@vorionsys/platform-core 0.1.0

package/dist/common/tenant-verification.js

@@ -0,0 +1,184 @@
+/**
+ * Tenant Membership Verification Service
+ *
+ * Provides secure verification that a user is a member of a tenant before
+ * allowing access to tenant-scoped resources. Uses Redis caching for performance.
+ *
+ * SECURITY: This service is critical for preventing cross-tenant data exposure.
+ * The JWT tenantId claim cannot be trusted alone - it must be verified against
+ * actual membership records.
+ *
+ * @packageDocumentation
+ */
+import { eq, and } from 'drizzle-orm';
+import { getDatabase } from './db.js';
+import { getRedis } from './redis.js';
+import { createLogger } from './logger.js';
+import { ForbiddenError } from './errors.js';
+import { tenantMemberships } from '../intent/schema.js';
+const logger = createLogger({ component: 'tenant-verification' });
+/** Cache TTL in seconds (5 minutes) */
+const MEMBERSHIP_CACHE_TTL_SECONDS = 300;
+/** Redis key prefix for membership cache */
+const CACHE_KEY_PREFIX = 'tenant:membership:';
+/**
+ * Build the Redis cache key for a user-tenant membership
+ */
+function buildCacheKey(userId, tenantId) {
+    return `${CACHE_KEY_PREFIX}${userId}:${tenantId}`;
+}
+/**
+ * Verify that a user is a member of a tenant.
+ *
+ * This function first checks Redis cache for a cached membership result.
+ * If not cached, it queries the database and caches the result.
+ *
+ * @param userId - The user ID from the JWT `sub` claim
+ * @param tenantId - The tenant ID from the JWT `tenantId` claim
+ * @returns Promise resolving to membership verification result
+ *
+ * @example
+ * ```typescript
+ * const result = await verifyTenantMembership(userId, tenantId);
+ * if (!result.isMember) {
+ *   throw new ForbiddenError('User is not a member of this tenant');
+ * }
+ * ```
+ */
+export async function verifyTenantMembership(userId, tenantId) {
+    const cacheKey = buildCacheKey(userId, tenantId);
+    const redis = getRedis();
+    try {
+        // Check cache first
+        const cached = await redis.get(cacheKey);
+        if (cached !== null) {
+            const parsed = JSON.parse(cached);
+            logger.debug({ userId, tenantId, cached: true, isMember: parsed.isMember }, 'Tenant membership cache hit');
+            return {
+                isMember: parsed.isMember,
+                role: parsed.role,
+                cached: true,
+            };
+        }
+    }
+    catch (error) {
+        // Log but don't fail on cache errors - fall through to DB check
+        logger.warn({ userId, tenantId, error: error instanceof Error ? error.message : 'Unknown error' }, 'Failed to read from membership cache');
+    }
+    // Cache miss - query database
+    const db = getDatabase();
+    const membership = await db
+        .select({
+        role: tenantMemberships.role,
+    })
+        .from(tenantMemberships)
+        .where(and(eq(tenantMemberships.userId, userId), eq(tenantMemberships.tenantId, tenantId)))
+        .limit(1);
+    const isMember = membership.length > 0;
+    const role = membership[0]?.role;
+    // Cache the result
+    try {
+        const cacheValue = JSON.stringify({ isMember, role });
+        await redis.setex(cacheKey, MEMBERSHIP_CACHE_TTL_SECONDS, cacheValue);
+        logger.debug({ userId, tenantId, isMember, role }, 'Cached tenant membership result');
+    }
+    catch (error) {
+        // Log but don't fail on cache write errors
+        logger.warn({ userId, tenantId, error: error instanceof Error ? error.message : 'Unknown error' }, 'Failed to write to membership cache');
+    }
+    logger.debug({ userId, tenantId, cached: false, isMember, role }, 'Tenant membership database lookup');
+    return {
+        isMember,
+        role,
+        cached: false,
+    };
+}
+/**
+ * Verify tenant membership and throw ForbiddenError if user is not a member.
+ *
+ * This is a convenience function that combines verification with error handling
+ * for use in request handlers.
+ *
+ * @param userId - The user ID from the JWT `sub` claim
+ * @param tenantId - The tenant ID from the JWT `tenantId` claim
+ * @throws ForbiddenError if the user is not a member of the tenant
+ *
+ * @example
+ * ```typescript
+ * // In a request handler:
+ * await requireTenantMembership(user.sub, payload.tenantId);
+ * // If we reach here, user is verified as tenant member
+ * ```
+ */
+export async function requireTenantMembership(userId, tenantId) {
+    const result = await verifyTenantMembership(userId, tenantId);
+    if (!result.isMember) {
+        logger.warn({ userId, tenantId }, 'Cross-tenant access attempt blocked');
+        throw new ForbiddenError('Access denied: user is not a member of this tenant', {
+            userId,
+            tenantId,
+        });
+    }
+}
+/**
+ * Invalidate the cached membership for a user-tenant pair.
+ *
+ * Call this when a user's membership changes (added, removed, or role changed).
+ *
+ * @param userId - The user ID
+ * @param tenantId - The tenant ID
+ */
+export async function invalidateMembershipCache(userId, tenantId) {
+    const cacheKey = buildCacheKey(userId, tenantId);
+    const redis = getRedis();
+    try {
+        await redis.del(cacheKey);
+        logger.debug({ userId, tenantId }, 'Invalidated tenant membership cache');
+    }
+    catch (error) {
+        logger.warn({ userId, tenantId, error: error instanceof Error ? error.message : 'Unknown error' }, 'Failed to invalidate membership cache');
+    }
+}
+/**
+ * Invalidate all cached memberships for a user.
+ *
+ * Call this when a user is removed from the system or all their memberships change.
+ *
+ * @param userId - The user ID
+ */
+export async function invalidateUserMembershipCache(userId) {
+    const redis = getRedis();
+    const pattern = `${CACHE_KEY_PREFIX}${userId}:*`;
+    try {
+        const keys = await redis.keys(pattern);
+        if (keys.length > 0) {
+            await redis.del(...keys);
+            logger.debug({ userId, keysDeleted: keys.length }, 'Invalidated all user membership cache');
+        }
+    }
+    catch (error) {
+        logger.warn({ userId, error: error instanceof Error ? error.message : 'Unknown error' }, 'Failed to invalidate user membership cache');
+    }
+}
+/**
+ * Invalidate all cached memberships for a tenant.
+ *
+ * Call this when tenant membership rules change globally.
+ *
+ * @param tenantId - The tenant ID
+ */
+export async function invalidateTenantMembershipCache(tenantId) {
+    const redis = getRedis();
+    const pattern = `${CACHE_KEY_PREFIX}*:${tenantId}`;
+    try {
+        const keys = await redis.keys(pattern);
+        if (keys.length > 0) {
+            await redis.del(...keys);
+            logger.debug({ tenantId, keysDeleted: keys.length }, 'Invalidated all tenant membership cache');
+        }
+    }
+    catch (error) {
+        logger.warn({ tenantId, error: error instanceof Error ? error.message : 'Unknown error' }, 'Failed to invalidate tenant membership cache');
+    }
+}
+//# sourceMappingURL=tenant-verification.js.map

package/dist/common/tenant-verification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-verification.js","sourceRoot":"","sources":["../../src/common/tenant-verification.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,SAAS,EAAE,qBAAqB,EAAE,CAAC,CAAC;AAElE,uCAAuC;AACvC,MAAM,4BAA4B,GAAG,GAAG,CAAC;AAEzC,4CAA4C;AAC5C,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AAE9C;;GAEG;AACH,SAAS,aAAa,CAAC,MAAc,EAAE,QAAgB;IACrD,OAAO,GAAG,gBAAgB,GAAG,MAAM,IAAI,QAAQ,EAAE,CAAC;AACpD,CAAC;AAcD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,MAAc,EACd,QAAgB;IAEhB,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;IAEzB,IAAI,CAAC;QACH,oBAAoB;QACpB,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACzC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAyC,CAAC;YAC1E,MAAM,CAAC,KAAK,CACV,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,EAC7D,6BAA6B,CAC9B,CAAC;YACF,OAAO;gBACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,MAAM,EAAE,IAAI;aACb,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,gEAAgE;QAChE,MAAM,CAAC,IAAI,CACT,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,EACrF,sCAAsC,CACvC,CAAC;IACJ,CAAC;IAED,8BAA8B;IAC9B,MAAM,EAAE,GAAG,WAAW,EAAE,CAAC;IACzB,MAAM,UAAU,GAAG,MAAM,EAAE;SACxB,MAAM,CAAC;QACN,IAAI,EAAE,iBAAiB,CAAC,IAAI;KAC7B,CAAC;SACD,IAAI,CAAC,iBAAiB,CAAC;SACvB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,EACpC,EAAE,CAAC,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CACzC,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;IAEjC,mBAAmB;IACnB,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,MAAM,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,4BAA4B,EAAE,UAAU,CAAC,CAAC;QACtE,MAAM,CAAC,KAAK,CACV,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,EACpC,iCAAiC,CAClC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,2CAA2C;QAC3C,MAAM,CAAC,IAAI,CACT,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,EACrF,qCAAqC,CACtC,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,KAAK,CACV,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,EACnD,mCAAmC,CACpC,CAAC;IAEF,OAAO;QACL,QAAQ;QACR,IAAI;QACJ,MAAM,EAAE,KAAK;KACd,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAAc,EACd,QAAgB;IAEhB,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAE9D,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrB,MAAM,CAAC,IAAI,CACT,EAAE,MAAM,EAAE,QAAQ,EAAE,EACpB,qCAAqC,CACtC,CAAC;QACF,MAAM,IAAI,cAAc,CAAC,oDAAoD,EAAE;YAC7E,MAAM;YACN,QAAQ;SACT,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,MAAc,EACd,QAAgB;IAEhB,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;IAEzB,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1B,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,qCAAqC,CAAC,CAAC;IAC5E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CACT,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,EACrF,uCAAuC,CACxC,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,MAAc;IAChE,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;IACzB,MAAM,OAAO,GAAG,GAAG,gBAAgB,GAAG,MAAM,IAAI,CAAC;IAEjD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;YACzB,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,uCAAuC,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CACT,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,EAC3E,4CAA4C,CAC7C,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,QAAgB;IACpE,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;IACzB,MAAM,OAAO,GAAG,GAAG,gBAAgB,KAAK,QAAQ,EAAE,CAAC;IAEnD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;YACzB,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,yCAAyC,CAAC,CAAC;QAClG,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CACT,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,EAC7E,8CAA8C,CAC/C,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/common/timeout.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Promise timeout utility
+ *
+ * Provides a mechanism to wrap promises with timeout behavior
+ * to prevent indefinite hangs during health checks.
+ */
+/**
+ * Wraps a promise with a timeout, rejecting if the operation
+ * takes longer than the specified duration.
+ *
+ * @param promise - The promise to wrap with timeout
+ * @param timeoutMs - Timeout duration in milliseconds
+ * @param errorMessage - Custom error message for timeout
+ * @returns The result of the promise if it resolves before timeout
+ * @throws Error if the operation times out
+ */
+export declare function withTimeout<T>(promise: Promise<T>, timeoutMs: number, errorMessage?: string): Promise<T>;
+/**
+ * TimeoutError class for type checking timeout errors
+ */
+export declare class TimeoutError extends Error {
+    readonly timeoutMs: number;
+    constructor(message: string, timeoutMs: number);
+}
+/**
+ * Wraps a promise with a timeout, returning a TimeoutError instance
+ * for easier type checking.
+ *
+ * @param promise - The promise to wrap with timeout
+ * @param timeoutMs - Timeout duration in milliseconds
+ * @param errorMessage - Custom error message for timeout
+ * @returns The result of the promise if it resolves before timeout
+ * @throws TimeoutError if the operation times out
+ */
+export declare function withTimeoutTyped<T>(promise: Promise<T>, timeoutMs: number, errorMessage?: string): Promise<T>;
+/**
+ * Check if an error is a timeout error
+ */
+export declare function isTimeoutError(error: unknown): error is TimeoutError;
+//# sourceMappingURL=timeout.d.ts.map

package/dist/common/timeout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"timeout.d.ts","sourceRoot":"","sources":["../../src/common/timeout.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH;;;;;;;;;GASG;AACH,wBAAsB,WAAW,CAAC,CAAC,EACjC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EACnB,SAAS,EAAE,MAAM,EACjB,YAAY,SAAwB,GACnC,OAAO,CAAC,CAAC,CAAC,CAkBZ;AAED;;GAEG;AACH,qBAAa,YAAa,SAAQ,KAAK;aACQ,SAAS,EAAE,MAAM;gBAAlD,OAAO,EAAE,MAAM,EAAkB,SAAS,EAAE,MAAM;CAI/D;AAED;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CAAC,CAAC,EACtC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EACnB,SAAS,EAAE,MAAM,EACjB,YAAY,SAAwB,GACnC,OAAO,CAAC,CAAC,CAAC,CAkBZ;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,YAAY,CAEpE"}

package/dist/common/timeout.js

@@ -0,0 +1,82 @@
+/**
+ * Promise timeout utility
+ *
+ * Provides a mechanism to wrap promises with timeout behavior
+ * to prevent indefinite hangs during health checks.
+ */
+import { createLogger } from './logger.js';
+const timeoutLogger = createLogger({ component: 'timeout' });
+/**
+ * Wraps a promise with a timeout, rejecting if the operation
+ * takes longer than the specified duration.
+ *
+ * @param promise - The promise to wrap with timeout
+ * @param timeoutMs - Timeout duration in milliseconds
+ * @param errorMessage - Custom error message for timeout
+ * @returns The result of the promise if it resolves before timeout
+ * @throws Error if the operation times out
+ */
+export async function withTimeout(promise, timeoutMs, errorMessage = 'Operation timed out') {
+    let timeoutId;
+    const timeoutPromise = new Promise((_, reject) => {
+        timeoutId = setTimeout(() => {
+            timeoutLogger.warn({ timeoutMs, errorMessage }, 'Operation timed out');
+            reject(new Error(errorMessage));
+        }, timeoutMs);
+    });
+    try {
+        const result = await Promise.race([promise, timeoutPromise]);
+        clearTimeout(timeoutId);
+        return result;
+    }
+    catch (error) {
+        clearTimeout(timeoutId);
+        throw error;
+    }
+}
+/**
+ * TimeoutError class for type checking timeout errors
+ */
+export class TimeoutError extends Error {
+    timeoutMs;
+    constructor(message, timeoutMs) {
+        super(message);
+        this.timeoutMs = timeoutMs;
+        this.name = 'TimeoutError';
+    }
+}
+/**
+ * Wraps a promise with a timeout, returning a TimeoutError instance
+ * for easier type checking.
+ *
+ * @param promise - The promise to wrap with timeout
+ * @param timeoutMs - Timeout duration in milliseconds
+ * @param errorMessage - Custom error message for timeout
+ * @returns The result of the promise if it resolves before timeout
+ * @throws TimeoutError if the operation times out
+ */
+export async function withTimeoutTyped(promise, timeoutMs, errorMessage = 'Operation timed out') {
+    let timeoutId;
+    const timeoutPromise = new Promise((_, reject) => {
+        timeoutId = setTimeout(() => {
+            timeoutLogger.warn({ timeoutMs, errorMessage }, 'Operation timed out');
+            reject(new TimeoutError(errorMessage, timeoutMs));
+        }, timeoutMs);
+    });
+    try {
+        const result = await Promise.race([promise, timeoutPromise]);
+        clearTimeout(timeoutId);
+        return result;
+    }
+    catch (error) {
+        clearTimeout(timeoutId);
+        throw error;
+    }
+}
+/**
+ * Check if an error is a timeout error
+ */
+export function isTimeoutError(error) {
+    return error instanceof TimeoutError;
+}
+//# sourceMappingURL=timeout.js.map

package/dist/common/timeout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"timeout.js","sourceRoot":"","sources":["../../src/common/timeout.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,aAAa,GAAG,YAAY,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;AAE7D;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAmB,EACnB,SAAiB,EACjB,YAAY,GAAG,qBAAqB;IAEpC,IAAI,SAAyB,CAAC;IAE9B,MAAM,cAAc,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;QACtD,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;YAC1B,aAAa,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,qBAAqB,CAAC,CAAC;YACvE,MAAM,CAAC,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;QAClC,CAAC,EAAE,SAAS,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC;QAC7D,YAAY,CAAC,SAAU,CAAC,CAAC;QACzB,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,YAAY,CAAC,SAAU,CAAC,CAAC;QACzB,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,YAAa,SAAQ,KAAK;IACQ;IAA7C,YAAY,OAAe,EAAkB,SAAiB;QAC5D,KAAK,CAAC,OAAO,CAAC,CAAC;QAD4B,cAAS,GAAT,SAAS,CAAQ;QAE5D,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAmB,EACnB,SAAiB,EACjB,YAAY,GAAG,qBAAqB;IAEpC,IAAI,SAAyB,CAAC;IAE9B,MAAM,cAAc,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;QACtD,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;YAC1B,aAAa,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,qBAAqB,CAAC,CAAC;YACvE,MAAM,CAAC,IAAI,YAAY,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC,CAAC;QACpD,CAAC,EAAE,SAAS,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC;QAC7D,YAAY,CAAC,SAAU,CAAC,CAAC;QACzB,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,YAAY,CAAC,SAAU,CAAC,CAAC;QACzB,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,OAAO,KAAK,YAAY,YAAY,CAAC;AACvC,CAAC"}

package/dist/common/token-revocation.d.ts

@@ -0,0 +1,44 @@
+/**
+ * JWT Token Revocation Service
+ *
+ * Uses Redis to maintain a blacklist of revoked tokens.
+ * Tokens are stored with TTL matching their expiration time.
+ *
+ * @packageDocumentation
+ */
+export interface TokenRevocationService {
+    revokeToken(jti: string, expiresAt: Date): Promise<void>;
+    isRevoked(jti: string): Promise<boolean>;
+    revokeAllForUser(userId: string, issuedBefore: Date): Promise<void>;
+    isUserTokenRevoked(userId: string, issuedAt: Date): Promise<boolean>;
+}
+/**
+ * Create a token revocation service instance
+ */
+export declare function createTokenRevocationService(): TokenRevocationService;
+/**
+ * Validate that a token has a JTI claim
+ * Returns the jti if valid, or handles missing jti based on environment
+ */
+export declare function validateJti(payload: {
+    jti?: string;
+}, config: {
+    env: string;
+    jwt: {
+        requireJti: boolean;
+    };
+}): {
+    valid: boolean;
+    jti?: string;
+    error?: string;
+};
+/**
+ * Record a token revocation audit event
+ */
+export declare function recordTokenRevocationAudit(tenantId: string, userId: string, eventType: 'token.revoked' | 'token.user_all_revoked', actor: {
+    type: 'user' | 'service' | 'system';
+    id: string;
+    name?: string;
+    ip?: string;
+}, metadata?: Record<string, unknown>): Promise<void>;
+//# sourceMappingURL=token-revocation.d.ts.map

package/dist/common/token-revocation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-revocation.d.ts","sourceRoot":"","sources":["../../src/common/token-revocation.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAaH,MAAM,WAAW,sBAAsB;IACrC,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzC,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACtE;AAmID;;GAEG;AACH,wBAAgB,4BAA4B,IAAI,sBAAsB,CAOrE;AAED;;;GAGG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,EACzB,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE;QAAE,UAAU,EAAE,OAAO,CAAA;KAAE,CAAA;CAAE,GACpD;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAclD;AAED;;GAEG;AACH,wBAAsB,0BAA0B,CAC9C,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,eAAe,GAAG,wBAAwB,EACrD,KAAK,EAAE;IAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,QAAQ,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,EACtF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACjC,OAAO,CAAC,IAAI,CAAC,CAmBf"}

package/dist/common/token-revocation.js

@@ -0,0 +1,169 @@
+/**
+ * JWT Token Revocation Service
+ *
+ * Uses Redis to maintain a blacklist of revoked tokens.
+ * Tokens are stored with TTL matching their expiration time.
+ *
+ * @packageDocumentation
+ */
+import { getRedis } from './redis.js';
+import { createLogger } from './logger.js';
+import { getConfig } from './config.js';
+import { tokensRevokedTotal } from './metrics-registry.js';
+import { createAuditService } from '../audit/service.js';
+const logger = createLogger({ component: 'token-revocation' });
+const REVOKED_TOKEN_PREFIX = 'token:revoked:';
+const USER_REVOCATION_PREFIX = 'token:user-revocation:';
+/**
+ * Revoke a single token by its JTI (JWT ID)
+ *
+ * @param jti - The JWT ID claim from the token
+ * @param expiresAt - When the token expires (used for TTL)
+ */
+async function revokeToken(jti, expiresAt) {
+    const redis = getRedis();
+    // Calculate TTL in seconds (time until token expires naturally)
+    const ttlMs = expiresAt.getTime() - Date.now();
+    // Don't store if token is already expired
+    if (ttlMs <= 0) {
+        logger.debug({ jti }, 'Token already expired, skipping revocation storage');
+        return;
+    }
+    const ttlSeconds = Math.ceil(ttlMs / 1000);
+    const key = `${REVOKED_TOKEN_PREFIX}${jti}`;
+    // Store with automatic expiration
+    await redis.setex(key, ttlSeconds, '1');
+    // Increment metrics
+    tokensRevokedTotal.inc({ type: 'single' });
+    logger.info({ jti, ttlSeconds }, 'Token revoked');
+}
+/**
+ * Check if a token has been revoked
+ *
+ * @param jti - The JWT ID claim from the token
+ * @returns true if the token is revoked, false otherwise
+ */
+async function isRevoked(jti) {
+    const redis = getRedis();
+    const key = `${REVOKED_TOKEN_PREFIX}${jti}`;
+    const result = await redis.exists(key);
+    return result === 1;
+}
+/**
+ * Revoke all tokens for a user issued before a specific time
+ *
+ * This is useful for security incidents where all sessions need to be terminated.
+ * Instead of tracking every token, we store a timestamp and check against it.
+ *
+ * @param userId - The user ID (sub claim)
+ * @param issuedBefore - Revoke all tokens issued before this time
+ */
+async function revokeAllForUser(userId, issuedBefore) {
+    const redis = getRedis();
+    const config = getConfig();
+    const key = `${USER_REVOCATION_PREFIX}${userId}`;
+    const timestamp = issuedBefore.getTime().toString();
+    // Store with TTL equal to max token lifetime (refresh token expiration)
+    // This ensures the revocation record exists until all affected tokens expire
+    const ttlSeconds = parseExpirationToSeconds(config.jwt.refreshExpiration);
+    await redis.setex(key, ttlSeconds, timestamp);
+    // Increment metrics
+    tokensRevokedTotal.inc({ type: 'user_all' });
+    logger.info({ userId, issuedBefore: issuedBefore.toISOString(), ttlSeconds }, 'All user tokens revoked');
+}
+/**
+ * Check if a user's token was issued before a revocation timestamp
+ *
+ * @param userId - The user ID (sub claim)
+ * @param issuedAt - When the token was issued (iat claim)
+ * @returns true if the token should be considered revoked
+ */
+async function isUserTokenRevoked(userId, issuedAt) {
+    const redis = getRedis();
+    const key = `${USER_REVOCATION_PREFIX}${userId}`;
+    const revocationTimestamp = await redis.get(key);
+    if (!revocationTimestamp) {
+        return false;
+    }
+    const revocationTime = parseInt(revocationTimestamp, 10);
+    return issuedAt.getTime() < revocationTime;
+}
+/**
+ * Parse JWT expiration string to seconds
+ * Supports formats like "1h", "7d", "30m", "3600"
+ */
+function parseExpirationToSeconds(expiration) {
+    const match = expiration.match(/^(\d+)([smhd])?$/);
+    if (!match) {
+        // Default to 7 days if parsing fails
+        logger.warn({ expiration }, 'Could not parse expiration, defaulting to 7 days');
+        return 7 * 24 * 60 * 60;
+    }
+    const value = parseInt(match[1] ?? '0', 10);
+    const unit = match[2] ?? 's';
+    switch (unit) {
+        case 's':
+            return value;
+        case 'm':
+            return value * 60;
+        case 'h':
+            return value * 60 * 60;
+        case 'd':
+            return value * 24 * 60 * 60;
+        default:
+            return value;
+    }
+}
+/**
+ * Create a token revocation service instance
+ */
+export function createTokenRevocationService() {
+    return {
+        revokeToken,
+        isRevoked,
+        revokeAllForUser,
+        isUserTokenRevoked,
+    };
+}
+/**
+ * Validate that a token has a JTI claim
+ * Returns the jti if valid, or handles missing jti based on environment
+ */
+export function validateJti(payload, config) {
+    if (payload.jti) {
+        return { valid: true, jti: payload.jti };
+    }
+    // In production with requireJti enabled, reject tokens without jti
+    if (config.jwt.requireJti && config.env === 'production') {
+        logger.warn('Token missing jti claim in production with requireJti enabled');
+        return { valid: false, error: 'Token missing required jti claim' };
+    }
+    // In development or with requireJti disabled, log warning but allow
+    logger.warn('Token missing jti claim, skipping revocation check');
+    return { valid: true };
+}
+/**
+ * Record a token revocation audit event
+ */
+export async function recordTokenRevocationAudit(tenantId, userId, eventType, actor, metadata) {
+    try {
+        const auditService = createAuditService();
+        const auditInput = {
+            tenantId,
+            eventType,
+            actor,
+            target: { type: 'user', id: userId },
+            action: eventType === 'token.revoked' ? 'revoke_token' : 'revoke_all_tokens',
+            outcome: 'success',
+        };
+        if (metadata) {
+            auditInput.metadata = metadata;
+        }
+        await auditService.record(auditInput);
+    }
+    catch (error) {
+        // Don't fail the revocation if audit logging fails
+        logger.error({ error, eventType, userId }, 'Failed to record token revocation audit');
+    }
+}
+//# sourceMappingURL=token-revocation.js.map

package/dist/common/token-revocation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-revocation.js","sourceRoot":"","sources":["../../src/common/token-revocation.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC,CAAC;AAE/D,MAAM,oBAAoB,GAAG,gBAAgB,CAAC;AAC9C,MAAM,sBAAsB,GAAG,wBAAwB,CAAC;AASxD;;;;;GAKG;AACH,KAAK,UAAU,WAAW,CAAC,GAAW,EAAE,SAAe;IACrD,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;IAEzB,gEAAgE;IAChE,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE/C,0CAA0C;IAC1C,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,oDAAoD,CAAC,CAAC;QAC5E,OAAO;IACT,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,GAAG,oBAAoB,GAAG,GAAG,EAAE,CAAC;IAE5C,kCAAkC;IAClC,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;IAExC,oBAAoB;IACpB,kBAAkB,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IAE3C,MAAM,CAAC,IAAI,CACT,EAAE,GAAG,EAAE,UAAU,EAAE,EACnB,eAAe,CAChB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,SAAS,CAAC,GAAW;IAClC,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;IACzB,MAAM,GAAG,GAAG,GAAG,oBAAoB,GAAG,GAAG,EAAE,CAAC;IAE5C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACvC,OAAO,MAAM,KAAK,CAAC,CAAC;AACtB,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,gBAAgB,CAAC,MAAc,EAAE,YAAkB;IAChE,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;IACzB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAE3B,MAAM,GAAG,GAAG,GAAG,sBAAsB,GAAG,MAAM,EAAE,CAAC;IACjD,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC;IAEpD,wEAAwE;IACxE,6EAA6E;IAC7E,MAAM,UAAU,GAAG,wBAAwB,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAE1E,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IAE9C,oBAAoB;IACpB,kBAAkB,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;IAE7C,MAAM,CAAC,IAAI,CACT,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,CAAC,WAAW,EAAE,EAAE,UAAU,EAAE,EAChE,yBAAyB,CAC1B,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,kBAAkB,CAAC,MAAc,EAAE,QAAc;IAC9D,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;IACzB,MAAM,GAAG,GAAG,GAAG,sBAAsB,GAAG,MAAM,EAAE,CAAC;IAEjD,MAAM,mBAAmB,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAEjD,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,cAAc,GAAG,QAAQ,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;IACzD,OAAO,QAAQ,CAAC,OAAO,EAAE,GAAG,cAAc,CAAC;AAC7C,CAAC;AAED;;;GAGG;AACH,SAAS,wBAAwB,CAAC,UAAkB;IAClD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAEnD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,qCAAqC;QACrC,MAAM,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,EAAE,kDAAkD,CAAC,CAAC;QAChF,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IAC1B,CAAC;IAED,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;IAE7B,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,GAAG;YACN,OAAO,KAAK,CAAC;QACf,KAAK,GAAG;YACN,OAAO,KAAK,GAAG,EAAE,CAAC;QACpB,KAAK,GAAG;YACN,OAAO,KAAK,GAAG,EAAE,GAAG,EAAE,CAAC;QACzB,KAAK,GAAG;YACN,OAAO,KAAK,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;QAC9B;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,4BAA4B;IAC1C,OAAO;QACL,WAAW;QACX,SAAS;QACT,gBAAgB;QAChB,kBAAkB;KACnB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CACzB,OAAyB,EACzB,MAAqD;IAErD,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;IAC3C,CAAC;IAED,mEAAmE;IACnE,IAAI,MAAM,CAAC,GAAG,CAAC,UAAU,IAAI,MAAM,CAAC,GAAG,KAAK,YAAY,EAAE,CAAC;QACzD,MAAM,CAAC,IAAI,CAAC,+DAA+D,CAAC,CAAC;QAC7E,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC;IACrE,CAAC;IAED,oEAAoE;IACpE,MAAM,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;IAClE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,QAAgB,EAChB,MAAc,EACd,SAAqD,EACrD,KAAsF,EACtF,QAAkC;IAElC,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,kBAAkB,EAAE,CAAC;QAC1C,MAAM,UAAU,GAA8C;YAC5D,QAAQ;YACR,SAAS;YACT,KAAK;YACL,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE;YACpC,MAAM,EAAE,SAAS,KAAK,eAAe,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,mBAAmB;YAC5E,OAAO,EAAE,SAAS;SACnB,CAAC;QACF,IAAI,QAAQ,EAAE,CAAC;YACb,UAAU,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACjC,CAAC;QACD,MAAM,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,mDAAmD;QACnD,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,yCAAyC,CAAC,CAAC;IACxF,CAAC;AACH,CAAC"}