,IAAI,GAAG,OAAO,CAAC,IAA4C,CAAC;QAClE,MAAM,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,IAAI,IAAI,CAAC,CAAC;IACxE,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,4BAA4B,CAAC,OAAgB;IAC3D,OAAO,KAAK,UAAU,sBAAsB,CAC1C,OAAuB,EACvB,MAAoB;QAEpB,MAAM,IAAI,GAAG,OAAO,CAAC,IAEb,CAAC;QACT,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,IAAI,IAAI,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,6EAA6E;AAC7E,SAAS,qBAAqB,CAAC,GAAW;IACxC,OAAO,CACL,GAAG,KAAK,gBAAgB;QACxB,GAAG,CAAC,UAAU,CAAC,iBAAiB,CAAC;QACjC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,CAC5B,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,kBAAkB,CAChC,GAAoB,EACpB,WAAmC;IAEnC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,YAAY,EAAE,EAAE;QACtC,YAAY,CAAC,MAAM,GAAG;YACpB,GAAG,YAAY,CAAC,MAAM;YACtB,WAAW,EAAE,YAAY,CAAC,MAAM,EAAE,WAAW,IAAI,WAAW;SAC7D,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,yBAAyB,CAAC,OAAgB;IACxD,OAAO,KAAK,UAAU,mBAAmB,CACvC,OAAuB,EACvB,MAAoB;QAEpB,IAAI,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO;QAE/C,MAAM,WAAW,GAAG,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,WAAW,CAAC;QAC9D,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,qBAAc,CAAC,uCAAuC,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,WAAW,KAAK,QAAQ;YAAE,OAAO;QAErC,MAAM,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;IACxD,CAAC,CAAC;AACJ,CAAC;AAED,qBAAqB;AAErB,0EAA0E;AAC1E,SAAgB,WAAW,CAAC,GAAmB;IAC7C,OAAQ,GAAG,CAAC,MAAiC,CAAC,EAAE,IAAI,IAAI,CAAC;AAC3D,CAAC;AAED,+CAA+C;AAC/C,SAAgB,iBAAiB,CAAC,GAAmB;IACnD,OAAQ,GAAG,CAAC,MAAiC,CAAC,QAAQ,IAAI,IAAI,CAAC;AACjE,CAAC;AAED,0CAA0C;AAC1C,SAAgB,iBAAiB,CAAC,GAAmB;IACnD,OAAQ,GAAG,CAAC,KAAgC,CAAC,SAAS,IAAI,IAAI,CAAC;AACjE,CAAC;AAED,sEAAsE;AACtE,SAAgB,gBAAgB,CAAC,GAAmB;IAClD,OAAQ,GAAG,CAAC,KAAgC,CAAC,QAAQ,IAAI,IAAI,CAAC;AAChE,CAAC;AAED,uEAAuE;AACvE,SAAgB,gBAAgB,CAAC,GAAmB;IAClD,OAAQ,GAAG,CAAC,KAAgC,CAAC,QAAQ,IAAI,IAAI,CAAC;AAChE,CAAC;AAED,0CAA0C;AAC1C,SAAgB,gBAAgB,CAAC,GAAmB;IAClD,OAAQ,GAAG,CAAC,IAAsC,EAAE,SAAS,IAAI,IAAI,CAAC;AACxE,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,mBAAmB,CAAC,GAAmB;IACrD,OAAQ,GAAG,CAAC,IAAsC,EAAE,aAAa,IAAI,IAAI,CAAC;AAC5E,CAAC"}

package/dist/routes/abac.js

@@ -6,7 +6,7 @@ const tenant_scope_js_1 = require("../middleware/tenant-scope.js");
 function createAbacRoutes(stratum) {
     return async function abacRoutes(app) {
         // Tenant-scoped keys can only access ABAC policies for their own tenant subtree
-        app.addHook("preHandler", (0, tenant_scope_js_1.createTenantScopeGuard)(stratum, tenant_scope_js_1.fromParamTenantId));
+        (0, tenant_scope_js_1.declareTenantScope)(app, tenant_scope_js_1.fromParamTenantId);
         // POST /api/v1/tenants/:tenantId/abac-policies — Create ABAC policy
         app.post("/", async (request, reply) => {
             const input = core_1.CreateAbacPolicyInputSchema.parse(request.body);