@vorionsys/platform-core 0.1.0

package/dist/common/tenant-context.d.ts

@@ -0,0 +1,253 @@
+/**
+ * Tenant Context - Secure Tenant ID Handling
+ *
+ * Provides branded types and secure context creation to prevent
+ * tenant ID injection attacks. Tenant IDs can ONLY be extracted
+ * from validated JWT tokens, never from request parameters or body.
+ *
+ * HIGH SECURITY: Prevents cross-tenant data access vulnerability.
+ *
+ * @packageDocumentation
+ */
+import type { FastifyRequest, FastifyReply } from 'fastify';
+import { z } from 'zod';
+import type { ID } from './types.js';
+/**
+ * Unique symbol for branding ValidatedTenantId
+ * This ensures the type cannot be forged at compile time
+ */
+declare const TenantIdBrand: unique symbol;
+/**
+ * A tenant ID that has been validated from a JWT token.
+ *
+ * This branded type can ONLY be created through:
+ * - `createTenantContext()` from a validated JWT
+ * - `extractTenantContext()` middleware
+ *
+ * Raw strings cannot be assigned to this type, preventing
+ * accidental use of unvalidated tenant IDs.
+ *
+ * @example
+ * // This will NOT compile:
+ * const badId: ValidatedTenantId = "some-tenant-id";
+ *
+ * // This is the only valid way:
+ * const ctx = await extractTenantContext(request);
+ * const validId: ValidatedTenantId = ctx.tenantId;
+ */
+export type ValidatedTenantId = string & {
+    readonly [TenantIdBrand]: true;
+};
+/**
+ * Unique symbol for branding ValidatedUserId
+ */
+declare const UserIdBrand: unique symbol;
+/**
+ * A user ID that has been validated from a JWT token.
+ */
+export type ValidatedUserId = string & {
+    readonly [UserIdBrand]: true;
+};
+/**
+ * Validated JWT payload structure
+ */
+export interface ValidatedJwtPayload {
+    /** Subject (user ID) - validated from JWT */
+    sub: string;
+    /** Tenant ID - validated from JWT */
+    tid: string;
+    /** User roles from JWT */
+    roles?: string[];
+    /** User permissions from JWT */
+    permissions?: string[];
+    /** Token issued at timestamp */
+    iat: number;
+    /** Token expiration timestamp */
+    exp: number;
+}
+/**
+ * Zod schema for validating JWT payload for tenant context
+ */
+export declare const validatedJwtPayloadSchema: z.ZodObject<{
+    sub: z.ZodString;
+    tid: z.ZodString;
+    iat: z.ZodNumber;
+    exp: z.ZodNumber;
+    roles: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+    permissions: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+}, "strip", z.ZodTypeAny, {
+    sub?: string;
+    tid?: string;
+    iat?: number;
+    exp?: number;
+    roles?: string[];
+    permissions?: string[];
+}, {
+    sub?: string;
+    tid?: string;
+    iat?: number;
+    exp?: number;
+    roles?: string[];
+    permissions?: string[];
+}>;
+/**
+ * Immutable tenant context created from validated JWT.
+ *
+ * This is the ONLY way to safely pass tenant information to services.
+ * All service methods should accept TenantContext instead of raw tenantId.
+ *
+ * Properties are readonly to prevent mutation after creation.
+ *
+ * @example
+ * // Service method signature (SECURE)
+ * async createPolicy(ctx: TenantContext, input: CreatePolicyInput): Promise<Policy>
+ *
+ * // NOT this (VULNERABLE)
+ * async createPolicy(tenantId: string, input: CreatePolicyInput): Promise<Policy>
+ */
+export interface TenantContext {
+    /** Validated tenant ID - can only come from JWT */
+    readonly tenantId: ValidatedTenantId;
+    /** Validated user ID - can only come from JWT */
+    readonly userId: ValidatedUserId;
+    /** User roles from JWT token */
+    readonly roles: readonly string[];
+    /** User permissions from JWT token */
+    readonly permissions: readonly string[];
+    /** Request trace ID for correlation */
+    readonly traceId?: string;
+    /** Session ID if available */
+    readonly sessionId?: string;
+    /** Timestamp when context was created */
+    readonly createdAt: number;
+}
+/**
+ * Create a TenantContext from a validated JWT payload.
+ *
+ * This is the ONLY legitimate way to create a TenantContext.
+ * The JWT must already be validated (signature verified, not expired).
+ *
+ * @param jwt - Validated JWT payload (must have passed signature verification)
+ * @param options - Additional context options
+ * @returns Immutable TenantContext
+ *
+ * @example
+ * // After JWT verification in middleware:
+ * const ctx = createTenantContext(validatedJwt, { traceId: request.id });
+ * request.tenantContext = ctx;
+ */
+export declare function createTenantContext(jwt: ValidatedJwtPayload, options?: {
+    traceId?: string;
+    sessionId?: string;
+}): TenantContext;
+/**
+ * Extend FastifyRequest with tenant context
+ */
+declare module 'fastify' {
+    interface FastifyRequest {
+        /**
+         * Validated tenant context from JWT.
+         * Only available after `requireTenantContext` middleware.
+         */
+        tenantContext?: TenantContext;
+    }
+}
+/**
+ * Extract and validate tenant context from JWT token.
+ *
+ * This middleware:
+ * 1. Extracts the Bearer token from Authorization header
+ * 2. Verifies the JWT signature
+ * 3. Validates required claims (sub, tid)
+ * 4. Creates an immutable TenantContext
+ * 5. Attaches it to request.tenantContext
+ *
+ * SECURITY: Tenant ID is extracted ONLY from the JWT, never from
+ * request body, query params, or other user-controlled input.
+ *
+ * @example
+ * // Register as route preHandler
+ * fastify.post('/api/v1/policies', {
+ *   preHandler: [requireTenantContext],
+ * }, async (request, reply) => {
+ *   const ctx = request.tenantContext!;
+ *   const policy = await policyService.create(ctx, input);
+ * });
+ */
+export declare function requireTenantContext(request: FastifyRequest, reply: FastifyReply): Promise<void>;
+/**
+ * Get the tenant context from a request, throwing if not available.
+ *
+ * Use this in route handlers after `requireTenantContext` middleware.
+ *
+ * @param request - Fastify request
+ * @returns TenantContext
+ * @throws UnauthorizedError if context is not set
+ *
+ * @example
+ * fastify.get('/policies', {
+ *   preHandler: [requireTenantContext],
+ * }, async (request) => {
+ *   const ctx = getTenantContext(request);
+ *   return policyService.list(ctx);
+ * });
+ */
+export declare function getTenantContext(request: FastifyRequest): TenantContext;
+/**
+ * Check if user has any of the specified roles
+ */
+export declare function hasRole(ctx: TenantContext, ...roles: string[]): boolean;
+/**
+ * Check if user has all of the specified permissions
+ */
+export declare function hasPermission(ctx: TenantContext, ...permissions: string[]): boolean;
+/**
+ * Check if user has any of the specified permissions
+ */
+export declare function hasAnyPermission(ctx: TenantContext, ...permissions: string[]): boolean;
+/**
+ * Check if user is an admin (has admin or super_admin role)
+ */
+export declare function isAdmin(ctx: TenantContext): boolean;
+/**
+ * Check if user is a super admin (cross-tenant access)
+ */
+export declare function isSuperAdmin(ctx: TenantContext): boolean;
+/**
+ * Create a tenant context for system operations (internal use only).
+ *
+ * WARNING: This bypasses JWT validation and should ONLY be used for:
+ * - Background jobs
+ * - Internal service-to-service calls
+ * - Scheduled tasks
+ *
+ * NEVER use this for handling user requests.
+ *
+ * @internal
+ */
+export declare function createSystemTenantContext(tenantId: string, options?: {
+    userId?: string;
+    roles?: string[];
+    traceId?: string;
+}): TenantContext;
+/**
+ * Extract raw tenant ID from context for legacy code migration.
+ *
+ * @deprecated Use TenantContext directly in service methods.
+ *             This function exists only for incremental migration.
+ *
+ * @param ctx - TenantContext
+ * @returns Raw tenant ID string
+ */
+export declare function extractTenantId(ctx: TenantContext): ID;
+/**
+ * Extract raw user ID from context for legacy code migration.
+ *
+ * @deprecated Use TenantContext directly in service methods.
+ *
+ * @param ctx - TenantContext
+ * @returns Raw user ID string
+ */
+export declare function extractUserId(ctx: TenantContext): ID;
+export {};
+//# sourceMappingURL=tenant-context.d.ts.map

package/dist/common/tenant-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-context.d.ts","sourceRoot":"","sources":["../../src/common/tenant-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC5D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,YAAY,CAAC;AAQrC;;;GAGG;AACH,OAAO,CAAC,MAAM,aAAa,EAAE,OAAO,MAAM,CAAC;AAE3C;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,CAAA;CAAE,CAAC;AAE5E;;GAEG;AACH,OAAO,CAAC,MAAM,WAAW,EAAE,OAAO,MAAM,CAAC;AAEzC;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,CAAC,WAAW,CAAC,EAAE,IAAI,CAAA;CAAE,CAAC;AAExE;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,6CAA6C;IAC7C,GAAG,EAAE,MAAM,CAAC;IACZ,qCAAqC;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,0BAA0B;IAC1B,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,gCAAgC;IAChC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,gCAAgC;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,iCAAiC;IACjC,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;GAEG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;EAOpC,CAAC;AAMH;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,aAAa;IAC5B,mDAAmD;IACnD,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,iDAAiD;IACjD,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,gCAAgC;IAChC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,sCAAsC;IACtC,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,uCAAuC;IACvC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,8BAA8B;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,yCAAyC;IACzC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAsBD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,mBAAmB,EACxB,OAAO,CAAC,EAAE;IACR,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GACA,aAAa,CA0Bf;AAMD;;GAEG;AACH,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,cAAc;QACtB;;;WAGG;QACH,aAAa,CAAC,EAAE,aAAa,CAAC;KAC/B;CACF;AAMD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,YAAY,GAClB,OAAO,CAAC,IAAI,CAAC,CAuDf;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,cAAc,GAAG,aAAa,CAKvE;AAMD;;GAEG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAEvE;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,WAAW,EAAE,MAAM,EAAE,GAAG,OAAO,CAEnF;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,WAAW,EAAE,MAAM,EAAE,GAAG,OAAO,CAEtF;AAED;;GAEG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAEnD;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAExD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;IACR,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GACA,aAAa,CAmBf;AAMD;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,aAAa,GAAG,EAAE,CAEtD;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,aAAa,GAAG,EAAE,CAEpD"}

package/dist/common/tenant-context.js

@@ -0,0 +1,259 @@
+/**
+ * Tenant Context - Secure Tenant ID Handling
+ *
+ * Provides branded types and secure context creation to prevent
+ * tenant ID injection attacks. Tenant IDs can ONLY be extracted
+ * from validated JWT tokens, never from request parameters or body.
+ *
+ * HIGH SECURITY: Prevents cross-tenant data access vulnerability.
+ *
+ * @packageDocumentation
+ */
+import { z } from 'zod';
+import { createLogger } from './logger.js';
+import { UnauthorizedError } from './errors.js';
+const logger = createLogger({ component: 'tenant-context' });
+/**
+ * Zod schema for validating JWT payload for tenant context
+ */
+export const validatedJwtPayloadSchema = z.object({
+    sub: z.string().min(1, 'Subject (sub) claim is required'),
+    tid: z.string().min(1, 'Tenant ID (tid) claim is required'),
+    iat: z.number().int().positive('Issued at (iat) must be a positive integer'),
+    exp: z.number().int().positive('Expiration (exp) must be a positive integer'),
+    roles: z.array(z.string()).optional().default([]),
+    permissions: z.array(z.string()).optional().default([]),
+});
+/**
+ * Internal function to brand a string as ValidatedTenantId.
+ * This should ONLY be called after JWT validation.
+ *
+ * @internal
+ */
+function brandTenantId(id) {
+    return id;
+}
+/**
+ * Internal function to brand a string as ValidatedUserId.
+ * This should ONLY be called after JWT validation.
+ *
+ * @internal
+ */
+function brandUserId(id) {
+    return id;
+}
+/**
+ * Create a TenantContext from a validated JWT payload.
+ *
+ * This is the ONLY legitimate way to create a TenantContext.
+ * The JWT must already be validated (signature verified, not expired).
+ *
+ * @param jwt - Validated JWT payload (must have passed signature verification)
+ * @param options - Additional context options
+ * @returns Immutable TenantContext
+ *
+ * @example
+ * // After JWT verification in middleware:
+ * const ctx = createTenantContext(validatedJwt, { traceId: request.id });
+ * request.tenantContext = ctx;
+ */
+export function createTenantContext(jwt, options) {
+    // Validate the JWT payload structure
+    const validated = validatedJwtPayloadSchema.parse(jwt);
+    // Create immutable context with branded IDs
+    const context = Object.freeze({
+        tenantId: brandTenantId(validated.tid),
+        userId: brandUserId(validated.sub),
+        roles: Object.freeze([...(validated.roles ?? [])]),
+        permissions: Object.freeze([...(validated.permissions ?? [])]),
+        traceId: options?.traceId,
+        sessionId: options?.sessionId,
+        createdAt: Date.now(),
+    });
+    logger.debug({
+        tenantId: validated.tid,
+        userId: validated.sub,
+        roles: validated.roles,
+        traceId: options?.traceId,
+    }, 'TenantContext created from validated JWT');
+    return context;
+}
+// =============================================================================
+// MIDDLEWARE
+// =============================================================================
+/**
+ * Extract and validate tenant context from JWT token.
+ *
+ * This middleware:
+ * 1. Extracts the Bearer token from Authorization header
+ * 2. Verifies the JWT signature
+ * 3. Validates required claims (sub, tid)
+ * 4. Creates an immutable TenantContext
+ * 5. Attaches it to request.tenantContext
+ *
+ * SECURITY: Tenant ID is extracted ONLY from the JWT, never from
+ * request body, query params, or other user-controlled input.
+ *
+ * @example
+ * // Register as route preHandler
+ * fastify.post('/api/v1/policies', {
+ *   preHandler: [requireTenantContext],
+ * }, async (request, reply) => {
+ *   const ctx = request.tenantContext!;
+ *   const policy = await policyService.create(ctx, input);
+ * });
+ */
+export async function requireTenantContext(request, reply) {
+    try {
+        // Use Fastify's JWT verification (signature + expiration)
+        const jwt = await request.jwtVerify();
+        // Validate required claims
+        const validation = validatedJwtPayloadSchema.safeParse(jwt);
+        if (!validation.success) {
+            logger.warn({
+                errors: validation.error.errors,
+                requestId: request.id,
+            }, 'SECURITY: JWT missing required tenant claims');
+            reply.status(401).send({
+                error: {
+                    code: 'INVALID_TOKEN',
+                    message: 'Token missing required tenant claims',
+                },
+            });
+            return;
+        }
+        // Create immutable tenant context
+        request.tenantContext = createTenantContext(validation.data, {
+            traceId: request.id,
+        });
+        logger.debug({
+            tenantId: request.tenantContext.tenantId,
+            userId: request.tenantContext.userId,
+            requestId: request.id,
+        }, 'Tenant context extracted from JWT');
+    }
+    catch (error) {
+        // Handle JWT verification errors
+        logger.warn({
+            error: error instanceof Error ? error.message : 'Unknown error',
+            requestId: request.id,
+        }, 'SECURITY: JWT verification failed');
+        reply.status(401).send({
+            error: {
+                code: 'UNAUTHORIZED',
+                message: 'Invalid or expired token',
+            },
+        });
+    }
+}
+/**
+ * Get the tenant context from a request, throwing if not available.
+ *
+ * Use this in route handlers after `requireTenantContext` middleware.
+ *
+ * @param request - Fastify request
+ * @returns TenantContext
+ * @throws UnauthorizedError if context is not set
+ *
+ * @example
+ * fastify.get('/policies', {
+ *   preHandler: [requireTenantContext],
+ * }, async (request) => {
+ *   const ctx = getTenantContext(request);
+ *   return policyService.list(ctx);
+ * });
+ */
+export function getTenantContext(request) {
+    if (!request.tenantContext) {
+        throw new UnauthorizedError('Tenant context not available - ensure requireTenantContext middleware is used');
+    }
+    return request.tenantContext;
+}
+// =============================================================================
+// UTILITY FUNCTIONS
+// =============================================================================
+/**
+ * Check if user has any of the specified roles
+ */
+export function hasRole(ctx, ...roles) {
+    return roles.some((role) => ctx.roles.includes(role));
+}
+/**
+ * Check if user has all of the specified permissions
+ */
+export function hasPermission(ctx, ...permissions) {
+    return permissions.every((perm) => ctx.permissions.includes(perm));
+}
+/**
+ * Check if user has any of the specified permissions
+ */
+export function hasAnyPermission(ctx, ...permissions) {
+    return permissions.some((perm) => ctx.permissions.includes(perm));
+}
+/**
+ * Check if user is an admin (has admin or super_admin role)
+ */
+export function isAdmin(ctx) {
+    return hasRole(ctx, 'admin', 'super_admin', 'tenant:admin');
+}
+/**
+ * Check if user is a super admin (cross-tenant access)
+ */
+export function isSuperAdmin(ctx) {
+    return hasRole(ctx, 'super_admin');
+}
+/**
+ * Create a tenant context for system operations (internal use only).
+ *
+ * WARNING: This bypasses JWT validation and should ONLY be used for:
+ * - Background jobs
+ * - Internal service-to-service calls
+ * - Scheduled tasks
+ *
+ * NEVER use this for handling user requests.
+ *
+ * @internal
+ */
+export function createSystemTenantContext(tenantId, options) {
+    logger.info({
+        tenantId,
+        userId: options?.userId ?? 'system',
+        traceId: options?.traceId,
+        caller: new Error().stack?.split('\n')[2]?.trim(),
+    }, 'AUDIT: System tenant context created (bypassing JWT)');
+    return Object.freeze({
+        tenantId: brandTenantId(tenantId),
+        userId: brandUserId(options?.userId ?? 'system'),
+        roles: Object.freeze(options?.roles ?? ['system']),
+        permissions: Object.freeze(['*']),
+        traceId: options?.traceId,
+        createdAt: Date.now(),
+    });
+}
+// =============================================================================
+// LEGACY COMPATIBILITY
+// =============================================================================
+/**
+ * Extract raw tenant ID from context for legacy code migration.
+ *
+ * @deprecated Use TenantContext directly in service methods.
+ *             This function exists only for incremental migration.
+ *
+ * @param ctx - TenantContext
+ * @returns Raw tenant ID string
+ */
+export function extractTenantId(ctx) {
+    return ctx.tenantId;
+}
+/**
+ * Extract raw user ID from context for legacy code migration.
+ *
+ * @deprecated Use TenantContext directly in service methods.
+ *
+ * @param ctx - TenantContext
+ * @returns Raw user ID string
+ */
+export function extractUserId(ctx) {
+    return ctx.userId;
+}
+//# sourceMappingURL=tenant-context.js.map

package/dist/common/tenant-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-context.js","sourceRoot":"","sources":["../../src/common/tenant-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAkB,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAGhE,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC;AA4D7D;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,iCAAiC,CAAC;IACzD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,mCAAmC,CAAC;IAC3D,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,4CAA4C,CAAC;IAC5E,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,6CAA6C,CAAC;IAC7E,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACjD,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;CACxD,CAAC,CAAC;AAsCH;;;;;GAKG;AACH,SAAS,aAAa,CAAC,EAAU;IAC/B,OAAO,EAAuB,CAAC;AACjC,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,EAAU;IAC7B,OAAO,EAAqB,CAAC;AAC/B,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAwB,EACxB,OAGC;IAED,qCAAqC;IACrC,MAAM,SAAS,GAAG,yBAAyB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAEvD,4CAA4C;IAC5C,MAAM,OAAO,GAAkB,MAAM,CAAC,MAAM,CAAC;QAC3C,QAAQ,EAAE,aAAa,CAAC,SAAS,CAAC,GAAG,CAAC;QACtC,MAAM,EAAE,WAAW,CAAC,SAAS,CAAC,GAAG,CAAC;QAClC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;QAClD,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC;QAC9D,OAAO,EAAE,OAAO,EAAE,OAAO;QACzB,SAAS,EAAE,OAAO,EAAE,SAAS;QAC7B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACtB,CAAC,CAAC;IAEH,MAAM,CAAC,KAAK,CACV;QACE,QAAQ,EAAE,SAAS,CAAC,GAAG;QACvB,MAAM,EAAE,SAAS,CAAC,GAAG;QACrB,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,OAAO,EAAE,OAAO,EAAE,OAAO;KAC1B,EACD,0CAA0C,CAC3C,CAAC;IAEF,OAAO,OAAO,CAAC;AACjB,CAAC;AAmBD,gFAAgF;AAChF,aAAa;AACb,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAuB,EACvB,KAAmB;IAEnB,IAAI,CAAC;QACH,0DAA0D;QAC1D,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,SAAS,EAAuB,CAAC;QAE3D,2BAA2B;QAC3B,MAAM,UAAU,GAAG,yBAAyB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC5D,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;YACxB,MAAM,CAAC,IAAI,CACT;gBACE,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,MAAM;gBAC/B,SAAS,EAAE,OAAO,CAAC,EAAE;aACtB,EACD,8CAA8C,CAC/C,CAAC;YAEF,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACrB,KAAK,EAAE;oBACL,IAAI,EAAE,eAAe;oBACrB,OAAO,EAAE,sCAAsC;iBAChD;aACF,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,kCAAkC;QAClC,OAAO,CAAC,aAAa,GAAG,mBAAmB,CAAC,UAAU,CAAC,IAA2B,EAAE;YAClF,OAAO,EAAE,OAAO,CAAC,EAAE;SACpB,CAAC,CAAC;QAEH,MAAM,CAAC,KAAK,CACV;YACE,QAAQ,EAAE,OAAO,CAAC,aAAa,CAAC,QAAQ;YACxC,MAAM,EAAE,OAAO,CAAC,aAAa,CAAC,MAAM;YACpC,SAAS,EAAE,OAAO,CAAC,EAAE;SACtB,EACD,mCAAmC,CACpC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,iCAAiC;QACjC,MAAM,CAAC,IAAI,CACT;YACE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;YAC/D,SAAS,EAAE,OAAO,CAAC,EAAE;SACtB,EACD,mCAAmC,CACpC,CAAC;QAEF,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACrB,KAAK,EAAE;gBACL,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,0BAA0B;aACpC;SACF,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAuB;IACtD,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QAC3B,MAAM,IAAI,iBAAiB,CAAC,+EAA+E,CAAC,CAAC;IAC/G,CAAC;IACD,OAAO,OAAO,CAAC,aAAa,CAAC;AAC/B,CAAC;AAED,gFAAgF;AAChF,oBAAoB;AACpB,gFAAgF;AAEhF;;GAEG;AACH,MAAM,UAAU,OAAO,CAAC,GAAkB,EAAE,GAAG,KAAe;IAC5D,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AACxD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,GAAkB,EAAE,GAAG,WAAqB;IACxE,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AACrE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAkB,EAAE,GAAG,WAAqB;IAC3E,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AACpE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,OAAO,CAAC,GAAkB;IACxC,OAAO,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC;AAC9D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,GAAkB;IAC7C,OAAO,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAAgB,EAChB,OAIC;IAED,MAAM,CAAC,IAAI,CACT;QACE,QAAQ;QACR,MAAM,EAAE,OAAO,EAAE,MAAM,IAAI,QAAQ;QACnC,OAAO,EAAE,OAAO,EAAE,OAAO;QACzB,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;KAClD,EACD,sDAAsD,CACvD,CAAC;IAEF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,QAAQ,EAAE,aAAa,CAAC,QAAQ,CAAC;QACjC,MAAM,EAAE,WAAW,CAAC,OAAO,EAAE,MAAM,IAAI,QAAQ,CAAC;QAChD,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,IAAI,CAAC,QAAQ,CAAC,CAAC;QAClD,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC;QACjC,OAAO,EAAE,OAAO,EAAE,OAAO;QACzB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACtB,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAChF,uBAAuB;AACvB,gFAAgF;AAEhF;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,GAAkB;IAChD,OAAO,GAAG,CAAC,QAAkB,CAAC;AAChC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,GAAkB;IAC9C,OAAO,GAAG,CAAC,MAAgB,CAAC;AAC9B,CAAC"}

package/dist/common/tenant-verification.d.ts

@@ -0,0 +1,86 @@
+/**
+ * Tenant Membership Verification Service
+ *
+ * Provides secure verification that a user is a member of a tenant before
+ * allowing access to tenant-scoped resources. Uses Redis caching for performance.
+ *
+ * SECURITY: This service is critical for preventing cross-tenant data exposure.
+ * The JWT tenantId claim cannot be trusted alone - it must be verified against
+ * actual membership records.
+ *
+ * @packageDocumentation
+ */
+/**
+ * Tenant membership verification result
+ */
+export interface TenantMembershipResult {
+    /** Whether the user is a member of the tenant */
+    isMember: boolean;
+    /** The user's role in the tenant (if member) */
+    role?: string;
+    /** Whether the result was served from cache */
+    cached: boolean;
+}
+/**
+ * Verify that a user is a member of a tenant.
+ *
+ * This function first checks Redis cache for a cached membership result.
+ * If not cached, it queries the database and caches the result.
+ *
+ * @param userId - The user ID from the JWT `sub` claim
+ * @param tenantId - The tenant ID from the JWT `tenantId` claim
+ * @returns Promise resolving to membership verification result
+ *
+ * @example
+ * ```typescript
+ * const result = await verifyTenantMembership(userId, tenantId);
+ * if (!result.isMember) {
+ *   throw new ForbiddenError('User is not a member of this tenant');
+ * }
+ * ```
+ */
+export declare function verifyTenantMembership(userId: string, tenantId: string): Promise<TenantMembershipResult>;
+/**
+ * Verify tenant membership and throw ForbiddenError if user is not a member.
+ *
+ * This is a convenience function that combines verification with error handling
+ * for use in request handlers.
+ *
+ * @param userId - The user ID from the JWT `sub` claim
+ * @param tenantId - The tenant ID from the JWT `tenantId` claim
+ * @throws ForbiddenError if the user is not a member of the tenant
+ *
+ * @example
+ * ```typescript
+ * // In a request handler:
+ * await requireTenantMembership(user.sub, payload.tenantId);
+ * // If we reach here, user is verified as tenant member
+ * ```
+ */
+export declare function requireTenantMembership(userId: string, tenantId: string): Promise<void>;
+/**
+ * Invalidate the cached membership for a user-tenant pair.
+ *
+ * Call this when a user's membership changes (added, removed, or role changed).
+ *
+ * @param userId - The user ID
+ * @param tenantId - The tenant ID
+ */
+export declare function invalidateMembershipCache(userId: string, tenantId: string): Promise<void>;
+/**
+ * Invalidate all cached memberships for a user.
+ *
+ * Call this when a user is removed from the system or all their memberships change.
+ *
+ * @param userId - The user ID
+ */
+export declare function invalidateUserMembershipCache(userId: string): Promise<void>;
+/**
+ * Invalidate all cached memberships for a tenant.
+ *
+ * Call this when tenant membership rules change globally.
+ *
+ * @param tenantId - The tenant ID
+ */
+export declare function invalidateTenantMembershipCache(tenantId: string): Promise<void>;
+//# sourceMappingURL=tenant-verification.d.ts.map

package/dist/common/tenant-verification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-verification.d.ts","sourceRoot":"","sources":["../../src/common/tenant-verification.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAwBH;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,iDAAiD;IACjD,QAAQ,EAAE,OAAO,CAAC;IAClB,gDAAgD;IAChD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+CAA+C;IAC/C,MAAM,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,sBAAsB,CAAC,CAuEjC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAaf;AAED;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAaf;AAED;;;;;;GAMG;AACH,wBAAsB,6BAA6B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBjF;AAED;;;;;;GAMG;AACH,wBAAsB,+BAA+B,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBrF"}