@vorionsys/platform-core 0.1.0

package/dist/agent-registry/tenant-service.d.ts

@@ -0,0 +1,104 @@
+/**
+ * Tenant Management Service
+ *
+ * Service for managing tenants (organizations) and API keys.
+ *
+ * @packageDocumentation
+ */
+import { type Tenant, type ApiKey } from "@vorionsys/contracts/db";
+/**
+ * Tenant tier configurations
+ */
+export declare const TENANT_TIERS: Record<string, {
+    agentLimit: number;
+    apiCallsPerMonth: number;
+}>;
+export interface CreateTenantOptions {
+    slug: string;
+    name: string;
+    contactEmail: string;
+    billingEmail?: string;
+    tier?: "free" | "organization" | "enterprise";
+    registry?: string;
+    metadata?: Record<string, unknown>;
+}
+export interface CreateApiKeyOptions {
+    tenantId: string;
+    name: string;
+    scopes?: string[];
+    rateLimit?: number;
+    expiresInDays?: number;
+}
+export interface ApiKeyWithSecret {
+    apiKey: ApiKey;
+    secret: string;
+}
+export declare class TenantService {
+    private db;
+    constructor();
+    /**
+     * Create a new tenant
+     */
+    createTenant(options: CreateTenantOptions): Promise<Tenant>;
+    /**
+     * Get tenant by ID
+     */
+    getTenantById(id: string): Promise<Tenant | null>;
+    /**
+     * Get tenant by slug
+     */
+    getTenantBySlug(slug: string): Promise<Tenant | null>;
+    /**
+     * Update tenant
+     */
+    updateTenant(id: string, updates: Partial<Pick<Tenant, "name" | "contactEmail" | "billingEmail" | "metadata">>): Promise<Tenant | null>;
+    /**
+     * Upgrade tenant tier
+     */
+    upgradeTier(id: string, newTier: "organization" | "enterprise"): Promise<Tenant | null>;
+    /**
+     * Suspend tenant
+     */
+    suspendTenant(id: string, reason: string): Promise<void>;
+    /**
+     * Reactivate tenant
+     */
+    reactivateTenant(id: string): Promise<void>;
+    private get ak();
+    /**
+     * Create a new API key
+     */
+    createApiKey(options: CreateApiKeyOptions): Promise<ApiKeyWithSecret>;
+    /**
+     * Validate an API key and return tenant context
+     */
+    validateApiKey(key: string): Promise<{
+        valid: boolean;
+        tenantId?: string;
+        scopes?: string[];
+        error?: string;
+    }>;
+    /**
+     * Revoke an API key
+     */
+    revokeApiKey(id: string, reason: string): Promise<void>;
+    /**
+     * List API keys for a tenant
+     */
+    listApiKeys(tenantId: string): Promise<ApiKey[]>;
+    /**
+     * Reset rate limits (called by scheduler)
+     */
+    resetRateLimits(): Promise<number>;
+    /**
+     * Generate a new API key
+     */
+    private generateApiKey;
+    /**
+     * Hash an API key for storage
+     */
+    private hashApiKey;
+}
+export declare function createTenantService(): TenantService;
+export declare function getTenantService(): TenantService;
+//# sourceMappingURL=tenant-service.d.ts.map

package/dist/agent-registry/tenant-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-service.d.ts","sourceRoot":"","sources":["../../src/agent-registry/tenant-service.ts"],"names":[],"mappings":"AACA;;;;;;GAMG;AAMH,OAAO,EAGL,KAAK,MAAM,EAEX,KAAK,MAAM,EAEZ,MAAM,yBAAyB,CAAC;AAgBjC;;GAEG;AACH,eAAO,MAAM,YAAY,EAAE,MAAM,CAC/B,MAAM,EACN;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,CAKjD,CAAC;AAMF,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,GAAG,cAAc,GAAG,YAAY,CAAC;IAC9C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAMD,qBAAa,aAAa;IACxB,OAAO,CAAC,EAAE,CAAW;;IAUrB;;OAEG;IACG,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC;IA8CjE;;OAEG;IACG,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAUvD;;OAEG;IACG,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAU3D;;OAEG;IACG,YAAY,CAChB,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,OAAO,CACd,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,GAAG,cAAc,GAAG,UAAU,CAAC,CACpE,GACA,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAazB;;OAEG;IACG,WAAW,CACf,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,cAAc,GAAG,YAAY,GACrC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAqBzB;;OAEG;IACG,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAc9D;;OAEG;IACG,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAsBjD,OAAO,KAAK,EAAE,GAA2B;IAEzC;;OAEG;IACG,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IA4C3E;;OAEG;IACG,cAAc,CAClB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC;QACT,KAAK,EAAE,OAAO,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;IA+CF;;OAEG;IACG,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAc7D;;OAEG;IACG,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAItD;;OAEG;IACG,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC;IAmBxC;;OAEG;IACH,OAAO,CAAC,cAAc;IAMtB;;OAEG;IACH,OAAO,CAAC,UAAU;CAGnB;AAQD,wBAAgB,mBAAmB,IAAI,aAAa,CAKnD;AAED,wBAAgB,gBAAgB,IAAI,aAAa,CAKhD"}

package/dist/agent-registry/tenant-service.js

@@ -0,0 +1,313 @@
+/* eslint-disable @typescript-eslint/ban-ts-comment */
+/**
+ * Tenant Management Service
+ *
+ * Service for managing tenants (organizations) and API keys.
+ *
+ * @packageDocumentation
+ */
+import crypto from "crypto";
+import { eq, and, sql } from "drizzle-orm";
+import { tenants, apiKeys, } from "@vorionsys/contracts/db";
+import { getDatabase } from "../common/db.js";
+import { createLogger } from "../common/logger.js";
+const logger = createLogger({ component: "tenant-service" });
+// ============================================================================
+// Constants
+// ============================================================================
+/**
+ * API key prefix for identification
+ */
+const API_KEY_PREFIX = "aa_";
+/**
+ * Tenant tier configurations
+ */
+export const TENANT_TIERS = {
+    free: { agentLimit: 5, apiCallsPerMonth: 10000 },
+    organization: { agentLimit: 100, apiCallsPerMonth: 1000000 },
+    enterprise: { agentLimit: -1, apiCallsPerMonth: -1 }, // Unlimited
+};
+// ============================================================================
+// Service Class
+// ============================================================================
+export class TenantService {
+    db;
+    constructor() {
+        this.db = getDatabase();
+    }
+    // ==========================================================================
+    // Tenant Management
+    // ==========================================================================
+    /**
+     * Create a new tenant
+     */
+    async createTenant(options) {
+        const { slug, name, contactEmail, billingEmail, tier = "free", registry = "a3i", metadata, } = options;
+        // Validate slug format
+        if (!/^[a-z0-9-]+$/.test(slug) || slug.length < 2 || slug.length > 63) {
+            throw new Error("Invalid slug format");
+        }
+        // Check for duplicate slug
+        const existing = await this.getTenantBySlug(slug);
+        if (existing) {
+            throw new Error("Tenant with this slug already exists");
+        }
+        const tierConfig = TENANT_TIERS[tier] ?? TENANT_TIERS.free;
+        const newTenant = {
+            slug,
+            name,
+            registry,
+            tier,
+            agentLimit: tierConfig.agentLimit,
+            apiCallsPerMonth: tierConfig.apiCallsPerMonth,
+            contactEmail,
+            billingEmail,
+            metadata,
+        };
+        const [tenant] = await this.db
+            .insert(tenants)
+            .values(newTenant)
+            .returning();
+        logger.info({ tenantId: tenant.id, slug }, "Tenant created");
+        return tenant;
+    }
+    /**
+     * Get tenant by ID
+     */
+    async getTenantById(id) {
+        const result = await this.db
+            .select()
+            .from(tenants)
+            .where(eq(tenants.id, id))
+            .limit(1);
+        return result[0] ?? null;
+    }
+    /**
+     * Get tenant by slug
+     */
+    async getTenantBySlug(slug) {
+        const result = await this.db
+            .select()
+            .from(tenants)
+            .where(eq(tenants.slug, slug))
+            .limit(1);
+        return result[0] ?? null;
+    }
+    /**
+     * Update tenant
+     */
+    async updateTenant(id, updates) {
+        const result = await this.db
+            .update(tenants)
+            .set({
+            ...updates,
+            updatedAt: new Date(),
+        })
+            .where(eq(tenants.id, id))
+            .returning();
+        return result[0] ?? null;
+    }
+    /**
+     * Upgrade tenant tier
+     */
+    async upgradeTier(id, newTier) {
+        const tierConfig = TENANT_TIERS[newTier];
+        const result = await this.db
+            .update(tenants)
+            .set({
+            tier: newTier,
+            agentLimit: tierConfig.agentLimit,
+            apiCallsPerMonth: tierConfig.apiCallsPerMonth,
+            updatedAt: new Date(),
+        })
+            .where(eq(tenants.id, id))
+            .returning();
+        if (result[0]) {
+            logger.info({ tenantId: id, newTier }, "Tenant tier upgraded");
+        }
+        return result[0] ?? null;
+    }
+    /**
+     * Suspend tenant
+     */
+    async suspendTenant(id, reason) {
+        await this.db
+            .update(tenants)
+            .set({
+            active: false,
+            suspendedAt: new Date(),
+            suspendedReason: reason,
+            updatedAt: new Date(),
+        })
+            .where(eq(tenants.id, id));
+        logger.info({ tenantId: id, reason }, "Tenant suspended");
+    }
+    /**
+     * Reactivate tenant
+     */
+    async reactivateTenant(id) {
+        await this.db
+            .update(tenants)
+            .set({
+            active: true,
+            suspendedAt: null,
+            suspendedReason: null,
+            updatedAt: new Date(),
+        })
+            .where(eq(tenants.id, id));
+        logger.info({ tenantId: id }, "Tenant reactivated");
+    }
+    // ==========================================================================
+    // API Key Management
+    // ==========================================================================
+    // The apiKeys table has a dual schema conflict in contracts (agents.ts vs api-keys.ts).
+    // The NewApiKey/ApiKey types come from agents.ts but the Drizzle table comes from api-keys.ts.
+    // Cast to any for column access until the contracts schema is unified.
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    get ak() { return apiKeys; }
+    /**
+     * Create a new API key
+     */
+    async createApiKey(options) {
+        const { tenantId, name, scopes = ["agents:read", "agents:write", "attestations:write"], rateLimit = 1000, expiresInDays, } = options;
+        // Generate API key
+        const secret = this.generateApiKey();
+        const keyHash = this.hashApiKey(secret);
+        const keyPrefix = secret.substring(0, 11); // "aa_" + 8 chars
+        let expiresAt;
+        if (expiresInDays) {
+            expiresAt = new Date();
+            expiresAt.setDate(expiresAt.getDate() + expiresInDays);
+        }
+        const newApiKey = {
+            tenantId,
+            keyHash,
+            keyPrefix,
+            name,
+            scopes,
+            rateLimit,
+            rateLimitRemaining: rateLimit,
+            expiresAt,
+        };
+        const [apiKey] = await this.db
+            .insert(this.ak)
+            .values(newApiKey)
+            .returning();
+        logger.info({ apiKeyId: apiKey.id, tenantId, name }, "API key created");
+        return {
+            apiKey,
+            secret, // Only returned on creation!
+        };
+    }
+    /**
+     * Validate an API key and return tenant context
+     */
+    async validateApiKey(key) {
+        if (!key.startsWith(API_KEY_PREFIX)) {
+            return { valid: false, error: "Invalid key format" };
+        }
+        const keyHash = this.hashApiKey(key);
+        const result = await this.db
+            .select()
+            .from(this.ak)
+            .where(and(eq(this.ak.keyHash, keyHash), eq(this.ak.active, true)))
+            .limit(1);
+        if (result.length === 0) {
+            return { valid: false, error: "Key not found or inactive" };
+        }
+        const apiKey = result[0];
+        // Check expiration
+        if (apiKey.expiresAt && apiKey.expiresAt < new Date()) {
+            return { valid: false, error: "Key expired" };
+        }
+        // Check rate limit
+        if (apiKey.rateLimitRemaining <= 0) {
+            return { valid: false, error: "Rate limit exceeded" };
+        }
+        // Update usage
+        await this.db
+            .update(this.ak)
+            .set({
+            lastUsedAt: new Date(),
+            usageCount: apiKey.usageCount + 1,
+            rateLimitRemaining: apiKey.rateLimitRemaining - 1,
+            updatedAt: new Date(),
+        })
+            .where(eq(this.ak.id, apiKey.id));
+        return {
+            valid: true,
+            tenantId: apiKey.tenantId,
+            scopes: apiKey.scopes,
+        };
+    }
+    /**
+     * Revoke an API key
+     */
+    async revokeApiKey(id, reason) {
+        await this.db
+            .update(this.ak)
+            .set({
+            active: false,
+            revokedAt: new Date(),
+            revokedReason: reason,
+            updatedAt: new Date(),
+        })
+            .where(eq(this.ak.id, id));
+        logger.info({ apiKeyId: id, reason }, "API key revoked");
+    }
+    /**
+     * List API keys for a tenant
+     */
+    async listApiKeys(tenantId) {
+        return this.db.select().from(this.ak).where(eq(this.ak.tenantId, tenantId));
+    }
+    /**
+     * Reset rate limits (called by scheduler)
+     */
+    async resetRateLimits() {
+        const result = await this.db
+            .update(this.ak)
+            .set({
+            rateLimitRemaining: sql `${this.ak.rateLimit}`,
+            rateLimitResetAt: new Date(),
+        })
+            .where(eq(this.ak.active, true))
+            .returning();
+        logger.info({ count: result.length }, "Rate limits reset");
+        return result.length;
+    }
+    // ==========================================================================
+    // Private Helpers
+    // ==========================================================================
+    /**
+     * Generate a new API key
+     */
+    generateApiKey() {
+        const bytes = crypto.randomBytes(32);
+        const key = bytes.toString("base64url");
+        return `${API_KEY_PREFIX}${key}`;
+    }
+    /**
+     * Hash an API key for storage
+     */
+    hashApiKey(key) {
+        return crypto.createHash("sha256").update(key).digest("hex");
+    }
+}
+// ============================================================================
+// Factory Functions
+// ============================================================================
+let instance = null;
+export function createTenantService() {
+    if (!instance) {
+        instance = new TenantService();
+    }
+    return instance;
+}
+export function getTenantService() {
+    if (!instance) {
+        throw new Error("TenantService not initialized");
+    }
+    return instance;
+}
+//# sourceMappingURL=tenant-service.js.map

package/dist/agent-registry/tenant-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-service.js","sourceRoot":"","sources":["../../src/agent-registry/tenant-service.ts"],"names":[],"mappings":"AAAA,sDAAsD;AACtD;;;;;;GAMG;AAEH,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,EACL,OAAO,EACP,OAAO,GAKR,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,WAAW,EAAiB,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC;AAE7D,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E;AAE/E;;GAEG;AACH,MAAM,cAAc,GAAG,KAAK,CAAC;AAE7B;;GAEG;AACH,MAAM,CAAC,MAAM,YAAY,GAGrB;IACF,IAAI,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,gBAAgB,EAAE,KAAK,EAAE;IAChD,YAAY,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,gBAAgB,EAAE,OAAO,EAAE;IAC5D,UAAU,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,YAAY;CACnE,CAAC;AA6BF,+EAA+E;AAC/E,gBAAgB;AAChB,+EAA+E;AAE/E,MAAM,OAAO,aAAa;IAChB,EAAE,CAAW;IAErB;QACE,IAAI,CAAC,EAAE,GAAG,WAAW,EAAE,CAAC;IAC1B,CAAC;IAED,6EAA6E;IAC7E,oBAAoB;IACpB,6EAA6E;IAE7E;;OAEG;IACH,KAAK,CAAC,YAAY,CAAC,OAA4B;QAC7C,MAAM,EACJ,IAAI,EACJ,IAAI,EACJ,YAAY,EACZ,YAAY,EACZ,IAAI,GAAG,MAAM,EACb,QAAQ,GAAG,KAAK,EAChB,QAAQ,GACT,GAAG,OAAO,CAAC;QAEZ,uBAAuB;QACvB,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YACtE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QAED,2BAA2B;QAC3B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC;QAE3D,MAAM,SAAS,GAAc;YAC3B,IAAI;YACJ,IAAI;YACJ,QAAQ;YACR,IAAI;YACJ,UAAU,EAAE,UAAU,CAAC,UAAU;YACjC,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;YAC7C,YAAY;YACZ,YAAY;YACZ,QAAQ;SACT,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aAC3B,MAAM,CAAC,OAAO,CAAC;aACf,MAAM,CAAC,SAAS,CAAC;aACjB,SAAS,EAAE,CAAC;QAEf,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,gBAAgB,CAAC,CAAC;QAE7D,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CAAC,EAAU;QAC5B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE;aACzB,MAAM,EAAE;aACR,IAAI,CAAC,OAAO,CAAC;aACb,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;aACzB,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,OAAO,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe,CAAC,IAAY;QAChC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE;aACzB,MAAM,EAAE;aACR,IAAI,CAAC,OAAO,CAAC;aACb,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;aAC7B,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,OAAO,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAChB,EAAU,EACV,OAEC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE;aACzB,MAAM,CAAC,OAAO,CAAC;aACf,GAAG,CAAC;YACH,GAAG,OAAO;YACV,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;aACzB,SAAS,EAAE,CAAC;QAEf,OAAO,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CACf,EAAU,EACV,OAAsC;QAEtC,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QAEzC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE;aACzB,MAAM,CAAC,OAAO,CAAC;aACf,GAAG,CAAC;YACH,IAAI,EAAE,OAAO;YACb,UAAU,EAAE,UAAU,CAAC,UAAU;YACjC,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;YAC7C,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;aACzB,SAAS,EAAE,CAAC;QAEf,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YACd,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,sBAAsB,CAAC,CAAC;QACjE,CAAC;QAED,OAAO,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CAAC,EAAU,EAAE,MAAc;QAC5C,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,OAAO,CAAC;aACf,GAAG,CAAC;YACH,MAAM,EAAE,KAAK;YACb,WAAW,EAAE,IAAI,IAAI,EAAE;YACvB,eAAe,EAAE,MAAM;YACvB,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAE7B,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CAAC,EAAU;QAC/B,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,OAAO,CAAC;aACf,GAAG,CAAC;YACH,MAAM,EAAE,IAAI;YACZ,WAAW,EAAE,IAAI;YACjB,eAAe,EAAE,IAAI;YACrB,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAE7B,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,oBAAoB,CAAC,CAAC;IACtD,CAAC;IAED,6EAA6E;IAC7E,qBAAqB;IACrB,6EAA6E;IAE7E,wFAAwF;IACxF,+FAA+F;IAC/F,uEAAuE;IACvE,8DAA8D;IAC9D,IAAY,EAAE,KAAU,OAAO,OAAO,CAAC,CAAC,CAAC;IAEzC;;OAEG;IACH,KAAK,CAAC,YAAY,CAAC,OAA4B;QAC7C,MAAM,EACJ,QAAQ,EACR,IAAI,EACJ,MAAM,GAAG,CAAC,aAAa,EAAE,cAAc,EAAE,oBAAoB,CAAC,EAC9D,SAAS,GAAG,IAAI,EAChB,aAAa,GACd,GAAG,OAAO,CAAC;QAEZ,mBAAmB;QACnB,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,kBAAkB;QAE7D,IAAI,SAA2B,CAAC;QAChC,IAAI,aAAa,EAAE,CAAC;YAClB,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,aAAa,CAAC,CAAC;QACzD,CAAC;QAED,MAAM,SAAS,GAAG;YAChB,QAAQ;YACR,OAAO;YACP,SAAS;YACT,IAAI;YACJ,MAAM;YACN,SAAS;YACT,kBAAkB,EAAE,SAAS;YAC7B,SAAS;SACV,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aAC3B,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;aACf,MAAM,CAAC,SAAS,CAAC;aACjB,SAAS,EAAc,CAAC;QAE3B,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,iBAAiB,CAAC,CAAC;QAExE,OAAO;YACL,MAAM;YACN,MAAM,EAAE,6BAA6B;SACtC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAClB,GAAW;QAOX,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;QACvD,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAErC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE;aACzB,MAAM,EAAE;aACR,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;aACb,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;aAClE,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;QAC9D,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QAEzB,mBAAmB;QACnB,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YACtD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;QAChD,CAAC;QAED,mBAAmB;QACnB,IAAI,MAAM,CAAC,kBAAkB,IAAI,CAAC,EAAE,CAAC;YACnC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;QACxD,CAAC;QAED,eAAe;QACf,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;aACf,GAAG,CAAC;YACH,UAAU,EAAE,IAAI,IAAI,EAAE;YACtB,UAAU,EAAE,MAAM,CAAC,UAAU,GAAG,CAAC;YACjC,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,GAAG,CAAC;YACjD,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAEpC,OAAO;YACL,KAAK,EAAE,IAAI;YACX,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,MAAM,CAAC,MAAkB;SAClC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAAC,EAAU,EAAE,MAAc;QAC3C,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;aACf,GAAG,CAAC;YACH,MAAM,EAAE,KAAK;YACb,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,aAAa,EAAE,MAAM;YACrB,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAE7B,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC;IAC3D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,QAAgB;QAChC,OAAO,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAiC,CAAC;IAC9G,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe;QACnB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE;aACzB,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;aACf,GAAG,CAAC;YACH,kBAAkB,EAAE,GAAG,CAAA,GAAG,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE;YAC7C,gBAAgB,EAAE,IAAI,IAAI,EAAE;SAC7B,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;aAC/B,SAAS,EAAc,CAAC;QAE3B,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC;QAE3D,OAAO,MAAM,CAAC,MAAM,CAAC;IACvB,CAAC;IAED,6EAA6E;IAC7E,kBAAkB;IAClB,6EAA6E;IAE7E;;OAEG;IACK,cAAc;QACpB,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACxC,OAAO,GAAG,cAAc,GAAG,GAAG,EAAE,CAAC;IACnC,CAAC;IAED;;OAEG;IACK,UAAU,CAAC,GAAW;QAC5B,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/D,CAAC;CACF;AAED,+EAA+E;AAC/E,oBAAoB;AACpB,+EAA+E;AAE/E,IAAI,QAAQ,GAAyB,IAAI,CAAC;AAE1C,MAAM,UAAU,mBAAmB;IACjC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,QAAQ,GAAG,IAAI,aAAa,EAAE,CAAC;IACjC,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/api/auth.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Authentication Middleware
+ *
+ * Provides JWT-based authentication with tenant context extraction.
+ *
+ * @packageDocumentation
+ */
+import { FastifyRequest, FastifyReply } from "fastify";
+import { AuthContext as CanonicalAuthContext, GovernanceRole, HierarchyLevel, authContextSchema, governanceRoleSchema, hierarchyLevelSchema } from '@vorionsys/contracts/canonical/governance';
+export { CanonicalAuthContext, GovernanceRole, HierarchyLevel, authContextSchema, governanceRoleSchema, hierarchyLevelSchema, };
+/**
+ * Authenticated user context
+ *
+ * @deprecated Use `CanonicalAuthContext` from `@vorionsys/contracts` for new code.
+ *             This interface is maintained for backwards compatibility and is a subset
+ *             of the canonical type. The canonical type includes additional fields for
+ *             governanceRole, sessionId, agentId, hierarchyLevel, and attributes.
+ */
+export interface AuthContext {
+    userId: string;
+    tenantId: string;
+    roles: string[];
+    permissions: string[];
+}
+/**
+ * Extend FastifyRequest with auth context
+ */
+declare module "fastify" {
+    interface FastifyRequest {
+        auth?: AuthContext;
+    }
+}
+/**
+ * Authentication middleware
+ */
+export declare function authenticate(request: FastifyRequest, reply: FastifyReply): Promise<void>;
+/**
+ * Authorization middleware factory
+ * Checks if user has required permission
+ */
+export declare function requirePermission(permission: string): (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
+/**
+ * Tenant authorization middleware
+ * Verifies user can access the specified tenant's resources
+ *
+ * SECURITY FIX: Only 'super_admin' role can access cross-tenant resources.
+ * Regular 'admin' role is now scoped to their own tenant only.
+ * All cross-tenant access attempts are logged for audit purposes.
+ */
+export declare function requireTenantAccess(getTenantId: (request: FastifyRequest) => string | undefined): (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
+/**
+ * Role check middleware factory
+ */
+export declare function requireRole(...roles: string[]): (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
+//# sourceMappingURL=auth.d.ts.map

package/dist/api/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/api/auth.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAIvD,OAAO,EACL,WAAW,IAAI,oBAAoB,EACnC,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,2CAA2C,CAAC;AAMnD,OAAO,EACL,oBAAoB,EACpB,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,GACrB,CAAC;AAIF;;;;;;;GAOG;AACH,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAoBD;;GAEG;AACH,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,cAAc;QACtB,IAAI,CAAC,EAAE,WAAW,CAAC;KACpB;CACF;AA0GD;;GAEG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,YAAY,GAClB,OAAO,CAAC,IAAI,CAAC,CAqEf;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,IAEhD,SAAS,cAAc,EACvB,OAAO,YAAY,KAClB,OAAO,CAAC,IAAI,CAAC,CA+BjB;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,MAAM,GAAG,SAAS,IAG1D,SAAS,cAAc,EACvB,OAAO,YAAY,KAClB,OAAO,CAAC,IAAI,CAAC,CAuGjB;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,GAAG,KAAK,EAAE,MAAM,EAAE,IAE1C,SAAS,cAAc,EACvB,OAAO,YAAY,KAClB,OAAO,CAAC,IAAI,CAAC,CAiCjB"}