@vorionsys/platform-core 0.1.0

package/dist/security/security-service.js

@@ -0,0 +1,531 @@
+/**
+ * Security Service - Main Coordinator
+ *
+ * Orchestrates all CAR security hardening components:
+ * - DPoP proof validation
+ * - TEE attestation verification
+ * - Pairwise DID management
+ * - Revocation enforcement
+ * - Token lifetime validation
+ * - Introspection for high-value operations
+ *
+ * Provides unified security context validation and pre-request checks
+ * based on trust tier requirements.
+ *
+ * Security Conformance Levels:
+ * - SH-1 (Basic): DPoP, short-lived tokens (T2)
+ * - SH-2 (Standard): SH-1 + pairwise DIDs, recursive revocation (T3)
+ * - SH-3 (Hardened): SH-2 + TEE binding, sync revocation checks (T4-T5)
+ *
+ * @packageDocumentation
+ */
+import { createLogger } from '../common/logger.js';
+import { VorionError } from '../common/errors.js';
+import { Counter, Histogram } from 'prom-client';
+import { vorionRegistry } from '../common/metrics-registry.js';
+import { SecurityConformanceLevel, getSecurityRequirementsForTier, securityContextSchema, securityValidationResultSchema, preRequestResultSchema, highValueCheckResultSchema, incomingRequestSchema, } from './types.js';
+import { createDPoPService } from './dpop.js';
+import { createTEEBindingService } from './tee.js';
+import { createPairwiseDIDService } from './pairwise-did.js';
+import { createRevocationService } from './revocation.js';
+import { createTokenLifetimeService } from './token-lifetime.js';
+import { createTokenIntrospectionService } from './introspection.js';
+const logger = createLogger({ component: 'security-service' });
+// =============================================================================
+// Metrics
+// =============================================================================
+const securityValidations = new Counter({
+    name: 'vorion_security_validations_total',
+    help: 'Total security context validations',
+    labelNames: ['result', 'tier', 'conformance_level'],
+    registers: [vorionRegistry],
+});
+const securityValidationDuration = new Histogram({
+    name: 'vorion_security_validation_duration_seconds',
+    help: 'Duration of security context validation',
+    labelNames: ['tier'],
+    buckets: [0.001, 0.005, 0.01, 0.025, 0.05, 0.1, 0.25],
+    registers: [vorionRegistry],
+});
+const preRequestChecks = new Counter({
+    name: 'vorion_security_pre_request_checks_total',
+    help: 'Total pre-request security checks',
+    labelNames: ['result', 'tier'],
+    registers: [vorionRegistry],
+});
+const highValueOperationChecks = new Counter({
+    name: 'vorion_security_high_value_operation_checks_total',
+    help: 'Total high-value operation security checks',
+    labelNames: ['result', 'tier', 'operation_type'],
+    registers: [vorionRegistry],
+});
+// =============================================================================
+// Errors
+// =============================================================================
+/**
+ * Security validation error
+ */
+export class SecurityValidationError extends VorionError {
+    errors;
+    code = 'SECURITY_VALIDATION_ERROR';
+    statusCode = 403;
+    constructor(message, errors) {
+        super(message, { errors });
+        this.errors = errors;
+        this.name = 'SecurityValidationError';
+    }
+}
+// =============================================================================
+// Security Service
+// =============================================================================
+/**
+ * Security Service - Main coordinator for CAR security hardening
+ *
+ * @example
+ * ```typescript
+ * const security = new SecurityService(
+ *   dpopService,
+ *   teeService,
+ *   pairwiseDIDService,
+ *   revocationService,
+ *   tokenLifetimeService,
+ *   introspectionService
+ * );
+ *
+ * // Validate complete security context
+ * const result = await security.validateSecurityContext(context);
+ *
+ * // Pre-request security check
+ * const preResult = await security.preRequestCheck(request);
+ *
+ * // High-value operation check
+ * const highValueResult = await security.highValueOperationCheck(operation, agent);
+ * ```
+ */
+export class SecurityService {
+    dpop;
+    tee;
+    pairwiseDID;
+    revocation;
+    tokenLifetime;
+    introspection;
+    /**
+     * Create a new security service
+     *
+     * @param dpop - DPoP service
+     * @param tee - TEE binding service
+     * @param pairwiseDID - Pairwise DID service
+     * @param revocation - Revocation service
+     * @param tokenLifetime - Token lifetime service
+     * @param introspection - Token introspection service
+     */
+    constructor(dpop, tee, pairwiseDID, revocation, tokenLifetime, introspection) {
+        this.dpop = dpop;
+        this.tee = tee;
+        this.pairwiseDID = pairwiseDID;
+        this.revocation = revocation;
+        this.tokenLifetime = tokenLifetime;
+        this.introspection = introspection;
+        logger.info('Security service initialized');
+    }
+    /**
+     * Validate complete security context
+     *
+     * Performs comprehensive validation based on trust tier requirements:
+     * - Token lifetime validation
+     * - Revocation status check
+     * - DPoP proof validation (T2+)
+     * - TEE attestation validation (T4+)
+     * - Pairwise DID validation (T3+ with sensitive data)
+     *
+     * @param context - Security context to validate
+     * @returns Validation result
+     */
+    async validateSecurityContext(context) {
+        const startTime = Date.now();
+        const errors = [];
+        const warnings = [];
+        // Validate context format
+        try {
+            securityContextSchema.parse(context);
+        }
+        catch (error) {
+            errors.push({
+                code: 'INVALID_CONTEXT',
+                message: 'Invalid security context format',
+                component: 'token',
+            });
+            return this.buildValidationResult(false, errors, warnings, context.agent.trustTier);
+        }
+        const tier = context.agent.trustTier;
+        const requirements = this.getRequirements(tier);
+        try {
+            // 1. Token lifetime validation
+            const tokenPayload = this.extractTokenPayload(context.accessToken);
+            if (tokenPayload) {
+                const isHighValue = this.tokenLifetime.isHighValueOperation(context.request);
+                const lifetimeResult = this.tokenLifetime.validateLifetime(tokenPayload, 'access', isHighValue);
+                if (!lifetimeResult.valid) {
+                    errors.push({
+                        code: lifetimeResult.errorCode ?? 'TOKEN_LIFETIME_ERROR',
+                        message: lifetimeResult.error ?? 'Token lifetime validation failed',
+                        component: 'token',
+                    });
+                }
+                if (lifetimeResult.shouldRefresh) {
+                    warnings.push('Token should be refreshed soon');
+                }
+            }
+            else {
+                errors.push({
+                    code: 'INVALID_TOKEN',
+                    message: 'Could not parse access token',
+                    component: 'token',
+                });
+            }
+            // 2. Revocation status check
+            const revocationStatus = await this.revocation.checkRevocationStatus(context.agent.did, tier);
+            if (revocationStatus.status === 'revoked') {
+                errors.push({
+                    code: 'AGENT_REVOKED',
+                    message: `Agent has been revoked: ${revocationStatus.reason ?? 'No reason provided'}`,
+                    component: 'revocation',
+                });
+            }
+            // 3. DPoP validation (T2+)
+            if (requirements.dpopRequired) {
+                if (!context.dpopProof) {
+                    errors.push({
+                        code: 'DPOP_REQUIRED',
+                        message: 'DPoP proof required for this trust tier',
+                        component: 'dpop',
+                    });
+                }
+                else {
+                    // Extract token confirmation claim for binding validation
+                    const tokenCnf = tokenPayload?.cnf;
+                    const dpopValid = await this.dpop.validateBoundToken(context.accessToken, context.dpopProof, context.request.method, context.request.uri, tokenCnf);
+                    if (!dpopValid) {
+                        errors.push({
+                            code: 'DPOP_VALIDATION_FAILED',
+                            message: 'DPoP proof validation failed',
+                            component: 'dpop',
+                        });
+                    }
+                }
+            }
+            // 4. TEE attestation validation (T4+)
+            if (requirements.teeRequired) {
+                if (!context.teeAttestation) {
+                    errors.push({
+                        code: 'TEE_REQUIRED',
+                        message: 'TEE attestation required for this trust tier',
+                        component: 'tee',
+                    });
+                }
+                else {
+                    const teeResult = await this.tee.verifyAttestation(context.teeAttestation);
+                    if (!teeResult.valid) {
+                        errors.push({
+                            code: 'TEE_VALIDATION_FAILED',
+                            message: teeResult.reason ?? 'TEE attestation validation failed',
+                            component: 'tee',
+                        });
+                    }
+                    // Verify key binding if agent has TEE binding
+                    if (context.agent.teeBinding) {
+                        const bindingValid = await this.tee.verifyKeyBinding(context.agent.teeBinding);
+                        if (!bindingValid) {
+                            errors.push({
+                                code: 'TEE_BINDING_INVALID',
+                                message: 'TEE key binding is invalid or expired',
+                                component: 'tee',
+                            });
+                        }
+                    }
+                }
+            }
+            // 5. Pairwise DID validation (T3+ with sensitive data)
+            if (requirements.pairwiseRequired && context.request.dataClassification) {
+                const pairwiseRequired = this.pairwiseDID.isRequired(context.request.dataClassification);
+                if (pairwiseRequired && !context.pairwiseDid) {
+                    errors.push({
+                        code: 'PAIRWISE_DID_REQUIRED',
+                        message: `Pairwise DID required for ${context.request.dataClassification} data`,
+                        component: 'pairwise',
+                    });
+                }
+            }
+            // 6. Introspection for high-value operations (T4+ or L3+ operations)
+            if (this.tokenLifetime.requiresIntrospection(context.request, tier)) {
+                const introspectionResult = await this.introspection.introspect(context.accessToken);
+                if (!introspectionResult.active) {
+                    errors.push({
+                        code: 'TOKEN_INACTIVE',
+                        message: 'Token is no longer active (introspection check)',
+                        component: 'introspection',
+                    });
+                }
+            }
+        }
+        catch (error) {
+            logger.error({ error, tier }, 'Error during security validation');
+            errors.push({
+                code: 'VALIDATION_ERROR',
+                message: error instanceof Error ? error.message : 'Unknown error during validation',
+                component: 'token',
+            });
+        }
+        finally {
+            const duration = (Date.now() - startTime) / 1000;
+            securityValidationDuration.observe({ tier: tier.toString() }, duration);
+        }
+        const valid = errors.length === 0;
+        const conformanceLevel = valid ? requirements.conformanceLevel : SecurityConformanceLevel.NONE;
+        securityValidations.inc({
+            result: valid ? 'success' : 'failure',
+            tier: tier.toString(),
+            conformance_level: conformanceLevel,
+        });
+        return this.buildValidationResult(valid, errors, warnings, tier);
+    }
+    /**
+     * Pre-request security check
+     *
+     * Lightweight check to determine if a request can proceed
+     * and what security requirements apply.
+     *
+     * @param request - Incoming request
+     * @returns Pre-request check result
+     */
+    async preRequestCheck(request) {
+        // Validate request format
+        try {
+            incomingRequestSchema.parse(request);
+        }
+        catch {
+            return {
+                allow: false,
+                denyReason: 'Invalid request format',
+                requirements: getSecurityRequirementsForTier(0),
+            };
+        }
+        // Extract tier from authorization (simplified - in production, decode JWT)
+        const tier = this.extractTierFromRequest(request);
+        const requirements = this.getRequirements(tier);
+        const requiredActions = [];
+        // Check what's missing
+        if (requirements.dpopRequired && !request.dpop) {
+            requiredActions.push('dpop');
+        }
+        if (requirements.teeRequired) {
+            // Would check for TEE attestation header
+            requiredActions.push('tee_attestation');
+        }
+        // Determine if we can proceed
+        const allow = requiredActions.length === 0;
+        preRequestChecks.inc({
+            result: allow ? 'allow' : 'requirements_missing',
+            tier: tier.toString(),
+        });
+        const result = {
+            allow,
+            requirements,
+        };
+        if (requiredActions.length > 0) {
+            result.requiredActions = requiredActions;
+        }
+        if (!allow) {
+            result.denyReason = `Missing required security controls: ${requiredActions.join(', ')}`;
+        }
+        preRequestResultSchema.parse(result);
+        return result;
+    }
+    /**
+     * High-value operation check
+     *
+     * Performs enhanced security checks for high-value operations:
+     * - Token introspection (sync)
+     * - Synchronous revocation check
+     * - Short token TTL validation
+     *
+     * @param operation - Action request
+     * @param agent - Agent identity
+     * @returns High-value check result
+     */
+    async highValueOperationCheck(operation, agent) {
+        const tier = agent.trustTier;
+        let introspectionPerformed = false;
+        let syncRevocationCheck = false;
+        let tokenTTLRemaining;
+        try {
+            // 1. Synchronous revocation check
+            if (this.revocation.requiresSyncCheck(tier, true)) {
+                const isRevoked = await this.revocation.syncRevocationCheck(agent.did);
+                syncRevocationCheck = true;
+                if (isRevoked) {
+                    highValueOperationChecks.inc({
+                        result: 'revoked',
+                        tier: tier.toString(),
+                        operation_type: operation.actionType,
+                    });
+                    return {
+                        allow: false,
+                        introspectionPerformed,
+                        syncRevocationCheck,
+                        denyReason: 'Agent has been revoked',
+                    };
+                }
+            }
+            // 2. Token introspection for T2+ high-value operations
+            if (this.tokenLifetime.requiresIntrospection(operation, tier)) {
+                // Note: In a real implementation, we'd get the token from the context
+                // For this check, we assume the caller will handle introspection separately
+                introspectionPerformed = true;
+            }
+            highValueOperationChecks.inc({
+                result: 'allow',
+                tier: tier.toString(),
+                operation_type: operation.actionType,
+            });
+            const result = {
+                allow: true,
+                introspectionPerformed,
+                syncRevocationCheck,
+            };
+            if (tokenTTLRemaining !== undefined) {
+                result.tokenTTLRemaining = tokenTTLRemaining;
+            }
+            highValueCheckResultSchema.parse(result);
+            return result;
+        }
+        catch (error) {
+            logger.error({ error, operation, agentDid: agent.did }, 'High-value operation check failed');
+            highValueOperationChecks.inc({
+                result: 'error',
+                tier: tier.toString(),
+                operation_type: operation.actionType,
+            });
+            return {
+                allow: false,
+                introspectionPerformed,
+                syncRevocationCheck,
+                denyReason: error instanceof Error ? error.message : 'Check failed',
+            };
+        }
+    }
+    /**
+     * Get security requirements for a trust tier
+     *
+     * @param tier - Trust tier
+     * @returns Security requirements
+     */
+    getRequirements(tier) {
+        return getSecurityRequirementsForTier(tier);
+    }
+    /**
+     * Get the DPoP service
+     */
+    getDPoPService() {
+        return this.dpop;
+    }
+    /**
+     * Get the TEE binding service
+     */
+    getTEEBindingService() {
+        return this.tee;
+    }
+    /**
+     * Get the pairwise DID service
+     */
+    getPairwiseDIDService() {
+        return this.pairwiseDID;
+    }
+    /**
+     * Get the revocation service
+     */
+    getRevocationService() {
+        return this.revocation;
+    }
+    /**
+     * Get the token lifetime service
+     */
+    getTokenLifetimeService() {
+        return this.tokenLifetime;
+    }
+    /**
+     * Get the introspection service
+     */
+    getIntrospectionService() {
+        return this.introspection;
+    }
+    /**
+     * Build validation result
+     */
+    buildValidationResult(valid, errors, warnings, tier) {
+        const requirements = this.getRequirements(tier);
+        const result = {
+            valid,
+            errors,
+            securityLevel: valid ? requirements.conformanceLevel : SecurityConformanceLevel.NONE,
+            warnings,
+            validatedAt: new Date().toISOString(),
+        };
+        securityValidationResultSchema.parse(result);
+        return result;
+    }
+    /**
+     * Extract token payload from JWT
+     */
+    extractTokenPayload(token) {
+        try {
+            const parts = token.split('.');
+            if (parts.length !== 3) {
+                return null;
+            }
+            // Decode payload (second part)
+            const payloadB64 = parts[1];
+            const padding = (4 - (payloadB64.length % 4)) % 4;
+            const padded = payloadB64 + '='.repeat(padding);
+            const base64 = padded.replace(/-/g, '+').replace(/_/g, '/');
+            const decoded = atob(base64);
+            return JSON.parse(decoded);
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Extract trust tier from request (simplified)
+     */
+    extractTierFromRequest(request) {
+        // In a real implementation, this would decode the JWT and extract
+        // the trust tier from claims. For now, default to T2.
+        // The actual tier should be determined by the authentication middleware.
+        return 2;
+    }
+    /**
+     * Destroy the service and cleanup all resources.
+     * This stops all cleanup intervals and clears caches.
+     */
+    destroy() {
+        // Destroy services with cleanup intervals/caches
+        this.dpop.destroy();
+        this.introspection.destroy();
+        this.revocation.destroy();
+        logger.info('Security service destroyed');
+    }
+}
+/**
+ * Create a security service with default configuration
+ */
+export function createSecurityService(options) {
+    const dpop = createDPoPService(options?.dpopConfig);
+    const tee = createTEEBindingService(options?.teeConfig);
+    const pairwiseDID = createPairwiseDIDService(options?.pairwiseDIDConfig);
+    const revocation = createRevocationService(options?.revocationConfig);
+    const tokenLifetime = createTokenLifetimeService(options?.tokenLifetimeConfig);
+    const introspection = createTokenIntrospectionService(options?.introspectionEndpoint ?? 'http://localhost:4000/oauth2/introspect');
+    return new SecurityService(dpop, tee, pairwiseDID, revocation, tokenLifetime, introspection);
+}
+//# sourceMappingURL=security-service.js.map

package/dist/security/security-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-service.js","sourceRoot":"","sources":["../../src/security/security-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAWL,wBAAwB,EACxB,8BAA8B,EAC9B,qBAAqB,EACrB,8BAA8B,EAC9B,sBAAsB,EACtB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAe,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC3D,OAAO,EAAqB,uBAAuB,EAAE,MAAM,UAAU,CAAC;AACtE,OAAO,EAAsB,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AACjF,OAAO,EAAqB,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EAAwB,0BAA0B,EAAmB,MAAM,qBAAqB,CAAC;AACxG,OAAO,EAA6B,+BAA+B,EAAE,MAAM,oBAAoB,CAAC;AAEhG,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC,CAAC;AAE/D,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAEhF,MAAM,mBAAmB,GAAG,IAAI,OAAO,CAAC;IACtC,IAAI,EAAE,mCAAmC;IACzC,IAAI,EAAE,oCAAoC;IAC1C,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,mBAAmB,CAAU;IAC5D,SAAS,EAAE,CAAC,cAAc,CAAC;CAC5B,CAAC,CAAC;AAEH,MAAM,0BAA0B,GAAG,IAAI,SAAS,CAAC;IAC/C,IAAI,EAAE,6CAA6C;IACnD,IAAI,EAAE,yCAAyC;IAC/C,UAAU,EAAE,CAAC,MAAM,CAAU;IAC7B,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC;IACrD,SAAS,EAAE,CAAC,cAAc,CAAC;CAC5B,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,IAAI,OAAO,CAAC;IACnC,IAAI,EAAE,0CAA0C;IAChD,IAAI,EAAE,mCAAmC;IACzC,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAU;IACvC,SAAS,EAAE,CAAC,cAAc,CAAC;CAC5B,CAAC,CAAC;AAEH,MAAM,wBAAwB,GAAG,IAAI,OAAO,CAAC;IAC3C,IAAI,EAAE,mDAAmD;IACzD,IAAI,EAAE,4CAA4C;IAClD,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,gBAAgB,CAAU;IACzD,SAAS,EAAE,CAAC,cAAc,CAAC;CAC5B,CAAC,CAAC;AAEH,gFAAgF;AAChF,SAAS;AACT,gFAAgF;AAEhF;;GAEG;AACH,MAAM,OAAO,uBAAwB,SAAQ,WAAW;IAMpC;IALT,IAAI,GAAG,2BAA2B,CAAC;IACnC,UAAU,GAAG,GAAG,CAAC;IAE1B,YACE,OAAe,EACC,MAA8D;QAE9E,KAAK,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAFX,WAAM,GAAN,MAAM,CAAwD;QAG9E,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED,gFAAgF;AAChF,mBAAmB;AACnB,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,OAAO,eAAe;IAYhB;IACA;IACA;IACA;IACA;IACA;IAhBV;;;;;;;;;OASG;IACH,YACU,IAAiB,EACjB,GAAsB,EACtB,WAA+B,EAC/B,UAA6B,EAC7B,aAAmC,EACnC,aAAwC;QALxC,SAAI,GAAJ,IAAI,CAAa;QACjB,QAAG,GAAH,GAAG,CAAmB;QACtB,gBAAW,GAAX,WAAW,CAAoB;QAC/B,eAAU,GAAV,UAAU,CAAmB;QAC7B,kBAAa,GAAb,aAAa,CAAsB;QACnC,kBAAa,GAAb,aAAa,CAA2B;QAEhD,MAAM,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,uBAAuB,CAC3B,OAAwB;QAExB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAkC,EAAE,CAAC;QACjD,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,0BAA0B;QAC1B,IAAI,CAAC;YACH,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,iCAAiC;gBAC1C,SAAS,EAAE,OAAO;aACnB,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACtF,CAAC;QAED,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;QACrC,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAEhD,IAAI,CAAC;YACH,+BAA+B;YAC/B,MAAM,YAAY,GAAG,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YACnE,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,oBAAoB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;gBAC7E,MAAM,cAAc,GAAG,IAAI,CAAC,aAAa,CAAC,gBAAgB,CACxD,YAAY,EACZ,QAAQ,EACR,WAAW,CACZ,CAAC;gBAEF,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;oBAC1B,MAAM,CAAC,IAAI,CAAC;wBACV,IAAI,EAAE,cAAc,CAAC,SAAS,IAAI,sBAAsB;wBACxD,OAAO,EAAE,cAAc,CAAC,KAAK,IAAI,kCAAkC;wBACnE,SAAS,EAAE,OAAO;qBACnB,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,cAAc,CAAC,aAAa,EAAE,CAAC;oBACjC,QAAQ,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;gBAClD,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,eAAe;oBACrB,OAAO,EAAE,8BAA8B;oBACvC,SAAS,EAAE,OAAO;iBACnB,CAAC,CAAC;YACL,CAAC;YAED,6BAA6B;YAC7B,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAClE,OAAO,CAAC,KAAK,CAAC,GAAG,EACjB,IAAI,CACL,CAAC;YACF,IAAI,gBAAgB,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC1C,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,eAAe;oBACrB,OAAO,EAAE,2BAA2B,gBAAgB,CAAC,MAAM,IAAI,oBAAoB,EAAE;oBACrF,SAAS,EAAE,YAAY;iBACxB,CAAC,CAAC;YACL,CAAC;YAED,2BAA2B;YAC3B,IAAI,YAAY,CAAC,YAAY,EAAE,CAAC;gBAC9B,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;oBACvB,MAAM,CAAC,IAAI,CAAC;wBACV,IAAI,EAAE,eAAe;wBACrB,OAAO,EAAE,yCAAyC;wBAClD,SAAS,EAAE,MAAM;qBAClB,CAAC,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACN,0DAA0D;oBAC1D,MAAM,QAAQ,GAAG,YAAY,EAAE,GAAmC,CAAC;oBAEnE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAClD,OAAO,CAAC,WAAW,EACnB,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,OAAO,CAAC,MAAM,EACtB,OAAO,CAAC,OAAO,CAAC,GAAG,EACnB,QAAQ,CACT,CAAC;oBAEF,IAAI,CAAC,SAAS,EAAE,CAAC;wBACf,MAAM,CAAC,IAAI,CAAC;4BACV,IAAI,EAAE,wBAAwB;4BAC9B,OAAO,EAAE,8BAA8B;4BACvC,SAAS,EAAE,MAAM;yBAClB,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;YAED,sCAAsC;YACtC,IAAI,YAAY,CAAC,WAAW,EAAE,CAAC;gBAC7B,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;oBAC5B,MAAM,CAAC,IAAI,CAAC;wBACV,IAAI,EAAE,cAAc;wBACpB,OAAO,EAAE,8CAA8C;wBACvD,SAAS,EAAE,KAAK;qBACjB,CAAC,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACN,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;oBAC3E,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;wBACrB,MAAM,CAAC,IAAI,CAAC;4BACV,IAAI,EAAE,uBAAuB;4BAC7B,OAAO,EAAE,SAAS,CAAC,MAAM,IAAI,mCAAmC;4BAChE,SAAS,EAAE,KAAK;yBACjB,CAAC,CAAC;oBACL,CAAC;oBAED,8CAA8C;oBAC9C,IAAI,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;wBAC7B,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;wBAC/E,IAAI,CAAC,YAAY,EAAE,CAAC;4BAClB,MAAM,CAAC,IAAI,CAAC;gCACV,IAAI,EAAE,qBAAqB;gCAC3B,OAAO,EAAE,uCAAuC;gCAChD,SAAS,EAAE,KAAK;6BACjB,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YAED,uDAAuD;YACvD,IAAI,YAAY,CAAC,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC;gBACxE,MAAM,gBAAgB,GAAG,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;gBAEzF,IAAI,gBAAgB,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;oBAC7C,MAAM,CAAC,IAAI,CAAC;wBACV,IAAI,EAAE,uBAAuB;wBAC7B,OAAO,EAAE,6BAA6B,OAAO,CAAC,OAAO,CAAC,kBAAkB,OAAO;wBAC/E,SAAS,EAAE,UAAU;qBACtB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,qEAAqE;YACrE,IAAI,IAAI,CAAC,aAAa,CAAC,qBAAqB,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;gBACpE,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;gBACrF,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,CAAC;oBAChC,MAAM,CAAC,IAAI,CAAC;wBACV,IAAI,EAAE,gBAAgB;wBACtB,OAAO,EAAE,iDAAiD;wBAC1D,SAAS,EAAE,eAAe;qBAC3B,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QAEH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,kCAAkC,CAAC,CAAC;YAClE,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,iCAAiC;gBACnF,SAAS,EAAE,OAAO;aACnB,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC;YACjD,0BAA0B,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC1E,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;QAClC,MAAM,gBAAgB,GAAG,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC,CAAC,wBAAwB,CAAC,IAAI,CAAC;QAE/F,mBAAmB,CAAC,GAAG,CAAC;YACtB,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;YACrC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;YACrB,iBAAiB,EAAE,gBAAgB;SACpC,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IACnE,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,eAAe,CAAC,OAAwB;QAC5C,0BAA0B;QAC1B,IAAI,CAAC;YACH,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,UAAU,EAAE,wBAAwB;gBACpC,YAAY,EAAE,8BAA8B,CAAC,CAAC,CAAC;aAChD,CAAC;QACJ,CAAC;QAED,2EAA2E;QAC3E,MAAM,IAAI,GAAG,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAChD,MAAM,eAAe,GAAsE,EAAE,CAAC;QAE9F,uBAAuB;QACvB,IAAI,YAAY,CAAC,YAAY,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAC/C,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC;QAED,IAAI,YAAY,CAAC,WAAW,EAAE,CAAC;YAC7B,yCAAyC;YACzC,eAAe,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC1C,CAAC;QAED,8BAA8B;QAC9B,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,KAAK,CAAC,CAAC;QAE3C,gBAAgB,CAAC,GAAG,CAAC;YACnB,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,sBAAsB;YAChD,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;SACtB,CAAC,CAAC;QAEH,MAAM,MAAM,GAAqB;YAC/B,KAAK;YACL,YAAY;SACb,CAAC;QAEF,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/B,MAAM,CAAC,eAAe,GAAG,eAAe,CAAC;QAC3C,CAAC;QAED,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,CAAC,UAAU,GAAG,uCAAuC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1F,CAAC;QAED,sBAAsB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACrC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,uBAAuB,CAC3B,SAAwB,EACxB,KAAoB;QAEpB,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC;QAC7B,IAAI,sBAAsB,GAAG,KAAK,CAAC;QACnC,IAAI,mBAAmB,GAAG,KAAK,CAAC;QAChC,IAAI,iBAAqC,CAAC;QAE1C,IAAI,CAAC;YACH,kCAAkC;YAClC,IAAI,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;gBAClD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACvE,mBAAmB,GAAG,IAAI,CAAC;gBAE3B,IAAI,SAAS,EAAE,CAAC;oBACd,wBAAwB,CAAC,GAAG,CAAC;wBAC3B,MAAM,EAAE,SAAS;wBACjB,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;wBACrB,cAAc,EAAE,SAAS,CAAC,UAAU;qBACrC,CAAC,CAAC;oBAEH,OAAO;wBACL,KAAK,EAAE,KAAK;wBACZ,sBAAsB;wBACtB,mBAAmB;wBACnB,UAAU,EAAE,wBAAwB;qBACrC,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,uDAAuD;YACvD,IAAI,IAAI,CAAC,aAAa,CAAC,qBAAqB,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC;gBAC9D,sEAAsE;gBACtE,4EAA4E;gBAC5E,sBAAsB,GAAG,IAAI,CAAC;YAChC,CAAC;YAED,wBAAwB,CAAC,GAAG,CAAC;gBAC3B,MAAM,EAAE,OAAO;gBACf,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;gBACrB,cAAc,EAAE,SAAS,CAAC,UAAU;aACrC,CAAC,CAAC;YAEH,MAAM,MAAM,GAAyB;gBACnC,KAAK,EAAE,IAAI;gBACX,sBAAsB;gBACtB,mBAAmB;aACpB,CAAC;YAEF,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;gBACpC,MAAM,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;YAC/C,CAAC;YAED,0BAA0B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACzC,OAAO,MAAM,CAAC;QAEhB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,GAAG,EAAE,EAAE,mCAAmC,CAAC,CAAC;YAE7F,wBAAwB,CAAC,GAAG,CAAC;gBAC3B,MAAM,EAAE,OAAO;gBACf,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;gBACrB,cAAc,EAAE,SAAS,CAAC,UAAU;aACrC,CAAC,CAAC;YAEH,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,sBAAsB;gBACtB,mBAAmB;gBACnB,UAAU,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc;aACpE,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,eAAe,CAAC,IAAe;QAC7B,OAAO,8BAA8B,CAAC,IAAI,CAAC,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,cAAc;QACZ,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED;;OAEG;IACH,oBAAoB;QAClB,OAAO,IAAI,CAAC,GAAG,CAAC;IAClB,CAAC;IAED;;OAEG;IACH,qBAAqB;QACnB,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED;;OAEG;IACH,oBAAoB;QAClB,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,uBAAuB;QACrB,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,uBAAuB;QACrB,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED;;OAEG;IACK,qBAAqB,CAC3B,KAAc,EACd,MAAqC,EACrC,QAAkB,EAClB,IAAe;QAEf,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAEhD,MAAM,MAAM,GAA6B;YACvC,KAAK;YACL,MAAM;YACN,aAAa,EAAE,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC,CAAC,wBAAwB,CAAC,IAAI;YACpF,QAAQ;YACR,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACtC,CAAC;QAEF,8BAA8B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7C,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACK,mBAAmB,CAAC,KAAa;QACvC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,+BAA+B;YAC/B,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;YAC7B,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAClD,MAAM,MAAM,GAAG,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAChD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;YAE7B,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAe,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACK,sBAAsB,CAAC,OAAwB;QACrD,kEAAkE;QAClE,sDAAsD;QACtD,yEAAyE;QACzE,OAAO,CAAC,CAAC;IACX,CAAC;IAED;;;OAGG;IACH,OAAO;QACL,iDAAiD;QACjD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACpB,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QAC1B,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAC5C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAOrC;IACC,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG,uBAAuB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACxD,MAAM,WAAW,GAAG,wBAAwB,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IACzE,MAAM,UAAU,GAAG,uBAAuB,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IACtE,MAAM,aAAa,GAAG,0BAA0B,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAC/E,MAAM,aAAa,GAAG,+BAA+B,CACnD,OAAO,EAAE,qBAAqB,IAAI,yCAAyC,CAC5E,CAAC;IAEF,OAAO,IAAI,eAAe,CACxB,IAAI,EACJ,GAAG,EACH,WAAW,EACX,UAAU,EACV,aAAa,EACb,aAAa,CACd,CAAC;AACJ,CAAC"}

package/dist/security/service-auth/index.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Service-to-Service Authentication Module
+ *
+ * Provides comprehensive service-to-service authentication for Vorion.
+ * Supports HMAC signature-based authentication and JWT token issuance.
+ *
+ * Features:
+ * - Service account management (create, revoke, rotate secrets)
+ * - HMAC-SHA256 request signing and verification
+ * - Short-lived JWT tokens for authenticated services
+ * - IP whitelist validation
+ * - Permission-based access control
+ *
+ * @packageDocumentation
+ * @module security/service-auth
+ */
+export { ServiceAccountStatus, type ServiceAccount, serviceAccountSchema, type CreateServiceAccountInput, createServiceAccountInputSchema, type ServiceAccountCreationResult, type SecretRotationResult, type UpdateServiceAccountInput, updateServiceAccountInputSchema, ServiceAccountError, ServiceAccountNotFoundError, ServiceAccountRevokedError, ServiceAccountSuspendedError, SERVICE_CLIENT_ID_PREFIX, generateClientSecret, generateClientId, hashClientSecret, verifyClientSecret, type IServiceAccountStore, InMemoryServiceAccountStore, ServiceAccountManager, type ServiceAccountManagerConfig, getServiceAccountStore, setServiceAccountStore, getServiceAccountManager, createServiceAccountManager, resetServiceAccountSingletons, } from './service-account.js';
+export { type ServiceTokenPayload, serviceTokenPayloadSchema, type ServiceSignature, serviceSignatureSchema, type TokenVerificationResult, tokenVerificationResultSchema, type SignatureVerificationResult, ServiceTokenError, TokenExpiredError, InvalidSignatureError, SignatureTimestampError, DEFAULT_TOKEN_TTL_SECONDS, MAX_CLOCK_SKEW_SECONDS, MIN_TOKEN_TTL_SECONDS, MAX_TOKEN_TTL_SECONDS, SERVICE_TOKEN_ISSUER, SERVICE_AUTH_HEADERS, ServiceTokenService, type ServiceTokenServiceConfig, serviceTokenServiceConfigSchema, initializeServiceTokenService, getServiceTokenService, createServiceTokenService, resetServiceTokenService, createServiceAuthHeaders, extractServiceIdFromBearer, } from './service-token.js';
+export { type ServiceAuthContext, type ServiceAuthenticatedRequest, type ServiceAuthMiddlewareOptions, ServiceAuthError, MissingAuthHeadersError, InvalidServiceSignatureError, IpNotAllowedError, InsufficientPermissionsError, createServiceAuthMiddleware, requireServicePermissions, requireAnyServicePermission, requireServiceTenant, getServiceAuth, requireServiceAuth, hasServiceAuth, getServiceClientId, getServiceTenantId, getServicePermissions, serviceHasPermission, serviceAuthPlugin, type ServiceAuthPluginOptions, } from './service-auth-middleware.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/security/service-auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/security/service-auth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAMH,OAAO,EAEL,oBAAoB,EACpB,KAAK,cAAc,EACnB,oBAAoB,EACpB,KAAK,yBAAyB,EAC9B,+BAA+B,EAC/B,KAAK,4BAA4B,EACjC,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC9B,+BAA+B,EAG/B,mBAAmB,EACnB,2BAA2B,EAC3B,0BAA0B,EAC1B,4BAA4B,EAG5B,wBAAwB,EAGxB,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAGlB,KAAK,oBAAoB,EACzB,2BAA2B,EAG3B,qBAAqB,EACrB,KAAK,2BAA2B,EAGhC,sBAAsB,EACtB,sBAAsB,EACtB,wBAAwB,EACxB,2BAA2B,EAC3B,6BAA6B,GAC9B,MAAM,sBAAsB,CAAC;AAM9B,OAAO,EAEL,KAAK,mBAAmB,EACxB,yBAAyB,EACzB,KAAK,gBAAgB,EACrB,sBAAsB,EACtB,KAAK,uBAAuB,EAC5B,6BAA6B,EAC7B,KAAK,2BAA2B,EAGhC,iBAAiB,EACjB,iBAAiB,EACjB,qBAAqB,EACrB,uBAAuB,EAGvB,yBAAyB,EACzB,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EAGpB,mBAAmB,EACnB,KAAK,yBAAyB,EAC9B,+BAA+B,EAG/B,6BAA6B,EAC7B,sBAAsB,EACtB,yBAAyB,EACzB,wBAAwB,EAGxB,wBAAwB,EACxB,0BAA0B,GAC3B,MAAM,oBAAoB,CAAC;AAM5B,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EAGjC,gBAAgB,EAChB,uBAAuB,EACvB,4BAA4B,EAC5B,iBAAiB,EACjB,4BAA4B,EAG5B,2BAA2B,EAG3B,yBAAyB,EACzB,2BAA2B,EAC3B,oBAAoB,EAGpB,cAAc,EACd,kBAAkB,EAClB,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAClB,qBAAqB,EACrB,oBAAoB,EAGpB,iBAAiB,EACjB,KAAK,wBAAwB,GAC9B,MAAM,8BAA8B,CAAC"}

package/dist/security/service-auth/index.js

@@ -0,0 +1,61 @@
+/**
+ * Service-to-Service Authentication Module
+ *
+ * Provides comprehensive service-to-service authentication for Vorion.
+ * Supports HMAC signature-based authentication and JWT token issuance.
+ *
+ * Features:
+ * - Service account management (create, revoke, rotate secrets)
+ * - HMAC-SHA256 request signing and verification
+ * - Short-lived JWT tokens for authenticated services
+ * - IP whitelist validation
+ * - Permission-based access control
+ *
+ * @packageDocumentation
+ * @module security/service-auth
+ */
+// =============================================================================
+// Service Account Management
+// =============================================================================
+export { 
+// Types
+ServiceAccountStatus, serviceAccountSchema, createServiceAccountInputSchema, updateServiceAccountInputSchema, 
+// Errors
+ServiceAccountError, ServiceAccountNotFoundError, ServiceAccountRevokedError, ServiceAccountSuspendedError, 
+// Constants
+SERVICE_CLIENT_ID_PREFIX, 
+// Utility functions
+generateClientSecret, generateClientId, hashClientSecret, verifyClientSecret, InMemoryServiceAccountStore, 
+// Manager
+ServiceAccountManager, 
+// Singleton management
+getServiceAccountStore, setServiceAccountStore, getServiceAccountManager, createServiceAccountManager, resetServiceAccountSingletons, } from './service-account.js';
+// =============================================================================
+// Service Token Management
+// =============================================================================
+export { serviceTokenPayloadSchema, serviceSignatureSchema, tokenVerificationResultSchema, 
+// Errors
+ServiceTokenError, TokenExpiredError, InvalidSignatureError, SignatureTimestampError, 
+// Constants
+DEFAULT_TOKEN_TTL_SECONDS, MAX_CLOCK_SKEW_SECONDS, MIN_TOKEN_TTL_SECONDS, MAX_TOKEN_TTL_SECONDS, SERVICE_TOKEN_ISSUER, SERVICE_AUTH_HEADERS, 
+// Service
+ServiceTokenService, serviceTokenServiceConfigSchema, 
+// Singleton management
+initializeServiceTokenService, getServiceTokenService, createServiceTokenService, resetServiceTokenService, 
+// Utility functions
+createServiceAuthHeaders, extractServiceIdFromBearer, } from './service-token.js';
+// =============================================================================
+// Service Authentication Middleware
+// =============================================================================
+export { 
+// Errors
+ServiceAuthError, MissingAuthHeadersError, InvalidServiceSignatureError, IpNotAllowedError, InsufficientPermissionsError, 
+// Middleware factory
+createServiceAuthMiddleware, 
+// Helper middleware
+requireServicePermissions, requireAnyServicePermission, requireServiceTenant, 
+// Request helpers
+getServiceAuth, requireServiceAuth, hasServiceAuth, getServiceClientId, getServiceTenantId, getServicePermissions, serviceHasPermission, 
+// Fastify plugin
+serviceAuthPlugin, } from './service-auth-middleware.js';
+//# sourceMappingURL=index.js.map

package/dist/security/service-auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/security/service-auth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,gFAAgF;AAChF,6BAA6B;AAC7B,gFAAgF;AAEhF,OAAO;AACL,QAAQ;AACR,oBAAoB,EAEpB,oBAAoB,EAEpB,+BAA+B,EAI/B,+BAA+B;AAE/B,SAAS;AACT,mBAAmB,EACnB,2BAA2B,EAC3B,0BAA0B,EAC1B,4BAA4B;AAE5B,YAAY;AACZ,wBAAwB;AAExB,oBAAoB;AACpB,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAIlB,2BAA2B;AAE3B,UAAU;AACV,qBAAqB;AAGrB,uBAAuB;AACvB,sBAAsB,EACtB,sBAAsB,EACtB,wBAAwB,EACxB,2BAA2B,EAC3B,6BAA6B,GAC9B,MAAM,sBAAsB,CAAC;AAE9B,gFAAgF;AAChF,2BAA2B;AAC3B,gFAAgF;AAEhF,OAAO,EAGL,yBAAyB,EAEzB,sBAAsB,EAEtB,6BAA6B;AAG7B,SAAS;AACT,iBAAiB,EACjB,iBAAiB,EACjB,qBAAqB,EACrB,uBAAuB;AAEvB,YAAY;AACZ,yBAAyB,EACzB,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB;AAEpB,UAAU;AACV,mBAAmB,EAEnB,+BAA+B;AAE/B,uBAAuB;AACvB,6BAA6B,EAC7B,sBAAsB,EACtB,yBAAyB,EACzB,wBAAwB;AAExB,oBAAoB;AACpB,wBAAwB,EACxB,0BAA0B,GAC3B,MAAM,oBAAoB,CAAC;AAE5B,gFAAgF;AAChF,oCAAoC;AACpC,gFAAgF;AAEhF,OAAO;AAML,SAAS;AACT,gBAAgB,EAChB,uBAAuB,EACvB,4BAA4B,EAC5B,iBAAiB,EACjB,4BAA4B;AAE5B,qBAAqB;AACrB,2BAA2B;AAE3B,oBAAoB;AACpB,yBAAyB,EACzB,2BAA2B,EAC3B,oBAAoB;AAEpB,kBAAkB;AAClB,cAAc,EACd,kBAAkB,EAClB,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAClB,qBAAqB,EACrB,oBAAoB;AAEpB,iBAAiB;AACjB,iBAAiB,GAElB,MAAM,8BAA8B,CAAC"}