@stratum-hq/lib 0.6.0 → 1.0.0

package/dist/index.d.ts

@@ -4,6 +4,7 @@ export { migrateAllSchemas, type MigrateSchemasOptions, type MigrateSchemasResul
 export { withClient, withTransaction } from "./pool-helpers.js";
 export { verifyWebhookSignature, signWebhookPayload, DEFAULT_WEBHOOK_TOLERANCE_SECONDS, type VerifyWebhookOptions, } from "./webhook-signature.js";
 export { traced, getTracer, isTracingEnabled } from "./telemetry.js";
+export { ErrorCode, StratumError, TenantNotFoundError, TenantAlreadyExistsError, TenantHasChildrenError, TenantCycleDetectedError, TenantArchivedError, TenantContextNotFoundError, IsolationViolationError, IsolationStrategyUnsupportedError, PermissionLockedError, PermissionNotFoundError, PermissionRevocationDeniedError, ConfigLockedError, ConfigNotFoundError, ValidationError, UnauthorizedError, ForbiddenError, WebhookNotFoundError, WebhookDeliveryError, AbacPolicyNotFoundError, InvalidAbacOperatorError, AbacPolicyLockedError, } from "@stratum-hq/core";
 export type { TenantNode, TenantContext, CreateTenantInput, UpdateTenantInput, MoveTenantInput, PaginationInput, PaginatedResult, ConfigEntry, SetConfigInput, ResolvedConfigEntry, ResolvedConfig, PermissionPolicy, CreatePermissionInput, UpdatePermissionInput, ResolvedPermission, } from "@stratum-hq/core";
 export type { ApiKeyRecord, CreatedApiKey, ValidatedApiKey, CreateApiKeyOptions } from "./services/api-key-service.js";
 export type { BatchCreateResult } from "./services/tenant-service.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EACL,iBAAiB,EACjB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,GAC1B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,iCAAiC,EACjC,KAAK,oBAAoB,GAC1B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAGrE,YAAY,EACV,UAAU,EACV,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,eAAe,EACf,WAAW,EACX,cAAc,EACd,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAE1B,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACvH,YAAY,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACtE,YAAY,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,YAAY,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,YAAY,EAAE,IAAI,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAGzF,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEhF,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACxD,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EACL,iBAAiB,EACjB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,GAC1B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,iCAAiC,EACjC,KAAK,oBAAoB,GAC1B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAKrE,OAAO,EACL,SAAS,EACT,YAAY,EACZ,mBAAmB,EACnB,wBAAwB,EACxB,sBAAsB,EACtB,wBAAwB,EACxB,mBAAmB,EACnB,0BAA0B,EAC1B,uBAAuB,EACvB,iCAAiC,EACjC,qBAAqB,EACrB,uBAAuB,EACvB,+BAA+B,EAC/B,iBAAiB,EACjB,mBAAmB,EACnB,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,oBAAoB,EACpB,oBAAoB,EACpB,uBAAuB,EACvB,wBAAwB,EACxB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAG1B,YAAY,EACV,UAAU,EACV,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,eAAe,EACf,WAAW,EACX,cAAc,EACd,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAE1B,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACvH,YAAY,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACtE,YAAY,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,YAAY,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,YAAY,EAAE,IAAI,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAGzF,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEhF,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACxD,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.noopLogger = exports.defaultLogger = exports.isTracingEnabled = exports.getTracer = exports.traced = exports.DEFAULT_WEBHOOK_TOLERANCE_SECONDS = exports.signWebhookPayload = exports.verifyWebhookSignature = exports.withTransaction = exports.withClient = exports.migrateAllSchemas = exports.migrate = exports.Stratum = void 0;
+exports.noopLogger = exports.defaultLogger = exports.AbacPolicyLockedError = exports.InvalidAbacOperatorError = exports.AbacPolicyNotFoundError = exports.WebhookDeliveryError = exports.WebhookNotFoundError = exports.ForbiddenError = exports.UnauthorizedError = exports.ValidationError = exports.ConfigNotFoundError = exports.ConfigLockedError = exports.PermissionRevocationDeniedError = exports.PermissionNotFoundError = exports.PermissionLockedError = exports.IsolationStrategyUnsupportedError = exports.IsolationViolationError = exports.TenantContextNotFoundError = exports.TenantArchivedError = exports.TenantCycleDetectedError = exports.TenantHasChildrenError = exports.TenantAlreadyExistsError = exports.TenantNotFoundError = exports.StratumError = exports.ErrorCode = exports.isTracingEnabled = exports.getTracer = exports.traced = exports.DEFAULT_WEBHOOK_TOLERANCE_SECONDS = exports.signWebhookPayload = exports.verifyWebhookSignature = exports.withTransaction = exports.withClient = exports.migrateAllSchemas = exports.migrate = exports.Stratum = void 0;
 var stratum_js_1 = require("./stratum.js");
 Object.defineProperty(exports, "Stratum", { enumerable: true, get: function () { return stratum_js_1.Stratum; } });
 var migrate_js_1 = require("./migrate.js");
@@ -18,6 +18,33 @@ var telemetry_js_1 = require("./telemetry.js");
 Object.defineProperty(exports, "traced", { enumerable: true, get: function () { return telemetry_js_1.traced; } });
 Object.defineProperty(exports, "getTracer", { enumerable: true, get: function () { return telemetry_js_1.getTracer; } });
 Object.defineProperty(exports, "isTracingEnabled", { enumerable: true, get: function () { return telemetry_js_1.isTracingEnabled; } });
+// Re-export core error classes as runtime VALUES (not `export type`) so consumers
+// can branch with `instanceof` instead of matching error-message substrings. A
+// type-only re-export would erase these at compile time and break instanceof.
+var core_1 = require("@stratum-hq/core");
+Object.defineProperty(exports, "ErrorCode", { enumerable: true, get: function () { return core_1.ErrorCode; } });
+Object.defineProperty(exports, "StratumError", { enumerable: true, get: function () { return core_1.StratumError; } });
+Object.defineProperty(exports, "TenantNotFoundError", { enumerable: true, get: function () { return core_1.TenantNotFoundError; } });
+Object.defineProperty(exports, "TenantAlreadyExistsError", { enumerable: true, get: function () { return core_1.TenantAlreadyExistsError; } });
+Object.defineProperty(exports, "TenantHasChildrenError", { enumerable: true, get: function () { return core_1.TenantHasChildrenError; } });
+Object.defineProperty(exports, "TenantCycleDetectedError", { enumerable: true, get: function () { return core_1.TenantCycleDetectedError; } });
+Object.defineProperty(exports, "TenantArchivedError", { enumerable: true, get: function () { return core_1.TenantArchivedError; } });
+Object.defineProperty(exports, "TenantContextNotFoundError", { enumerable: true, get: function () { return core_1.TenantContextNotFoundError; } });
+Object.defineProperty(exports, "IsolationViolationError", { enumerable: true, get: function () { return core_1.IsolationViolationError; } });
+Object.defineProperty(exports, "IsolationStrategyUnsupportedError", { enumerable: true, get: function () { return core_1.IsolationStrategyUnsupportedError; } });
+Object.defineProperty(exports, "PermissionLockedError", { enumerable: true, get: function () { return core_1.PermissionLockedError; } });
+Object.defineProperty(exports, "PermissionNotFoundError", { enumerable: true, get: function () { return core_1.PermissionNotFoundError; } });
+Object.defineProperty(exports, "PermissionRevocationDeniedError", { enumerable: true, get: function () { return core_1.PermissionRevocationDeniedError; } });
+Object.defineProperty(exports, "ConfigLockedError", { enumerable: true, get: function () { return core_1.ConfigLockedError; } });
+Object.defineProperty(exports, "ConfigNotFoundError", { enumerable: true, get: function () { return core_1.ConfigNotFoundError; } });
+Object.defineProperty(exports, "ValidationError", { enumerable: true, get: function () { return core_1.ValidationError; } });
+Object.defineProperty(exports, "UnauthorizedError", { enumerable: true, get: function () { return core_1.UnauthorizedError; } });
+Object.defineProperty(exports, "ForbiddenError", { enumerable: true, get: function () { return core_1.ForbiddenError; } });
+Object.defineProperty(exports, "WebhookNotFoundError", { enumerable: true, get: function () { return core_1.WebhookNotFoundError; } });
+Object.defineProperty(exports, "WebhookDeliveryError", { enumerable: true, get: function () { return core_1.WebhookDeliveryError; } });
+Object.defineProperty(exports, "AbacPolicyNotFoundError", { enumerable: true, get: function () { return core_1.AbacPolicyNotFoundError; } });
+Object.defineProperty(exports, "InvalidAbacOperatorError", { enumerable: true, get: function () { return core_1.InvalidAbacOperatorError; } });
+Object.defineProperty(exports, "AbacPolicyLockedError", { enumerable: true, get: function () { return core_1.AbacPolicyLockedError; } });
 var logger_js_1 = require("./logger.js");
 Object.defineProperty(exports, "defaultLogger", { enumerable: true, get: function () { return logger_js_1.defaultLogger; } });
 Object.defineProperty(exports, "noopLogger", { enumerable: true, get: function () { return logger_js_1.noopLogger; } });

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,2CAA4D;AAAnD,qGAAA,OAAO,OAAA;AAChB,2CAA4D;AAAnD,qGAAA,OAAO,OAAA;AAChB,2DAI8B;AAH5B,uHAAA,iBAAiB,OAAA;AAInB,qDAAgE;AAAvD,6GAAA,UAAU,OAAA;AAAE,kHAAA,eAAe,OAAA;AACpC,+DAKgC;AAJ9B,8HAAA,sBAAsB,OAAA;AACtB,0HAAA,kBAAkB,OAAA;AAClB,yIAAA,iCAAiC,OAAA;AAGnC,+CAAqE;AAA5D,sGAAA,MAAM,OAAA;AAAE,yGAAA,SAAS,OAAA;AAAE,gHAAA,gBAAgB,OAAA;AA8B5C,yCAAwD;AAA/C,0GAAA,aAAa,OAAA;AAAE,uGAAA,UAAU,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,2CAA4D;AAAnD,qGAAA,OAAO,OAAA;AAChB,2CAA4D;AAAnD,qGAAA,OAAO,OAAA;AAChB,2DAI8B;AAH5B,uHAAA,iBAAiB,OAAA;AAInB,qDAAgE;AAAvD,6GAAA,UAAU,OAAA;AAAE,kHAAA,eAAe,OAAA;AACpC,+DAKgC;AAJ9B,8HAAA,sBAAsB,OAAA;AACtB,0HAAA,kBAAkB,OAAA;AAClB,yIAAA,iCAAiC,OAAA;AAGnC,+CAAqE;AAA5D,sGAAA,MAAM,OAAA;AAAE,yGAAA,SAAS,OAAA;AAAE,gHAAA,gBAAgB,OAAA;AAE5C,kFAAkF;AAClF,+EAA+E;AAC/E,8EAA8E;AAC9E,yCAwB0B;AAvBxB,iGAAA,SAAS,OAAA;AACT,oGAAA,YAAY,OAAA;AACZ,2GAAA,mBAAmB,OAAA;AACnB,gHAAA,wBAAwB,OAAA;AACxB,8GAAA,sBAAsB,OAAA;AACtB,gHAAA,wBAAwB,OAAA;AACxB,2GAAA,mBAAmB,OAAA;AACnB,kHAAA,0BAA0B,OAAA;AAC1B,+GAAA,uBAAuB,OAAA;AACvB,yHAAA,iCAAiC,OAAA;AACjC,6GAAA,qBAAqB,OAAA;AACrB,+GAAA,uBAAuB,OAAA;AACvB,uHAAA,+BAA+B,OAAA;AAC/B,yGAAA,iBAAiB,OAAA;AACjB,2GAAA,mBAAmB,OAAA;AACnB,uGAAA,eAAe,OAAA;AACf,yGAAA,iBAAiB,OAAA;AACjB,sGAAA,cAAc,OAAA;AACd,4GAAA,oBAAoB,OAAA;AACpB,4GAAA,oBAAoB,OAAA;AACpB,+GAAA,uBAAuB,OAAA;AACvB,gHAAA,wBAAwB,OAAA;AACxB,6GAAA,qBAAqB,OAAA;AA+BvB,yCAAwD;AAA/C,0GAAA,aAAa,OAAA;AAAE,uGAAA,UAAU,OAAA"}

package/dist/migrations/019_rls_policies.sql

@@ -0,0 +1,236 @@
+-- Migration 019: Real Postgres row-level security for the SHARED_RLS strategy.
+--
+-- Backs the `isolation_strategy = 'SHARED_RLS'` literal (001_init.sql) with
+-- database-enforced tenant isolation. This is a SECOND, independent layer; the
+-- application control-plane authorization stays the primary enforcement. See
+-- docs/adr/0001-postgres-rls-defense-in-depth.md for the full design.
+--
+-- Context model:
+--   * Tenant context: SET LOCAL app.current_tenant_id (transaction scoped).
+--   * System bypass:   SET LOCAL app.bypass_rls = 'on' (control-plane path).
+--   Both are set with set_config(..., true) / SET LOCAL so they cannot leak
+--   across pooled connections.
+--
+-- Every policy is fail closed: with no context set,
+--   NULLIF(current_setting('app.current_tenant_id', true), '')::uuid  ->  NULL,
+-- so the scope predicate is NULL (not true) and zero rows are visible; a write
+-- with no context is rejected. current_setting(name, true) returns NULL instead
+-- of raising when the GUC is unset.
+--
+-- ENABLE + FORCE: FORCE applies the policy to the table owner too. Note that a
+-- Postgres SUPERUSER or a role with BYPASSRLS always skips RLS regardless of
+-- FORCE; the application role must be neither (see docker/init-db.sql:
+-- stratum_app is NOSUPERUSER NOBYPASSRLS).
+--
+-- DROP POLICY IF EXISTS before CREATE makes the migration safe to re-run.
+
+-- Reusable predicate (documented once; inlined per policy below because Postgres
+-- policies cannot reference a shared expression):
+--   current_setting('app.bypass_rls', true) = 'on'
+--   OR tenant_id = NULLIF(current_setting('app.current_tenant_id', true), '')::uuid
+
+-- ---------------------------------------------------------------------------
+-- Direct tenant_id tables: exact-tenant scope.
+-- ---------------------------------------------------------------------------
+
+-- config_entries
+ALTER TABLE config_entries ENABLE ROW LEVEL SECURITY;
+ALTER TABLE config_entries FORCE ROW LEVEL SECURITY;
+DROP POLICY IF EXISTS tenant_isolation ON config_entries;
+CREATE POLICY tenant_isolation ON config_entries FOR ALL
+  USING (
+    current_setting('app.bypass_rls', true) = 'on'
+    OR tenant_id = NULLIF(current_setting('app.current_tenant_id', true), '')::uuid
+  )
+  WITH CHECK (
+    current_setting('app.bypass_rls', true) = 'on'
+    OR tenant_id = NULLIF(current_setting('app.current_tenant_id', true), '')::uuid
+  );
+
+-- permission_policies
+ALTER TABLE permission_policies ENABLE ROW LEVEL SECURITY;
+ALTER TABLE permission_policies FORCE ROW LEVEL SECURITY;
+DROP POLICY IF EXISTS tenant_isolation ON permission_policies;
+CREATE POLICY tenant_isolation ON permission_policies FOR ALL
+  USING (
+    current_setting('app.bypass_rls', true) = 'on'
+    OR tenant_id = NULLIF(current_setting('app.current_tenant_id', true), '')::uuid
+  )
+  WITH CHECK (
+    current_setting('app.bypass_rls', true) = 'on'
+    OR tenant_id = NULLIF(current_setting('app.current_tenant_id', true), '')::uuid
+  );
+
+-- audit_logs (tenant_id nullable: ON DELETE SET NULL; NULL rows visible only under bypass)
+ALTER TABLE audit_logs ENABLE ROW LEVEL SECURITY;
+ALTER TABLE audit_logs FORCE ROW LEVEL SECURITY;
+DROP POLICY IF EXISTS tenant_isolation ON audit_logs;
+CREATE POLICY tenant_isolation ON audit_logs FOR ALL
+  USING (
+    current_setting('app.bypass_rls', true) = 'on'
+    OR tenant_id = NULLIF(current_setting('app.current_tenant_id', true), '')::uuid
+  )
+  WITH CHECK (
+    current_setting('app.bypass_rls', true) = 'on'
+    OR tenant_id = NULLIF(current_setting('app.current_tenant_id', true), '')::uuid
+  );
+
+-- webhook_events
+ALTER TABLE webhook_events ENABLE ROW LEVEL SECURITY;
+ALTER TABLE webhook_events FORCE ROW LEVEL SECURITY;
+DROP POLICY IF EXISTS tenant_isolation ON webhook_events;
+CREATE POLICY tenant_isolation ON webhook_events FOR ALL
+  USING (
+    current_setting('app.bypass_rls', true) = 'on'
+    OR tenant_id = NULLIF(current_setting('app.current_tenant_id', true), '')::uuid
+  )
+  WITH CHECK (
+    current_setting('app.bypass_rls', true) = 'on'
+    OR tenant_id = NULLIF(current_setting('app.current_tenant_id', true), '')::uuid
+  );
+
+-- webhooks (tenant_id nullable)
+ALTER TABLE webhooks ENABLE ROW LEVEL SECURITY;
+ALTER TABLE webhooks FORCE ROW LEVEL SECURITY;
+DROP POLICY IF EXISTS tenant_isolation ON webhooks;
+CREATE POLICY tenant_isolation ON webhooks FOR ALL
+  USING (
+    current_setting('app.bypass_rls', true) = 'on'
+    OR tenant_id = NULLIF(current_setting('app.current_tenant_id', true), '')::uuid
+  )
+  WITH CHECK (
+    current_setting('app.bypass_rls', true) = 'on'
+    OR tenant_id = NULLIF(current_setting('app.current_tenant_id', true), '')::uuid
+  );
+
+-- consent_records
+ALTER TABLE consent_records ENABLE ROW LEVEL SECURITY;
+ALTER TABLE consent_records FORCE ROW LEVEL SECURITY;
+DROP POLICY IF EXISTS tenant_isolation ON consent_records;
+CREATE POLICY tenant_isolation ON consent_records FOR ALL
+  USING (
+    current_setting('app.bypass_rls', true) = 'on'
+    OR tenant_id = NULLIF(current_setting('app.current_tenant_id', true), '')::uuid
+  )
+  WITH CHECK (
+    current_setting('app.bypass_rls', true) = 'on'
+    OR tenant_id = NULLIF(current_setting('app.current_tenant_id', true), '')::uuid
+  );
+
+-- abac_policies
+ALTER TABLE abac_policies ENABLE ROW LEVEL SECURITY;
+ALTER TABLE abac_policies FORCE ROW LEVEL SECURITY;
+DROP POLICY IF EXISTS tenant_isolation ON abac_policies;
+CREATE POLICY tenant_isolation ON abac_policies FOR ALL
+  USING (
+    current_setting('app.bypass_rls', true) = 'on'
+    OR tenant_id = NULLIF(current_setting('app.current_tenant_id', true), '')::uuid
+  )
+  WITH CHECK (
+    current_setting('app.bypass_rls', true) = 'on'
+    OR tenant_id = NULLIF(current_setting('app.current_tenant_id', true), '')::uuid
+  );
+
+-- api_keys (auth table; tenant_id nullable. Read by the control plane before a
+-- tenant context exists, so it is safe only because the control plane bypasses.
+-- Global keys (tenant_id NULL) are visible only under bypass.)
+ALTER TABLE api_keys ENABLE ROW LEVEL SECURITY;
+ALTER TABLE api_keys FORCE ROW LEVEL SECURITY;
+DROP POLICY IF EXISTS tenant_isolation ON api_keys;
+CREATE POLICY tenant_isolation ON api_keys FOR ALL
+  USING (
+    current_setting('app.bypass_rls', true) = 'on'
+    OR tenant_id = NULLIF(current_setting('app.current_tenant_id', true), '')::uuid
+  )
+  WITH CHECK (
+    current_setting('app.bypass_rls', true) = 'on'
+    OR tenant_id = NULLIF(current_setting('app.current_tenant_id', true), '')::uuid
+  );
+
+-- roles (auth table; tenant_id nullable for global roles, visible only under bypass)
+ALTER TABLE roles ENABLE ROW LEVEL SECURITY;
+ALTER TABLE roles FORCE ROW LEVEL SECURITY;
+DROP POLICY IF EXISTS tenant_isolation ON roles;
+CREATE POLICY tenant_isolation ON roles FOR ALL
+  USING (
+    current_setting('app.bypass_rls', true) = 'on'
+    OR tenant_id = NULLIF(current_setting('app.current_tenant_id', true), '')::uuid
+  )
+  WITH CHECK (
+    current_setting('app.bypass_rls', true) = 'on'
+    OR tenant_id = NULLIF(current_setting('app.current_tenant_id', true), '')::uuid
+  );
+
+-- ---------------------------------------------------------------------------
+-- tenants registry: self-scope on id. The ancestry source; no tenant_id column.
+-- A data-plane context reads only its own registry row and cannot enumerate the
+-- tree. All tree / ancestry mutations are control-plane and run under bypass.
+-- ---------------------------------------------------------------------------
+ALTER TABLE tenants ENABLE ROW LEVEL SECURITY;
+ALTER TABLE tenants FORCE ROW LEVEL SECURITY;
+DROP POLICY IF EXISTS tenant_isolation ON tenants;
+CREATE POLICY tenant_isolation ON tenants FOR ALL
+  USING (
+    current_setting('app.bypass_rls', true) = 'on'
+    OR id = NULLIF(current_setting('app.current_tenant_id', true), '')::uuid
+  )
+  WITH CHECK (
+    current_setting('app.bypass_rls', true) = 'on'
+    OR id = NULLIF(current_setting('app.current_tenant_id', true), '')::uuid
+  );
+
+-- ---------------------------------------------------------------------------
+-- Indirect tables (no tenant_id): scoped through their tenant-bearing parent.
+-- The parent subquery is itself RLS-filtered under a tenant context, which
+-- composes correctly. No policy recursion: neither parent references back.
+-- ---------------------------------------------------------------------------
+
+-- webhook_deliveries -> webhook_events.tenant_id
+ALTER TABLE webhook_deliveries ENABLE ROW LEVEL SECURITY;
+ALTER TABLE webhook_deliveries FORCE ROW LEVEL SECURITY;
+DROP POLICY IF EXISTS tenant_isolation ON webhook_deliveries;
+CREATE POLICY tenant_isolation ON webhook_deliveries FOR ALL
+  USING (
+    current_setting('app.bypass_rls', true) = 'on'
+    OR EXISTS (
+      SELECT 1 FROM webhook_events we
+      WHERE we.id = webhook_deliveries.event_id
+        AND we.tenant_id = NULLIF(current_setting('app.current_tenant_id', true), '')::uuid
+    )
+  )
+  WITH CHECK (
+    current_setting('app.bypass_rls', true) = 'on'
+    OR EXISTS (
+      SELECT 1 FROM webhook_events we
+      WHERE we.id = webhook_deliveries.event_id
+        AND we.tenant_id = NULLIF(current_setting('app.current_tenant_id', true), '')::uuid
+    )
+  );
+
+-- principal_roles -> roles.tenant_id (global-role assignments visible only under bypass)
+ALTER TABLE principal_roles ENABLE ROW LEVEL SECURITY;
+ALTER TABLE principal_roles FORCE ROW LEVEL SECURITY;
+DROP POLICY IF EXISTS tenant_isolation ON principal_roles;
+CREATE POLICY tenant_isolation ON principal_roles FOR ALL
+  USING (
+    current_setting('app.bypass_rls', true) = 'on'
+    OR EXISTS (
+      SELECT 1 FROM roles r
+      WHERE r.id = principal_roles.role_id
+        AND r.tenant_id = NULLIF(current_setting('app.current_tenant_id', true), '')::uuid
+    )
+  )
+  WITH CHECK (
+    current_setting('app.bypass_rls', true) = 'on'
+    OR EXISTS (
+      SELECT 1 FROM roles r
+      WHERE r.id = principal_roles.role_id
+        AND r.tenant_id = NULLIF(current_setting('app.current_tenant_id', true), '')::uuid
+    )
+  );
+
+-- ---------------------------------------------------------------------------
+-- Intentionally NOT protected (documented in the ADR):
+--   * regions       -- global infrastructure catalog, no tenant_id, not tenant-private
+--   * _migrations   -- internal migration bookkeeping
+-- ---------------------------------------------------------------------------

package/dist/pool-helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pool-helpers.d.ts","sourceRoot":"","sources":["../src/pool-helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AAEpB,wBAAsB,UAAU,CAAC,CAAC,EAChC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,GACxC,OAAO,CAAC,CAAC,CAAC,CAOZ;AAED,wBAAsB,eAAe,CAAC,CAAC,EACrC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,GACxC,OAAO,CAAC,CAAC,CAAC,CAaZ"}
+{"version":3,"file":"pool-helpers.d.ts","sourceRoot":"","sources":["../src/pool-helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AAyBpB,wBAAsB,UAAU,CAAC,CAAC,EAChC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,GACxC,OAAO,CAAC,CAAC,CAAC,CAcZ;AAED,wBAAsB,eAAe,CAAC,CAAC,EACrC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,GACxC,OAAO,CAAC,CAAC,CAAC,CAcZ"}

package/dist/pool-helpers.js

@@ -2,10 +2,39 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.withClient = withClient;
 exports.withTransaction = withTransaction;
+// The Stratum library is the trusted CONTROL PLANE: it manages the whole tenant
+// tree (authenticating keys before any tenant is known, resolving inherited
+// config up the ancestry chain, listing descendants, moving subtrees, cascade
+// ops). By construction it reads and writes across tenant boundaries, so it runs
+// under the RLS bypass.
+//
+// Both helpers open a transaction and issue `SET LOCAL app.bypass_rls = 'on'`
+// before running the caller's work. SET LOCAL (set_config third arg `true`) is
+// transaction scoped, so the flag cannot leak into a later request that reuses
+// the same pooled connection. Row-level security stays enforced on the separate
+// data-plane path (packages/db-adapters, withTenantContext); see
+// docs/adr/0001-postgres-rls-defense-in-depth.md.
+//
+// This is the single chokepoint for all lib database access: every service goes
+// through withClient / withTransaction, so no service function needs to change.
+async function enterBypass(client) {
+    // SET LOCAL (not session SET) so the flag is transaction scoped and cannot
+    // leak across pooled connections. Equivalent to
+    // set_config('app.bypass_rls', 'on', true).
+    await client.query("SET LOCAL app.bypass_rls = 'on'");
+}
 async function withClient(pool, fn) {
     const client = await pool.connect();
     try {
-        return await fn(client);
+        await client.query("BEGIN");
+        await enterBypass(client);
+        const result = await fn(client);
+        await client.query("COMMIT");
+        return result;
+    }
+    catch (err) {
+        await client.query("ROLLBACK");
+        throw err;
     }
     finally {
         client.release();
@@ -15,6 +44,7 @@ async function withTransaction(pool, fn) {
     const client = await pool.connect();
     try {
         await client.query("BEGIN");
+        await enterBypass(client);
         const result = await fn(client);
         await client.query("COMMIT");
         return result;

package/dist/pool-helpers.js.map

@@ -1 +1 @@
-{"version":3,"file":"pool-helpers.js","sourceRoot":"","sources":["../src/pool-helpers.ts"],"names":[],"mappings":";;AAEA,gCAUC;AAED,0CAgBC;AA5BM,KAAK,UAAU,UAAU,CAC9B,IAAa,EACb,EAAyC;IAEzC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;IACpC,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,eAAe,CACnC,IAAa,EACb,EAAyC;IAEzC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC;QAChC,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC/B,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;AACH,CAAC"}
+{"version":3,"file":"pool-helpers.js","sourceRoot":"","sources":["../src/pool-helpers.ts"],"names":[],"mappings":";;AAyBA,gCAiBC;AAED,0CAiBC;AA3DD,gFAAgF;AAChF,4EAA4E;AAC5E,8EAA8E;AAC9E,iFAAiF;AACjF,wBAAwB;AACxB,EAAE;AACF,8EAA8E;AAC9E,+EAA+E;AAC/E,+EAA+E;AAC/E,gFAAgF;AAChF,iEAAiE;AACjE,kDAAkD;AAClD,EAAE;AACF,gFAAgF;AAChF,gFAAgF;AAEhF,KAAK,UAAU,WAAW,CAAC,MAAqB;IAC9C,2EAA2E;IAC3E,gDAAgD;IAChD,4CAA4C;IAC5C,MAAM,MAAM,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;AACxD,CAAC;AAEM,KAAK,UAAU,UAAU,CAC9B,IAAa,EACb,EAAyC;IAEzC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5B,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC;QAChC,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC/B,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,eAAe,CACnC,IAAa,EACb,EAAyC;IAEzC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5B,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC;QAChC,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC/B,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/services/api-key-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-key-service.d.ts","sourceRoot":"","sources":["../../src/services/api-key-service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,IAAI,CAAC;AAGpB,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,UAAU,EAAE,IAAI,CAAC;IACjB,YAAY,EAAE,IAAI,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,UAAU,EAAE,IAAI,CAAC;IACjB,8DAA8D;IAC9D,aAAa,EAAE,MAAM,CAAC;CACvB;AAiCD,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAK7G;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAsB,YAAY,CAChC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,aAAa,CAAC,EAAE,MAAM,GAAG,mBAAmB,EAC5C,SAAS,CAAC,EAAE,IAAI,GACf,OAAO,CAAC,aAAa,CAAC,CAyBxB;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,wBAAsB,cAAc,CAClC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAoDjC;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQjF;AAED,wBAAsB,YAAY,CAChC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,aAAa,CAAC,CAqCxB;AAED,wBAAsB,WAAW,CAC/B,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,UAAU,EAAE,IAAI,CAAC;IAAC,YAAY,EAAE,IAAI,GAAG,IAAI,CAAC;IAAC,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IAAC,UAAU,EAAE,IAAI,GAAG,IAAI,CAAA;CAAE,CAAC,CAAC,CAgB9K;AAED;;;;GAIG;AACH,wBAAsB,SAAS,CAC7B,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,EAAE,EAAE,MAAM,GACT,OAAO,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,UAAU,EAAE,IAAI,CAAC;IAAC,YAAY,EAAE,IAAI,GAAG,IAAI,CAAC;IAAC,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IAAC,UAAU,EAAE,IAAI,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,CAAC,CAS9K;AAED,wBAAsB,eAAe,CACnC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,WAAW,GAAE,MAAW,GACvB,OAAO,CAAC,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,YAAY,EAAE,IAAI,GAAG,IAAI,CAAC;IAAC,UAAU,EAAE,IAAI,CAAA;CAAE,CAAC,CAAC,CAY5H"}
+{"version":3,"file":"api-key-service.d.ts","sourceRoot":"","sources":["../../src/services/api-key-service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,IAAI,CAAC;AAIpB,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,UAAU,EAAE,IAAI,CAAC;IACjB,YAAY,EAAE,IAAI,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,UAAU,EAAE,IAAI,CAAC;IACjB,8DAA8D;IAC9D,aAAa,EAAE,MAAM,CAAC;CACvB;AAiCD,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAK7G;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAsB,YAAY,CAChC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,aAAa,CAAC,EAAE,MAAM,GAAG,mBAAmB,EAC5C,SAAS,CAAC,EAAE,IAAI,GACf,OAAO,CAAC,aAAa,CAAC,CAyBxB;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,wBAAsB,cAAc,CAClC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAsDjC;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQjF;AAED,wBAAsB,YAAY,CAChC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,aAAa,CAAC,CAqCxB;AAED,wBAAsB,WAAW,CAC/B,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,UAAU,EAAE,IAAI,CAAC;IAAC,YAAY,EAAE,IAAI,GAAG,IAAI,CAAC;IAAC,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IAAC,UAAU,EAAE,IAAI,GAAG,IAAI,CAAA;CAAE,CAAC,CAAC,CAgB9K;AAED;;;;GAIG;AACH,wBAAsB,SAAS,CAC7B,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,EAAE,EAAE,MAAM,GACT,OAAO,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,UAAU,EAAE,IAAI,CAAC;IAAC,YAAY,EAAE,IAAI,GAAG,IAAI,CAAC;IAAC,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IAAC,UAAU,EAAE,IAAI,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,CAAC,CAS9K;AAED,wBAAsB,eAAe,CACnC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,WAAW,GAAE,MAAW,GACvB,OAAO,CAAC,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,YAAY,EAAE,IAAI,GAAG,IAAI,CAAC;IAAC,UAAU,EAAE,IAAI,CAAA;CAAE,CAAC,CAAC,CAY5H"}

package/dist/services/api-key-service.js

@@ -13,6 +13,7 @@ exports.getApiKey = getApiKey;
 exports.listDormantKeys = listDormantKeys;
 const node_crypto_1 = __importDefault(require("node:crypto"));
 const pool_helpers_js_1 = require("../pool-helpers.js");
+const role_service_js_1 = require("./role-service.js");
 // --- Hashing ---
 const HASH_V1_SHA256 = 1;
 const HASH_V2_HMAC = 2;
@@ -99,7 +100,9 @@ async function validateApiKey(pool, key) {
             return {
                 tenant_id: row.tenant_id,
                 key_id: row.id,
-                scopes: row.scopes ?? ["read"],
+                // Resolve through the single source so an assigned role governs the
+                // key's scopes at the auth boundary, exactly as resolveKeyScopes does.
+                scopes: await (0, role_service_js_1.resolveEffectiveScopes)(pool, row.id),
                 rate_limit_max: row.rate_limit_max,
                 rate_limit_window: row.rate_limit_window,
             };

package/dist/services/api-key-service.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-key-service.js","sourceRoot":"","sources":["../../src/services/api-key-service.ts"],"names":[],"mappings":";;;;;AA0DA,kCAKC;AASD,oCA+BC;AAUD,wCAuDC;AAED,oCAQC;AAED,oCA0CC;AAED,kCAmBC;AAOD,8BAYC;AAED,0CAeC;AAvRD,8DAAiC;AAEjC,wDAAiE;AAyBjE,kBAAkB;AAElB,MAAM,cAAc,GAAG,CAAC,CAAC;AACzB,MAAM,YAAY,GAAG,CAAC,CAAC;AAEvB,SAAS,aAAa;IACpB,OAAO,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC;AACjD,CAAC;AAED,gCAAgC;AAChC,SAAS,UAAU,CAAC,GAAW;IAC7B,OAAO,qBAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC/D,CAAC;AAED,mEAAmE;AACnE,SAAS,QAAQ,CAAC,GAAW,EAAE,MAAc;IAC3C,OAAO,qBAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACvE,CAAC;AAED;;;GAGG;AACH,SAAS,OAAO,CAAC,GAAW;IAC1B,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;IACvE,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC;AACnE,CAAC;AAED,SAAgB,WAAW,CAAC,SAAiB;IAC3C,MAAM,MAAM,GAAG,qBAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,GAAG,SAAS,GAAG,MAAM,EAAE,CAAC;IAC7C,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACvD,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;AAChD,CAAC;AASM,KAAK,UAAU,YAAY,CAChC,IAAa,EACb,SAAiB,EACjB,QAAgB,EAChB,aAA4C,EAC5C,SAAgB;IAEhB,sEAAsE;IACtE,MAAM,IAAI,GAAwB,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,KAAK,IAAI;QAC3F,CAAC,CAAC,aAAa;QACf,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC;IACvC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IAEtE,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;mBAEa,EACb,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI,EAAE,IAAI,CAAC,YAAY,IAAI,IAAI,EAAE,IAAI,CAAC,eAAe,IAAI,IAAI,EAAE,WAAW,CAAC,CAChJ,CAAC;QAEF,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxB,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,aAAa,EAAE,YAAY;SAC5B,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAUM,KAAK,UAAU,cAAc,CAClC,IAAa,EACb,GAAW;IAEX,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;IAEnC,mFAAmF;IACnF,MAAM,UAAU,GAA6C,EAAE,CAAC;IAChE,IAAI,UAAU,EAAE,CAAC;QACf,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC;IAEpE,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;iHACyG,EACzG,CAAC,SAAS,CAAC,IAAI,CAAC,CACjB,CAAC;YAEF,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YAEpC,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAExB,sFAAsF;YACtF,wDAAwD;YACxD,IAAI,GAAG,CAAC,YAAY,KAAK,cAAc,IAAI,UAAU,EAAE,CAAC;gBACtD,MAAM,YAAY,GAAG,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;gBAC/C,IAAI;qBACD,KAAK,CACJ,0FAA0F,EAC1F,CAAC,YAAY,EAAE,YAAY,EAAE,GAAG,CAAC,EAAE,CAAC,CACrC;qBACA,KAAK,CAAC,GAAG,EAAE;oBACV,oDAAoD;gBACtD,CAAC,CAAC,CAAC;YACP,CAAC;iBAAM,CAAC;gBACN,wCAAwC;gBACxC,IAAI;qBACD,KAAK,CAAC,wDAAwD,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;qBACzE,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACrB,CAAC;YAED,OAAO;gBACL,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,MAAM,EAAE,GAAG,CAAC,EAAE;gBACd,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC;gBAC9B,cAAc,EAAE,GAAG,CAAC,cAAc;gBAClC,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;aACzC,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,YAAY,CAAC,IAAa,EAAE,KAAa;IAC7D,OAAO,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,0FAA0F,EAC1F,CAAC,KAAK,CAAC,CACR,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,YAAY,CAChC,IAAa,EACb,SAAiB,EACjB,QAAgB,EAChB,OAAgB;IAEhB,OAAO,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,2CAA2C;QAC3C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAC/B,2FAA2F,EAC3F,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,yCAAyC,QAAQ,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAE3B,iCAAiC;QACjC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;QACtE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;6DAEuD,EACvD,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,KAAK,YAAY,EAAE,WAAW,CAAC,CAC9F,CAAC;QAEF,iBAAiB;QACjB,MAAM,MAAM,CAAC,KAAK,CAChB,sDAAsD,EACtD,CAAC,QAAQ,CAAC,CACX,CAAC;QAEF,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxB,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,aAAa,EAAE,YAAY;SAC5B,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,WAAW,CAC/B,IAAa,EACb,QAAiB;IAEjB,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;qEAC6D,EAC7D,CAAC,QAAQ,CAAC,CACX,CAAC;YACF,OAAO,GAAG,CAAC,IAAI,CAAC;QAClB,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;8CACwC,CACzC,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,SAAS,CAC7B,IAAa,EACb,EAAU;IAEV,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;mCAC6B,EAC7B,CAAC,EAAE,CAAC,CACL,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,eAAe,CACnC,IAAa,EACb,cAAsB,EAAE;IAExB,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;;;6CAIuC,EACvC,CAAC,WAAW,CAAC,CACd,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"api-key-service.js","sourceRoot":"","sources":["../../src/services/api-key-service.ts"],"names":[],"mappings":";;;;;AA2DA,kCAKC;AASD,oCA+BC;AAUD,wCAyDC;AAED,oCAQC;AAED,oCA0CC;AAED,kCAmBC;AAOD,8BAYC;AAED,0CAeC;AA1RD,8DAAiC;AAEjC,wDAAiE;AACjE,uDAA2D;AAyB3D,kBAAkB;AAElB,MAAM,cAAc,GAAG,CAAC,CAAC;AACzB,MAAM,YAAY,GAAG,CAAC,CAAC;AAEvB,SAAS,aAAa;IACpB,OAAO,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC;AACjD,CAAC;AAED,gCAAgC;AAChC,SAAS,UAAU,CAAC,GAAW;IAC7B,OAAO,qBAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC/D,CAAC;AAED,mEAAmE;AACnE,SAAS,QAAQ,CAAC,GAAW,EAAE,MAAc;IAC3C,OAAO,qBAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACvE,CAAC;AAED;;;GAGG;AACH,SAAS,OAAO,CAAC,GAAW;IAC1B,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;IACvE,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC;AACnE,CAAC;AAED,SAAgB,WAAW,CAAC,SAAiB;IAC3C,MAAM,MAAM,GAAG,qBAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,GAAG,SAAS,GAAG,MAAM,EAAE,CAAC;IAC7C,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACvD,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;AAChD,CAAC;AASM,KAAK,UAAU,YAAY,CAChC,IAAa,EACb,SAAiB,EACjB,QAAgB,EAChB,aAA4C,EAC5C,SAAgB;IAEhB,sEAAsE;IACtE,MAAM,IAAI,GAAwB,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,KAAK,IAAI;QAC3F,CAAC,CAAC,aAAa;QACf,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC;IACvC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IAEtE,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;mBAEa,EACb,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI,EAAE,IAAI,CAAC,YAAY,IAAI,IAAI,EAAE,IAAI,CAAC,eAAe,IAAI,IAAI,EAAE,WAAW,CAAC,CAChJ,CAAC;QAEF,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxB,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,aAAa,EAAE,YAAY;SAC5B,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAUM,KAAK,UAAU,cAAc,CAClC,IAAa,EACb,GAAW;IAEX,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;IAEnC,mFAAmF;IACnF,MAAM,UAAU,GAA6C,EAAE,CAAC;IAChE,IAAI,UAAU,EAAE,CAAC;QACf,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC;IAEpE,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;iHACyG,EACzG,CAAC,SAAS,CAAC,IAAI,CAAC,CACjB,CAAC;YAEF,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YAEpC,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAExB,sFAAsF;YACtF,wDAAwD;YACxD,IAAI,GAAG,CAAC,YAAY,KAAK,cAAc,IAAI,UAAU,EAAE,CAAC;gBACtD,MAAM,YAAY,GAAG,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;gBAC/C,IAAI;qBACD,KAAK,CACJ,0FAA0F,EAC1F,CAAC,YAAY,EAAE,YAAY,EAAE,GAAG,CAAC,EAAE,CAAC,CACrC;qBACA,KAAK,CAAC,GAAG,EAAE;oBACV,oDAAoD;gBACtD,CAAC,CAAC,CAAC;YACP,CAAC;iBAAM,CAAC;gBACN,wCAAwC;gBACxC,IAAI;qBACD,KAAK,CAAC,wDAAwD,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;qBACzE,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACrB,CAAC;YAED,OAAO;gBACL,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,MAAM,EAAE,GAAG,CAAC,EAAE;gBACd,oEAAoE;gBACpE,uEAAuE;gBACvE,MAAM,EAAE,MAAM,IAAA,wCAAsB,EAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;gBAClD,cAAc,EAAE,GAAG,CAAC,cAAc;gBAClC,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;aACzC,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,YAAY,CAAC,IAAa,EAAE,KAAa;IAC7D,OAAO,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,0FAA0F,EAC1F,CAAC,KAAK,CAAC,CACR,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,YAAY,CAChC,IAAa,EACb,SAAiB,EACjB,QAAgB,EAChB,OAAgB;IAEhB,OAAO,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,2CAA2C;QAC3C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAC/B,2FAA2F,EAC3F,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,yCAAyC,QAAQ,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAE3B,iCAAiC;QACjC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;QACtE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;6DAEuD,EACvD,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,KAAK,YAAY,EAAE,WAAW,CAAC,CAC9F,CAAC;QAEF,iBAAiB;QACjB,MAAM,MAAM,CAAC,KAAK,CAChB,sDAAsD,EACtD,CAAC,QAAQ,CAAC,CACX,CAAC;QAEF,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxB,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,aAAa,EAAE,YAAY;SAC5B,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,WAAW,CAC/B,IAAa,EACb,QAAiB;IAEjB,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;qEAC6D,EAC7D,CAAC,QAAQ,CAAC,CACX,CAAC;YACF,OAAO,GAAG,CAAC,IAAI,CAAC;QAClB,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;8CACwC,CACzC,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,SAAS,CAC7B,IAAa,EACb,EAAU;IAEV,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;mCAC6B,EAC7B,CAAC,EAAE,CAAC,CACL,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,eAAe,CACnC,IAAa,EACb,cAAsB,EAAE;IAExB,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;;;6CAIuC,EACvC,CAAC,WAAW,CAAC,CACd,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/services/config-service.js

@@ -54,7 +54,7 @@ async function resolveConfig(pool, tenantId) {
                 }
                 const isCurrentTenant = currentTenantId === tenantId;
                 const resolvedValue = entry.sensitive
-                    ? JSON.parse((0, crypto_js_1.decrypt)(JSON.parse(entry.value)))
+                    ? JSON.parse((0, crypto_js_1.decrypt)(entry.value))
                     : entry.value;
                 resolved.set(entry.key, {
                     key: entry.key,
@@ -229,7 +229,7 @@ async function getConfigWithInheritance(pool, tenantId) {
             }
         }
         const decryptEntryValue = (entry) => entry.sensitive
-            ? JSON.parse((0, crypto_js_1.decrypt)(JSON.parse(entry.value)))
+            ? JSON.parse((0, crypto_js_1.decrypt)(entry.value))
             : entry.value;
         const result = {};
         for (const [key, rec] of byKey) {

package/dist/services/config-service.js.map

@@ -1 +1 @@
-{"version":3,"file":"config-service.js","sourceRoot":"","sources":["../../src/services/config-service.ts"],"names":[],"mappings":";;AAqBA,sCAyEC;AAMD,8BAsDC;AAOD,wCA2EC;AAKD,oCAcC;AAMD,4DA6GC;AAjXD,wDAAiE;AACjE,2CAY0B;AAC1B,4CAAgD;AAEhD;;;GAGG;AACI,KAAK,UAAU,aAAa,CAAC,IAAa,EAAE,QAAgB;IACjE,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAClC,0EAA0E,EAC1E,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,wCAAwC;YACxC,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,KAAK,CACpC,sCAAsC,EACtC,CAAC,QAAQ,CAAC,CACX,CAAC;YACF,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAChC,MAAM,IAAI,0BAAmB,CAAC,QAAQ,CAAC,CAAC;YAC1C,CAAC;YACD,MAAM,IAAI,0BAAmB,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,YAAY,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;QACrD,MAAM,WAAW,GAAG,IAAA,wBAAiB,EAAC,YAAY,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,CAAC,GAAG,WAAW,EAAE,QAAQ,CAAC,CAAC;QAE1C,qEAAqE;QACrE,oGAAoG;QACpG,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,KAAK,CACnC;;+DAEyD,EACzD,CAAC,MAAM,CAAC,CACT,CAAC;QAEF,sCAAsC;QACtC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAyB,CAAC;QAClD,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;YACxB,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACvB,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC;YACpC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC3C,IAAI,IAAI,EAAE,CAAC;gBACT,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;QAED,qEAAqE;QACrE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA+B,CAAC;QAExD,KAAK,MAAM,eAAe,IAAI,MAAM,EAAE,CAAC;YACrC,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;YAEpD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAEzC,IAAI,QAAQ,EAAE,MAAM,EAAE,CAAC;oBACrB,sDAAsD;oBACtD,SAAS;gBACX,CAAC;gBAED,MAAM,eAAe,GAAG,eAAe,KAAK,QAAQ,CAAC;gBACrD,MAAM,aAAa,GAAG,KAAK,CAAC,SAAS;oBACnC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAe,CAAW,CAAC,CAAC;oBAClE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;gBAChB,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE;oBACtB,GAAG,EAAE,KAAK,CAAC,GAAG;oBACd,KAAK,EAAE,aAAa;oBACpB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;oBACxC,SAAS,EAAE,CAAC,eAAe;oBAC3B,MAAM,EAAE,KAAK,CAAC,MAAM;iBACrB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,SAAS,CAC7B,IAAa,EACb,QAAgB,EAChB,GAAW,EACX,KAAqB;IAErB,OAAO,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAClC,iDAAiD,EACjD,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,0BAAmB,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,WAAW,GAAG,IAAA,wBAAiB,EAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QACvE,sDAAsD;QACtD,kFAAkF;QAClF,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAClC;;;;;sCAK8B,EAC9B,CAAC,WAAW,EAAE,GAAG,CAAC,CACnB,CAAC;YACF,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9B,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACjC,MAAM,IAAI,wBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC;QAC3C,MAAM,WAAW,GAAG,SAAS;YAC3B,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;YACtD,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAEhC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;;;;;;;mBAQa,EACb,CAAC,QAAQ,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,IAAI,KAAK,EAAE,SAAS,CAAC,CAC/D,CAAC;QAEF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,cAAc,CAClC,IAAa,EACb,QAAgB,EAChB,OAAsF;IAEtF,OAAO,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAClC,iDAAiD,EACjD,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,0BAAmB,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,WAAW,GAAG,IAAA,wBAAiB,EAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QACvE,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAEvC,kDAAkD;QAClD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC7C,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9C,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAClC;;;6BAGqB,EACrB,CAAC,WAAW,EAAE,IAAI,CAAC,CACpB,CAAC;YACF,KAAK,MAAM,GAAG,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC;gBACjC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,gBAAgB,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAA8B,EAAE,CAAC;QAC9C,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,IAAI,MAAM,GAAG,CAAC,CAAC;QAEf,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,cAAc,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACjD,IAAI,cAAc,EAAE,CAAC;gBACnB,OAAO,CAAC,IAAI,CAAC;oBACX,GAAG,EAAE,KAAK,CAAC,GAAG;oBACd,MAAM,EAAE,OAAO;oBACf,KAAK,EAAE,WAAW,KAAK,CAAC,GAAG,yBAAyB,cAAc,2BAA2B;iBAC9F,CAAC,CAAC;gBACH,MAAM,EAAE,CAAC;gBACT,SAAS;YACX,CAAC;YAED,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC;YAC3C,MAAM,WAAW,GAAG,SAAS;gBAC3B,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;gBACtD,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAEhC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;;;;;;;qBAQa,EACb,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,IAAI,KAAK,EAAE,SAAS,CAAC,CACrE,CAAC;YACF,OAAO,CAAC,IAAI,CAAC;gBACX,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,MAAM,EAAE,IAAI;gBACZ,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;aACnB,CAAC,CAAC;YACH,SAAS,EAAE,CAAC;QACd,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,YAAY,CAChC,IAAa,EACb,QAAgB,EAChB,GAAW;IAEX,OAAO,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,8DAA8D,EAC9D,CAAC,QAAQ,EAAE,GAAG,CAAC,CAChB,CAAC;QACF,IAAI,GAAG,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,0BAAmB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,wBAAwB,CAC5C,IAAa,EACb,QAAgB;IAEhB,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAClC,iDAAiD,EACjD,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,0BAAmB,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,YAAY,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;QACrD,MAAM,WAAW,GAAG,IAAA,wBAAiB,EAAC,YAAY,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,CAAC,GAAG,WAAW,EAAE,QAAQ,CAAC,CAAC;QAE1C,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,KAAK,CACnC,wDAAwD,EACxD,CAAC,MAAM,CAAC,CACT,CAAC;QAEF,mDAAmD;QACnD,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAyB,CAAC;QAC3D,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC;YACpC,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;YAC1D,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjB,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC/C,CAAC;QAED,mDAAmD;QACnD,MAAM,KAAK,GAAG,IAAI,GAAG,EAOlB,CAAC;QAEJ,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;YAChD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC1B,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE;wBACnB,aAAa,EAAE,IAAI;wBACnB,WAAW,EAAE,IAAI;wBACjB,QAAQ,EAAE,IAAI;qBACf,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAE,CAAC;gBAElC,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;oBACpB,GAAG,CAAC,WAAW,GAAG,KAAK,CAAC;gBAC1B,CAAC;qBAAM,CAAC;oBACN,8EAA8E;oBAC9E,GAAG,CAAC,aAAa,GAAG,KAAK,CAAC;oBAC1B,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;wBAClC,gEAAgE;wBAChE,GAAG,CAAC,QAAQ,GAAG,KAAK,CAAC;oBACvB,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,iBAAiB,GAAG,CAAC,KAAkB,EAAW,EAAE,CACxD,KAAK,CAAC,SAAS;YACb,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAe,CAAW,CAAC,CAAC;YAClE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;QAElB,MAAM,MAAM,GAAmB,EAAE,CAAC;QAElC,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,KAAK,EAAE,CAAC;YAC/B,MAAM,WAAW,GAAG,GAAG,CAAC,QAAQ,CAAC;YACjC,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,CAAC;YACpC,MAAM,aAAa,GAAG,GAAG,CAAC,aAAa,CAAC;YAExC,IAAI,WAAW,EAAE,CAAC;gBAChB,6EAA6E;gBAC7E,MAAM,CAAC,GAAG,CAAC,GAAG;oBACZ,GAAG;oBACH,KAAK,EAAE,iBAAiB,CAAC,WAAW,CAAC;oBACrC,gBAAgB,EAAE,WAAW,CAAC,gBAAgB;oBAC9C,SAAS,EAAE,IAAI;oBACf,MAAM,EAAE,IAAI;iBACb,CAAC;YACJ,CAAC;iBAAM,IAAI,WAAW,EAAE,CAAC;gBACvB,mDAAmD;gBACnD,MAAM,CAAC,GAAG,CAAC,GAAG;oBACZ,GAAG;oBACH,KAAK,EAAE,iBAAiB,CAAC,WAAW,CAAC;oBACrC,gBAAgB,EAAE,WAAW,CAAC,gBAAgB;oBAC9C,SAAS,EAAE,KAAK;oBAChB,MAAM,EAAE,WAAW,CAAC,MAAM;iBAC3B,CAAC;YACJ,CAAC;iBAAM,IAAI,aAAa,EAAE,CAAC;gBACzB,0BAA0B;gBAC1B,MAAM,CAAC,GAAG,CAAC,GAAG;oBACZ,GAAG;oBACH,KAAK,EAAE,iBAAiB,CAAC,aAAa,CAAC;oBACvC,gBAAgB,EAAE,aAAa,CAAC,gBAAgB;oBAChD,SAAS,EAAE,IAAI;oBACf,MAAM,EAAE,aAAa,CAAC,MAAM;iBAC7B,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"config-service.js","sourceRoot":"","sources":["../../src/services/config-service.ts"],"names":[],"mappings":";;AAqBA,sCAyEC;AAMD,8BAsDC;AAOD,wCA2EC;AAKD,oCAcC;AAMD,4DA6GC;AAjXD,wDAAiE;AACjE,2CAY0B;AAC1B,4CAAgD;AAEhD;;;GAGG;AACI,KAAK,UAAU,aAAa,CAAC,IAAa,EAAE,QAAgB;IACjE,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAClC,0EAA0E,EAC1E,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,wCAAwC;YACxC,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,KAAK,CACpC,sCAAsC,EACtC,CAAC,QAAQ,CAAC,CACX,CAAC;YACF,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAChC,MAAM,IAAI,0BAAmB,CAAC,QAAQ,CAAC,CAAC;YAC1C,CAAC;YACD,MAAM,IAAI,0BAAmB,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,YAAY,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;QACrD,MAAM,WAAW,GAAG,IAAA,wBAAiB,EAAC,YAAY,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,CAAC,GAAG,WAAW,EAAE,QAAQ,CAAC,CAAC;QAE1C,qEAAqE;QACrE,oGAAoG;QACpG,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,KAAK,CACnC;;+DAEyD,EACzD,CAAC,MAAM,CAAC,CACT,CAAC;QAEF,sCAAsC;QACtC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAyB,CAAC;QAClD,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;YACxB,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACvB,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC;YACpC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC3C,IAAI,IAAI,EAAE,CAAC;gBACT,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;QAED,qEAAqE;QACrE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA+B,CAAC;QAExD,KAAK,MAAM,eAAe,IAAI,MAAM,EAAE,CAAC;YACrC,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;YAEpD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAEzC,IAAI,QAAQ,EAAE,MAAM,EAAE,CAAC;oBACrB,sDAAsD;oBACtD,SAAS;gBACX,CAAC;gBAED,MAAM,eAAe,GAAG,eAAe,KAAK,QAAQ,CAAC;gBACrD,MAAM,aAAa,GAAG,KAAK,CAAC,SAAS;oBACnC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAA,mBAAO,EAAC,KAAK,CAAC,KAAe,CAAC,CAAC;oBAC5C,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;gBAChB,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE;oBACtB,GAAG,EAAE,KAAK,CAAC,GAAG;oBACd,KAAK,EAAE,aAAa;oBACpB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;oBACxC,SAAS,EAAE,CAAC,eAAe;oBAC3B,MAAM,EAAE,KAAK,CAAC,MAAM;iBACrB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,SAAS,CAC7B,IAAa,EACb,QAAgB,EAChB,GAAW,EACX,KAAqB;IAErB,OAAO,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAClC,iDAAiD,EACjD,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,0BAAmB,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,WAAW,GAAG,IAAA,wBAAiB,EAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QACvE,sDAAsD;QACtD,kFAAkF;QAClF,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAClC;;;;;sCAK8B,EAC9B,CAAC,WAAW,EAAE,GAAG,CAAC,CACnB,CAAC;YACF,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9B,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACjC,MAAM,IAAI,wBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC;QAC3C,MAAM,WAAW,GAAG,SAAS;YAC3B,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;YACtD,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAEhC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;;;;;;;mBAQa,EACb,CAAC,QAAQ,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,IAAI,KAAK,EAAE,SAAS,CAAC,CAC/D,CAAC;QAEF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,cAAc,CAClC,IAAa,EACb,QAAgB,EAChB,OAAsF;IAEtF,OAAO,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAClC,iDAAiD,EACjD,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,0BAAmB,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,WAAW,GAAG,IAAA,wBAAiB,EAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QACvE,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAEvC,kDAAkD;QAClD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC7C,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9C,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAClC;;;6BAGqB,EACrB,CAAC,WAAW,EAAE,IAAI,CAAC,CACpB,CAAC;YACF,KAAK,MAAM,GAAG,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC;gBACjC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,gBAAgB,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAA8B,EAAE,CAAC;QAC9C,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,IAAI,MAAM,GAAG,CAAC,CAAC;QAEf,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,cAAc,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACjD,IAAI,cAAc,EAAE,CAAC;gBACnB,OAAO,CAAC,IAAI,CAAC;oBACX,GAAG,EAAE,KAAK,CAAC,GAAG;oBACd,MAAM,EAAE,OAAO;oBACf,KAAK,EAAE,WAAW,KAAK,CAAC,GAAG,yBAAyB,cAAc,2BAA2B;iBAC9F,CAAC,CAAC;gBACH,MAAM,EAAE,CAAC;gBACT,SAAS;YACX,CAAC;YAED,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC;YAC3C,MAAM,WAAW,GAAG,SAAS;gBAC3B,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;gBACtD,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAEhC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;;;;;;;qBAQa,EACb,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,IAAI,KAAK,EAAE,SAAS,CAAC,CACrE,CAAC;YACF,OAAO,CAAC,IAAI,CAAC;gBACX,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,MAAM,EAAE,IAAI;gBACZ,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;aACnB,CAAC,CAAC;YACH,SAAS,EAAE,CAAC;QACd,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,YAAY,CAChC,IAAa,EACb,QAAgB,EAChB,GAAW;IAEX,OAAO,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,8DAA8D,EAC9D,CAAC,QAAQ,EAAE,GAAG,CAAC,CAChB,CAAC;QACF,IAAI,GAAG,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,0BAAmB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,wBAAwB,CAC5C,IAAa,EACb,QAAgB;IAEhB,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAClC,iDAAiD,EACjD,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,0BAAmB,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,YAAY,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;QACrD,MAAM,WAAW,GAAG,IAAA,wBAAiB,EAAC,YAAY,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,CAAC,GAAG,WAAW,EAAE,QAAQ,CAAC,CAAC;QAE1C,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,KAAK,CACnC,wDAAwD,EACxD,CAAC,MAAM,CAAC,CACT,CAAC;QAEF,mDAAmD;QACnD,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAyB,CAAC;QAC3D,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC;YACpC,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;YAC1D,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjB,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC/C,CAAC;QAED,mDAAmD;QACnD,MAAM,KAAK,GAAG,IAAI,GAAG,EAOlB,CAAC;QAEJ,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;YAChD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC1B,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE;wBACnB,aAAa,EAAE,IAAI;wBACnB,WAAW,EAAE,IAAI;wBACjB,QAAQ,EAAE,IAAI;qBACf,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAE,CAAC;gBAElC,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;oBACpB,GAAG,CAAC,WAAW,GAAG,KAAK,CAAC;gBAC1B,CAAC;qBAAM,CAAC;oBACN,8EAA8E;oBAC9E,GAAG,CAAC,aAAa,GAAG,KAAK,CAAC;oBAC1B,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;wBAClC,gEAAgE;wBAChE,GAAG,CAAC,QAAQ,GAAG,KAAK,CAAC;oBACvB,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,iBAAiB,GAAG,CAAC,KAAkB,EAAW,EAAE,CACxD,KAAK,CAAC,SAAS;YACb,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAA,mBAAO,EAAC,KAAK,CAAC,KAAe,CAAC,CAAC;YAC5C,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;QAElB,MAAM,MAAM,GAAmB,EAAE,CAAC;QAElC,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,KAAK,EAAE,CAAC;YAC/B,MAAM,WAAW,GAAG,GAAG,CAAC,QAAQ,CAAC;YACjC,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,CAAC;YACpC,MAAM,aAAa,GAAG,GAAG,CAAC,aAAa,CAAC;YAExC,IAAI,WAAW,EAAE,CAAC;gBAChB,6EAA6E;gBAC7E,MAAM,CAAC,GAAG,CAAC,GAAG;oBACZ,GAAG;oBACH,KAAK,EAAE,iBAAiB,CAAC,WAAW,CAAC;oBACrC,gBAAgB,EAAE,WAAW,CAAC,gBAAgB;oBAC9C,SAAS,EAAE,IAAI;oBACf,MAAM,EAAE,IAAI;iBACb,CAAC;YACJ,CAAC;iBAAM,IAAI,WAAW,EAAE,CAAC;gBACvB,mDAAmD;gBACnD,MAAM,CAAC,GAAG,CAAC,GAAG;oBACZ,GAAG;oBACH,KAAK,EAAE,iBAAiB,CAAC,WAAW,CAAC;oBACrC,gBAAgB,EAAE,WAAW,CAAC,gBAAgB;oBAC9C,SAAS,EAAE,KAAK;oBAChB,MAAM,EAAE,WAAW,CAAC,MAAM;iBAC3B,CAAC;YACJ,CAAC;iBAAM,IAAI,aAAa,EAAE,CAAC;gBACzB,0BAA0B;gBAC1B,MAAM,CAAC,GAAG,CAAC,GAAG;oBACZ,GAAG;oBACH,KAAK,EAAE,iBAAiB,CAAC,aAAa,CAAC;oBACvC,gBAAgB,EAAE,aAAa,CAAC,gBAAgB;oBAChD,SAAS,EAAE,IAAI;oBACf,MAAM,EAAE,aAAa,CAAC,MAAM;iBAC7B,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/services/key-rotation-service.js

@@ -27,7 +27,7 @@ async function rotateEncryptionKey(pool, oldKeyMaterial, newKeyMaterial, batchSi
             if (batch.rows.length === 0)
                 return 0;
             for (const row of batch.rows) {
-                const encryptedBlob = JSON.parse(row.value);
+                const encryptedBlob = row.value;
                 const reEncrypted = (0, crypto_js_1.reEncrypt)(encryptedBlob, oldKeyMaterial, newKeyMaterial);
                 await client.query(`UPDATE config_entries SET value = $1, updated_at = now() WHERE id = $2`, [JSON.stringify(reEncrypted), row.id]);
             }

package/dist/services/key-rotation-service.js.map

@@ -1 +1 @@
-{"version":3,"file":"key-rotation-service.js","sourceRoot":"","sources":["../../src/services/key-rotation-service.ts"],"names":[],"mappings":";;AAqBA,kDA6DC;AAjFD,wDAAqD;AACrD,4CAAyC;AAOzC,+EAA+E;AAC/E,MAAM,SAAS,GAAG,sCAAsC,CAAC;AAEzD;;;;;;;;GAQG;AACI,KAAK,UAAU,mBAAmB,CACvC,IAAa,EACb,cAAsB,EACtB,cAAsB,EACtB,YAAoB,GAAG;IAEvB,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,YAAY,GAAG,CAAC,CAAC;IAErB,sEAAsE;IACtE,IAAI,YAAY,GAAG,SAAS,CAAC;IAC7B,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,KAAK,GAAG,MAAM,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACzD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,CAC9B;;yCAEiC,EACjC,CAAC,YAAY,EAAE,SAAS,CAAC,CAC1B,CAAC;YACF,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,CAAC,CAAC;YACtC,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;gBAC7B,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAW,CAAC;gBACtD,MAAM,WAAW,GAAG,IAAA,qBAAS,EAAC,aAAa,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC;gBAC7E,MAAM,MAAM,CAAC,KAAK,CAChB,wEAAwE,EACxE,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CACtC,CAAC;YACJ,CAAC;YACD,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACpD,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;QAC3B,CAAC,CAAC,CAAC;QACH,WAAW,IAAI,KAAK,CAAC;QACrB,IAAI,KAAK,GAAG,SAAS;YAAE,MAAM;IAC/B,CAAC;IAED,gEAAgE;IAChE,IAAI,aAAa,GAAG,SAAS,CAAC;IAC9B,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,KAAK,GAAG,MAAM,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACzD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,CAC9B;;yCAEiC,EACjC,CAAC,aAAa,EAAE,SAAS,CAAC,CAC3B,CAAC;YACF,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,CAAC,CAAC;YACtC,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;gBAC7B,MAAM,WAAW,GAAG,IAAA,qBAAS,EAAC,GAAG,CAAC,WAAW,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC;gBAC/E,MAAM,MAAM,CAAC,KAAK,CAChB,oDAAoD,EACpD,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC,CACtB,CAAC;YACJ,CAAC;YACD,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;QAC3B,CAAC,CAAC,CAAC;QACH,YAAY,IAAI,KAAK,CAAC;QACtB,IAAI,KAAK,GAAG,SAAS;YAAE,MAAM;IAC/B,CAAC;IAED,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE,gBAAgB,EAAE,YAAY,EAAE,CAAC;AACjF,CAAC"}
+{"version":3,"file":"key-rotation-service.js","sourceRoot":"","sources":["../../src/services/key-rotation-service.ts"],"names":[],"mappings":";;AAqBA,kDA6DC;AAjFD,wDAAqD;AACrD,4CAAyC;AAOzC,+EAA+E;AAC/E,MAAM,SAAS,GAAG,sCAAsC,CAAC;AAEzD;;;;;;;;GAQG;AACI,KAAK,UAAU,mBAAmB,CACvC,IAAa,EACb,cAAsB,EACtB,cAAsB,EACtB,YAAoB,GAAG;IAEvB,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,YAAY,GAAG,CAAC,CAAC;IAErB,sEAAsE;IACtE,IAAI,YAAY,GAAG,SAAS,CAAC;IAC7B,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,KAAK,GAAG,MAAM,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACzD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,CAC9B;;yCAEiC,EACjC,CAAC,YAAY,EAAE,SAAS,CAAC,CAC1B,CAAC;YACF,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,CAAC,CAAC;YACtC,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;gBAC7B,MAAM,aAAa,GAAG,GAAG,CAAC,KAAK,CAAC;gBAChC,MAAM,WAAW,GAAG,IAAA,qBAAS,EAAC,aAAa,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC;gBAC7E,MAAM,MAAM,CAAC,KAAK,CAChB,wEAAwE,EACxE,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CACtC,CAAC;YACJ,CAAC;YACD,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACpD,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;QAC3B,CAAC,CAAC,CAAC;QACH,WAAW,IAAI,KAAK,CAAC;QACrB,IAAI,KAAK,GAAG,SAAS;YAAE,MAAM;IAC/B,CAAC;IAED,gEAAgE;IAChE,IAAI,aAAa,GAAG,SAAS,CAAC;IAC9B,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,KAAK,GAAG,MAAM,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACzD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,CAC9B;;yCAEiC,EACjC,CAAC,aAAa,EAAE,SAAS,CAAC,CAC3B,CAAC;YACF,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,CAAC,CAAC;YACtC,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;gBAC7B,MAAM,WAAW,GAAG,IAAA,qBAAS,EAAC,GAAG,CAAC,WAAW,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC;gBAC/E,MAAM,MAAM,CAAC,KAAK,CAChB,oDAAoD,EACpD,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC,CACtB,CAAC;YACJ,CAAC;YACD,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;QAC3B,CAAC,CAAC,CAAC;QACH,YAAY,IAAI,KAAK,CAAC;QACtB,IAAI,KAAK,GAAG,SAAS;YAAE,MAAM;IAC/B,CAAC;IAED,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE,gBAAgB,EAAE,YAAY,EAAE,CAAC;AACjF,CAAC"}

package/dist/services/role-service.d.ts

@@ -27,9 +27,19 @@ export declare function deleteRole(pool: pg.Pool, id: string): Promise<boolean>;
 export declare function assignRoleToKey(pool: pg.Pool, keyId: string, roleId: string): Promise<boolean>;
 export declare function removeRoleFromKey(pool: pg.Pool, keyId: string): Promise<boolean>;
 /**
- * Resolve effective scopes for an API key.
- * If the key has a role, the role's scopes take precedence.
- * Otherwise, falls back to the key's own scopes.
+ * Resolve the effective scopes for an API key — the single source of truth for
+ * what a key is authorized to do. When a role is assigned to the key, the role's
+ * scopes govern; otherwise the key's own column scopes apply; a key with neither
+ * (or no such key) defaults to ["read"].
+ *
+ * Both the auth boundary (`validateApiKey`) and `resolveKeyScopes` resolve scopes
+ * through this function so a key authorizes identically no matter which path
+ * asks. Assigning a role therefore governs authorization everywhere.
+ */
+export declare function resolveEffectiveScopes(pool: pg.Pool, keyId: string): Promise<string[]>;
+/**
+ * Resolve effective scopes for an API key. Thin alias over
+ * {@link resolveEffectiveScopes}, kept as the public facade name.
  */
 export declare function resolveKeyScopes(pool: pg.Pool, keyId: string): Promise<string[]>;
 /**

package/dist/services/role-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role-service.d.ts","sourceRoot":"","sources":["../../src/services/role-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AAGpB,MAAM,WAAW,IAAI;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,IAAI,CAAC;IACjB,UAAU,EAAE,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,wBAAsB,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAUrF;AAED,wBAAsB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAQ7E;AAED,wBAAsB,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAcjF;AAED,wBAAsB,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAoCxG;AAED,wBAAsB,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQ5E;AAED,wBAAsB,eAAe,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQpG;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQtF;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CActF;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,UAAU,CAC9B,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,CAAC,CAiBlB;AAED,6EAA6E;AAC7E,wBAAsB,UAAU,CAC9B,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,OAAO,CAAC,CAUlB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,EAAE,CAAC,CAanB"}
+{"version":3,"file":"role-service.d.ts","sourceRoot":"","sources":["../../src/services/role-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AAGpB,MAAM,WAAW,IAAI;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,IAAI,CAAC;IACjB,UAAU,EAAE,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,wBAAsB,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAUrF;AAED,wBAAsB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAQ7E;AAED,wBAAsB,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAcjF;AAED,wBAAsB,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAoCxG;AAED,wBAAsB,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQ5E;AAED,wBAAsB,eAAe,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQpG;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQtF;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAc5F;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAEhF;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,UAAU,CAC9B,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,CAAC,CAiBlB;AAED,6EAA6E;AAC7E,wBAAsB,UAAU,CAC9B,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,OAAO,CAAC,CAUlB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,EAAE,CAAC,CAanB"}

package/dist/services/role-service.js

@@ -7,6 +7,7 @@ exports.updateRole = updateRole;
 exports.deleteRole = deleteRole;
 exports.assignRoleToKey = assignRoleToKey;
 exports.removeRoleFromKey = removeRoleFromKey;
+exports.resolveEffectiveScopes = resolveEffectiveScopes;
 exports.resolveKeyScopes = resolveKeyScopes;
 exports.assignRole = assignRole;
 exports.removeRole = removeRole;
@@ -83,11 +84,16 @@ async function removeRoleFromKey(pool, keyId) {
     });
 }
 /**
- * Resolve effective scopes for an API key.
- * If the key has a role, the role's scopes take precedence.
- * Otherwise, falls back to the key's own scopes.
+ * Resolve the effective scopes for an API key — the single source of truth for
+ * what a key is authorized to do. When a role is assigned to the key, the role's
+ * scopes govern; otherwise the key's own column scopes apply; a key with neither
+ * (or no such key) defaults to ["read"].
+ *
+ * Both the auth boundary (`validateApiKey`) and `resolveKeyScopes` resolve scopes
+ * through this function so a key authorizes identically no matter which path
+ * asks. Assigning a role therefore governs authorization everywhere.
  */
-async function resolveKeyScopes(pool, keyId) {
+async function resolveEffectiveScopes(pool, keyId) {
     return (0, pool_helpers_js_1.withClient)(pool, async (client) => {
         const res = await client.query(`SELECT ak.scopes, r.scopes as role_scopes
        FROM api_keys ak
@@ -96,10 +102,17 @@ async function resolveKeyScopes(pool, keyId) {
         if (res.rows.length === 0)
             return ["read"];
         const row = res.rows[0];
-        // Role scopes override key scopes when a role is assigned
+        // Role scopes override key scopes when a role is assigned.
         return row.role_scopes ?? row.scopes ?? ["read"];
     });
 }
+/**
+ * Resolve effective scopes for an API key. Thin alias over
+ * {@link resolveEffectiveScopes}, kept as the public facade name.
+ */
+function resolveKeyScopes(pool, keyId) {
+    return resolveEffectiveScopes(pool, keyId);
+}
 /**
  * Assign a role to any principal (an application user, a service account, an
  * API key, etc.), keyed by an application-defined (type, id) pair. One role per