@stratum-hq/lib 1.4.0 → 1.6.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/crypto.d.ts +9 -6
- package/dist/crypto.d.ts.map +1 -1
- package/dist/crypto.js +43 -26
- package/dist/crypto.js.map +1 -1
- package/dist/index.d.ts +1 -1
- package/dist/index.d.ts.map +1 -1
- package/dist/migrations/029_tenant_parent_cycle_guard.sql +62 -0
- package/dist/migrations/030_redact_url_credentials_audit.sql +112 -0
- package/dist/services/abac-service.d.ts.map +1 -1
- package/dist/services/abac-service.js +2 -5
- package/dist/services/abac-service.js.map +1 -1
- package/dist/services/api-key-service.d.ts.map +1 -1
- package/dist/services/api-key-service.js +18 -0
- package/dist/services/api-key-service.js.map +1 -1
- package/dist/services/config-service.d.ts.map +1 -1
- package/dist/services/config-service.js +5 -10
- package/dist/services/config-service.js.map +1 -1
- package/dist/services/consent-service.d.ts.map +1 -1
- package/dist/services/consent-service.js +2 -0
- package/dist/services/consent-service.js.map +1 -1
- package/dist/services/event-service.d.ts.map +1 -1
- package/dist/services/event-service.js +3 -2
- package/dist/services/event-service.js.map +1 -1
- package/dist/services/key-rotation-service.d.ts +18 -4
- package/dist/services/key-rotation-service.d.ts.map +1 -1
- package/dist/services/key-rotation-service.js +30 -10
- package/dist/services/key-rotation-service.js.map +1 -1
- package/dist/services/permission-service.d.ts.map +1 -1
- package/dist/services/permission-service.js +4 -10
- package/dist/services/permission-service.js.map +1 -1
- package/dist/services/role-service.d.ts.map +1 -1
- package/dist/services/role-service.js +19 -0
- package/dist/services/role-service.js.map +1 -1
- package/dist/services/tenant-service.d.ts +10 -0
- package/dist/services/tenant-service.d.ts.map +1 -1
- package/dist/services/tenant-service.js +32 -20
- package/dist/services/tenant-service.js.map +1 -1
- package/dist/services/usage-service.d.ts.map +1 -1
- package/dist/services/usage-service.js +2 -0
- package/dist/services/usage-service.js.map +1 -1
- package/dist/services/webhook-service.d.ts.map +1 -1
- package/dist/services/webhook-service.js +11 -1
- package/dist/services/webhook-service.js.map +1 -1
- package/dist/stratum.d.ts +1 -1
- package/dist/stratum.d.ts.map +1 -1
- package/dist/stratum.js +22 -9
- package/dist/stratum.js.map +1 -1
- package/dist/url-redaction.d.ts +9 -0
- package/dist/url-redaction.d.ts.map +1 -0
- package/dist/url-redaction.js +32 -0
- package/dist/url-redaction.js.map +1 -0
- package/package.json +4 -4
package/dist/crypto.d.ts
CHANGED
|
@@ -1,13 +1,16 @@
|
|
|
1
1
|
/** Encrypts a value. Returns versioned format: v1:iv:authTag:ciphertext (all hex) */
|
|
2
2
|
export declare function encrypt(plaintext: string): string;
|
|
3
3
|
/** Decrypts a versioned encrypted value. Supports v1 format and legacy (no version prefix).
|
|
4
|
-
*
|
|
5
|
-
*
|
|
4
|
+
* If the current key and salt fail, it tries the previous pair: STRATUM_ENCRYPTION_KEY_PREVIOUS
|
|
5
|
+
* and STRATUM_HKDF_SALT_PREVIOUS. A previous variable that is unset uses the current value.
|
|
6
|
+
* This keeps values readable during a rolling deployment and until a rotation finishes. */
|
|
6
7
|
export declare function decrypt(encrypted: string): string;
|
|
7
|
-
/** Encrypts a value with the key derived from `keyMaterial`.
|
|
8
|
+
/** Encrypts a value with the key derived from `keyMaterial` and `saltHex`.
|
|
9
|
+
* If `saltHex` is not given, the configured salt applies.
|
|
8
10
|
* Key rotation uses it because it must not read or change process.env. */
|
|
9
|
-
export declare function encryptWithKeyMaterial(plaintext: string, keyMaterial: string): string;
|
|
10
|
-
/** Returns the plaintext, or null when the value does not decrypt with the key derived from `keyMaterial`.
|
|
11
|
+
export declare function encryptWithKeyMaterial(plaintext: string, keyMaterial: string, saltHex?: string): string;
|
|
12
|
+
/** Returns the plaintext, or null when the value does not decrypt with the key derived from `keyMaterial` and `saltHex`.
|
|
13
|
+
* If `saltHex` is not given, the configured salt applies.
|
|
11
14
|
* Key rotation uses the null result to try the next key instead of failing. */
|
|
12
|
-
export declare function decryptWithKeyMaterial(encrypted: string, keyMaterial: string): string | null;
|
|
15
|
+
export declare function decryptWithKeyMaterial(encrypted: string, keyMaterial: string, saltHex?: string): string | null;
|
|
13
16
|
//# sourceMappingURL=crypto.d.ts.map
|
package/dist/crypto.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAyFA,qFAAqF;AACrF,wBAAgB,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED;;;2FAG2F;AAC3F,wBAAgB,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAejD;AAED;;0EAE0E;AAC1E,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAEvG;AAED;;+EAE+E;AAC/E,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAM9G"}
|
package/dist/crypto.js
CHANGED
|
@@ -12,37 +12,50 @@ const ALGORITHM = "aes-256-gcm";
|
|
|
12
12
|
const IV_LENGTH = 12;
|
|
13
13
|
const AUTH_TAG_LENGTH = 16;
|
|
14
14
|
const CURRENT_KEY_VERSION = "v1";
|
|
15
|
-
//
|
|
16
|
-
// unset
|
|
15
|
+
// Built-in key material is allowed only in local development and test runs
|
|
16
|
+
// (an unset NODE_ENV counts as development). Every other environment, staging
|
|
17
|
+
// and preview included, must supply real key material or refuse to start.
|
|
18
|
+
function nodeEnvRequiringKeyMaterial() {
|
|
19
|
+
const nodeEnv = process.env.NODE_ENV || "development";
|
|
20
|
+
return nodeEnv === "development" || nodeEnv === "test" ? null : nodeEnv;
|
|
21
|
+
}
|
|
22
|
+
// Fixed, public salt used only in development and test when STRATUM_HKDF_SALT
|
|
23
|
+
// is unset. It must stay stable: a per-process salt would make every value
|
|
17
24
|
// encrypted by an earlier process (or another replica) undecryptable. An HKDF
|
|
18
|
-
// salt is not secret; the key material is.
|
|
25
|
+
// salt is not secret; the key material is. Every other environment requires an
|
|
19
26
|
// explicit STRATUM_HKDF_SALT.
|
|
20
27
|
const NON_PRODUCTION_DEFAULT_SALT = "stratum-non-production-hkdf-salt-v1";
|
|
21
28
|
const HKDF_SALT = (() => {
|
|
22
29
|
if (process.env.STRATUM_HKDF_SALT) {
|
|
23
30
|
return Buffer.from(process.env.STRATUM_HKDF_SALT, "hex");
|
|
24
31
|
}
|
|
25
|
-
|
|
26
|
-
|
|
32
|
+
const strictEnv = nodeEnvRequiringKeyMaterial();
|
|
33
|
+
if (strictEnv) {
|
|
34
|
+
throw new Error(`STRATUM_HKDF_SALT must be set in ${strictEnv}`);
|
|
27
35
|
}
|
|
28
36
|
return Buffer.from(NON_PRODUCTION_DEFAULT_SALT, "utf8");
|
|
29
37
|
})();
|
|
30
|
-
function hkdfDeriveKey(keyMaterial, info = "stratum-aes-key") {
|
|
31
|
-
return Buffer.from(node_crypto_1.default.hkdfSync("sha256", Buffer.from(keyMaterial, "utf8"),
|
|
38
|
+
function hkdfDeriveKey(keyMaterial, salt = HKDF_SALT, info = "stratum-aes-key") {
|
|
39
|
+
return Buffer.from(node_crypto_1.default.hkdfSync("sha256", Buffer.from(keyMaterial, "utf8"), salt, info, 32));
|
|
32
40
|
}
|
|
33
|
-
function
|
|
41
|
+
function getEncryptionKeyMaterial() {
|
|
34
42
|
const envKey = process.env.STRATUM_ENCRYPTION_KEY ?? process.env.WEBHOOK_ENCRYPTION_KEY;
|
|
35
43
|
if (envKey) {
|
|
36
|
-
return
|
|
44
|
+
return envKey;
|
|
37
45
|
}
|
|
38
|
-
|
|
39
|
-
|
|
46
|
+
const strictEnv = nodeEnvRequiringKeyMaterial();
|
|
47
|
+
if (strictEnv) {
|
|
48
|
+
throw new Error(`STRATUM_ENCRYPTION_KEY must be set in ${strictEnv}`);
|
|
40
49
|
}
|
|
41
|
-
//
|
|
42
|
-
return
|
|
50
|
+
// Development and test only fallback
|
|
51
|
+
return "stratum-dev-key";
|
|
52
|
+
}
|
|
53
|
+
function getEncryptionKey() {
|
|
54
|
+
return hkdfDeriveKey(getEncryptionKeyMaterial());
|
|
43
55
|
}
|
|
44
|
-
|
|
45
|
-
|
|
56
|
+
// A hex salt argument follows the STRATUM_HKDF_SALT format. No argument means the configured salt.
|
|
57
|
+
function deriveKey(keyMaterial, saltHex) {
|
|
58
|
+
return hkdfDeriveKey(keyMaterial, saltHex ? Buffer.from(saltHex, "hex") : HKDF_SALT);
|
|
46
59
|
}
|
|
47
60
|
function encryptWithKey(plaintext, key) {
|
|
48
61
|
const iv = node_crypto_1.default.randomBytes(IV_LENGTH);
|
|
@@ -77,35 +90,39 @@ function encrypt(plaintext) {
|
|
|
77
90
|
return encryptWithKey(plaintext, getEncryptionKey());
|
|
78
91
|
}
|
|
79
92
|
/** Decrypts a versioned encrypted value. Supports v1 format and legacy (no version prefix).
|
|
80
|
-
*
|
|
81
|
-
*
|
|
93
|
+
* If the current key and salt fail, it tries the previous pair: STRATUM_ENCRYPTION_KEY_PREVIOUS
|
|
94
|
+
* and STRATUM_HKDF_SALT_PREVIOUS. A previous variable that is unset uses the current value.
|
|
95
|
+
* This keeps values readable during a rolling deployment and until a rotation finishes. */
|
|
82
96
|
function decrypt(encrypted) {
|
|
83
97
|
try {
|
|
84
98
|
return decryptWithKey(encrypted, getEncryptionKey());
|
|
85
99
|
}
|
|
86
100
|
catch (err) {
|
|
87
101
|
const previousKey = process.env.STRATUM_ENCRYPTION_KEY_PREVIOUS;
|
|
88
|
-
|
|
102
|
+
const previousSalt = process.env.STRATUM_HKDF_SALT_PREVIOUS;
|
|
103
|
+
if (previousKey || previousSalt) {
|
|
89
104
|
try {
|
|
90
|
-
return decryptWithKey(encrypted,
|
|
105
|
+
return decryptWithKey(encrypted, deriveKey(previousKey || getEncryptionKeyMaterial(), previousSalt));
|
|
91
106
|
}
|
|
92
107
|
catch {
|
|
93
|
-
// Both
|
|
108
|
+
// Both pairs failed — throw the original error
|
|
94
109
|
}
|
|
95
110
|
}
|
|
96
111
|
throw err;
|
|
97
112
|
}
|
|
98
113
|
}
|
|
99
|
-
/** Encrypts a value with the key derived from `keyMaterial`.
|
|
114
|
+
/** Encrypts a value with the key derived from `keyMaterial` and `saltHex`.
|
|
115
|
+
* If `saltHex` is not given, the configured salt applies.
|
|
100
116
|
* Key rotation uses it because it must not read or change process.env. */
|
|
101
|
-
function encryptWithKeyMaterial(plaintext, keyMaterial) {
|
|
102
|
-
return encryptWithKey(plaintext, deriveKey(keyMaterial));
|
|
117
|
+
function encryptWithKeyMaterial(plaintext, keyMaterial, saltHex) {
|
|
118
|
+
return encryptWithKey(plaintext, deriveKey(keyMaterial, saltHex));
|
|
103
119
|
}
|
|
104
|
-
/** Returns the plaintext, or null when the value does not decrypt with the key derived from `keyMaterial`.
|
|
120
|
+
/** Returns the plaintext, or null when the value does not decrypt with the key derived from `keyMaterial` and `saltHex`.
|
|
121
|
+
* If `saltHex` is not given, the configured salt applies.
|
|
105
122
|
* Key rotation uses the null result to try the next key instead of failing. */
|
|
106
|
-
function decryptWithKeyMaterial(encrypted, keyMaterial) {
|
|
123
|
+
function decryptWithKeyMaterial(encrypted, keyMaterial, saltHex) {
|
|
107
124
|
try {
|
|
108
|
-
return decryptWithKey(encrypted, deriveKey(keyMaterial));
|
|
125
|
+
return decryptWithKey(encrypted, deriveKey(keyMaterial, saltHex));
|
|
109
126
|
}
|
|
110
127
|
catch {
|
|
111
128
|
return null;
|
package/dist/crypto.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":";;;;;
|
|
1
|
+
{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":";;;;;AA0FA,0BAEC;AAMD,0BAeC;AAKD,wDAEC;AAKD,wDAMC;AAnID,8DAAiC;AAEjC,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAEjC,2EAA2E;AAC3E,8EAA8E;AAC9E,0EAA0E;AAC1E,SAAS,2BAA2B;IAClC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,aAAa,CAAC;IACtD,OAAO,OAAO,KAAK,aAAa,IAAI,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;AAC1E,CAAC;AAED,8EAA8E;AAC9E,2EAA2E;AAC3E,8EAA8E;AAC9E,+EAA+E;AAC/E,8BAA8B;AAC9B,MAAM,2BAA2B,GAAG,qCAAqC,CAAC;AAE1E,MAAM,SAAS,GAAW,CAAC,GAAG,EAAE;IAC9B,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC;QAClC,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,SAAS,GAAG,2BAA2B,EAAE,CAAC;IAChD,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,oCAAoC,SAAS,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,MAAM,CAAC,CAAC;AAC1D,CAAC,CAAC,EAAE,CAAC;AAEL,SAAS,aAAa,CAAC,WAAmB,EAAE,OAAe,SAAS,EAAE,IAAI,GAAG,iBAAiB;IAC5F,OAAO,MAAM,CAAC,IAAI,CAChB,qBAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,CAC5E,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB;IAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IACxF,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,SAAS,GAAG,2BAA2B,EAAE,CAAC;IAChD,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,yCAAyC,SAAS,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,qCAAqC;IACrC,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,SAAS,gBAAgB;IACvB,OAAO,aAAa,CAAC,wBAAwB,EAAE,CAAC,CAAC;AACnD,CAAC;AAED,mGAAmG;AACnG,SAAS,SAAS,CAAC,WAAmB,EAAE,OAAgB;IACtD,OAAO,aAAa,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AACvF,CAAC;AAED,SAAS,cAAc,CAAC,SAAiB,EAAE,GAAW;IACpD,MAAM,EAAE,GAAG,qBAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,qBAAM,CAAC,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC,CAAC;IAC7F,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACpF,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IACpC,OAAO,GAAG,mBAAmB,IAAI,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AAChH,CAAC;AAED,SAAS,cAAc,CAAC,SAAiB,EAAE,GAAW;IACpD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,KAAa,EAAE,UAAkB,EAAE,aAAqB,CAAC;IAC7D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACnD,sCAAsC;QACtC,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,aAAa,CAAC,GAAG,KAAyC,CAAC;IACnF,CAAC;SAAM,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,gCAAgC;QAChC,CAAC,KAAK,EAAE,UAAU,EAAE,aAAa,CAAC,GAAG,KAAiC,CAAC;IACzE,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,qBAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC,CAAC;IACjG,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC7B,OAAO,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAC/E,CAAC;AAED,qFAAqF;AACrF,SAAgB,OAAO,CAAC,SAAiB;IACvC,OAAO,cAAc,CAAC,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC;AACvD,CAAC;AAED;;;2FAG2F;AAC3F,SAAgB,OAAO,CAAC,SAAiB;IACvC,IAAI,CAAC;QACH,OAAO,cAAc,CAAC,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC;QAChE,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;QAC5D,IAAI,WAAW,IAAI,YAAY,EAAE,CAAC;YAChC,IAAI,CAAC;gBACH,OAAO,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,WAAW,IAAI,wBAAwB,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC;YACvG,CAAC;YAAC,MAAM,CAAC;gBACP,+CAA+C;YACjD,CAAC;QACH,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;0EAE0E;AAC1E,SAAgB,sBAAsB,CAAC,SAAiB,EAAE,WAAmB,EAAE,OAAgB;IAC7F,OAAO,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AACpE,CAAC;AAED;;+EAE+E;AAC/E,SAAgB,sBAAsB,CAAC,SAAiB,EAAE,WAAmB,EAAE,OAAgB;IAC7F,IAAI,CAAC;QACH,OAAO,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
|
package/dist/index.d.ts
CHANGED
|
@@ -12,7 +12,7 @@ export { RateLimiter, MemoryRateLimitStore } from "./services/rate-limit-service
|
|
|
12
12
|
export type { RateLimit, RateLimitResult, RateLimitState, RateLimitStore, RateLimitResolver, RateLimiterOptions, } from "./services/rate-limit-service.js";
|
|
13
13
|
export type { ApiKeyRecord, CreatedApiKey, ValidatedApiKey, CreateApiKeyOptions } from "./services/api-key-service.js";
|
|
14
14
|
export type { BatchCreateResult } from "./services/tenant-service.js";
|
|
15
|
-
export type { KeyRotationResult, KeyRotationUnreadableRow } from "./services/key-rotation-service.js";
|
|
15
|
+
export type { KeyRotationResult, KeyRotationSalts, KeyRotationUnreadableRow } from "./services/key-rotation-service.js";
|
|
16
16
|
export type { DeliveryStats } from "./services/event-service.js";
|
|
17
17
|
export type { Role, CreateRoleInput, UpdateRoleInput } from "./services/role-service.js";
|
|
18
18
|
export type { AuditContext, AuditEntry, AuditLogQuery, RecordAuditEventInput } from "@stratum-hq/core";
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EACL,iBAAiB,EACjB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,GAC1B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EACL,YAAY,EACZ,KAAK,WAAW,EAChB,KAAK,mBAAmB,GACzB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,iCAAiC,EACjC,KAAK,oBAAoB,GAC1B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAKrE,OAAO,EACL,SAAS,EACT,YAAY,EACZ,mBAAmB,EACnB,wBAAwB,EACxB,sBAAsB,EACtB,wBAAwB,EACxB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,uBAAuB,EACvB,uBAAuB,EACvB,0BAA0B,EAC1B,uBAAuB,EACvB,iCAAiC,EACjC,qBAAqB,EACrB,uBAAuB,EACvB,+BAA+B,EAC/B,iBAAiB,EACjB,mBAAmB,EACnB,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,EACpB,yBAAyB,EACzB,mBAAmB,EACnB,uBAAuB,EACvB,wBAAwB,EACxB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAG1B,YAAY,EACV,UAAU,EACV,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,eAAe,EACf,WAAW,EACX,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACrF,YAAY,EACV,SAAS,EACT,eAAe,EACf,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,kCAAkC,CAAC;AAE1C,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACvH,YAAY,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACtE,YAAY,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EACL,iBAAiB,EACjB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,GAC1B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EACL,YAAY,EACZ,KAAK,WAAW,EAChB,KAAK,mBAAmB,GACzB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,iCAAiC,EACjC,KAAK,oBAAoB,GAC1B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAKrE,OAAO,EACL,SAAS,EACT,YAAY,EACZ,mBAAmB,EACnB,wBAAwB,EACxB,sBAAsB,EACtB,wBAAwB,EACxB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,uBAAuB,EACvB,uBAAuB,EACvB,0BAA0B,EAC1B,uBAAuB,EACvB,iCAAiC,EACjC,qBAAqB,EACrB,uBAAuB,EACvB,+BAA+B,EAC/B,iBAAiB,EACjB,mBAAmB,EACnB,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,EACpB,yBAAyB,EACzB,mBAAmB,EACnB,uBAAuB,EACvB,wBAAwB,EACxB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAG1B,YAAY,EACV,UAAU,EACV,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,eAAe,EACf,WAAW,EACX,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACrF,YAAY,EACV,SAAS,EACT,eAAe,EACf,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,kCAAkC,CAAC;AAE1C,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACvH,YAAY,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACtE,YAAY,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AACxH,YAAY,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,YAAY,EAAE,IAAI,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAGzF,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAGvG,YAAY,EACV,gBAAgB,EAChB,UAAU,EACV,cAAc,EACd,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACxD,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC"}
|
|
@@ -0,0 +1,62 @@
|
|
|
1
|
+
-- Migration 029: Refuse a parent_id that makes a tenant its own ancestor.
|
|
2
|
+
--
|
|
3
|
+
-- The tenant tree must stay a tree whoever writes to it. The library already
|
|
4
|
+
-- checks for cycles before a move; this BEFORE trigger enforces the same rule
|
|
5
|
+
-- in the database. It walks up from the new parent and refuses the row when the
|
|
6
|
+
-- walk reaches the row itself. The walk remembers the ids it has seen, so it
|
|
7
|
+
-- also ends on a cycle that is already in the data.
|
|
8
|
+
--
|
|
9
|
+
-- It fires on every write that sets parent_id or slug, including the
|
|
10
|
+
-- `slug = slug` updates that carry ancestry_ltree down a subtree (024). A cycle
|
|
11
|
+
-- already present in the data therefore stops the first write that touches it
|
|
12
|
+
-- with this error, instead of carrying the ltree around the loop. It is named
|
|
13
|
+
-- so that it runs before maintain_tenant_ancestry_ltree (BEFORE triggers run in
|
|
14
|
+
-- name order).
|
|
15
|
+
--
|
|
16
|
+
-- The walk must see the whole chain even when the writer is under row-level
|
|
17
|
+
-- security (019), where a session sees only its own tenant row. SECURITY
|
|
18
|
+
-- DEFINER would not help: FORCE ROW LEVEL SECURITY applies to the table owner
|
|
19
|
+
-- too, and the recommended owner is the application role without BYPASSRLS.
|
|
20
|
+
-- The function therefore turns on the 019 bypass setting for its own duration
|
|
21
|
+
-- only (a function SET clause is restored when the function exits, on error
|
|
22
|
+
-- too). The function reads nothing back to the caller: it returns the row it
|
|
23
|
+
-- was given or raises. search_path is pinned below to pg_catalog and the
|
|
24
|
+
-- schema this migration runs in, which is where 001 created tenants.
|
|
25
|
+
CREATE OR REPLACE FUNCTION refuse_tenant_parent_cycle()
|
|
26
|
+
RETURNS TRIGGER
|
|
27
|
+
SET app.bypass_rls = 'on'
|
|
28
|
+
AS $$
|
|
29
|
+
BEGIN
|
|
30
|
+
IF NEW.parent_id = NEW.id OR EXISTS (
|
|
31
|
+
WITH RECURSIVE up(id, parent_id, seen) AS (
|
|
32
|
+
SELECT t.id, t.parent_id, ARRAY[t.id]
|
|
33
|
+
FROM tenants t
|
|
34
|
+
WHERE t.id = NEW.parent_id
|
|
35
|
+
UNION ALL
|
|
36
|
+
SELECT t.id, t.parent_id, up.seen || t.id
|
|
37
|
+
FROM tenants t
|
|
38
|
+
JOIN up ON t.id = up.parent_id
|
|
39
|
+
WHERE t.id <> ALL (up.seen)
|
|
40
|
+
)
|
|
41
|
+
SELECT 1 FROM up WHERE up.id = NEW.id
|
|
42
|
+
) THEN
|
|
43
|
+
RAISE EXCEPTION 'tenant % cannot be its own ancestor (parent_id cycle)', NEW.id
|
|
44
|
+
USING ERRCODE = 'check_violation';
|
|
45
|
+
END IF;
|
|
46
|
+
RETURN NEW;
|
|
47
|
+
END;
|
|
48
|
+
$$ language 'plpgsql';
|
|
49
|
+
|
|
50
|
+
DO $pin$ BEGIN
|
|
51
|
+
EXECUTE format(
|
|
52
|
+
'ALTER FUNCTION refuse_tenant_parent_cycle() SET search_path = pg_catalog, %I',
|
|
53
|
+
current_schema()
|
|
54
|
+
);
|
|
55
|
+
END $pin$;
|
|
56
|
+
|
|
57
|
+
DROP TRIGGER IF EXISTS guard_tenant_parent_cycle ON tenants;
|
|
58
|
+
CREATE TRIGGER guard_tenant_parent_cycle
|
|
59
|
+
BEFORE INSERT OR UPDATE OF parent_id, slug ON tenants
|
|
60
|
+
FOR EACH ROW
|
|
61
|
+
WHEN (NEW.parent_id IS NOT NULL)
|
|
62
|
+
EXECUTE FUNCTION refuse_tenant_parent_cycle();
|
|
@@ -0,0 +1,112 @@
|
|
|
1
|
+
-- Migration 030: Redact URLs in existing webhook and region audit rows.
|
|
2
|
+
--
|
|
3
|
+
-- Webhook and region audit rows used to record the full webhook URL and
|
|
4
|
+
-- control-plane URL. Userinfo, query string and fragment can carry access
|
|
5
|
+
-- tokens, and some providers put the secret in the path. New rows record
|
|
6
|
+
-- `scheme://host/` when the path is empty or "/", and otherwise
|
|
7
|
+
-- `scheme://host/#fp=<first 12 hex characters of sha256(path)>`, so rows for
|
|
8
|
+
-- different endpoints stay distinguishable. A URL without a host (for example
|
|
9
|
+
-- `mailto:`) is recorded as "[REDACTED]". This migration applies the same
|
|
10
|
+
-- reduction to rows written before that change, using the same expression as
|
|
11
|
+
-- the write path, and leaves values already in that form unchanged, so running
|
|
12
|
+
-- it again changes nothing. The rest of each audit row is kept.
|
|
13
|
+
--
|
|
14
|
+
-- Runs under bypass so row-level security (019) does not hide rows from the
|
|
15
|
+
-- migration role.
|
|
16
|
+
SET LOCAL app.bypass_rls = 'on';
|
|
17
|
+
|
|
18
|
+
UPDATE audit_logs AS a
|
|
19
|
+
SET after_state = jsonb_set(a.after_state, '{url}', to_jsonb(r.redacted))
|
|
20
|
+
FROM (
|
|
21
|
+
SELECT id,
|
|
22
|
+
CASE
|
|
23
|
+
WHEN v ~ '^[A-Za-z][A-Za-z0-9+.-]*://[^/?#@]+/#fp=[0-9a-f]{12}$' THEN v
|
|
24
|
+
WHEN m IS NULL OR m[2] = '' THEN '[REDACTED]'
|
|
25
|
+
WHEN m[3] IN ('', '/') THEN m[1] || m[2] || '/'
|
|
26
|
+
ELSE m[1] || m[2] || '/#fp=' || left(encode(sha256(convert_to(m[3], 'UTF8')), 'hex'), 12)
|
|
27
|
+
END AS redacted
|
|
28
|
+
FROM (
|
|
29
|
+
SELECT id, after_state->>'url' AS v,
|
|
30
|
+
regexp_match(after_state->>'url', '^([A-Za-z][A-Za-z0-9+.-]*://)(?:[^/?#]*@)?([^/?#]*)([^?#]*)') AS m
|
|
31
|
+
FROM audit_logs
|
|
32
|
+
WHERE resource_type = 'webhook'
|
|
33
|
+
AND action LIKE 'webhook.%'
|
|
34
|
+
AND after_state IS NOT NULL
|
|
35
|
+
AND jsonb_typeof(after_state) = 'object'
|
|
36
|
+
AND jsonb_typeof(after_state->'url') = 'string'
|
|
37
|
+
) AS s
|
|
38
|
+
) AS r
|
|
39
|
+
WHERE a.id = r.id
|
|
40
|
+
AND a.after_state->>'url' IS DISTINCT FROM r.redacted;
|
|
41
|
+
|
|
42
|
+
UPDATE audit_logs AS a
|
|
43
|
+
SET before_state = jsonb_set(a.before_state, '{url}', to_jsonb(r.redacted))
|
|
44
|
+
FROM (
|
|
45
|
+
SELECT id,
|
|
46
|
+
CASE
|
|
47
|
+
WHEN v ~ '^[A-Za-z][A-Za-z0-9+.-]*://[^/?#@]+/#fp=[0-9a-f]{12}$' THEN v
|
|
48
|
+
WHEN m IS NULL OR m[2] = '' THEN '[REDACTED]'
|
|
49
|
+
WHEN m[3] IN ('', '/') THEN m[1] || m[2] || '/'
|
|
50
|
+
ELSE m[1] || m[2] || '/#fp=' || left(encode(sha256(convert_to(m[3], 'UTF8')), 'hex'), 12)
|
|
51
|
+
END AS redacted
|
|
52
|
+
FROM (
|
|
53
|
+
SELECT id, before_state->>'url' AS v,
|
|
54
|
+
regexp_match(before_state->>'url', '^([A-Za-z][A-Za-z0-9+.-]*://)(?:[^/?#]*@)?([^/?#]*)([^?#]*)') AS m
|
|
55
|
+
FROM audit_logs
|
|
56
|
+
WHERE resource_type = 'webhook'
|
|
57
|
+
AND action LIKE 'webhook.%'
|
|
58
|
+
AND before_state IS NOT NULL
|
|
59
|
+
AND jsonb_typeof(before_state) = 'object'
|
|
60
|
+
AND jsonb_typeof(before_state->'url') = 'string'
|
|
61
|
+
) AS s
|
|
62
|
+
) AS r
|
|
63
|
+
WHERE a.id = r.id
|
|
64
|
+
AND a.before_state->>'url' IS DISTINCT FROM r.redacted;
|
|
65
|
+
|
|
66
|
+
UPDATE audit_logs AS a
|
|
67
|
+
SET after_state = jsonb_set(a.after_state, '{control_plane_url}', to_jsonb(r.redacted))
|
|
68
|
+
FROM (
|
|
69
|
+
SELECT id,
|
|
70
|
+
CASE
|
|
71
|
+
WHEN v ~ '^[A-Za-z][A-Za-z0-9+.-]*://[^/?#@]+/#fp=[0-9a-f]{12}$' THEN v
|
|
72
|
+
WHEN m IS NULL OR m[2] = '' THEN '[REDACTED]'
|
|
73
|
+
WHEN m[3] IN ('', '/') THEN m[1] || m[2] || '/'
|
|
74
|
+
ELSE m[1] || m[2] || '/#fp=' || left(encode(sha256(convert_to(m[3], 'UTF8')), 'hex'), 12)
|
|
75
|
+
END AS redacted
|
|
76
|
+
FROM (
|
|
77
|
+
SELECT id, after_state->>'control_plane_url' AS v,
|
|
78
|
+
regexp_match(after_state->>'control_plane_url', '^([A-Za-z][A-Za-z0-9+.-]*://)(?:[^/?#]*@)?([^/?#]*)([^?#]*)') AS m
|
|
79
|
+
FROM audit_logs
|
|
80
|
+
WHERE resource_type = 'region'
|
|
81
|
+
AND action LIKE 'region.%'
|
|
82
|
+
AND after_state IS NOT NULL
|
|
83
|
+
AND jsonb_typeof(after_state) = 'object'
|
|
84
|
+
AND jsonb_typeof(after_state->'control_plane_url') = 'string'
|
|
85
|
+
) AS s
|
|
86
|
+
) AS r
|
|
87
|
+
WHERE a.id = r.id
|
|
88
|
+
AND a.after_state->>'control_plane_url' IS DISTINCT FROM r.redacted;
|
|
89
|
+
|
|
90
|
+
UPDATE audit_logs AS a
|
|
91
|
+
SET before_state = jsonb_set(a.before_state, '{control_plane_url}', to_jsonb(r.redacted))
|
|
92
|
+
FROM (
|
|
93
|
+
SELECT id,
|
|
94
|
+
CASE
|
|
95
|
+
WHEN v ~ '^[A-Za-z][A-Za-z0-9+.-]*://[^/?#@]+/#fp=[0-9a-f]{12}$' THEN v
|
|
96
|
+
WHEN m IS NULL OR m[2] = '' THEN '[REDACTED]'
|
|
97
|
+
WHEN m[3] IN ('', '/') THEN m[1] || m[2] || '/'
|
|
98
|
+
ELSE m[1] || m[2] || '/#fp=' || left(encode(sha256(convert_to(m[3], 'UTF8')), 'hex'), 12)
|
|
99
|
+
END AS redacted
|
|
100
|
+
FROM (
|
|
101
|
+
SELECT id, before_state->>'control_plane_url' AS v,
|
|
102
|
+
regexp_match(before_state->>'control_plane_url', '^([A-Za-z][A-Za-z0-9+.-]*://)(?:[^/?#]*@)?([^/?#]*)([^?#]*)') AS m
|
|
103
|
+
FROM audit_logs
|
|
104
|
+
WHERE resource_type = 'region'
|
|
105
|
+
AND action LIKE 'region.%'
|
|
106
|
+
AND before_state IS NOT NULL
|
|
107
|
+
AND jsonb_typeof(before_state) = 'object'
|
|
108
|
+
AND jsonb_typeof(before_state->'control_plane_url') = 'string'
|
|
109
|
+
) AS s
|
|
110
|
+
) AS r
|
|
111
|
+
WHERE a.id = r.id
|
|
112
|
+
AND a.before_state->>'control_plane_url' IS DISTINCT FROM r.redacted;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"abac-service.d.ts","sourceRoot":"","sources":["../../src/services/abac-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AAIpB,OAAO,EAEL,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EAOxB,MAAM,kBAAkB,CAAC;AAM1B;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,aAAa,EACxB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,OAAO,CAsCT;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,OAAO,CAKT;AAMD;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAgE/B;AAMD;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,oBAAoB,CAAC,CAyF/B;AAMD;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,qBAAqB,GAC9B,OAAO,CAAC,UAAU,CAAC,
|
|
1
|
+
{"version":3,"file":"abac-service.d.ts","sourceRoot":"","sources":["../../src/services/abac-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AAIpB,OAAO,EAEL,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EAOxB,MAAM,kBAAkB,CAAC;AAM1B;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,aAAa,EACxB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,OAAO,CAsCT;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,OAAO,CAKT;AAMD;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAgE/B;AAMD;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,oBAAoB,CAAC,CAyF/B;AAMD;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,qBAAqB,GAC9B,OAAO,CAAC,UAAU,CAAC,CAyCrB;AAED;;GAEG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,UAAU,EAAE,CAAC,CAQvB;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAiDf"}
|
|
@@ -212,11 +212,8 @@ async function evaluateAbac(pool, tenantId, request) {
|
|
|
212
212
|
async function createAbacPolicy(pool, tenantId, rawInput) {
|
|
213
213
|
const input = (0, validation_js_1.parseInput)(core_1.CreateAbacPolicyInputSchema, rawInput);
|
|
214
214
|
return (0, pool_helpers_js_1.withTransaction)(pool, async (client) => {
|
|
215
|
-
const
|
|
216
|
-
|
|
217
|
-
throw new core_1.TenantNotFoundError(tenantId);
|
|
218
|
-
}
|
|
219
|
-
const ancestorIds = (0, core_1.parseAncestryPath)(tenantRes.rows[0].ancestry_path);
|
|
215
|
+
const tenant = await (0, tenant_service_js_1.loadActiveTenant)(client, tenantId);
|
|
216
|
+
const ancestorIds = (0, core_1.parseAncestryPath)(tenant.ancestry_path);
|
|
220
217
|
if (ancestorIds.length > 0) {
|
|
221
218
|
const lockedRes = await client.query(`SELECT * FROM abac_policies
|
|
222
219
|
WHERE tenant_id = ANY($1)
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"abac-service.js","sourceRoot":"","sources":["../../src/services/abac-service.ts"],"names":[],"mappings":";;AA6BA,8CAyCC;AAMD,wCAQC;AAUD,kDAmEC;AAaD,oCA6FC;AAUD,
|
|
1
|
+
{"version":3,"file":"abac-service.js","sourceRoot":"","sources":["../../src/services/abac-service.ts"],"names":[],"mappings":";;AA6BA,8CAyCC;AAMD,wCAQC;AAUD,kDAmEC;AAaD,oCA6FC;AAUD,4CA6CC;AAKD,0CAWC;AAMD,4CAqDC;AA5YD,wDAAiE;AACjE,2DAAiE;AACjE,oDAA8C;AAC9C,2CAc0B;AAE1B,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E;;;;GAIG;AACH,SAAgB,iBAAiB,CAC/B,SAAwB,EACxB,OAAgC;IAEhC,IAAI,CAAC,CAAC,SAAS,CAAC,SAAS,IAAI,OAAO,CAAC,EAAE,CAAC;QACtC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC;IAE5B,QAAQ,SAAS,CAAC,QAAQ,EAAE,CAAC;QAC3B,KAAK,IAAI;YACP,OAAO,IAAI,KAAK,GAAG,CAAC;QAEtB,KAAK,KAAK;YACR,OAAO,IAAI,KAAK,GAAG,CAAC;QAEtB,KAAK,IAAI;YACP,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAElD,KAAK,QAAQ;YACX,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAEnD,KAAK,UAAU;YACb,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAEnD,KAAK,IAAI;YACP,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,IAAI,GAAG,GAAG,CAAC;QAE3E,KAAK,KAAK;YACR,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,IAAI,IAAI,GAAG,CAAC;QAE5E,KAAK,IAAI;YACP,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,IAAI,GAAG,GAAG,CAAC;QAE3E,KAAK,KAAK;YACR,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,IAAI,IAAI,GAAG,CAAC;QAE5E;YACE,MAAM,IAAI,+BAAwB,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,cAAc,CAC5B,MAAkB,EAClB,OAAgC;IAEhC,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,8EAA8E;AAC9E,0BAA0B;AAC1B,8EAA8E;AAE9E;;;GAGG;AACI,KAAK,UAAU,mBAAmB,CACvC,IAAa,EACb,QAAgB;IAEhB,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAClC,iDAAiD,EACjD,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,0BAAmB,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,YAAY,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;QACrD,MAAM,WAAW,GAAG,IAAA,wBAAiB,EAAC,YAAY,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,CAAC,GAAG,WAAW,EAAE,QAAQ,CAAC,CAAC;QAE1C,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,KAAK,CACpC,8EAA8E,EAC9E,CAAC,MAAM,CAAC,CACT,CAAC;QAEF,+CAA+C;QAC/C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAwB,CAAC;QACjD,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;YACxB,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACvB,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,WAAW,CAAC,IAAI,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC5C,IAAI,IAAI,EAAE,CAAC;gBACT,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACpB,CAAC;QACH,CAAC;QAED,qEAAqE;QACrE,wEAAwE;QACxE,4EAA4E;QAC5E,0EAA0E;QAC1E,wEAAwE;QACxE,+DAA+D;QAC/D,MAAM,WAAW,GAAG,IAAI,GAAG,EAAgC,CAAC;QAE5D,KAAK,MAAM,eAAe,IAAI,MAAM,EAAE,CAAC;YACrC,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;YAErD,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;gBAC9B,MAAM,YAAY,GAAG,GAAG,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC/E,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;gBAErD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,gBAAgB,KAAK,eAAe,CAAC,EAAE,CAAC;oBAC7E,yDAAyD;oBACzD,SAAS;gBACX,CAAC;gBAED,MAAM,cAAc,GAAuB;oBACzC,MAAM;oBACN,gBAAgB,EAAE,eAAe;oBACjC,MAAM,EAAE,MAAM,CAAC,IAAI,KAAK,QAAQ;oBAChC,SAAS,EAAE,MAAM,CAAC,IAAI,KAAK,WAAW;iBACvC,CAAC;gBACF,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,KAAK,eAAe,CAAC,CAAC;gBAClF,WAAW,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,GAAG,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;GAMG;AACI,KAAK,UAAU,YAAY,CAChC,IAAa,EACb,QAAgB,EAChB,OAA8B;IAE9B,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAE3D,wEAAwE;IACxE,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE;QAC9C,MAAM,aAAa,GACjB,MAAM,CAAC,aAAa,KAAK,GAAG;YAC5B,MAAM,CAAC,aAAa,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,IAAI,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QACrF,MAAM,WAAW,GACf,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC;QAC5D,OAAO,aAAa,IAAI,WAAW,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAC1D,CAAC;IAED,8EAA8E;IAC9E,4EAA4E;IAC5E,2EAA2E;IAC3E,2EAA2E;IAC3E,4BAA4B;IAC5B,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,MAAM,WAAW,GAAG,CAAC,GAAW,EAAE,EAAE,CAClC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;IAC5D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3D,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC9C,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5D,IAAI,WAAW,CAAC,GAAG,CAAC;YAAE,SAAS;QAC/B,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;YAC/D,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACnB,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3D,OAAO,CAAC,WAAW,GAAG,EAAE,CAAC,GAAG,KAAK,CAAC;IACpC,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5D,OAAO,CAAC,YAAY,GAAG,EAAE,CAAC,GAAG,KAAK,CAAC;IACrC,CAAC;IAED,MAAM,sBAAsB,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAC1D,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAC1D,CAAC;IACF,IAAI,sBAAsB,EAAE,CAAC;QAC3B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAC3D,CAAC;IAED,8BAA8B;IAC9B,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAC/B,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,QAAQ,CAChD,CAAC;IAEF,wCAAwC;IACxC,MAAM,YAAY,GAAyB,EAAE,CAAC;IAC9C,MAAM,WAAW,GAAyB,EAAE,CAAC;IAE7C,KAAK,MAAM,QAAQ,IAAI,MAAM,EAAE,CAAC;QAC9B,IAAI,cAAc,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;YAC7C,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBACtC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC7B,CAAC;iBAAM,CAAC;gBACN,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO;YACL,OAAO,EAAE,KAAK;YACd,cAAc,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM;YACrC,MAAM,EAAE,eAAe;SACxB,CAAC;IACJ,CAAC;IAED,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO;YACL,OAAO,EAAE,IAAI;YACb,cAAc,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM;YACtC,MAAM,EAAE,gBAAgB;SACzB,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;AAC1D,CAAC;AAED,8EAA8E;AAC9E,OAAO;AACP,8EAA8E;AAE9E;;;GAGG;AACI,KAAK,UAAU,gBAAgB,CACpC,IAAa,EACb,QAAgB,EAChB,QAA+B;IAE/B,MAAM,KAAK,GAAG,IAAA,0BAAU,EAAC,kCAA2B,EAAE,QAAQ,CAAC,CAAC;IAChE,OAAO,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,MAAM,GAAG,MAAM,IAAA,oCAAgB,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAExD,MAAM,WAAW,GAAG,IAAA,wBAAiB,EAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAC5D,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAClC;;;;;+BAKuB,EACvB,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,CAC7D,CAAC;YACF,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9B,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACjC,MAAM,IAAI,4BAAqB,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;;mBAGa,EACb;YACE,QAAQ;YACR,KAAK,CAAC,IAAI;YACV,KAAK,CAAC,aAAa;YACnB,KAAK,CAAC,MAAM;YACZ,KAAK,CAAC,MAAM;YACZ,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC;YAChC,KAAK,CAAC,QAAQ,IAAI,CAAC;YACnB,KAAK,CAAC,IAAI,IAAI,WAAW;SAC1B,CACF,CAAC;QAEF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,eAAe,CACnC,IAAa,EACb,QAAgB;IAEhB,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,yFAAyF,EACzF,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,gBAAgB,CACpC,IAAa,EACb,QAAgB,EAChB,QAAgB;IAEhB,OAAO,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,8DAA8D,EAC9D,CAAC,QAAQ,EAAE,QAAQ,CAAC,CACrB,CAAC;QACF,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,8BAAuB,CAAC,QAAQ,CAAC,CAAC;QAC9C,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAEhC,yEAAyE;QACzE,uEAAuE;QACvE,0EAA0E;QAC1E,iDAAiD;QACjD,yDAAyD;QACzD,MAAM,IAAA,4BAAQ,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACjC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAClC,iDAAiD,EACjD,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,sEAAsE;QACtE,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,0BAAmB,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC;QACD,MAAM,WAAW,GAAG,IAAA,mBAAY,EAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QAC5E,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,KAAK,CACvC;yDACmD,EACnD,CAAC,WAAW,EAAE,GAAG,WAAW,IAAI,CAAC,CAClC,CAAC;QACF,MAAM,aAAa,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAE3D,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,MAAM,CAAC,KAAK,CAChB;;;;yBAIiB,EACjB,CAAC,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAClE,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,CAAC,KAAK,CAChB,yCAAyC,EACzC,CAAC,QAAQ,CAAC,CACX,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"api-key-service.d.ts","sourceRoot":"","sources":["../../src/services/api-key-service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,IAAI,CAAC;
|
|
1
|
+
{"version":3,"file":"api-key-service.d.ts","sourceRoot":"","sources":["../../src/services/api-key-service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,IAAI,CAAC;AAKpB,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,UAAU,EAAE,IAAI,CAAC;IACjB,YAAY,EAAE,IAAI,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,UAAU,EAAE,IAAI,CAAC;IACjB,8DAA8D;IAC9D,aAAa,EAAE,MAAM,CAAC;CACvB;AAiCD,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAK7G;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAwBD,wBAAsB,YAAY,CAChC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,aAAa,CAAC,EAAE,MAAM,GAAG,mBAAmB,EAC5C,SAAS,CAAC,EAAE,IAAI,GACf,OAAO,CAAC,aAAa,CAAC,CA0BxB;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAeD,wBAAsB,cAAc,CAClC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAqFjC;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQjF;AAED,wBAAsB,YAAY,CAChC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,aAAa,CAAC,CAyDxB;AAED,wBAAsB,WAAW,CAC/B,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,UAAU,EAAE,IAAI,CAAC;IAAC,YAAY,EAAE,IAAI,GAAG,IAAI,CAAC;IAAC,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IAAC,UAAU,EAAE,IAAI,GAAG,IAAI,CAAA;CAAE,CAAC,CAAC,CAgB9K;AAED;;;;GAIG;AACH,wBAAsB,SAAS,CAC7B,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,EAAE,EAAE,MAAM,GACT,OAAO,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,UAAU,EAAE,IAAI,CAAC;IAAC,YAAY,EAAE,IAAI,GAAG,IAAI,CAAC;IAAC,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IAAC,UAAU,EAAE,IAAI,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,CAAC,CAS9K;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,WAAW,GAAE,MAAW,GACvB,OAAO,CAAC,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,YAAY,EAAE,IAAI,GAAG,IAAI,CAAC;IAAC,UAAU,EAAE,IAAI,CAAA;CAAE,CAAC,CAAC,CAY5H"}
|
|
@@ -14,6 +14,7 @@ exports.listDormantKeys = listDormantKeys;
|
|
|
14
14
|
const node_crypto_1 = __importDefault(require("node:crypto"));
|
|
15
15
|
const pool_helpers_js_1 = require("../pool-helpers.js");
|
|
16
16
|
const role_service_js_1 = require("./role-service.js");
|
|
17
|
+
const core_1 = require("@stratum-hq/core");
|
|
17
18
|
// --- Hashing ---
|
|
18
19
|
const HASH_V1_SHA256 = 1;
|
|
19
20
|
const HASH_V2_HMAC = 2;
|
|
@@ -45,6 +46,19 @@ function generateKey(keyPrefix) {
|
|
|
45
46
|
const { keyHash, hashVersion } = hashKey(plaintextKey);
|
|
46
47
|
return { plaintextKey, keyHash, hashVersion };
|
|
47
48
|
}
|
|
49
|
+
/** Tenant states under which a key could never authenticate. */
|
|
50
|
+
const KEYLESS_TENANT_STATES = ["suspended", "archived"];
|
|
51
|
+
/**
|
|
52
|
+
* Refuse to issue a key for a suspended or archived tenant: such a key could
|
|
53
|
+
* never authenticate. A missing tenant is left to the foreign key.
|
|
54
|
+
*/
|
|
55
|
+
async function assertTenantAcceptsKeys(client, tenantId, operation) {
|
|
56
|
+
const res = await client.query(`SELECT status FROM tenants WHERE id = $1`, [tenantId]);
|
|
57
|
+
const status = res.rows[0]?.status;
|
|
58
|
+
if (status !== undefined && KEYLESS_TENANT_STATES.includes(status)) {
|
|
59
|
+
throw new core_1.InvalidTenantStateError(tenantId, status, operation, ["active", "pending"]);
|
|
60
|
+
}
|
|
61
|
+
}
|
|
48
62
|
async function createApiKey(pool, keyPrefix, tenantId, nameOrOptions, expiresAt) {
|
|
49
63
|
// Support both old signature (name, expiresAt) and new options object
|
|
50
64
|
const opts = typeof nameOrOptions === "object" && nameOrOptions !== null
|
|
@@ -52,6 +66,7 @@ async function createApiKey(pool, keyPrefix, tenantId, nameOrOptions, expiresAt)
|
|
|
52
66
|
: { name: nameOrOptions, expiresAt };
|
|
53
67
|
const { plaintextKey, keyHash, hashVersion } = generateKey(keyPrefix);
|
|
54
68
|
return (0, pool_helpers_js_1.withClient)(pool, async (client) => {
|
|
69
|
+
await assertTenantAcceptsKeys(client, tenantId, "create an API key for");
|
|
55
70
|
const res = await client.query(`INSERT INTO api_keys (tenant_id, key_hash, key_prefix, name, expires_at, rate_limit_max, rate_limit_window, hash_version)
|
|
56
71
|
VALUES ($1, $2, $3, $4, $5, $6, $7, $8)
|
|
57
72
|
RETURNING *`, [tenantId, keyHash, keyPrefix, opts.name ?? null, opts.expiresAt ?? null, opts.rateLimitMax ?? null, opts.rateLimitWindow ?? null, hashVersion]);
|
|
@@ -165,6 +180,9 @@ async function rotateApiKey(pool, keyPrefix, oldKeyId, newName) {
|
|
|
165
180
|
throw new Error(`API key not found, expired or already revoked: ${oldKeyId}`);
|
|
166
181
|
}
|
|
167
182
|
const old = oldRes.rows[0];
|
|
183
|
+
if (old.tenant_id !== null) {
|
|
184
|
+
await assertTenantAcceptsKeys(client, old.tenant_id, "rotate an API key for");
|
|
185
|
+
}
|
|
168
186
|
// Create the new key for the same tenant with the same restrictions: scopes,
|
|
169
187
|
// role, expiry and rate limit carry over, so rotation never widens access.
|
|
170
188
|
const { plaintextKey, keyHash, hashVersion } = generateKey(keyPrefix);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"api-key-service.js","sourceRoot":"","sources":["../../src/services/api-key-service.ts"],"names":[],"mappings":";;;;;
|
|
1
|
+
{"version":3,"file":"api-key-service.js","sourceRoot":"","sources":["../../src/services/api-key-service.ts"],"names":[],"mappings":";;;;;AA4DA,kCAKC;AA+BD,oCAgCC;AAuBD,wCAwFC;AAED,oCAQC;AAED,oCA8DC;AAED,kCAmBC;AAOD,8BAYC;AAQD,0CAeC;AAxXD,8DAAiC;AAEjC,wDAAiE;AACjE,uDAAmE;AACnE,2CAA2D;AAyB3D,kBAAkB;AAElB,MAAM,cAAc,GAAG,CAAC,CAAC;AACzB,MAAM,YAAY,GAAG,CAAC,CAAC;AAEvB,SAAS,aAAa;IACpB,OAAO,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC;AACjD,CAAC;AAED,gCAAgC;AAChC,SAAS,UAAU,CAAC,GAAW;IAC7B,OAAO,qBAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC/D,CAAC;AAED,mEAAmE;AACnE,SAAS,QAAQ,CAAC,GAAW,EAAE,MAAc;IAC3C,OAAO,qBAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACvE,CAAC;AAED;;;GAGG;AACH,SAAS,OAAO,CAAC,GAAW;IAC1B,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;IACvE,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC;AACnE,CAAC;AAED,SAAgB,WAAW,CAAC,SAAiB;IAC3C,MAAM,MAAM,GAAG,qBAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,GAAG,SAAS,GAAG,MAAM,EAAE,CAAC;IAC7C,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACvD,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;AAChD,CAAC;AASD,gEAAgE;AAChE,MAAM,qBAAqB,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;AAExD;;;GAGG;AACH,KAAK,UAAU,uBAAuB,CACpC,MAAqB,EACrB,QAAgB,EAChB,SAAiB;IAEjB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,0CAA0C,EAC1C,CAAC,QAAQ,CAAC,CACX,CAAC;IACF,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;IACnC,IAAI,MAAM,KAAK,SAAS,IAAI,qBAAqB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,8BAAuB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;IACxF,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,YAAY,CAChC,IAAa,EACb,SAAiB,EACjB,QAAgB,EAChB,aAA4C,EAC5C,SAAgB;IAEhB,sEAAsE;IACtE,MAAM,IAAI,GAAwB,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,KAAK,IAAI;QAC3F,CAAC,CAAC,aAAa;QACf,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC;IACvC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IAEtE,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,uBAAuB,CAAC,MAAM,EAAE,QAAQ,EAAE,uBAAuB,CAAC,CAAC;QACzE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;mBAEa,EACb,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI,EAAE,IAAI,CAAC,YAAY,IAAI,IAAI,EAAE,IAAI,CAAC,eAAe,IAAI,IAAI,EAAE,WAAW,CAAC,CAChJ,CAAC;QAEF,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxB,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,aAAa,EAAE,YAAY;SAC5B,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAUD;;;;GAIG;AACH,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAElC;;;GAGG;AACH,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAEvB,KAAK,UAAU,cAAc,CAClC,IAAa,EACb,GAAW;IAEX,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;IAEnC,mFAAmF;IACnF,MAAM,UAAU,GAA6C,EAAE,CAAC;IAChE,IAAI,UAAU,EAAE,CAAC;QACf,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC;IAEpE,6EAA6E;IAC7E,4CAA4C;IAC5C,MAAM,KAAK,GAAG,MAAM,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACpD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,mEAAmE;YACnE,oEAAoE;YACpE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;;;;;;;;;;;cAYM,EACN,CAAC,SAAS,CAAC,IAAI,EAAE,sBAAsB,CAAC,CACzC,CAAC;YAEF,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YAEpC,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAExB,OAAO;gBACL,GAAG;gBACH,SAAS,EAAE;oBACT,SAAS,EAAE,GAAG,CAAC,SAAS;oBACxB,MAAM,EAAE,GAAG,CAAC,EAAE;oBACd,oEAAoE;oBACpE,uEAAuE;oBACvE,MAAM,EAAE,MAAM,IAAA,gDAA8B,EAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;oBAC5D,cAAc,EAAE,GAAG,CAAC,cAAc;oBAClC,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;iBACzC;aACF,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,2EAA2E;IAC3E,mFAAmF;IACnF,4EAA4E;IAC5E,6EAA6E;IAC7E,0BAA0B;IAC1B,2EAA2E;IAC3E,oEAAoE;IACpE,MAAM,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;IACtB,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,KAAK,cAAc,IAAI,UAAU,CAAC;IAClE,IAAI,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC,SAAS,CAAC;IACvD,MAAM,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACtC,wFAAwF;QACxF,MAAM,MAAM,CAAC,KAAK,CAAC,iCAAiC,gBAAgB,EAAE,CAAC,CAAC;QACxE,OAAO,OAAO;YACZ,CAAC,CAAC,MAAM,CAAC,KAAK,CACV,0FAA0F,EAC1F,CAAC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,EAAE,CAAC,CAClD;YACH,CAAC,CAAC,oFAAoF;gBACpF,MAAM,CAAC,KAAK,CACV;wGAC8F,EAC9F,CAAC,GAAG,CAAC,EAAE,EAAE,sBAAsB,CAAC,CACjC,CAAC;IACR,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;QACZ,wFAAwF;IAC1F,CAAC,CAAC,CAAC;IAEH,OAAO,KAAK,CAAC,SAAS,CAAC;AACzB,CAAC;AAEM,KAAK,UAAU,YAAY,CAAC,IAAa,EAAE,KAAa;IAC7D,OAAO,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,0FAA0F,EAC1F,CAAC,KAAK,CAAC,CACR,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,YAAY,CAChC,IAAa,EACb,SAAiB,EACjB,QAAgB,EAChB,OAAgB;IAEhB,OAAO,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,4DAA4D;QAC5D,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAW/B;;;kBAGY,EACZ,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,kDAAkD,QAAQ,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAC3B,MAAM,uBAAuB,CAAC,MAAM,EAAE,GAAG,CAAC,SAAS,EAAE,uBAAuB,CAAC,CAAC;QAChF,CAAC;QAED,6EAA6E;QAC7E,2EAA2E;QAC3E,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;QACtE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;6DAEuD,EACvD;YACE,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,KAAK,YAAY,EAAE,WAAW;YAC3F,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC,iBAAiB;SACnF,CACF,CAAC;QAEF,iBAAiB;QACjB,MAAM,MAAM,CAAC,KAAK,CAChB,sDAAsD,EACtD,CAAC,QAAQ,CAAC,CACX,CAAC;QAEF,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxB,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,aAAa,EAAE,YAAY;SAC5B,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,WAAW,CAC/B,IAAa,EACb,QAAiB;IAEjB,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;qEAC6D,EAC7D,CAAC,QAAQ,CAAC,CACX,CAAC;YACF,OAAO,GAAG,CAAC,IAAI,CAAC;QAClB,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;8CACwC,CACzC,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,SAAS,CAC7B,IAAa,EACb,EAAU;IAEV,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;mCAC6B,EAC7B,CAAC,EAAE,CAAC,CACL,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,eAAe,CACnC,IAAa,EACb,cAAsB,EAAE;IAExB,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;;;6CAIuC,EACvC,CAAC,WAAW,CAAC,CACd,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"config-service.d.ts","sourceRoot":"","sources":["../../src/services/config-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AAEpB,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EAExB,KAAK,cAAc,EACnB,KAAK,oBAAoB,EAO1B,MAAM,kBAAkB,CAAC;
|
|
1
|
+
{"version":3,"file":"config-service.d.ts","sourceRoot":"","sources":["../../src/services/config-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AAEpB,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EAExB,KAAK,cAAc,EACnB,KAAK,oBAAoB,EAO1B,MAAM,kBAAkB,CAAC;AAI1B;;;GAGG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAyE5F;AAED;;;GAGG;AACH,wBAAsB,SAAS,CAC7B,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,cAAc,GACpB,OAAO,CAAC,WAAW,CAAC,CA2CtB;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,mBAAmB,EAAE,GAC7B,OAAO,CAAC,oBAAoB,CAAC,CAoE/B;AAED;;GAEG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,IAAI,CAAC,CAUf;AAED;;;GAGG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,cAAc,CAAC,CA+GzB"}
|
|
@@ -8,6 +8,7 @@ exports.getConfigWithInheritance = getConfigWithInheritance;
|
|
|
8
8
|
const pool_helpers_js_1 = require("../pool-helpers.js");
|
|
9
9
|
const core_1 = require("@stratum-hq/core");
|
|
10
10
|
const crypto_js_1 = require("../crypto.js");
|
|
11
|
+
const tenant_service_js_1 = require("./tenant-service.js");
|
|
11
12
|
/**
|
|
12
13
|
* Resolve the effective config for a tenant by batch-loading ancestor configs
|
|
13
14
|
* in a single query and walking root→leaf.
|
|
@@ -74,11 +75,8 @@ async function resolveConfig(pool, tenantId) {
|
|
|
74
75
|
*/
|
|
75
76
|
async function setConfig(pool, tenantId, key, input) {
|
|
76
77
|
return (0, pool_helpers_js_1.withTransaction)(pool, async (client) => {
|
|
77
|
-
const
|
|
78
|
-
|
|
79
|
-
throw new core_1.TenantNotFoundError(tenantId);
|
|
80
|
-
}
|
|
81
|
-
const ancestorIds = (0, core_1.parseAncestryPath)(tenantRes.rows[0].ancestry_path);
|
|
78
|
+
const tenant = await (0, tenant_service_js_1.loadActiveTenant)(client, tenantId);
|
|
79
|
+
const ancestorIds = (0, core_1.parseAncestryPath)(tenant.ancestry_path);
|
|
82
80
|
// Check ancestor locks (ancestry_path excludes self).
|
|
83
81
|
// Only enforce locks from non-archived ancestors — consistent with resolveConfig.
|
|
84
82
|
if (ancestorIds.length > 0) {
|
|
@@ -116,11 +114,8 @@ async function setConfig(pool, tenantId, key, input) {
|
|
|
116
114
|
*/
|
|
117
115
|
async function batchSetConfig(pool, tenantId, entries) {
|
|
118
116
|
return (0, pool_helpers_js_1.withTransaction)(pool, async (client) => {
|
|
119
|
-
const
|
|
120
|
-
|
|
121
|
-
throw new core_1.TenantNotFoundError(tenantId);
|
|
122
|
-
}
|
|
123
|
-
const ancestorIds = (0, core_1.parseAncestryPath)(tenantRes.rows[0].ancestry_path);
|
|
117
|
+
const tenant = await (0, tenant_service_js_1.loadActiveTenant)(client, tenantId);
|
|
118
|
+
const ancestorIds = (0, core_1.parseAncestryPath)(tenant.ancestry_path);
|
|
124
119
|
const keys = entries.map((e) => e.key);
|
|
125
120
|
// Batch-load all ancestor locks in a single query.
|
|
126
121
|
// Only enforce locks from non-archived ancestors — consistent with setConfig.
|