@stratum-hq/control-plane 0.4.0 → 1.0.1

package/dist/__tests__/configdiff-roles-scope.test.js

@@ -1,246 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-const vitest_1 = require("vitest");
-const test_helpers_js_1 = require("./test-helpers.js");
-/**
- * Regression tests for cross-tenant authorization on the config-diff and role
- * administration routes.
- *
- * Both route groups were declared "global" for the default-deny enforcer, which
- * is behavior-preserving but performs no per-tenant check. That left a
- * tenant-scoped API key able to reach tenants outside its own subtree:
- *  - config diff compares two tenants read from the query string;
- *  - role routes read/mutate roles owned by an arbitrary tenant.
- *
- * A scoped key must be confined to its own tenant and descendants. Global
- * operator keys (tenant_id === null) keep unrestricted access.
- */
-const ATTACKER = "11111111-1111-4111-8111-111111111111";
-const ATTACKER_CHILD = "22222222-2222-4222-8222-222222222222";
-const VICTIM = "99999999-9999-4999-8999-999999999999";
-// ancestry_path holds a tenant's ANCESTORS and excludes self, so a root is "".
-const TENANTS = {
-    [ATTACKER]: { id: ATTACKER, ancestry_path: "", status: "active" },
-    [ATTACKER_CHILD]: { id: ATTACKER_CHILD, ancestry_path: ATTACKER, status: "active" },
-    [VICTIM]: { id: VICTIM, ancestry_path: "", status: "active" },
-};
-const ROLE_OWN = "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa";
-const ROLE_FOREIGN = "bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb";
-const ROLE_GLOBAL = "cccccccc-cccc-4ccc-8ccc-cccccccccccc";
-const ROLES = {
-    [ROLE_OWN]: { id: ROLE_OWN, name: "own", description: null, scopes: ["read"], tenant_id: ATTACKER },
-    [ROLE_FOREIGN]: { id: ROLE_FOREIGN, name: "foreign", description: null, scopes: ["read"], tenant_id: VICTIM },
-    [ROLE_GLOBAL]: { id: ROLE_GLOBAL, name: "global", description: null, scopes: ["read"], tenant_id: null },
-};
-const OWN_KEY = "own-key-id";
-const FOREIGN_KEY = "foreign-key-id";
-const KEYS = {
-    [OWN_KEY]: { id: OWN_KEY, tenant_id: ATTACKER },
-    [FOREIGN_KEY]: { id: FOREIGN_KEY, tenant_id: VICTIM },
-};
-let app;
-let stratum;
-function wireCommonMocks() {
-    stratum.getTenant.mockImplementation(async (id) => {
-        const row = TENANTS[id];
-        if (!row)
-            throw new Error(`Tenant ${id} not found`);
-        return row;
-    });
-    stratum.diffConfig.mockResolvedValue({ added: {}, removed: {}, changed: {} });
-    stratum.getRole.mockImplementation(async (id) => ROLES[id] ?? null);
-    // Without a tenant filter, listing returns every tenant's roles: this is the leak.
-    stratum.listRoles.mockImplementation(async (tenantId) => {
-        const all = Object.values(ROLES);
-        if (!tenantId)
-            return all;
-        return all.filter((r) => r.tenant_id === tenantId || r.tenant_id === null);
-    });
-    stratum.createRole.mockImplementation(async (input) => ({
-        id: "new-role",
-        description: null,
-        ...input,
-    }));
-    stratum.updateRole.mockImplementation(async (id) => ROLES[id] ?? null);
-    stratum.deleteRole.mockResolvedValue(true);
-    stratum.assignRoleToKey.mockResolvedValue(true);
-    stratum.removeRoleFromKey.mockResolvedValue(true);
-    stratum.getApiKey.mockImplementation(async (id) => KEYS[id] ?? null);
-}
-async function diff(tenantA, tenantB) {
-    return app.inject({
-        method: "GET",
-        url: `/api/v1/config/diff?tenant_a=${tenantA}&tenant_b=${tenantB}`,
-        headers: (0, test_helpers_js_1.authHeaders)(),
-    });
-}
-(0, vitest_1.describe)("config diff scopes both compared tenants to the caller's subtree", () => {
-    (0, vitest_1.beforeEach)(async () => {
-        stratum = (0, test_helpers_js_1.createMockStratum)();
-        stratum.validateApiKey.mockResolvedValue({
-            key_id: "attacker-key",
-            tenant_id: ATTACKER,
-            scopes: ["read", "write", "admin"],
-            rate_limit_max: null,
-            rate_limit_window: null,
-        });
-        wireCommonMocks();
-        app = await (0, test_helpers_js_1.buildTestApp)(stratum);
-    });
-    (0, vitest_1.it)("refuses diffing against an unrelated tenant", async () => {
-        const res = await diff(ATTACKER, VICTIM);
-        (0, vitest_1.expect)(res.statusCode).toBe(403);
-        (0, vitest_1.expect)(stratum.diffConfig).not.toHaveBeenCalled();
-    });
-    (0, vitest_1.it)("refuses when the first tenant is unrelated", async () => {
-        const res = await diff(VICTIM, ATTACKER);
-        (0, vitest_1.expect)(res.statusCode).toBe(403);
-        (0, vitest_1.expect)(stratum.diffConfig).not.toHaveBeenCalled();
-    });
-    (0, vitest_1.it)("allows diffing entirely within the caller's subtree", async () => {
-        const res = await diff(ATTACKER, ATTACKER_CHILD);
-        (0, vitest_1.expect)(res.statusCode).toBe(200);
-        (0, vitest_1.expect)(stratum.diffConfig).toHaveBeenCalledWith(ATTACKER, ATTACKER_CHILD);
-    });
-});
-(0, vitest_1.describe)("role routes scope to the caller's subtree", () => {
-    (0, vitest_1.beforeEach)(async () => {
-        stratum = (0, test_helpers_js_1.createMockStratum)();
-        stratum.validateApiKey.mockResolvedValue({
-            key_id: "attacker-key",
-            tenant_id: ATTACKER,
-            scopes: ["read", "write", "admin"],
-            rate_limit_max: null,
-            rate_limit_window: null,
-        });
-        wireCommonMocks();
-        app = await (0, test_helpers_js_1.buildTestApp)(stratum);
-    });
-    (0, vitest_1.it)("does not enumerate other tenants' roles when listing without a filter", async () => {
-        const res = await app.inject({ method: "GET", url: "/api/v1/roles", headers: (0, test_helpers_js_1.authHeaders)() });
-        (0, vitest_1.expect)(res.statusCode).toBe(200);
-        const ids = res.json().map((r) => r.id);
-        (0, vitest_1.expect)(ids).not.toContain(ROLE_FOREIGN);
-        (0, vitest_1.expect)(ids).toContain(ROLE_OWN);
-    });
-    (0, vitest_1.it)("refuses listing a foreign tenant's roles by explicit filter", async () => {
-        const res = await app.inject({
-            method: "GET",
-            url: `/api/v1/roles?tenant_id=${VICTIM}`,
-            headers: (0, test_helpers_js_1.authHeaders)(),
-        });
-        (0, vitest_1.expect)(res.statusCode).toBe(403);
-        (0, vitest_1.expect)(stratum.listRoles).not.toHaveBeenCalled();
-    });
-    (0, vitest_1.it)("refuses reading a foreign tenant's role", async () => {
-        const res = await app.inject({ method: "GET", url: `/api/v1/roles/${ROLE_FOREIGN}`, headers: (0, test_helpers_js_1.authHeaders)() });
-        (0, vitest_1.expect)(res.statusCode).toBe(403);
-    });
-    (0, vitest_1.it)("allows reading a role in the caller's own tenant", async () => {
-        const res = await app.inject({ method: "GET", url: `/api/v1/roles/${ROLE_OWN}`, headers: (0, test_helpers_js_1.authHeaders)() });
-        (0, vitest_1.expect)(res.statusCode).toBe(200);
-    });
-    (0, vitest_1.it)("refuses updating a foreign tenant's role", async () => {
-        const res = await app.inject({
-            method: "PATCH",
-            url: `/api/v1/roles/${ROLE_FOREIGN}`,
-            headers: { ...(0, test_helpers_js_1.authHeaders)(), "content-type": "application/json" },
-            payload: { name: "hijacked" },
-        });
-        (0, vitest_1.expect)(res.statusCode).toBe(403);
-        (0, vitest_1.expect)(stratum.updateRole).not.toHaveBeenCalled();
-    });
-    (0, vitest_1.it)("refuses deleting a foreign tenant's role", async () => {
-        const res = await app.inject({ method: "DELETE", url: `/api/v1/roles/${ROLE_FOREIGN}`, headers: (0, test_helpers_js_1.authHeaders)() });
-        (0, vitest_1.expect)(res.statusCode).toBe(403);
-        (0, vitest_1.expect)(stratum.deleteRole).not.toHaveBeenCalled();
-    });
-    (0, vitest_1.it)("refuses creating a role in a foreign tenant", async () => {
-        const res = await app.inject({
-            method: "POST",
-            url: "/api/v1/roles",
-            headers: { ...(0, test_helpers_js_1.authHeaders)(), "content-type": "application/json" },
-            payload: { name: "planted", scopes: ["read"], tenant_id: VICTIM },
-        });
-        (0, vitest_1.expect)(res.statusCode).toBe(403);
-        (0, vitest_1.expect)(stratum.createRole).not.toHaveBeenCalled();
-    });
-    (0, vitest_1.it)("refuses assigning a foreign tenant's role to an own key", async () => {
-        const res = await app.inject({
-            method: "POST",
-            url: `/api/v1/roles/assign/${OWN_KEY}`,
-            headers: { ...(0, test_helpers_js_1.authHeaders)(), "content-type": "application/json" },
-            payload: { role_id: ROLE_FOREIGN },
-        });
-        (0, vitest_1.expect)(res.statusCode).toBe(403);
-        (0, vitest_1.expect)(stratum.assignRoleToKey).not.toHaveBeenCalled();
-    });
-    (0, vitest_1.it)("refuses assigning a role to a key in another tenant", async () => {
-        const res = await app.inject({
-            method: "POST",
-            url: `/api/v1/roles/assign/${FOREIGN_KEY}`,
-            headers: { ...(0, test_helpers_js_1.authHeaders)(), "content-type": "application/json" },
-            payload: { role_id: ROLE_OWN },
-        });
-        (0, vitest_1.expect)(res.statusCode).toBe(403);
-        (0, vitest_1.expect)(stratum.assignRoleToKey).not.toHaveBeenCalled();
-    });
-    (0, vitest_1.it)("refuses removing a role from a key in another tenant", async () => {
-        const res = await app.inject({
-            method: "DELETE",
-            url: `/api/v1/roles/assign/${FOREIGN_KEY}`,
-            headers: (0, test_helpers_js_1.authHeaders)(),
-        });
-        (0, vitest_1.expect)(res.statusCode).toBe(403);
-        (0, vitest_1.expect)(stratum.removeRoleFromKey).not.toHaveBeenCalled();
-    });
-    (0, vitest_1.it)("allows assigning an own role to an own key", async () => {
-        const res = await app.inject({
-            method: "POST",
-            url: `/api/v1/roles/assign/${OWN_KEY}`,
-            headers: { ...(0, test_helpers_js_1.authHeaders)(), "content-type": "application/json" },
-            payload: { role_id: ROLE_OWN },
-        });
-        (0, vitest_1.expect)(res.statusCode).toBe(200);
-        (0, vitest_1.expect)(stratum.assignRoleToKey).toHaveBeenCalledWith(OWN_KEY, ROLE_OWN);
-    });
-});
-(0, vitest_1.describe)("global operator keys keep full access", () => {
-    (0, vitest_1.beforeEach)(async () => {
-        stratum = (0, test_helpers_js_1.createMockStratum)();
-        stratum.validateApiKey.mockResolvedValue({
-            key_id: "global-key",
-            tenant_id: null,
-            scopes: ["read", "write", "admin"],
-            rate_limit_max: null,
-            rate_limit_window: null,
-        });
-        wireCommonMocks();
-        app = await (0, test_helpers_js_1.buildTestApp)(stratum);
-    });
-    (0, vitest_1.it)("still diffs any two tenants", async () => {
-        const res = await diff(ATTACKER, VICTIM);
-        (0, vitest_1.expect)(res.statusCode).toBe(200);
-        (0, vitest_1.expect)(stratum.diffConfig).toHaveBeenCalledWith(ATTACKER, VICTIM);
-    });
-    (0, vitest_1.it)("still enumerates every tenant's roles", async () => {
-        const res = await app.inject({ method: "GET", url: "/api/v1/roles", headers: (0, test_helpers_js_1.authHeaders)() });
-        (0, vitest_1.expect)(res.statusCode).toBe(200);
-        (0, vitest_1.expect)(res.json().map((r) => r.id)).toContain(ROLE_FOREIGN);
-    });
-    (0, vitest_1.it)("still reads any tenant's role", async () => {
-        const res = await app.inject({ method: "GET", url: `/api/v1/roles/${ROLE_FOREIGN}`, headers: (0, test_helpers_js_1.authHeaders)() });
-        (0, vitest_1.expect)(res.statusCode).toBe(200);
-    });
-    (0, vitest_1.it)("still assigns any role to any key", async () => {
-        const res = await app.inject({
-            method: "POST",
-            url: `/api/v1/roles/assign/${FOREIGN_KEY}`,
-            headers: { ...(0, test_helpers_js_1.authHeaders)(), "content-type": "application/json" },
-            payload: { role_id: ROLE_FOREIGN },
-        });
-        (0, vitest_1.expect)(res.statusCode).toBe(200);
-        (0, vitest_1.expect)(stratum.assignRoleToKey).toHaveBeenCalledWith(FOREIGN_KEY, ROLE_FOREIGN);
-    });
-});
-//# sourceMappingURL=configdiff-roles-scope.test.js.map

package/dist/__tests__/configdiff-roles-scope.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"configdiff-roles-scope.test.js","sourceRoot":"","sources":["../../src/__tests__/configdiff-roles-scope.test.ts"],"names":[],"mappings":";;AAAA,mCAA8D;AAG9D,uDAAiF;AAEjF;;;;;;;;;;;;GAYG;AAEH,MAAM,QAAQ,GAAG,sCAAsC,CAAC;AACxD,MAAM,cAAc,GAAG,sCAAsC,CAAC;AAC9D,MAAM,MAAM,GAAG,sCAAsC,CAAC;AAItD,+EAA+E;AAC/E,MAAM,OAAO,GAAwB;IACnC,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE;IACjE,CAAC,cAAc,CAAC,EAAE,EAAE,EAAE,EAAE,cAAc,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE;IACnF,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE;CAC9D,CAAC;AAEF,MAAM,QAAQ,GAAG,sCAAsC,CAAC;AACxD,MAAM,YAAY,GAAG,sCAAsC,CAAC;AAC5D,MAAM,WAAW,GAAG,sCAAsC,CAAC;AAI3D,MAAM,KAAK,GAA4B;IACrC,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE;IACnG,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE;IAC7G,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE;CACzG,CAAC;AAEF,MAAM,OAAO,GAAG,YAAY,CAAC;AAC7B,MAAM,WAAW,GAAG,gBAAgB,CAAC;AAErC,MAAM,IAAI,GAA6D;IACrE,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE;IAC/C,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE;CACtD,CAAC;AAEF,IAAI,GAAoB,CAAC;AACzB,IAAI,OAAgB,CAAC;AAErB,SAAS,eAAe;IACrB,OAAO,CAAC,SAAsC,CAAC,kBAAkB,CAAC,KAAK,EAAE,EAAU,EAAE,EAAE;QACtF,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;QACxB,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QACpD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC,CAAC;IACF,OAAO,CAAC,UAAuC,CAAC,iBAAiB,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;IAC3G,OAAO,CAAC,OAAoC,CAAC,kBAAkB,CAAC,KAAK,EAAE,EAAU,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC;IAC1G,mFAAmF;IAClF,OAAO,CAAC,SAAsC,CAAC,kBAAkB,CAAC,KAAK,EAAE,QAAiB,EAAE,EAAE;QAC7F,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,CAAC,QAAQ;YAAE,OAAO,GAAG,CAAC;QAC1B,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;IACF,OAAO,CAAC,UAAuC,CAAC,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACpF,EAAE,EAAE,UAAU;QACd,WAAW,EAAE,IAAI;QACjB,GAAG,KAAK;KACT,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,UAAuC,CAAC,kBAAkB,CAAC,KAAK,EAAE,EAAU,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC;IAC5G,OAAO,CAAC,UAAuC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACxE,OAAO,CAAC,eAA4C,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC7E,OAAO,CAAC,iBAA8C,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC/E,OAAO,CAAC,SAAsC,CAAC,kBAAkB,CAAC,KAAK,EAAE,EAAU,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC;AAC7G,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,OAAe,EAAE,OAAe;IAClD,OAAO,GAAG,CAAC,MAAM,CAAC;QAChB,MAAM,EAAE,KAAK;QACb,GAAG,EAAE,gCAAgC,OAAO,aAAa,OAAO,EAAE;QAClE,OAAO,EAAE,IAAA,6BAAW,GAAE;KACvB,CAAC,CAAC;AACL,CAAC;AAED,IAAA,iBAAQ,EAAC,kEAAkE,EAAE,GAAG,EAAE;IAChF,IAAA,mBAAU,EAAC,KAAK,IAAI,EAAE;QACpB,OAAO,GAAG,IAAA,mCAAiB,GAAE,CAAC;QAC7B,OAAO,CAAC,cAA2C,CAAC,iBAAiB,CAAC;YACrE,MAAM,EAAE,cAAc;YACtB,SAAS,EAAE,QAAQ;YACnB,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC;YAClC,cAAc,EAAE,IAAI;YACpB,iBAAiB,EAAE,IAAI;SACxB,CAAC,CAAC;QACH,eAAe,EAAE,CAAC;QAClB,GAAG,GAAG,MAAM,IAAA,8BAAY,EAAC,OAAO,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACzC,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACzC,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;QACjD,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,UAAU,CAAC,CAAC,oBAAoB,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,iBAAQ,EAAC,2CAA2C,EAAE,GAAG,EAAE;IACzD,IAAA,mBAAU,EAAC,KAAK,IAAI,EAAE;QACpB,OAAO,GAAG,IAAA,mCAAiB,GAAE,CAAC;QAC7B,OAAO,CAAC,cAA2C,CAAC,iBAAiB,CAAC;YACrE,MAAM,EAAE,cAAc;YACtB,SAAS,EAAE,QAAQ;YACnB,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC;YAClC,cAAc,EAAE,IAAI;YACpB,iBAAiB,EAAE,IAAI;SACxB,CAAC,CAAC;QACH,eAAe,EAAE,CAAC;QAClB,GAAG,GAAG,MAAM,IAAA,8BAAY,EAAC,OAAO,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,eAAe,EAAE,OAAO,EAAE,IAAA,6BAAW,GAAE,EAAE,CAAC,CAAC;QAC9F,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,GAAG,GAAI,GAAG,CAAC,IAAI,EAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACvD,IAAA,eAAM,EAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QACxC,IAAA,eAAM,EAAC,GAAG,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;YAC3B,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,2BAA2B,MAAM,EAAE;YACxC,OAAO,EAAE,IAAA,6BAAW,GAAE;SACvB,CAAC,CAAC;QACH,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,iBAAiB,YAAY,EAAE,EAAE,OAAO,EAAE,IAAA,6BAAW,GAAE,EAAE,CAAC,CAAC;QAC9G,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,iBAAiB,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAA,6BAAW,GAAE,EAAE,CAAC,CAAC;QAC1G,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;YAC3B,MAAM,EAAE,OAAO;YACf,GAAG,EAAE,iBAAiB,YAAY,EAAE;YACpC,OAAO,EAAE,EAAE,GAAG,IAAA,6BAAW,GAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YACjE,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;SAC9B,CAAC,CAAC;QACH,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,iBAAiB,YAAY,EAAE,EAAE,OAAO,EAAE,IAAA,6BAAW,GAAE,EAAE,CAAC,CAAC;QACjH,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;YAC3B,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,eAAe;YACpB,OAAO,EAAE,EAAE,GAAG,IAAA,6BAAW,GAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YACjE,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE;SAClE,CAAC,CAAC;QACH,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;YAC3B,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,wBAAwB,OAAO,EAAE;YACtC,OAAO,EAAE,EAAE,GAAG,IAAA,6BAAW,GAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YACjE,OAAO,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE;SACnC,CAAC,CAAC;QACH,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;YAC3B,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,wBAAwB,WAAW,EAAE;YAC1C,OAAO,EAAE,EAAE,GAAG,IAAA,6BAAW,GAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YACjE,OAAO,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE;SAC/B,CAAC,CAAC;QACH,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;YAC3B,MAAM,EAAE,QAAQ;YAChB,GAAG,EAAE,wBAAwB,WAAW,EAAE;YAC1C,OAAO,EAAE,IAAA,6BAAW,GAAE;SACvB,CAAC,CAAC;QACH,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;YAC3B,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,wBAAwB,OAAO,EAAE;YACtC,OAAO,EAAE,EAAE,GAAG,IAAA,6BAAW,GAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YACjE,OAAO,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE;SAC/B,CAAC,CAAC;QACH,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,eAAe,CAAC,CAAC,oBAAoB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,iBAAQ,EAAC,uCAAuC,EAAE,GAAG,EAAE;IACrD,IAAA,mBAAU,EAAC,KAAK,IAAI,EAAE;QACpB,OAAO,GAAG,IAAA,mCAAiB,GAAE,CAAC;QAC7B,OAAO,CAAC,cAA2C,CAAC,iBAAiB,CAAC;YACrE,MAAM,EAAE,YAAY;YACpB,SAAS,EAAE,IAAI;YACf,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC;YAClC,cAAc,EAAE,IAAI;YACpB,iBAAiB,EAAE,IAAI;SACxB,CAAC,CAAC;QACH,eAAe,EAAE,CAAC;QAClB,GAAG,GAAG,MAAM,IAAA,8BAAY,EAAC,OAAO,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,6BAA6B,EAAE,KAAK,IAAI,EAAE;QAC3C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACzC,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,UAAU,CAAC,CAAC,oBAAoB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,eAAe,EAAE,OAAO,EAAE,IAAA,6BAAW,GAAE,EAAE,CAAC,CAAC;QAC9F,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAE,GAAG,CAAC,IAAI,EAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,iBAAiB,YAAY,EAAE,EAAE,OAAO,EAAE,IAAA,6BAAW,GAAE,EAAE,CAAC,CAAC;QAC9G,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;QACjD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;YAC3B,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,wBAAwB,WAAW,EAAE;YAC1C,OAAO,EAAE,EAAE,GAAG,IAAA,6BAAW,GAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YACjE,OAAO,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE;SACnC,CAAC,CAAC;QACH,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,eAAe,CAAC,CAAC,oBAAoB,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/default-deny.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=default-deny.test.d.ts.map

package/dist/__tests__/default-deny.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"default-deny.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/default-deny.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/default-deny.test.js

@@ -1,92 +0,0 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-const vitest_1 = require("vitest");
-const fastify_1 = __importDefault(require("fastify"));
-const auth_js_1 = require("../middleware/auth.js");
-const authorize_js_1 = require("../middleware/authorize.js");
-const tenant_scope_js_1 = require("../middleware/tenant-scope.js");
-const error_handler_js_1 = require("../middleware/error-handler.js");
-const test_helpers_js_1 = require("./test-helpers.js");
-/**
- * Control-plane authorization must be default-deny: a route that does not
- * declare a tenant scope is refused, so a route added without a guard fails
- * closed instead of silently serving data.
- */
-const SCOPED_TENANT = "11111111-1111-4111-8111-111111111111";
-const OTHER_TENANT = "99999999-9999-4999-8999-999999999999";
-let stratum;
-(0, vitest_1.beforeEach)(() => {
-    stratum = (0, test_helpers_js_1.createMockStratum)();
-    stratum.validateApiKey.mockResolvedValue({
-        key_id: "scoped-key",
-        tenant_id: SCOPED_TENANT,
-        scopes: ["read", "write", "admin"],
-        rate_limit_max: null,
-        rate_limit_window: null,
-    });
-    // Both tenants are roots (empty ancestry), so neither is a descendant of the
-    // other: a scoped key may reach only its own.
-    stratum.getTenant.mockImplementation(async (id) => ({ id, ancestry_path: "", status: "active" }));
-});
-/**
- * Build an app wired exactly like the production control plane: authenticate,
- * authorize by scope, then enforce tenant scope. The caller registers routes.
- */
-async function buildApp(register) {
-    const app = (0, fastify_1.default)({ logger: false });
-    app.addHook("preHandler", (0, auth_js_1.createAuthMiddleware)(stratum));
-    app.addHook("preHandler", (0, authorize_js_1.createAuthorizeMiddleware)());
-    app.addHook("preHandler", (0, tenant_scope_js_1.createTenantScopeEnforcer)(stratum));
-    app.setErrorHandler(error_handler_js_1.errorHandler);
-    await register(app);
-    await app.ready();
-    return app;
-}
-(0, vitest_1.describe)("default-deny authorization", () => {
-    (0, vitest_1.it)("denies a route that declares no tenant scope", async () => {
-        const app = await buildApp((app) => {
-            // A control-plane route that ships without any tenant-scope declaration.
-            app.get("/api/v1/unguarded/:id", async (_req, reply) => reply.status(200).send({ reached: true }));
-        });
-        const res = await app.inject({
-            method: "GET",
-            url: `/api/v1/unguarded/${OTHER_TENANT}`,
-            headers: (0, test_helpers_js_1.authHeaders)(),
-        });
-        (0, vitest_1.expect)(res.statusCode).toBe(403);
-    });
-    (0, vitest_1.it)("admits a route explicitly declared as global", async () => {
-        const app = await buildApp((app) => {
-            (0, tenant_scope_js_1.declareTenantScope)(app, "global");
-            app.get("/api/v1/ops", async (_req, reply) => reply.status(200).send({ ok: true }));
-        });
-        const res = await app.inject({
-            method: "GET",
-            url: "/api/v1/ops",
-            headers: (0, test_helpers_js_1.authHeaders)(),
-        });
-        (0, vitest_1.expect)(res.statusCode).toBe(200);
-    });
-    (0, vitest_1.it)("enforces a declared extractor: own tenant allowed, others denied", async () => {
-        const app = await buildApp((app) => {
-            (0, tenant_scope_js_1.declareTenantScope)(app, tenant_scope_js_1.fromParamId);
-            app.get("/api/v1/tenants/:id/thing", async (_req, reply) => reply.status(200).send({ ok: true }));
-        });
-        const own = await app.inject({
-            method: "GET",
-            url: `/api/v1/tenants/${SCOPED_TENANT}/thing`,
-            headers: (0, test_helpers_js_1.authHeaders)(),
-        });
-        const other = await app.inject({
-            method: "GET",
-            url: `/api/v1/tenants/${OTHER_TENANT}/thing`,
-            headers: (0, test_helpers_js_1.authHeaders)(),
-        });
-        (0, vitest_1.expect)(own.statusCode).toBe(200);
-        (0, vitest_1.expect)(other.statusCode).toBe(403);
-    });
-});
-//# sourceMappingURL=default-deny.test.js.map

package/dist/__tests__/default-deny.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"default-deny.test.js","sourceRoot":"","sources":["../../src/__tests__/default-deny.test.ts"],"names":[],"mappings":";;;;;AAAA,mCAA8D;AAC9D,sDAAmD;AAEnD,mDAA6D;AAC7D,6DAAuE;AACvE,mEAIuC;AACvC,qEAA8D;AAC9D,uDAAmE;AAEnE;;;;GAIG;AAEH,MAAM,aAAa,GAAG,sCAAsC,CAAC;AAC7D,MAAM,YAAY,GAAG,sCAAsC,CAAC;AAE5D,IAAI,OAAgB,CAAC;AAErB,IAAA,mBAAU,EAAC,GAAG,EAAE;IACd,OAAO,GAAG,IAAA,mCAAiB,GAAE,CAAC;IAC7B,OAAO,CAAC,cAA2C,CAAC,iBAAiB,CAAC;QACrE,MAAM,EAAE,YAAY;QACpB,SAAS,EAAE,aAAa;QACxB,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC;QAClC,cAAc,EAAE,IAAI;QACpB,iBAAiB,EAAE,IAAI;KACxB,CAAC,CAAC;IACH,6EAA6E;IAC7E,8CAA8C;IAC7C,OAAO,CAAC,SAAsC,CAAC,kBAAkB,CAChE,KAAK,EAAE,EAAU,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CACpE,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH;;;GAGG;AACH,KAAK,UAAU,QAAQ,CACrB,QAAwD;IAExD,MAAM,GAAG,GAAG,IAAA,iBAAO,EAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACvC,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,IAAA,8BAAoB,EAAC,OAAO,CAAC,CAAC,CAAC;IACzD,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,IAAA,wCAAyB,GAAE,CAAC,CAAC;IACvD,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,IAAA,2CAAyB,EAAC,OAAO,CAAC,CAAC,CAAC;IAC9D,GAAG,CAAC,eAAe,CAAC,+BAAY,CAAC,CAAC;IAClC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;IACpB,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;IAClB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,IAAA,iBAAQ,EAAC,4BAA4B,EAAE,GAAG,EAAE;IAC1C,IAAA,WAAE,EAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,CAAC,GAAG,EAAE,EAAE;YACjC,yEAAyE;YACzE,GAAG,CAAC,GAAG,CACL,uBAAuB,EACvB,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CACjE,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;YAC3B,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,qBAAqB,YAAY,EAAE;YACxC,OAAO,EAAE,IAAA,6BAAW,GAAE;SACvB,CAAC,CAAC;QAEH,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,CAAC,GAAG,EAAE,EAAE;YACjC,IAAA,oCAAkB,EAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAClC,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAC3C,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CACrC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;YAC3B,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,aAAa;YAClB,OAAO,EAAE,IAAA,6BAAW,GAAE;SACvB,CAAC,CAAC;QAEH,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,CAAC,GAAG,EAAE,EAAE;YACjC,IAAA,oCAAkB,EAAC,GAAG,EAAE,6BAAW,CAAC,CAAC;YACrC,GAAG,CAAC,GAAG,CACL,2BAA2B,EAC3B,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAC5D,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;YAC3B,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,mBAAmB,aAAa,QAAQ;YAC7C,OAAO,EAAE,IAAA,6BAAW,GAAE;SACvB,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;YAC7B,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,mBAAmB,YAAY,QAAQ;YAC5C,OAAO,EAAE,IAAA,6BAAW,GAAE;SACvB,CAAC,CAAC;QAEH,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/tenant-create-scope.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=tenant-create-scope.test.d.ts.map

package/dist/__tests__/tenant-create-scope.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"tenant-create-scope.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/tenant-create-scope.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/tenant-create-scope.test.js

@@ -1,129 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-const vitest_1 = require("vitest");
-const test_helpers_js_1 = require("./test-helpers.js");
-/**
- * Tenant creation must respect the caller's key scope.
- *
- * A tenant-scoped key may only create tenants WITHIN its own subtree: the new
- * tenant's parent must be the key's own tenant or a descendant of it. A scoped
- * key may not create a new root (a tenant with no parent). Only global
- * (operator) keys may create roots or create anywhere in the tree.
- */
-const OWNER = "11111111-1111-4111-8111-111111111111";
-const OWNER_CHILD = "22222222-2222-4222-8222-222222222222";
-const OUTSIDER = "99999999-9999-4999-8999-999999999999";
-// ancestry_path holds a tenant's ANCESTORS and excludes self, so a root is "".
-const TENANTS = {
-    [OWNER]: { id: OWNER, ancestry_path: "", status: "active" },
-    [OWNER_CHILD]: { id: OWNER_CHILD, ancestry_path: OWNER, status: "active" },
-    [OUTSIDER]: { id: OUTSIDER, ancestry_path: "", status: "active" },
-};
-let app;
-let stratum;
-function useScopedKey() {
-    stratum.validateApiKey.mockResolvedValue({
-        key_id: "scoped-key",
-        tenant_id: OWNER,
-        scopes: ["read", "write", "admin"],
-        rate_limit_max: null,
-        rate_limit_window: null,
-    });
-}
-function useGlobalKey() {
-    stratum.validateApiKey.mockResolvedValue({
-        key_id: "global-key",
-        tenant_id: null,
-        scopes: ["read", "write", "admin"],
-        rate_limit_max: null,
-        rate_limit_window: null,
-    });
-}
-(0, vitest_1.beforeEach)(async () => {
-    stratum = (0, test_helpers_js_1.createMockStratum)();
-    stratum.getTenant.mockImplementation(async (id) => {
-        const row = TENANTS[id];
-        if (!row)
-            throw new Error(`Tenant ${id} not found`);
-        return row;
-    });
-    stratum.createTenant.mockResolvedValue({
-        id: "created-id",
-        slug: "newco",
-        isolation_strategy: "SHARED_RLS",
-    });
-    stratum.batchCreateTenants.mockResolvedValue({
-        created: [],
-    });
-    app = await (0, test_helpers_js_1.buildTestApp)(stratum);
-});
-async function create(body) {
-    return app.inject({
-        method: "POST",
-        url: "/api/v1/tenants",
-        headers: { ...(0, test_helpers_js_1.authHeaders)(), "content-type": "application/json" },
-        payload: body,
-    });
-}
-(0, vitest_1.describe)("scoped key create is confined to its own subtree", () => {
-    (0, vitest_1.beforeEach)(useScopedKey);
-    (0, vitest_1.it)("refuses creating a tenant under a parent outside the key subtree", async () => {
-        const res = await create({ slug: "newco", name: "New Co", parent_id: OUTSIDER });
-        (0, vitest_1.expect)(res.statusCode).toBe(403);
-        (0, vitest_1.expect)(stratum.createTenant).not.toHaveBeenCalled();
-    });
-    (0, vitest_1.it)("refuses creating a new root tenant (no parent)", async () => {
-        const res = await create({ slug: "newco", name: "New Co" });
-        (0, vitest_1.expect)(res.statusCode).toBe(403);
-        (0, vitest_1.expect)(stratum.createTenant).not.toHaveBeenCalled();
-    });
-    (0, vitest_1.it)("refuses an explicit null parent (root)", async () => {
-        const res = await create({ slug: "newco", name: "New Co", parent_id: null });
-        (0, vitest_1.expect)(res.statusCode).toBe(403);
-        (0, vitest_1.expect)(stratum.createTenant).not.toHaveBeenCalled();
-    });
-    (0, vitest_1.it)("allows creating directly under the key's own tenant", async () => {
-        const res = await create({ slug: "newco", name: "New Co", parent_id: OWNER });
-        (0, vitest_1.expect)(res.statusCode).toBe(201);
-        (0, vitest_1.expect)(stratum.createTenant).toHaveBeenCalled();
-    });
-    (0, vitest_1.it)("allows creating under a descendant of the key's tenant", async () => {
-        const res = await create({ slug: "newco", name: "New Co", parent_id: OWNER_CHILD });
-        (0, vitest_1.expect)(res.statusCode).toBe(201);
-        (0, vitest_1.expect)(stratum.createTenant).toHaveBeenCalled();
-    });
-    (0, vitest_1.it)("refuses a batch create that targets a parent outside the subtree", async () => {
-        const res = await app.inject({
-            method: "POST",
-            url: "/api/v1/tenants/batch",
-            headers: { ...(0, test_helpers_js_1.authHeaders)(), "content-type": "application/json" },
-            payload: { tenants: [{ slug: "newco", name: "New Co", parent_id: OUTSIDER }] },
-        });
-        (0, vitest_1.expect)(res.statusCode).toBe(403);
-        (0, vitest_1.expect)(stratum.batchCreateTenants).not.toHaveBeenCalled();
-    });
-    (0, vitest_1.it)("refuses a batch create that includes a new root", async () => {
-        const res = await app.inject({
-            method: "POST",
-            url: "/api/v1/tenants/batch",
-            headers: { ...(0, test_helpers_js_1.authHeaders)(), "content-type": "application/json" },
-            payload: { tenants: [{ slug: "newco", name: "New Co", parent_id: OWNER }, { slug: "rootco", name: "Root Co" }] },
-        });
-        (0, vitest_1.expect)(res.statusCode).toBe(403);
-        (0, vitest_1.expect)(stratum.batchCreateTenants).not.toHaveBeenCalled();
-    });
-});
-(0, vitest_1.describe)("global key create is unrestricted", () => {
-    (0, vitest_1.beforeEach)(useGlobalKey);
-    (0, vitest_1.it)("allows creating a new root tenant", async () => {
-        const res = await create({ slug: "rootco", name: "Root Co" });
-        (0, vitest_1.expect)(res.statusCode).toBe(201);
-        (0, vitest_1.expect)(stratum.createTenant).toHaveBeenCalled();
-    });
-    (0, vitest_1.it)("allows creating anywhere in the tree", async () => {
-        const res = await create({ slug: "newco", name: "New Co", parent_id: OUTSIDER });
-        (0, vitest_1.expect)(res.statusCode).toBe(201);
-        (0, vitest_1.expect)(stratum.createTenant).toHaveBeenCalled();
-    });
-});
-//# sourceMappingURL=tenant-create-scope.test.js.map

package/dist/__tests__/tenant-create-scope.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"tenant-create-scope.test.js","sourceRoot":"","sources":["../../src/__tests__/tenant-create-scope.test.ts"],"names":[],"mappings":";;AAAA,mCAA8D;AAG9D,uDAAiF;AAEjF;;;;;;;GAOG;AAEH,MAAM,KAAK,GAAG,sCAAsC,CAAC;AACrD,MAAM,WAAW,GAAG,sCAAsC,CAAC;AAC3D,MAAM,QAAQ,GAAG,sCAAsC,CAAC;AAIxD,+EAA+E;AAC/E,MAAM,OAAO,GAAwB;IACnC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE;IAC3D,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE;IAC1E,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE;CAClE,CAAC;AAEF,IAAI,GAAoB,CAAC;AACzB,IAAI,OAAgB,CAAC;AAErB,SAAS,YAAY;IAClB,OAAO,CAAC,cAA2C,CAAC,iBAAiB,CAAC;QACrE,MAAM,EAAE,YAAY;QACpB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC;QAClC,cAAc,EAAE,IAAI;QACpB,iBAAiB,EAAE,IAAI;KACxB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY;IAClB,OAAO,CAAC,cAA2C,CAAC,iBAAiB,CAAC;QACrE,MAAM,EAAE,YAAY;QACpB,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC;QAClC,cAAc,EAAE,IAAI;QACpB,iBAAiB,EAAE,IAAI;KACxB,CAAC,CAAC;AACL,CAAC;AAED,IAAA,mBAAU,EAAC,KAAK,IAAI,EAAE;IACpB,OAAO,GAAG,IAAA,mCAAiB,GAAE,CAAC;IAE7B,OAAO,CAAC,SAAsC,CAAC,kBAAkB,CAChE,KAAK,EAAE,EAAU,EAAE,EAAE;QACnB,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;QACxB,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QACpD,OAAO,GAAG,CAAC;IACb,CAAC,CACF,CAAC;IAED,OAAO,CAAC,YAAyC,CAAC,iBAAiB,CAAC;QACnE,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,OAAO;QACb,kBAAkB,EAAE,YAAY;KACjC,CAAC,CAAC;IACF,OAAO,CAAC,kBAA+C,CAAC,iBAAiB,CAAC;QACzE,OAAO,EAAE,EAAE;KACZ,CAAC,CAAC;IAEH,GAAG,GAAG,MAAM,IAAA,8BAAY,EAAC,OAAO,CAAC,CAAC;AACpC,CAAC,CAAC,CAAC;AAEH,KAAK,UAAU,MAAM,CAAC,IAA6B;IACjD,OAAO,GAAG,CAAC,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM;QACd,GAAG,EAAE,iBAAiB;QACtB,OAAO,EAAE,EAAE,GAAG,IAAA,6BAAW,GAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QACjE,OAAO,EAAE,IAAI;KACd,CAAC,CAAC;AACL,CAAC;AAED,IAAA,iBAAQ,EAAC,kDAAkD,EAAE,GAAG,EAAE;IAChE,IAAA,mBAAU,EAAC,YAAY,CAAC,CAAC;IAEzB,IAAA,WAAE,EAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;QAEjF,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QAE5D,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACtD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAE7E,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QAE9E,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,YAAY,CAAC,CAAC,gBAAgB,EAAE,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC;QAEpF,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,YAAY,CAAC,CAAC,gBAAgB,EAAE,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;YAC3B,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,uBAAuB;YAC5B,OAAO,EAAE,EAAE,GAAG,IAAA,6BAAW,GAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YACjE,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,EAAE;SAC/E,CAAC,CAAC;QAEH,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;YAC3B,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,uBAAuB;YAC5B,OAAO,EAAE,EAAE,GAAG,IAAA,6BAAW,GAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YACjE,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE;SACjH,CAAC,CAAC;QAEH,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,iBAAQ,EAAC,mCAAmC,EAAE,GAAG,EAAE;IACjD,IAAA,mBAAU,EAAC,YAAY,CAAC,CAAC;IAEzB,IAAA,WAAE,EAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;QACjD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAE9D,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,YAAY,CAAC,CAAC,gBAAgB,EAAE,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;QAEjF,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,YAAY,CAAC,CAAC,gBAAgB,EAAE,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/tenant-move-scope.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=tenant-move-scope.test.d.ts.map

package/dist/__tests__/tenant-move-scope.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"tenant-move-scope.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/tenant-move-scope.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/tenant-move-scope.test.js

@@ -1,113 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-const vitest_1 = require("vitest");
-const test_helpers_js_1 = require("./test-helpers.js");
-/**
- * Regression tests for a critical cross-tenant authorization flaw in the move route.
- *
- * The bug: createTenantScopeGuard was registered with the `fromParamId` extractor,
- * which reads only `:id`, the tenant being MOVED. Nothing authorized
- * `body.new_parent_id`, the move DESTINATION.
- *
- * A key scoped to its own tenant therefore passed the guard on the fast path
- * (`apiKey.tenant_id === targetTenantId`) and could graft itself under any tenant
- * in the system. Because Stratum resolves config by walking UP the ancestry path,
- * the attacker's tenant then inherits the victim's config, including `sensitive`
- * values, which are decrypted on resolve, plus the victim's delegated permissions.
- *
- * The library's moveTenant is not at fault: it locks both rows, rejects archived
- * tenants and detects cycles. Authorization is the control plane's job.
- */
-const ATTACKER = "11111111-1111-4111-8111-111111111111";
-const ATTACKER_CHILD = "22222222-2222-4222-8222-222222222222";
-const ATTACKER_GRANDCHILD = "33333333-3333-4333-8333-333333333333";
-const VICTIM = "99999999-9999-4999-8999-999999999999";
-// ancestry_path holds a tenant's ANCESTORS and excludes self, so a root is "".
-const TENANTS = {
-    [ATTACKER]: { id: ATTACKER, ancestry_path: "", status: "active" },
-    [ATTACKER_CHILD]: {
-        id: ATTACKER_CHILD,
-        ancestry_path: ATTACKER,
-        status: "active",
-    },
-    [ATTACKER_GRANDCHILD]: {
-        id: ATTACKER_GRANDCHILD,
-        ancestry_path: `${ATTACKER}/${ATTACKER_CHILD}`,
-        status: "active",
-    },
-    [VICTIM]: { id: VICTIM, ancestry_path: "", status: "active" },
-};
-let app;
-let stratum;
-(0, vitest_1.beforeEach)(async () => {
-    stratum = (0, test_helpers_js_1.createMockStratum)();
-    // A key scoped to the attacker's own tenant. Not a global key.
-    stratum.validateApiKey.mockResolvedValue({
-        key_id: "attacker-key",
-        tenant_id: ATTACKER,
-        scopes: ["read", "write", "admin"],
-        rate_limit_max: null,
-        rate_limit_window: null,
-    });
-    stratum.getTenant.mockImplementation(async (id) => {
-        const row = TENANTS[id];
-        if (!row)
-            throw new Error(`Tenant ${id} not found`);
-        return row;
-    });
-    stratum.moveTenant.mockImplementation(async (id) => TENANTS[id]);
-    app = await (0, test_helpers_js_1.buildTestApp)(stratum);
-});
-async function move(id, newParentId) {
-    return app.inject({
-        method: "POST",
-        url: `/api/v1/tenants/${id}/move`,
-        headers: { ...(0, test_helpers_js_1.authHeaders)(), "content-type": "application/json" },
-        payload: { new_parent_id: newParentId },
-    });
-}
-(0, vitest_1.describe)("move route authorizes the destination parent, not just the moved tenant", () => {
-    (0, vitest_1.it)("refuses grafting your own tenant under an unrelated tenant", async () => {
-        const res = await move(ATTACKER, VICTIM);
-        (0, vitest_1.expect)(res.statusCode).toBe(403);
-        (0, vitest_1.expect)(stratum.moveTenant).not.toHaveBeenCalled();
-    });
-    (0, vitest_1.it)("refuses grafting a tenant you do own under a tenant you do not", async () => {
-        const res = await move(ATTACKER_CHILD, VICTIM);
-        (0, vitest_1.expect)(res.statusCode).toBe(403);
-        (0, vitest_1.expect)(stratum.moveTenant).not.toHaveBeenCalled();
-    });
-    (0, vitest_1.it)("allows reorganizing entirely inside your own subtree", async () => {
-        const res = await move(ATTACKER_GRANDCHILD, ATTACKER_CHILD);
-        (0, vitest_1.expect)(res.statusCode).toBe(200);
-        (0, vitest_1.expect)(stratum.moveTenant).toHaveBeenCalledWith(ATTACKER_GRANDCHILD, ATTACKER_CHILD, vitest_1.expect.anything());
-    });
-    (0, vitest_1.it)("allows moving a descendant up to your own root", async () => {
-        const res = await move(ATTACKER_GRANDCHILD, ATTACKER);
-        (0, vitest_1.expect)(res.statusCode).toBe(200);
-        (0, vitest_1.expect)(stratum.moveTenant).toHaveBeenCalled();
-    });
-    (0, vitest_1.it)("fails closed when the destination tenant cannot be loaded", async () => {
-        const res = await move(ATTACKER, "44444444-4444-4444-8444-444444444444");
-        (0, vitest_1.expect)(res.statusCode).toBe(403);
-        (0, vitest_1.expect)(stratum.moveTenant).not.toHaveBeenCalled();
-    });
-});
-(0, vitest_1.describe)("global keys are unaffected", () => {
-    (0, vitest_1.beforeEach)(async () => {
-        stratum.validateApiKey.mockResolvedValue({
-            key_id: "global-key",
-            tenant_id: null,
-            scopes: ["read", "write", "admin"],
-            rate_limit_max: null,
-            rate_limit_window: null,
-        });
-        app = await (0, test_helpers_js_1.buildTestApp)(stratum);
-    });
-    (0, vitest_1.it)("still permits an operator key to move a tenant anywhere", async () => {
-        const res = await move(ATTACKER, VICTIM);
-        (0, vitest_1.expect)(res.statusCode).toBe(200);
-        (0, vitest_1.expect)(stratum.moveTenant).toHaveBeenCalled();
-    });
-});
-//# sourceMappingURL=tenant-move-scope.test.js.map