@stratum-hq/control-plane 0.3.0 → 1.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/app.d.ts.map +1 -1
- package/dist/app.js +3 -0
- package/dist/app.js.map +1 -1
- package/dist/middleware/authorize.d.ts.map +1 -1
- package/dist/middleware/authorize.js +7 -2
- package/dist/middleware/authorize.js.map +1 -1
- package/dist/middleware/tenant-scope.d.ts +70 -6
- package/dist/middleware/tenant-scope.d.ts.map +1 -1
- package/dist/middleware/tenant-scope.js +160 -30
- package/dist/middleware/tenant-scope.js.map +1 -1
- package/dist/routes/abac.js +1 -1
- package/dist/routes/abac.js.map +1 -1
- package/dist/routes/api-keys.d.ts.map +1 -1
- package/dist/routes/api-keys.js +5 -1
- package/dist/routes/api-keys.js.map +1 -1
- package/dist/routes/audit-logs.d.ts.map +1 -1
- package/dist/routes/audit-logs.js +3 -0
- package/dist/routes/audit-logs.js.map +1 -1
- package/dist/routes/config-diff.d.ts.map +1 -1
- package/dist/routes/config-diff.js +8 -1
- package/dist/routes/config-diff.js.map +1 -1
- package/dist/routes/config.js +1 -1
- package/dist/routes/config.js.map +1 -1
- package/dist/routes/consent.js +1 -1
- package/dist/routes/consent.js.map +1 -1
- package/dist/routes/maintenance.d.ts.map +1 -1
- package/dist/routes/maintenance.js +3 -0
- package/dist/routes/maintenance.js.map +1 -1
- package/dist/routes/permissions.js +1 -1
- package/dist/routes/permissions.js.map +1 -1
- package/dist/routes/regions.d.ts.map +1 -1
- package/dist/routes/regions.js +3 -0
- package/dist/routes/regions.js.map +1 -1
- package/dist/routes/roles.d.ts.map +1 -1
- package/dist/routes/roles.js +49 -6
- package/dist/routes/roles.js.map +1 -1
- package/dist/routes/tenants.d.ts.map +1 -1
- package/dist/routes/tenants.js +14 -4
- package/dist/routes/tenants.js.map +1 -1
- package/dist/routes/webhooks.js +1 -1
- package/dist/routes/webhooks.js.map +1 -1
- package/package.json +16 -2
- package/dist/__tests__/api-keys.test.d.ts +0 -2
- package/dist/__tests__/api-keys.test.d.ts.map +0 -1
- package/dist/__tests__/api-keys.test.js +0 -240
- package/dist/__tests__/api-keys.test.js.map +0 -1
- package/dist/__tests__/auth.test.d.ts +0 -2
- package/dist/__tests__/auth.test.d.ts.map +0 -1
- package/dist/__tests__/auth.test.js +0 -229
- package/dist/__tests__/auth.test.js.map +0 -1
- package/dist/__tests__/config.test.d.ts +0 -2
- package/dist/__tests__/config.test.d.ts.map +0 -1
- package/dist/__tests__/config.test.js +0 -256
- package/dist/__tests__/config.test.js.map +0 -1
- package/dist/__tests__/tenants.test.d.ts +0 -2
- package/dist/__tests__/tenants.test.d.ts.map +0 -1
- package/dist/__tests__/tenants.test.js +0 -214
- package/dist/__tests__/tenants.test.js.map +0 -1
- package/dist/__tests__/test-helpers.d.ts +0 -71
- package/dist/__tests__/test-helpers.d.ts.map +0 -1
- package/dist/__tests__/test-helpers.js +0 -176
- package/dist/__tests__/test-helpers.js.map +0 -1
package/dist/app.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AACA,OAAgB,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;
|
|
1
|
+
{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AACA,OAAgB,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AA4CnD,wBAAsB,QAAQ,IAAI,OAAO,CAAC,eAAe,CAAC,CA4EzD"}
|
package/dist/app.js
CHANGED
|
@@ -14,6 +14,7 @@ const openapi_js_1 = require("./openapi.js");
|
|
|
14
14
|
const error_handler_js_1 = require("./middleware/error-handler.js");
|
|
15
15
|
const auth_js_1 = require("./middleware/auth.js");
|
|
16
16
|
const authorize_js_1 = require("./middleware/authorize.js");
|
|
17
|
+
const tenant_scope_js_1 = require("./middleware/tenant-scope.js");
|
|
17
18
|
const per_key_rate_limit_js_1 = require("./middleware/per-key-rate-limit.js");
|
|
18
19
|
const rate_limit_redis_js_1 = require("./middleware/rate-limit-redis.js");
|
|
19
20
|
const redis_js_1 = require("./redis.js");
|
|
@@ -82,6 +83,8 @@ async function buildApp() {
|
|
|
82
83
|
await (0, openapi_js_1.registerOpenApi)(app);
|
|
83
84
|
app.addHook("preHandler", (0, auth_js_1.createAuthMiddleware)(stratum));
|
|
84
85
|
app.addHook("preHandler", (0, authorize_js_1.createAuthorizeMiddleware)());
|
|
86
|
+
// Default-deny: a route that declares no tenant scope is refused.
|
|
87
|
+
app.addHook("preHandler", (0, tenant_scope_js_1.createTenantScopeEnforcer)(stratum));
|
|
85
88
|
// Use Redis-backed rate limiting when REDIS_URL is configured, otherwise in-memory
|
|
86
89
|
const redisClient = (0, redis_js_1.createRedisClient)();
|
|
87
90
|
if (redisClient) {
|
package/dist/app.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":";;;;;
|
|
1
|
+
{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":";;;;;AA6CA,4BA4EC;AAzHD,8DAAiC;AACjC,sDAAmD;AACnD,yDAAiC;AACjC,qEAA4C;AAC5C,6DAAqC;AACrC,yCAA0C;AAC1C,6CAA+C;AAC/C,oEAA6D;AAC7D,kDAA4D;AAC5D,4DAAsE;AACtE,kEAAyE;AACzE,8EAAqF;AACrF,0EAA0E;AAC1E,yCAAiE;AACjE,kDAAkD;AAClD,oDAAyD;AACzD,kDAAwD;AACxD,4DAAiE;AACjE,sDAA0D;AAC1D,sDAA2D;AAC3D,0DAA8D;AAC9D,oDAA0D;AAC1D,4DAAkE;AAClE,oDAAyD;AACzD,gDAAqD;AACrD,4DAAiE;AACjE,8CAAoD;AACpD,4DAAmE;AACnE,2CAAqC;AACrC,sDAA6C;AAE7C,iEAAiE;AACjE,SAAS,iBAAiB,CAAC,MAAc;IACvC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;IACpE,IAAI,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACrC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QAC/B,KAAK,QAAQ,CAAC,CAAC,OAAO,KAAK,GAAG,KAAK,CAAC;QACpC,KAAK,QAAQ,CAAC,CAAC,OAAO,KAAK,GAAG,MAAM,CAAC;QACrC,KAAK,MAAM,CAAC,CAAG,OAAO,KAAK,GAAG,SAAS,CAAC;QACxC,KAAK,KAAK,CAAC,CAAI,OAAO,KAAK,GAAG,UAAU,CAAC;QACzC,OAAO,CAAC,CAAO,OAAO,MAAM,CAAC;IAC/B,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,QAAQ;IAC5B,MAAM,GAAG,GAAG,IAAA,iBAAO,EAAC;QAClB,MAAM,EAAE;YACN,KAAK,EAAE,kBAAM,CAAC,OAAO,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;YACzD,MAAM,EAAE,CAAC,2BAA2B,EAAE,0BAA0B,CAAC;SAClE;QACD,QAAQ,EAAE,GAAG,EAAE,CAAC,qBAAM,CAAC,UAAU,EAAE;KACpC,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,IAAI,aAAO,CAAC;QAC1B,IAAI,EAAE,IAAA,uBAAO,GAAE;QACf,SAAS,EAAE,kBAAM,CAAC,OAAO,KAAK,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU;KACrE,CAAC,CAAC;IAEH,MAAM,GAAG,CAAC,QAAQ,CAAC,gBAAa,EAAE;QAChC,qBAAqB,EAAE;YACrB,UAAU,EAAE;gBACV,UAAU,EAAE,CAAC,QAAQ,CAAC;gBACtB,SAAS,EAAE,CAAC,QAAQ,EAAE,iBAAiB,CAAC;gBACxC,QAAQ,EAAE,CAAC,QAAQ,EAAE,iBAAiB,CAAC;gBACvC,MAAM,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,qBAAqB,CAAC;aACnD;SACF;KACF,CAAC,CAAC;IACH,MAAM,GAAG,CAAC,QAAQ,CAAC,cAAW,EAAE;QAC9B,MAAM,EAAE,kBAAM,CAAC,cAAc;QAC7B,WAAW,EAAE,IAAI;KAClB,CAAC,CAAC;IACH,MAAM,GAAG,CAAC,QAAQ,CAAC,oBAAgB,EAAE;QACnC,GAAG,EAAE,kBAAM,CAAC,YAAY;QACxB,UAAU,EAAE,kBAAM,CAAC,eAAe;KACnC,CAAC,CAAC;IAEH,wEAAwE;IACxE,IAAA,qCAAsB,EAAC,GAAG,CAAC,CAAC;IAE5B,MAAM,IAAA,4BAAe,EAAC,GAAG,CAAC,CAAC;IAC3B,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,IAAA,8BAAoB,EAAC,OAAO,CAAC,CAAC,CAAC;IACzD,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,IAAA,wCAAyB,GAAE,CAAC,CAAC;IACvD,kEAAkE;IAClE,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,IAAA,2CAAyB,EAAC,OAAO,CAAC,CAAC,CAAC;IAE9D,mFAAmF;IACnF,MAAM,WAAW,GAAG,IAAA,4BAAiB,GAAE,CAAC;IACxC,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,QAAQ,GAAG,iBAAiB,CAAC,kBAAM,CAAC,eAAe,CAAC,CAAC;QAC3D,GAAG,CAAC,OAAO,CACT,YAAY,EACZ,IAAA,4CAAsB,EAAC,WAAW,EAAE;YAClC,WAAW,EAAE,kBAAM,CAAC,YAAY;YAChC,QAAQ;SACT,CAAC,CACH,CAAC;QACF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;IAC7E,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,IAAA,uDAA+B,GAAE,CAAC,CAAC;QAC7D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;IAClE,CAAC;IAED,GAAG,CAAC,eAAe,CAAC,+BAAY,CAAC,CAAC;IAElC,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAA,wBAAY,EAAC,2BAAgB,CAAC,CAAC,CAAC;IACnD,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAA,+BAAkB,EAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC/E,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAA,8BAAkB,EAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC,CAAC;IAC1F,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAA,uCAAsB,EAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC,CAAC;IACnG,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAA,gCAAkB,EAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAChF,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAA,iCAAmB,EAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC;IACjF,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAA,oCAAoB,EAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;IACpF,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAA,gCAAmB,EAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC,CAAC;IAClG,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAA,+BAAkB,EAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC/E,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAA,2BAAgB,EAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;IAC3E,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAA,wCAAuB,EAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC;IACxF,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAA,uCAAsB,EAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAClF,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAA,0BAAgB,EAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,yCAAyC,EAAE,CAAC,CAAC;IAErG,OAAO,GAAG,CAAC;AACb,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../src/middleware/authorize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;
|
|
1
|
+
{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../src/middleware/authorize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAwCvD,wBAAgB,yBAAyB,KAErC,SAAS,cAAc,EACvB,OAAO,YAAY,KAClB,OAAO,CAAC,IAAI,CAAC,CAwBjB"}
|
|
@@ -24,8 +24,11 @@ const ADMIN_ROUTES = [
|
|
|
24
24
|
/^\/api\/v1\/tenants\/[^/]+\/context$/,
|
|
25
25
|
];
|
|
26
26
|
function getRequiredScope(method, url) {
|
|
27
|
+
// Match on the request path. Take everything before the first "?" so the
|
|
28
|
+
// route match is evaluated on the normalized path alone.
|
|
29
|
+
const path = url.split("?", 1)[0];
|
|
27
30
|
for (const pattern of ADMIN_ROUTES) {
|
|
28
|
-
if (pattern.test(
|
|
31
|
+
if (pattern.test(path)) {
|
|
29
32
|
return "admin";
|
|
30
33
|
}
|
|
31
34
|
}
|
|
@@ -45,7 +48,9 @@ function createAuthorizeMiddleware() {
|
|
|
45
48
|
}
|
|
46
49
|
const requiredScope = getRequiredScope(request.method, request.url);
|
|
47
50
|
const scopes = request.apiKey.scopes ?? ["read"];
|
|
48
|
-
|
|
51
|
+
// Hierarchical scopes: admin implies write implies read. A granted scope
|
|
52
|
+
// satisfies any required scope of equal-or-lower rank.
|
|
53
|
+
if (!(0, core_1.scopeSatisfies)(scopes, requiredScope)) {
|
|
49
54
|
throw new core_1.ForbiddenError("Insufficient permissions for this operation");
|
|
50
55
|
}
|
|
51
56
|
};
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"authorize.js","sourceRoot":"","sources":["../../src/middleware/authorize.ts"],"names":[],"mappings":";;
|
|
1
|
+
{"version":3,"file":"authorize.js","sourceRoot":"","sources":["../../src/middleware/authorize.ts"],"names":[],"mappings":";;AAwCA,8DA4BC;AAnED,2CAAqF;AAIrF,SAAS,aAAa,CAAC,MAAc;IACnC,QAAQ,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;QAC7B,KAAK,KAAK,CAAC;QACX,KAAK,MAAM,CAAC;QACZ,KAAK,SAAS;YACZ,OAAO,MAAM,CAAC;QAChB;YACE,OAAO,OAAO,CAAC;IACnB,CAAC;AACH,CAAC;AAED,0DAA0D;AAC1D,MAAM,YAAY,GAAG;IACnB,sBAAsB;IACtB,wBAAwB;IACxB,yBAAyB;IACzB,qBAAqB;IACrB,oCAAoC;IACpC,qCAAqC;IACrC,6CAA6C;IAC7C,sCAAsC;CACvC,CAAC;AAEF,SAAS,gBAAgB,CAAC,MAAc,EAAE,GAAW;IACnD,yEAAyE;IACzE,yDAAyD;IACzD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;QACnC,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,SAAgB,yBAAyB;IACvC,OAAO,KAAK,UAAU,mBAAmB,CACvC,OAAuB,EACvB,KAAmB;QAEnB,8CAA8C;QAC9C,IACE,OAAO,CAAC,GAAG,KAAK,gBAAgB;YAChC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,iBAAiB,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,EACnC,CAAC;YACD,OAAO;QACT,CAAC;QAED,mEAAmE;QACnE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,MAAM,IAAI,wBAAiB,CAAC,yBAAyB,CAAC,CAAC;QACzD,CAAC;QAED,MAAM,aAAa,GAAG,gBAAgB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC;QAEjD,yEAAyE;QACzE,uDAAuD;QACvD,IAAI,CAAC,IAAA,qBAAc,EAAC,MAAM,EAAE,aAAa,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,qBAAc,CAAC,6CAA6C,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}
|
|
@@ -1,20 +1,84 @@
|
|
|
1
|
-
import { FastifyRequest, FastifyReply } from "fastify";
|
|
1
|
+
import { FastifyRequest, FastifyReply, FastifyInstance } from "fastify";
|
|
2
2
|
import { Stratum } from "@stratum-hq/lib";
|
|
3
|
+
/** Reads the target tenant id from a request, or null when there is none to check. */
|
|
4
|
+
export type TenantIdExtractor = (req: FastifyRequest) => string | null;
|
|
3
5
|
/**
|
|
4
|
-
*
|
|
6
|
+
* A route's tenant-scope declaration:
|
|
7
|
+
* - an extractor: enforce that the caller's key may reach the extracted tenant;
|
|
8
|
+
* - "global": operator-level route with no single tenant target, or one that
|
|
9
|
+
* scopes itself in its handler. The middleware performs no tenant check.
|
|
10
|
+
*/
|
|
11
|
+
export type TenantScopeDeclaration = TenantIdExtractor | "global";
|
|
12
|
+
declare module "fastify" {
|
|
13
|
+
interface FastifyContextConfig {
|
|
14
|
+
tenantScope?: TenantScopeDeclaration;
|
|
15
|
+
}
|
|
16
|
+
}
|
|
17
|
+
/**
|
|
18
|
+
* Core tenant-scope check for a single, already-resolved tenant id.
|
|
19
|
+
*
|
|
20
|
+
* Ensures that tenant-scoped API keys can only access data belonging to their
|
|
21
|
+
* own tenant or its descendants in the hierarchy. Global keys (tenant_id ===
|
|
22
|
+
* null) have unrestricted access. A null `tenantId` means there is no tenant to
|
|
23
|
+
* check (for example a global role, or an omitted optional filter) and passes.
|
|
24
|
+
*
|
|
25
|
+
* Exported for routes whose target tenant is not present in the request and
|
|
26
|
+
* must be resolved first (for example a role's owning tenant, looked up by id).
|
|
27
|
+
*/
|
|
28
|
+
export declare function assertTenantInScope(stratum: Stratum, request: FastifyRequest, tenantId: string | null): Promise<void>;
|
|
29
|
+
/**
|
|
30
|
+
* Tenant-scope enforcement middleware for a single extractor.
|
|
31
|
+
*
|
|
32
|
+
* Retained for routes that must authorize a second tenant beyond the one the
|
|
33
|
+
* global enforcer already covers (for example, a move's destination parent).
|
|
34
|
+
*/
|
|
35
|
+
export declare function createTenantScopeGuard(stratum: Stratum, extractTenantId: TenantIdExtractor): (request: FastifyRequest, _reply: FastifyReply) => Promise<void>;
|
|
36
|
+
/**
|
|
37
|
+
* Guard for POST /tenants: constrain a scoped key's new tenant to its subtree.
|
|
38
|
+
*/
|
|
39
|
+
export declare function createTenantCreateGuard(stratum: Stratum): (request: FastifyRequest, _reply: FastifyReply) => Promise<void>;
|
|
40
|
+
/**
|
|
41
|
+
* Guard for POST /tenants/batch: every tenant in the batch is authorized the
|
|
42
|
+
* same way a single create is, so the batch route cannot sidestep the subtree
|
|
43
|
+
* constraint.
|
|
44
|
+
*/
|
|
45
|
+
export declare function createTenantBatchCreateGuard(stratum: Stratum): (request: FastifyRequest, _reply: FastifyReply) => Promise<void>;
|
|
46
|
+
/**
|
|
47
|
+
* Declare the tenant scope for every route registered in the current plugin.
|
|
5
48
|
*
|
|
6
|
-
*
|
|
7
|
-
*
|
|
49
|
+
* Stamps the declaration onto each route's config so the global enforcer can
|
|
50
|
+
* read it. A route may still set its own `config.tenantScope`, which wins.
|
|
51
|
+
*/
|
|
52
|
+
export declare function declareTenantScope(app: FastifyInstance, declaration: TenantScopeDeclaration): void;
|
|
53
|
+
/**
|
|
54
|
+
* Default-deny authorization enforcer, registered once as a global preHandler.
|
|
8
55
|
*
|
|
9
|
-
*
|
|
56
|
+
* Every route must declare its tenant scope (see {@link declareTenantScope}). A
|
|
57
|
+
* route that declares none is refused, so a route added without a guard fails
|
|
58
|
+
* closed rather than silently serving data.
|
|
10
59
|
*/
|
|
11
|
-
export declare function
|
|
60
|
+
export declare function createTenantScopeEnforcer(stratum: Stratum): (request: FastifyRequest, _reply: FastifyReply) => Promise<void>;
|
|
12
61
|
/** Extract :id param (tenant routes, config routes, permission routes) */
|
|
13
62
|
export declare function fromParamId(req: FastifyRequest): string | null;
|
|
14
63
|
/** Extract :tenantId param (consent routes) */
|
|
15
64
|
export declare function fromParamTenantId(req: FastifyRequest): string | null;
|
|
16
65
|
/** Extract tenant_id from query string */
|
|
17
66
|
export declare function fromQueryTenantId(req: FastifyRequest): string | null;
|
|
67
|
+
/** Extract tenant_a from query string (config diff, first operand) */
|
|
68
|
+
export declare function fromQueryTenantA(req: FastifyRequest): string | null;
|
|
69
|
+
/** Extract tenant_b from query string (config diff, second operand) */
|
|
70
|
+
export declare function fromQueryTenantB(req: FastifyRequest): string | null;
|
|
18
71
|
/** Extract tenant_id from request body */
|
|
19
72
|
export declare function fromBodyTenantId(req: FastifyRequest): string | null;
|
|
73
|
+
/**
|
|
74
|
+
* Extract new_parent_id from a move request body: the move DESTINATION.
|
|
75
|
+
*
|
|
76
|
+
* A move has two tenants to authorize, not one. The route-level `:id` guard
|
|
77
|
+
* only covers the tenant being moved, which a scoped key already owns, so it
|
|
78
|
+
* passes on the fast path. Without authorizing the destination as well, a
|
|
79
|
+
* tenant can graft itself under any other tenant and inherit that tenant's
|
|
80
|
+
* resolved config (including decrypted `sensitive` values) and delegated
|
|
81
|
+
* permissions, because resolution walks UP the ancestry path.
|
|
82
|
+
*/
|
|
83
|
+
export declare function fromBodyNewParentId(req: FastifyRequest): string | null;
|
|
20
84
|
//# sourceMappingURL=tenant-scope.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"tenant-scope.d.ts","sourceRoot":"","sources":["../../src/middleware/tenant-scope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;
|
|
1
|
+
{"version":3,"file":"tenant-scope.d.ts","sourceRoot":"","sources":["../../src/middleware/tenant-scope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAExE,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAE1C,sFAAsF;AACtF,MAAM,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE,cAAc,KAAK,MAAM,GAAG,IAAI,CAAC;AAEvE;;;;;GAKG;AACH,MAAM,MAAM,sBAAsB,GAAG,iBAAiB,GAAG,QAAQ,CAAC;AAElE,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,oBAAoB;QAC5B,WAAW,CAAC,EAAE,sBAAsB,CAAC;KACtC;CACF;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,cAAc,EACvB,QAAQ,EAAE,MAAM,GAAG,IAAI,GACtB,OAAO,CAAC,IAAI,CAAC,CAgCf;AAaD;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,OAAO,EAChB,eAAe,EAAE,iBAAiB,IAGhC,SAAS,cAAc,EACvB,QAAQ,YAAY,KACnB,OAAO,CAAC,IAAI,CAAC,CAGjB;AA6BD;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,IAEpD,SAAS,cAAc,EACvB,QAAQ,YAAY,KACnB,OAAO,CAAC,IAAI,CAAC,CAIjB;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,OAAO,IAEzD,SAAS,cAAc,EACvB,QAAQ,YAAY,KACnB,OAAO,CAAC,IAAI,CAAC,CASjB;AAYD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,eAAe,EACpB,WAAW,EAAE,sBAAsB,GAClC,IAAI,CAON;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,OAAO,IAEtD,SAAS,cAAc,EACvB,QAAQ,YAAY,KACnB,OAAO,CAAC,IAAI,CAAC,CAWjB;AAID,0EAA0E;AAC1E,wBAAgB,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,MAAM,GAAG,IAAI,CAE9D;AAED,+CAA+C;AAC/C,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,cAAc,GAAG,MAAM,GAAG,IAAI,CAEpE;AAED,0CAA0C;AAC1C,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,cAAc,GAAG,MAAM,GAAG,IAAI,CAEpE;AAED,sEAAsE;AACtE,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,MAAM,GAAG,IAAI,CAEnE;AAED,uEAAuE;AACvE,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,MAAM,GAAG,IAAI,CAEnE;AAED,0CAA0C;AAC1C,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,MAAM,GAAG,IAAI,CAEnE;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,cAAc,GAAG,MAAM,GAAG,IAAI,CAEtE"}
|
|
@@ -1,50 +1,159 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.assertTenantInScope = assertTenantInScope;
|
|
3
4
|
exports.createTenantScopeGuard = createTenantScopeGuard;
|
|
5
|
+
exports.createTenantCreateGuard = createTenantCreateGuard;
|
|
6
|
+
exports.createTenantBatchCreateGuard = createTenantBatchCreateGuard;
|
|
7
|
+
exports.declareTenantScope = declareTenantScope;
|
|
8
|
+
exports.createTenantScopeEnforcer = createTenantScopeEnforcer;
|
|
4
9
|
exports.fromParamId = fromParamId;
|
|
5
10
|
exports.fromParamTenantId = fromParamTenantId;
|
|
6
11
|
exports.fromQueryTenantId = fromQueryTenantId;
|
|
12
|
+
exports.fromQueryTenantA = fromQueryTenantA;
|
|
13
|
+
exports.fromQueryTenantB = fromQueryTenantB;
|
|
7
14
|
exports.fromBodyTenantId = fromBodyTenantId;
|
|
15
|
+
exports.fromBodyNewParentId = fromBodyNewParentId;
|
|
8
16
|
const core_1 = require("@stratum-hq/core");
|
|
9
17
|
/**
|
|
10
|
-
*
|
|
18
|
+
* Core tenant-scope check for a single, already-resolved tenant id.
|
|
11
19
|
*
|
|
12
|
-
* Ensures that tenant-scoped API keys can only access data belonging
|
|
13
|
-
*
|
|
20
|
+
* Ensures that tenant-scoped API keys can only access data belonging to their
|
|
21
|
+
* own tenant or its descendants in the hierarchy. Global keys (tenant_id ===
|
|
22
|
+
* null) have unrestricted access. A null `tenantId` means there is no tenant to
|
|
23
|
+
* check (for example a global role, or an omitted optional filter) and passes.
|
|
14
24
|
*
|
|
15
|
-
*
|
|
25
|
+
* Exported for routes whose target tenant is not present in the request and
|
|
26
|
+
* must be resolved first (for example a role's owning tenant, looked up by id).
|
|
27
|
+
*/
|
|
28
|
+
async function assertTenantInScope(stratum, request, tenantId) {
|
|
29
|
+
const apiKey = request.apiKey;
|
|
30
|
+
if (!apiKey)
|
|
31
|
+
return;
|
|
32
|
+
// Only API keys may have global (null tenant_id) access.
|
|
33
|
+
// JWT auth should never reach here with null tenant_id after the auth middleware
|
|
34
|
+
// fix, but guard defensively anyway.
|
|
35
|
+
if (apiKey.tenant_id === null) {
|
|
36
|
+
if (request.authMethod === "api_key")
|
|
37
|
+
return;
|
|
38
|
+
throw new core_1.ForbiddenError("JWT authentication requires a tenant scope");
|
|
39
|
+
}
|
|
40
|
+
if (!tenantId)
|
|
41
|
+
return;
|
|
42
|
+
// Fast path: exact match
|
|
43
|
+
if (apiKey.tenant_id === tenantId)
|
|
44
|
+
return;
|
|
45
|
+
// Hierarchy check: target must be a descendant of the key's tenant
|
|
46
|
+
try {
|
|
47
|
+
const target = await stratum.getTenant(tenantId);
|
|
48
|
+
const ancestorIds = target.ancestry_path.split("/").filter(Boolean);
|
|
49
|
+
if (ancestorIds.includes(apiKey.tenant_id))
|
|
50
|
+
return;
|
|
51
|
+
}
|
|
52
|
+
catch {
|
|
53
|
+
// Tenant not found: fail closed for scoped keys
|
|
54
|
+
throw new core_1.ForbiddenError("API key tenant scope does not grant access to this tenant");
|
|
55
|
+
}
|
|
56
|
+
throw new core_1.ForbiddenError("API key tenant scope does not grant access to this tenant");
|
|
57
|
+
}
|
|
58
|
+
/**
|
|
59
|
+
* Core tenant-scope check for a tenant id read from the request by `extractTenantId`.
|
|
60
|
+
*/
|
|
61
|
+
async function checkTenantScope(stratum, request, extractTenantId) {
|
|
62
|
+
await assertTenantInScope(stratum, request, extractTenantId(request));
|
|
63
|
+
}
|
|
64
|
+
/**
|
|
65
|
+
* Tenant-scope enforcement middleware for a single extractor.
|
|
66
|
+
*
|
|
67
|
+
* Retained for routes that must authorize a second tenant beyond the one the
|
|
68
|
+
* global enforcer already covers (for example, a move's destination parent).
|
|
16
69
|
*/
|
|
17
70
|
function createTenantScopeGuard(stratum, extractTenantId) {
|
|
18
71
|
return async function tenantScopeGuard(request, _reply) {
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
72
|
+
await checkTenantScope(stratum, request, extractTenantId);
|
|
73
|
+
};
|
|
74
|
+
}
|
|
75
|
+
/**
|
|
76
|
+
* Authorize a single tenant CREATE against the caller's key scope.
|
|
77
|
+
*
|
|
78
|
+
* A scoped key may only create tenants within its own subtree, so the new
|
|
79
|
+
* tenant's parent must be the key's own tenant or a descendant of it. A scoped
|
|
80
|
+
* key may not create a new root (a tenant with no parent). Global (operator)
|
|
81
|
+
* keys are unrestricted and may create roots anywhere.
|
|
82
|
+
*/
|
|
83
|
+
async function authorizeCreateUnder(stratum, request, parentId) {
|
|
84
|
+
const apiKey = request.apiKey;
|
|
85
|
+
if (!apiKey)
|
|
86
|
+
return;
|
|
87
|
+
// Only global API keys (null tenant_id) may create roots or create anywhere.
|
|
88
|
+
if (apiKey.tenant_id === null && request.authMethod === "api_key")
|
|
89
|
+
return;
|
|
90
|
+
if (!parentId) {
|
|
91
|
+
throw new core_1.ForbiddenError("API key tenant scope may not create root tenants");
|
|
92
|
+
}
|
|
93
|
+
await checkTenantScope(stratum, request, () => parentId);
|
|
94
|
+
}
|
|
95
|
+
/**
|
|
96
|
+
* Guard for POST /tenants: constrain a scoped key's new tenant to its subtree.
|
|
97
|
+
*/
|
|
98
|
+
function createTenantCreateGuard(stratum) {
|
|
99
|
+
return async function tenantCreateGuard(request, _reply) {
|
|
100
|
+
const body = request.body;
|
|
101
|
+
await authorizeCreateUnder(stratum, request, body?.parent_id ?? null);
|
|
102
|
+
};
|
|
103
|
+
}
|
|
104
|
+
/**
|
|
105
|
+
* Guard for POST /tenants/batch: every tenant in the batch is authorized the
|
|
106
|
+
* same way a single create is, so the batch route cannot sidestep the subtree
|
|
107
|
+
* constraint.
|
|
108
|
+
*/
|
|
109
|
+
function createTenantBatchCreateGuard(stratum) {
|
|
110
|
+
return async function tenantBatchCreateGuard(request, _reply) {
|
|
111
|
+
const body = request.body;
|
|
112
|
+
const tenants = Array.isArray(body?.tenants) ? body.tenants : [];
|
|
113
|
+
for (const tenant of tenants) {
|
|
114
|
+
await authorizeCreateUnder(stratum, request, tenant?.parent_id ?? null);
|
|
29
115
|
}
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
116
|
+
};
|
|
117
|
+
}
|
|
118
|
+
// Endpoints that carry no authentication and therefore no tenant scope.
|
|
119
|
+
// Kept in step with the same skip list in the auth and authorize middleware.
|
|
120
|
+
function isUnauthenticatedPath(url) {
|
|
121
|
+
return (url === "/api/v1/health" ||
|
|
122
|
+
url.startsWith("/api/v1/health?") ||
|
|
123
|
+
url.startsWith("/api/docs"));
|
|
124
|
+
}
|
|
125
|
+
/**
|
|
126
|
+
* Declare the tenant scope for every route registered in the current plugin.
|
|
127
|
+
*
|
|
128
|
+
* Stamps the declaration onto each route's config so the global enforcer can
|
|
129
|
+
* read it. A route may still set its own `config.tenantScope`, which wins.
|
|
130
|
+
*/
|
|
131
|
+
function declareTenantScope(app, declaration) {
|
|
132
|
+
app.addHook("onRoute", (routeOptions) => {
|
|
133
|
+
routeOptions.config = {
|
|
134
|
+
...routeOptions.config,
|
|
135
|
+
tenantScope: routeOptions.config?.tenantScope ?? declaration,
|
|
136
|
+
};
|
|
137
|
+
});
|
|
138
|
+
}
|
|
139
|
+
/**
|
|
140
|
+
* Default-deny authorization enforcer, registered once as a global preHandler.
|
|
141
|
+
*
|
|
142
|
+
* Every route must declare its tenant scope (see {@link declareTenantScope}). A
|
|
143
|
+
* route that declares none is refused, so a route added without a guard fails
|
|
144
|
+
* closed rather than silently serving data.
|
|
145
|
+
*/
|
|
146
|
+
function createTenantScopeEnforcer(stratum) {
|
|
147
|
+
return async function tenantScopeEnforcer(request, _reply) {
|
|
148
|
+
if (isUnauthenticatedPath(request.url))
|
|
35
149
|
return;
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
const ancestorIds = target.ancestry_path.split("/").filter(Boolean);
|
|
40
|
-
if (ancestorIds.includes(apiKey.tenant_id))
|
|
41
|
-
return;
|
|
42
|
-
}
|
|
43
|
-
catch {
|
|
44
|
-
// Tenant not found — fail closed for scoped keys
|
|
45
|
-
throw new core_1.ForbiddenError("API key tenant scope does not grant access to this tenant");
|
|
150
|
+
const declaration = request.routeOptions?.config?.tenantScope;
|
|
151
|
+
if (declaration === undefined) {
|
|
152
|
+
throw new core_1.ForbiddenError("Route has no tenant-scope declaration");
|
|
46
153
|
}
|
|
47
|
-
|
|
154
|
+
if (declaration === "global")
|
|
155
|
+
return;
|
|
156
|
+
await checkTenantScope(stratum, request, declaration);
|
|
48
157
|
};
|
|
49
158
|
}
|
|
50
159
|
// --- Extractors ---
|
|
@@ -60,8 +169,29 @@ function fromParamTenantId(req) {
|
|
|
60
169
|
function fromQueryTenantId(req) {
|
|
61
170
|
return req.query.tenant_id ?? null;
|
|
62
171
|
}
|
|
172
|
+
/** Extract tenant_a from query string (config diff, first operand) */
|
|
173
|
+
function fromQueryTenantA(req) {
|
|
174
|
+
return req.query.tenant_a ?? null;
|
|
175
|
+
}
|
|
176
|
+
/** Extract tenant_b from query string (config diff, second operand) */
|
|
177
|
+
function fromQueryTenantB(req) {
|
|
178
|
+
return req.query.tenant_b ?? null;
|
|
179
|
+
}
|
|
63
180
|
/** Extract tenant_id from request body */
|
|
64
181
|
function fromBodyTenantId(req) {
|
|
65
182
|
return req.body?.tenant_id ?? null;
|
|
66
183
|
}
|
|
184
|
+
/**
|
|
185
|
+
* Extract new_parent_id from a move request body: the move DESTINATION.
|
|
186
|
+
*
|
|
187
|
+
* A move has two tenants to authorize, not one. The route-level `:id` guard
|
|
188
|
+
* only covers the tenant being moved, which a scoped key already owns, so it
|
|
189
|
+
* passes on the fast path. Without authorizing the destination as well, a
|
|
190
|
+
* tenant can graft itself under any other tenant and inherit that tenant's
|
|
191
|
+
* resolved config (including decrypted `sensitive` values) and delegated
|
|
192
|
+
* permissions, because resolution walks UP the ancestry path.
|
|
193
|
+
*/
|
|
194
|
+
function fromBodyNewParentId(req) {
|
|
195
|
+
return req.body?.new_parent_id ?? null;
|
|
196
|
+
}
|
|
67
197
|
//# sourceMappingURL=tenant-scope.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"tenant-scope.js","sourceRoot":"","sources":["../../src/middleware/tenant-scope.ts"],"names":[],"mappings":";;
|
|
1
|
+
{"version":3,"file":"tenant-scope.js","sourceRoot":"","sources":["../../src/middleware/tenant-scope.ts"],"names":[],"mappings":";;AAgCA,kDAoCC;AAmBD,wDAUC;AAgCD,0DAQC;AAOD,oEAaC;AAkBD,gDAUC;AASD,8DAeC;AAKD,kCAEC;AAGD,8CAEC;AAGD,8CAEC;AAGD,4CAEC;AAGD,4CAEC;AAGD,4CAEC;AAYD,kDAEC;AA9PD,2CAAkD;AAoBlD;;;;;;;;;;GAUG;AACI,KAAK,UAAU,mBAAmB,CACvC,OAAgB,EAChB,OAAuB,EACvB,QAAuB;IAEvB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,IAAI,CAAC,MAAM;QAAE,OAAO;IAEpB,yDAAyD;IACzD,iFAAiF;IACjF,qCAAqC;IACrC,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAC9B,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS;YAAE,OAAO;QAC7C,MAAM,IAAI,qBAAc,CAAC,4CAA4C,CAAC,CAAC;IACzE,CAAC;IAED,IAAI,CAAC,QAAQ;QAAE,OAAO;IAEtB,yBAAyB;IACzB,IAAI,MAAM,CAAC,SAAS,KAAK,QAAQ;QAAE,OAAO;IAE1C,mEAAmE;IACnE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACjD,MAAM,WAAW,GAAG,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpE,IAAI,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;YAAE,OAAO;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,gDAAgD;QAChD,MAAM,IAAI,qBAAc,CACtB,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,qBAAc,CACtB,2DAA2D,CAC5D,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,gBAAgB,CAC7B,OAAgB,EAChB,OAAuB,EACvB,eAAkC;IAElC,MAAM,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;AACxE,CAAC;AAED;;;;;GAKG;AACH,SAAgB,sBAAsB,CACpC,OAAgB,EAChB,eAAkC;IAElC,OAAO,KAAK,UAAU,gBAAgB,CACpC,OAAuB,EACvB,MAAoB;QAEpB,MAAM,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC;IAC5D,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,oBAAoB,CACjC,OAAgB,EAChB,OAAuB,EACvB,QAAuB;IAEvB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,IAAI,CAAC,MAAM;QAAE,OAAO;IAEpB,6EAA6E;IAC7E,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO;IAE1E,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,qBAAc,CACtB,kDAAkD,CACnD,CAAC;IACJ,CAAC;IACD,MAAM,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC;AAC3D,CAAC;AAED;;GAEG;AACH,SAAgB,uBAAuB,CAAC,OAAgB;IACtD,OAAO,KAAK,UAAU,iBAAiB,CACrC,OAAuB,EACvB,MAAoB;QAEpB,MAAM,IAAI,GAAG,OAAO,CAAC,IAA4C,CAAC;QAClE,MAAM,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,IAAI,IAAI,CAAC,CAAC;IACxE,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,4BAA4B,CAAC,OAAgB;IAC3D,OAAO,KAAK,UAAU,sBAAsB,CAC1C,OAAuB,EACvB,MAAoB;QAEpB,MAAM,IAAI,GAAG,OAAO,CAAC,IAEb,CAAC;QACT,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,IAAI,IAAI,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,6EAA6E;AAC7E,SAAS,qBAAqB,CAAC,GAAW;IACxC,OAAO,CACL,GAAG,KAAK,gBAAgB;QACxB,GAAG,CAAC,UAAU,CAAC,iBAAiB,CAAC;QACjC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,CAC5B,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,kBAAkB,CAChC,GAAoB,EACpB,WAAmC;IAEnC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,YAAY,EAAE,EAAE;QACtC,YAAY,CAAC,MAAM,GAAG;YACpB,GAAG,YAAY,CAAC,MAAM;YACtB,WAAW,EAAE,YAAY,CAAC,MAAM,EAAE,WAAW,IAAI,WAAW;SAC7D,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,yBAAyB,CAAC,OAAgB;IACxD,OAAO,KAAK,UAAU,mBAAmB,CACvC,OAAuB,EACvB,MAAoB;QAEpB,IAAI,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO;QAE/C,MAAM,WAAW,GAAG,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,WAAW,CAAC;QAC9D,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,qBAAc,CAAC,uCAAuC,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,WAAW,KAAK,QAAQ;YAAE,OAAO;QAErC,MAAM,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;IACxD,CAAC,CAAC;AACJ,CAAC;AAED,qBAAqB;AAErB,0EAA0E;AAC1E,SAAgB,WAAW,CAAC,GAAmB;IAC7C,OAAQ,GAAG,CAAC,MAAiC,CAAC,EAAE,IAAI,IAAI,CAAC;AAC3D,CAAC;AAED,+CAA+C;AAC/C,SAAgB,iBAAiB,CAAC,GAAmB;IACnD,OAAQ,GAAG,CAAC,MAAiC,CAAC,QAAQ,IAAI,IAAI,CAAC;AACjE,CAAC;AAED,0CAA0C;AAC1C,SAAgB,iBAAiB,CAAC,GAAmB;IACnD,OAAQ,GAAG,CAAC,KAAgC,CAAC,SAAS,IAAI,IAAI,CAAC;AACjE,CAAC;AAED,sEAAsE;AACtE,SAAgB,gBAAgB,CAAC,GAAmB;IAClD,OAAQ,GAAG,CAAC,KAAgC,CAAC,QAAQ,IAAI,IAAI,CAAC;AAChE,CAAC;AAED,uEAAuE;AACvE,SAAgB,gBAAgB,CAAC,GAAmB;IAClD,OAAQ,GAAG,CAAC,KAAgC,CAAC,QAAQ,IAAI,IAAI,CAAC;AAChE,CAAC;AAED,0CAA0C;AAC1C,SAAgB,gBAAgB,CAAC,GAAmB;IAClD,OAAQ,GAAG,CAAC,IAAsC,EAAE,SAAS,IAAI,IAAI,CAAC;AACxE,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,mBAAmB,CAAC,GAAmB;IACrD,OAAQ,GAAG,CAAC,IAAsC,EAAE,aAAa,IAAI,IAAI,CAAC;AAC5E,CAAC"}
|
package/dist/routes/abac.js
CHANGED
|
@@ -6,7 +6,7 @@ const tenant_scope_js_1 = require("../middleware/tenant-scope.js");
|
|
|
6
6
|
function createAbacRoutes(stratum) {
|
|
7
7
|
return async function abacRoutes(app) {
|
|
8
8
|
// Tenant-scoped keys can only access ABAC policies for their own tenant subtree
|
|
9
|
-
|
|
9
|
+
(0, tenant_scope_js_1.declareTenantScope)(app, tenant_scope_js_1.fromParamTenantId);
|
|
10
10
|
// POST /api/v1/tenants/:tenantId/abac-policies — Create ABAC policy
|
|
11
11
|
app.post("/", async (request, reply) => {
|
|
12
12
|
const input = core_1.CreateAbacPolicyInputSchema.parse(request.body);
|
package/dist/routes/abac.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"abac.js","sourceRoot":"","sources":["../../src/routes/abac.ts"],"names":[],"mappings":";;AAKA,4CA2CC;AA9CD,2CAAoJ;AACpJ,
|
|
1
|
+
{"version":3,"file":"abac.js","sourceRoot":"","sources":["../../src/routes/abac.ts"],"names":[],"mappings":";;AAKA,4CA2CC;AA9CD,2CAAoJ;AACpJ,mEAAsF;AAEtF,SAAgB,gBAAgB,CAAC,OAAgB;IAC/C,OAAO,KAAK,UAAU,UAAU,CAAC,GAAoB;QACnD,gFAAgF;QAChF,IAAA,oCAAkB,EAAC,GAAG,EAAE,mCAAiB,CAAC,CAAC;QAE3C,oEAAoE;QACpE,GAAG,CAAC,IAAI,CAAmC,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YACvE,MAAM,KAAK,GAAG,kCAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAA0B,CAAC;YACvF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAC3C,OAAO,CAAC,MAAM,CAAC,QAAQ,EACvB,KAAK,CACN,CAAC;YACF,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,uEAAuE;QACvE,GAAG,CAAC,GAAG,CAAmC,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YACtE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACxE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;QAEH,0EAA0E;QAC1E,GAAG,CAAC,IAAI,CAAmC,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YAC/E,MAAM,WAAW,GAAG,kCAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAA0B,CAAC;YAC7F,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,CACvC,OAAO,CAAC,MAAM,CAAC,QAAQ,EACvB,WAAW,CACZ,CAAC;YACF,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,gFAAgF;QAChF,GAAG,CAAC,MAAM,CACR,YAAY,EACZ,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YACvB,MAAM,OAAO,CAAC,gBAAgB,CAC5B,OAAO,CAAC,MAAM,CAAC,QAAQ,EACvB,OAAO,CAAC,MAAM,CAAC,QAAQ,CACxB,CAAC;YACF,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3B,CAAC,CACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"api-keys.d.ts","sourceRoot":"","sources":["../../src/routes/api-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAW1C,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,IACd,KAAK,eAAe,KAAG,OAAO,CAAC,IAAI,CAAC,
|
|
1
|
+
{"version":3,"file":"api-keys.d.ts","sourceRoot":"","sources":["../../src/routes/api-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAW1C,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,IACd,KAAK,eAAe,KAAG,OAAO,CAAC,IAAI,CAAC,CAkFxE"}
|
package/dist/routes/api-keys.js
CHANGED
|
@@ -11,8 +11,12 @@ const createApiKeySchema = zod_1.z.object({
|
|
|
11
11
|
});
|
|
12
12
|
function createApiKeyRoutes(stratum) {
|
|
13
13
|
return async function apiKeyRoutes(app) {
|
|
14
|
+
// Scoped keys can only manage keys for their own tenant subtree. On create,
|
|
15
|
+
// the target tenant is in the body; the other routes scope themselves in
|
|
16
|
+
// their handlers.
|
|
17
|
+
(0, tenant_scope_js_1.declareTenantScope)(app, tenant_scope_js_1.fromBodyTenantId);
|
|
14
18
|
// POST /api/v1/api-keys — Create a new API key (plaintext returned once)
|
|
15
|
-
app.post("/",
|
|
19
|
+
app.post("/", async (request, reply) => {
|
|
16
20
|
const parsed = createApiKeySchema.safeParse(request.body);
|
|
17
21
|
if (!parsed.success) {
|
|
18
22
|
reply.status(400).send({ error: { code: "VALIDATION_ERROR", message: "Invalid request body" }, details: parsed.error.issues });
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"api-keys.js","sourceRoot":"","sources":["../../src/routes/api-keys.ts"],"names":[],"mappings":";;AAYA,
|
|
1
|
+
{"version":3,"file":"api-keys.js","sourceRoot":"","sources":["../../src/routes/api-keys.ts"],"names":[],"mappings":";;AAYA,gDAmFC;AA7FD,6BAAwB;AACxB,mEAAqF;AAErF,MAAM,kBAAkB,GAAG,OAAC,CAAC,MAAM,CAAC;IAClC,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE;IAC/D,iBAAiB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC,QAAQ,EAAE;CACtF,CAAC,CAAC;AAEH,SAAgB,kBAAkB,CAAC,OAAgB;IACjD,OAAO,KAAK,UAAU,YAAY,CAAC,GAAoB;QACrD,4EAA4E;QAC5E,yEAAyE;QACzE,kBAAkB;QAClB,IAAA,oCAAkB,EAAC,GAAG,EAAE,kCAAgB,CAAC,CAAC;QAE1C,yEAAyE;QACzE,GAAG,CAAC,IAAI,CACN,GAAG,EACH,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YACvB,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC1D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC/H,OAAO;YACT,CAAC;YACD,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;YAC3E,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,SAAS,EAAE;gBACnD,IAAI;gBACJ,YAAY,EAAE,cAAc;gBAC5B,eAAe,EAAE,iBAAiB;aACnC,CAAC,CAAC;YACH,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC,CACF,CAAC;QAEF,8DAA8D;QAC9D,GAAG,CAAC,GAAG,CAA0C,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YAC7E,sDAAsD;YACtD,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,EAAE,SAAS,IAAI,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;YACtE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;YACjD,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;QAEH,6EAA6E;QAC7E,GAAG,CAAC,GAAG,CAAqC,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YAC/E,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACpE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;YACjD,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC;YACjD,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC;gBACjE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAiB,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC3F,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAgC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;gBACnH,OAAO;YACT,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;QAEH,uDAAuD;QACvD,GAAG,CAAC,IAAI,CAA6B,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YAC3E,gDAAgD;YAChD,IAAI,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC;gBAC9B,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACjE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;oBAChD,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,sCAAsC,EAAE,EAAE,CAAC,CAAC;oBAC1G,OAAO;gBACT,CAAC;YACH,CAAC;YACD,MAAM,YAAY,GAAG,OAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YACxE,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;YACtD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;YAC1E,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,kDAAkD;QAClD,GAAG,CAAC,MAAM,CAA6B,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YACtE,gDAAgD;YAChD,IAAI,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC;gBAC9B,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACjE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;oBAChD,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,sCAAsC,EAAE,EAAE,CAAC,CAAC;oBAC1G,OAAO;gBACT,CAAC;YACH,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC9D,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,sCAAsC,EAAE,EAAE,CAAC,CAAC;gBAC1G,OAAO;YACT,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"audit-logs.d.ts","sourceRoot":"","sources":["../../src/routes/audit-logs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE1D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;
|
|
1
|
+
{"version":3,"file":"audit-logs.d.ts","sourceRoot":"","sources":["../../src/routes/audit-logs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE1D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAG1C,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,cAAc,GAAG,YAAY,CAOvE;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,IACd,KAAK,eAAe,KAAG,OAAO,CAAC,IAAI,CAAC,CA8B1E"}
|
|
@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
|
|
|
3
3
|
exports.buildAuditContext = buildAuditContext;
|
|
4
4
|
exports.createAuditLogRoutes = createAuditLogRoutes;
|
|
5
5
|
const core_1 = require("@stratum-hq/core");
|
|
6
|
+
const tenant_scope_js_1 = require("../middleware/tenant-scope.js");
|
|
6
7
|
function buildAuditContext(request) {
|
|
7
8
|
return {
|
|
8
9
|
actor_id: request.apiKey?.id ?? "unknown",
|
|
@@ -13,6 +14,8 @@ function buildAuditContext(request) {
|
|
|
13
14
|
}
|
|
14
15
|
function createAuditLogRoutes(stratum) {
|
|
15
16
|
return async function auditLogRoutes(app) {
|
|
17
|
+
// Scoped keys are constrained to their own tenant inside the handlers below.
|
|
18
|
+
(0, tenant_scope_js_1.declareTenantScope)(app, "global");
|
|
16
19
|
// GET /api/v1/audit-logs — List audit logs with filters
|
|
17
20
|
app.get("/", async (request, reply) => {
|
|
18
21
|
const query = core_1.AuditLogQuerySchema.parse(request.query);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"audit-logs.js","sourceRoot":"","sources":["../../src/routes/audit-logs.ts"],"names":[],"mappings":";;
|
|
1
|
+
{"version":3,"file":"audit-logs.js","sourceRoot":"","sources":["../../src/routes/audit-logs.ts"],"names":[],"mappings":";;AAMA,8CAOC;AAED,oDA+BC;AA7CD,2CAAuD;AAGvD,mEAAmE;AAEnE,SAAgB,iBAAiB,CAAC,OAAuB;IACvD,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,SAAS;QACzC,UAAU,EAAE,CAAC,OAAO,CAAC,UAAU,IAAI,SAAS,CAAsB;QAClE,SAAS,EAAE,OAAO,CAAC,EAAE;QACrB,UAAU,EAAE,OAAO,CAAC,EAAE;KACvB,CAAC;AACJ,CAAC;AAED,SAAgB,oBAAoB,CAAC,OAAgB;IACnD,OAAO,KAAK,UAAU,cAAc,CAAC,GAAoB;QACvD,6EAA6E;QAC7E,IAAA,oCAAkB,EAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAElC,wDAAwD;QACxD,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YACpC,MAAM,KAAK,GAAG,0BAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACvD,qDAAqD;YACrD,IAAI,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC;gBAC9B,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;YAC7C,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YACpD,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QAEH,sDAAsD;QACtD,GAAG,CAAC,GAAG,CAA6B,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YACnE,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC7D,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,uBAAuB,EAAE,EAAE,CAAC,CAAC;gBAC3F,OAAO;YACT,CAAC;YACD,2CAA2C;YAC3C,IAAI,OAAO,CAAC,MAAM,EAAE,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBAC9E,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,uBAAuB,EAAE,EAAE,CAAC,CAAC;gBAC3F,OAAO;YACT,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"config-diff.d.ts","sourceRoot":"","sources":["../../src/routes/config-diff.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;
|
|
1
|
+
{"version":3,"file":"config-diff.d.ts","sourceRoot":"","sources":["../../src/routes/config-diff.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAQ1C,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,IAMd,KAAK,eAAe,KAAG,OAAO,CAAC,IAAI,CAAC,CAoC5E"}
|
|
@@ -1,10 +1,17 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
3
|
exports.createConfigDiffRoutes = createConfigDiffRoutes;
|
|
4
|
+
const tenant_scope_js_1 = require("../middleware/tenant-scope.js");
|
|
4
5
|
function createConfigDiffRoutes(stratum) {
|
|
6
|
+
// The diff compares two tenants read from the query string, so both operands
|
|
7
|
+
// must be authorized against the caller's subtree. The scope declaration below
|
|
8
|
+
// covers `tenant_a`; this second guard covers `tenant_b`.
|
|
9
|
+
const secondOperandGuard = (0, tenant_scope_js_1.createTenantScopeGuard)(stratum, tenant_scope_js_1.fromQueryTenantB);
|
|
5
10
|
return async function configDiffRoutes(app) {
|
|
11
|
+
// A scoped key may diff only within its own subtree; a global key, anywhere.
|
|
12
|
+
(0, tenant_scope_js_1.declareTenantScope)(app, tenant_scope_js_1.fromQueryTenantA);
|
|
6
13
|
// GET /api/v1/config/diff?tenant_a=UUID&tenant_b=UUID — Compare resolved config between two tenants
|
|
7
|
-
app.get("/diff", async (request, reply) => {
|
|
14
|
+
app.get("/diff", { preHandler: secondOperandGuard }, async (request, reply) => {
|
|
8
15
|
const { tenant_a, tenant_b } = request.query;
|
|
9
16
|
if (!tenant_a || !tenant_b) {
|
|
10
17
|
reply.status(400).send({
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"config-diff.js","sourceRoot":"","sources":["../../src/routes/config-diff.ts"],"names":[],"mappings":";;
|
|
1
|
+
{"version":3,"file":"config-diff.js","sourceRoot":"","sources":["../../src/routes/config-diff.ts"],"names":[],"mappings":";;AASA,wDA0CC;AAjDD,mEAKuC;AAEvC,SAAgB,sBAAsB,CAAC,OAAgB;IACrD,6EAA6E;IAC7E,+EAA+E;IAC/E,0DAA0D;IAC1D,MAAM,kBAAkB,GAAG,IAAA,wCAAsB,EAAC,OAAO,EAAE,kCAAgB,CAAC,CAAC;IAE7E,OAAO,KAAK,UAAU,gBAAgB,CAAC,GAAoB;QACzD,6EAA6E;QAC7E,IAAA,oCAAkB,EAAC,GAAG,EAAE,kCAAgB,CAAC,CAAC;QAE1C,oGAAoG;QACpG,GAAG,CAAC,GAAG,CACL,OAAO,EACP,EAAE,UAAU,EAAE,kBAAkB,EAAE,EAClC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YACvB,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC;YAE7C,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC3B,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACrB,KAAK,EAAE;wBACL,IAAI,EAAE,kBAAkB;wBACxB,OAAO,EAAE,0DAA0D;qBACpE;iBACF,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC1B,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACrB,KAAK,EAAE;wBACL,IAAI,EAAE,kBAAkB;wBACxB,OAAO,EAAE,yCAAyC;qBACnD;iBACF,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAC1D,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC,CACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}
|
package/dist/routes/config.js
CHANGED
|
@@ -7,7 +7,7 @@ const tenant_scope_js_1 = require("../middleware/tenant-scope.js");
|
|
|
7
7
|
function createConfigRoutes(stratum) {
|
|
8
8
|
return async function configRoutes(app) {
|
|
9
9
|
// Tenant-scoped keys can only access config for their own tenant subtree
|
|
10
|
-
|
|
10
|
+
(0, tenant_scope_js_1.declareTenantScope)(app, tenant_scope_js_1.fromParamId);
|
|
11
11
|
// GET /api/v1/tenants/:id/config — Get resolved config
|
|
12
12
|
app.get("/", async (request, reply) => {
|
|
13
13
|
const resolved = await stratum.resolveConfig(request.params.id);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/routes/config.ts"],"names":[],"mappings":";;AAMA,gDAiDC;AAtDD,2CAAwD;AAExD,mDAAoD;AACpD,
|
|
1
|
+
{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/routes/config.ts"],"names":[],"mappings":";;AAMA,gDAiDC;AAtDD,2CAAwD;AAExD,mDAAoD;AACpD,mEAAgF;AAEhF,SAAgB,kBAAkB,CAAC,OAAgB;IACjD,OAAO,KAAK,UAAU,YAAY,CAAC,GAAoB;QACrD,yEAAyE;QACzE,IAAA,oCAAkB,EAAC,GAAG,EAAE,6BAAW,CAAC,CAAC;QACrC,uDAAuD;QACvD,GAAG,CAAC,GAAG,CAA6B,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YAChE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAChE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;QAEH,yDAAyD;QACzD,GAAG,CAAC,GAAG,CAA0C,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YACjF,MAAM,KAAK,GAAG,2BAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACvD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,IAAA,iCAAiB,EAAC,OAAO,CAAC,CAAC,CAAC;YAChH,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;QAEH,kEAAkE;QAClE,GAAG,CAAC,MAAM,CAA0C,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YACpF,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,IAAA,iCAAiB,EAAC,OAAO,CAAC,CAAC,CAAC;YAC9F,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3B,CAAC,CAAC,CAAC;QAEH,6EAA6E;QAC7E,GAAG,CAAC,GAAG,CAA6B,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YACrE,MAAM,IAAI,GAAG,OAAO,CAAC,IAA+B,CAAC;YACrD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC/D,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,+CAA+C,EAAE,EAAE,CAAC,CAAC;gBAC1H,OAAO;YACT,CAAC;YACD,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;gBAC9B,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,8BAA8B,EAAE,EAAE,CAAC,CAAC;gBACzG,OAAO;YACT,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;gBACrC,MAAM,MAAM,GAAG,2BAAoB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC7C,MAAM,KAAK,GAAG,CAA4B,CAAC;gBAC3C,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,GAAa,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;YAC/G,CAAC,CAAC,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,IAAA,iCAAiB,EAAC,OAAO,CAAC,CAAC,CAAC;YACzG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,yEAAyE;QACzE,GAAG,CAAC,GAAG,CAA6B,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YAC3E,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,wBAAwB,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC9E,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC"}
|
package/dist/routes/consent.js
CHANGED
|
@@ -7,7 +7,7 @@ const tenant_scope_js_1 = require("../middleware/tenant-scope.js");
|
|
|
7
7
|
function createConsentRoutes(stratum) {
|
|
8
8
|
return async function consentRoutes(app) {
|
|
9
9
|
// Tenant-scoped keys can only access consent for their own tenant subtree
|
|
10
|
-
|
|
10
|
+
(0, tenant_scope_js_1.declareTenantScope)(app, tenant_scope_js_1.fromParamTenantId);
|
|
11
11
|
// POST /api/v1/tenants/:tenantId/consent — Grant consent
|
|
12
12
|
app.post("/", async (request, reply) => {
|
|
13
13
|
const { tenantId } = request.params;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"consent.js","sourceRoot":"","sources":["../../src/routes/consent.ts"],"names":[],"mappings":";;AAMA,kDA4CC;AAjDD,2CAA2D;AAE3D,mDAAoD;AACpD,
|
|
1
|
+
{"version":3,"file":"consent.js","sourceRoot":"","sources":["../../src/routes/consent.ts"],"names":[],"mappings":";;AAMA,kDA4CC;AAjDD,2CAA2D;AAE3D,mDAAoD;AACpD,mEAAsF;AAEtF,SAAgB,mBAAmB,CAAC,OAAgB;IAClD,OAAO,KAAK,UAAU,aAAa,CAAC,GAAoB;QACtD,0EAA0E;QAC1E,IAAA,oCAAkB,EAAC,GAAG,EAAE,mCAAiB,CAAC,CAAC;QAC3C,yDAAyD;QACzD,GAAG,CAAC,IAAI,CAAmC,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YACvE,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;YACpC,MAAM,KAAK,GAAG,8BAAuB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC1D,MAAM,KAAK,GAAG,IAAA,iCAAiB,EAAC,OAAO,CAAC,CAAC;YACzC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;YAClE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,+DAA+D;QAC/D,GAAG,CAAC,GAAG,CACL,GAAG,EACH,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YACvB,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;YACpC,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC;YAC3C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YAC/D,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC,CACF,CAAC;QAEF,qEAAqE;QACrE,GAAG,CAAC,MAAM,CACR,WAAW,EACX,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YACvB,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;YAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC;YAC3C,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,wCAAwC,EAAE,EAAE,CAAC,CAAC;gBACnH,OAAO;YACT,CAAC;YACD,MAAM,KAAK,GAAG,IAAA,iCAAiB,EAAC,OAAO,CAAC,CAAC;YACzC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;YACjF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,0BAA0B,EAAE,EAAE,CAAC,CAAC;gBAC9F,OAAO;YACT,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,CAAC,CACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"maintenance.d.ts","sourceRoot":"","sources":["../../src/routes/maintenance.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;
|
|
1
|
+
{"version":3,"file":"maintenance.d.ts","sourceRoot":"","sources":["../../src/routes/maintenance.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAI1C,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,IACd,KAAK,eAAe,KAAG,OAAO,CAAC,IAAI,CAAC,CA+B7E"}
|