@vorionsys/security 1.0.0

package/dist/api/auth.js

@@ -0,0 +1,306 @@
+/**
+ * Authentication Middleware
+ *
+ * Provides JWT-based authentication with tenant context extraction.
+ *
+ * @packageDocumentation
+ */
+import { createLogger } from '../common/logger.js';
+import { getConfig } from '../common/config.js';
+// Import canonical types from @vorion/contracts
+import { authContextSchema, governanceRoleSchema, hierarchyLevelSchema, } from '@vorionsys/contracts/canonical';
+// Re-export canonical types for backwards compatibility
+export { authContextSchema, governanceRoleSchema, hierarchyLevelSchema, };
+const logger = createLogger({ component: 'auth' });
+import { z } from 'zod';
+/**
+ * Zod schema for JWT payload validation
+ * Ensures all required claims are present and properly typed
+ */
+const jwtPayloadSchema = z.object({
+    sub: z.string().min(1, 'Subject (sub) claim is required'),
+    tid: z.string().min(1, 'Tenant ID (tid) claim is required'),
+    iat: z.number().int().positive('Issued at (iat) must be a positive integer'),
+    exp: z.number().int().positive('Expiration (exp) must be a positive integer'),
+    roles: z.array(z.string()).optional(),
+    permissions: z.array(z.string()).optional(),
+});
+/**
+ * Decode and verify JWT token with schema validation
+ * Note: In production, use @fastify/jwt with proper verification
+ */
+function decodeToken(token) {
+    try {
+        // Basic JWT decode (header.payload.signature)
+        const parts = token.split('.');
+        if (parts.length !== 3)
+            return null;
+        const payload = Buffer.from(parts[1], 'base64url').toString('utf-8');
+        const parsed = JSON.parse(payload);
+        // Validate JWT payload against schema
+        const validationResult = jwtPayloadSchema.safeParse(parsed);
+        if (!validationResult.success) {
+            // Log validation failures for security audit
+            logger.warn({
+                errors: validationResult.error.errors.map((e) => ({
+                    path: e.path.join('.'),
+                    message: e.message,
+                })),
+                timestamp: new Date().toISOString(),
+            }, 'SECURITY_AUDIT: JWT payload schema validation failed');
+            return null;
+        }
+        return validationResult.data;
+    }
+    catch (error) {
+        logger.warn({
+            error: error instanceof Error ? error.message : String(error),
+            operation: 'decodeToken',
+            tokenLength: token?.length,
+        }, 'Failed to decode JWT token');
+        return null;
+    }
+}
+/**
+ * Verify JWT signature
+ * Note: This is a placeholder - use @fastify/jwt in production
+ */
+async function verifySignature(token, secret) {
+    try {
+        // SECURITY: Never skip signature verification, even in development
+        // The old dev bypass has been removed for security
+        // If you need to test without real tokens, use the testing mode with mocks
+        // For production, implement proper HMAC verification
+        // This should use crypto.subtle.verify() with the JWT signature
+        const parts = token.split('.');
+        if (parts.length !== 3)
+            return false;
+        const [header, payload, signature] = parts;
+        const data = `${header}.${payload}`;
+        // Use Web Crypto API for verification
+        const encoder = new TextEncoder();
+        const keyData = encoder.encode(secret);
+        const key = await crypto.subtle.importKey('raw', keyData, { name: 'HMAC', hash: 'SHA-256' }, false, ['verify']);
+        const signatureBytes = Buffer.from(signature, 'base64url');
+        return await crypto.subtle.verify('HMAC', key, signatureBytes, encoder.encode(data));
+    }
+    catch (error) {
+        logger.warn({
+            error: error instanceof Error ? error.message : String(error),
+            operation: 'verifySignature',
+        }, 'JWT signature verification failed');
+        return false;
+    }
+}
+/**
+ * Authentication middleware
+ */
+export async function authenticate(request, reply) {
+    const config = getConfig();
+    // Extract token from Authorization header
+    const authHeader = request.headers.authorization;
+    if (!authHeader?.startsWith('Bearer ')) {
+        reply.status(401).send({
+            error: {
+                code: 'UNAUTHORIZED',
+                message: 'Missing or invalid authorization header',
+            },
+        });
+        return;
+    }
+    const token = authHeader.slice(7);
+    // Verify signature
+    const isValid = await verifySignature(token, config.jwt.secret);
+    if (!isValid) {
+        logger.warn({ requestId: request.id }, 'Invalid token signature');
+        reply.status(401).send({
+            error: {
+                code: 'INVALID_TOKEN',
+                message: 'Invalid or expired token',
+            },
+        });
+        return;
+    }
+    // Decode payload
+    const payload = decodeToken(token);
+    if (!payload || !payload.sub || !payload.tid) {
+        reply.status(401).send({
+            error: {
+                code: 'INVALID_TOKEN',
+                message: 'Invalid token payload',
+            },
+        });
+        return;
+    }
+    // Check expiration
+    if (payload.exp && payload.exp * 1000 < Date.now()) {
+        reply.status(401).send({
+            error: {
+                code: 'TOKEN_EXPIRED',
+                message: 'Token has expired',
+            },
+        });
+        return;
+    }
+    // Set auth context
+    request.auth = {
+        userId: payload.sub,
+        tenantId: payload.tid,
+        roles: payload.roles ?? [],
+        permissions: payload.permissions ?? [],
+    };
+    logger.debug({
+        userId: payload.sub,
+        tenantId: payload.tid,
+        requestId: request.id,
+    }, 'Request authenticated');
+}
+/**
+ * Authorization middleware factory
+ * Checks if user has required permission
+ */
+export function requirePermission(permission) {
+    return async (request, reply) => {
+        if (!request.auth) {
+            reply.status(401).send({
+                error: {
+                    code: 'UNAUTHORIZED',
+                    message: 'Authentication required',
+                },
+            });
+            return;
+        }
+        if (!request.auth.permissions.includes(permission)) {
+            logger.warn({
+                userId: request.auth.userId,
+                tenantId: request.auth.tenantId,
+                requiredPermission: permission,
+                requestId: request.id,
+            }, 'Permission denied');
+            reply.status(403).send({
+                error: {
+                    code: 'FORBIDDEN',
+                    message: 'Insufficient permissions',
+                },
+            });
+            return;
+        }
+    };
+}
+/**
+ * Tenant authorization middleware
+ * Verifies user can access the specified tenant's resources
+ *
+ * SECURITY FIX: Only 'super_admin' role can access cross-tenant resources.
+ * Regular 'admin' role is now scoped to their own tenant only.
+ * All cross-tenant access attempts are logged for audit purposes.
+ */
+export function requireTenantAccess(getTenantId) {
+    return async (request, reply) => {
+        if (!request.auth) {
+            reply.status(401).send({
+                error: {
+                    code: 'UNAUTHORIZED',
+                    message: 'Authentication required',
+                },
+            });
+            return;
+        }
+        const resourceTenantId = getTenantId(request);
+        if (!resourceTenantId) {
+            reply.status(400).send({
+                error: {
+                    code: 'INVALID_REQUEST',
+                    message: 'Tenant ID required',
+                },
+            });
+            return;
+        }
+        const isSameTenant = request.auth.tenantId === resourceTenantId;
+        const isSuperAdmin = request.auth.roles.includes('super_admin');
+        const isRegularAdmin = request.auth.roles.includes('admin');
+        // SECURITY: Log all cross-tenant access attempts for audit
+        if (!isSameTenant) {
+            logger.info({
+                userId: request.auth.userId,
+                userTenantId: request.auth.tenantId,
+                resourceTenantId,
+                userRoles: request.auth.roles,
+                isSuperAdmin,
+                requestId: request.id,
+                timestamp: new Date().toISOString(),
+            }, 'AUDIT: Cross-tenant access attempt');
+        }
+        // Check if user's tenant matches resource tenant
+        // SECURITY FIX: Only 'super_admin' can access cross-tenant resources
+        // Regular 'admin' is now scoped to their own tenant
+        const hasAccess = isSameTenant || isSuperAdmin;
+        // Log when regular admin tries cross-tenant access (denied)
+        if (!isSameTenant && isRegularAdmin && !isSuperAdmin) {
+            logger.warn({
+                userId: request.auth.userId,
+                userTenantId: request.auth.tenantId,
+                resourceTenantId,
+                requestId: request.id,
+            }, 'SECURITY: Regular admin cross-tenant access denied - requires super_admin role');
+        }
+        if (!hasAccess) {
+            logger.warn({
+                userId: request.auth.userId,
+                userTenantId: request.auth.tenantId,
+                resourceTenantId,
+                requestId: request.id,
+            }, 'Tenant access denied');
+            reply.status(403).send({
+                error: {
+                    code: 'TENANT_ACCESS_DENIED',
+                    message: 'Access denied to this tenant resource',
+                },
+            });
+            return;
+        }
+        // Log successful cross-tenant access by super_admin
+        if (!isSameTenant && isSuperAdmin) {
+            logger.info({
+                userId: request.auth.userId,
+                userTenantId: request.auth.tenantId,
+                resourceTenantId,
+                requestId: request.id,
+            }, 'AUDIT: Super admin granted cross-tenant access');
+        }
+    };
+}
+/**
+ * Role check middleware factory
+ */
+export function requireRole(...roles) {
+    return async (request, reply) => {
+        if (!request.auth) {
+            reply.status(401).send({
+                error: {
+                    code: 'UNAUTHORIZED',
+                    message: 'Authentication required',
+                },
+            });
+            return;
+        }
+        const hasRole = roles.some((role) => request.auth.roles.includes(role));
+        if (!hasRole) {
+            logger.warn({
+                userId: request.auth.userId,
+                tenantId: request.auth.tenantId,
+                requiredRoles: roles,
+                userRoles: request.auth.roles,
+                requestId: request.id,
+            }, 'Role check failed');
+            reply.status(403).send({
+                error: {
+                    code: 'FORBIDDEN',
+                    message: 'Insufficient role',
+                },
+            });
+            return;
+        }
+    };
+}
+//# sourceMappingURL=auth.js.map

package/dist/api/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/api/auth.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAGhD,gDAAgD;AAChD,OAAO,EAIL,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,gCAAgC,CAAC;AAExC,wDAAwD;AACxD,OAAO,EAIL,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,GACrB,CAAC;AAEF,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;AAiBnD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;GAGG;AACH,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,iCAAiC,CAAC;IACzD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,mCAAmC,CAAC;IAC3D,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,4CAA4C,CAAC;IAC5E,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,6CAA6C,CAAC;IAC7E,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC;AAgBH;;;GAGG;AACH,SAAS,WAAW,CAAC,KAAa;IAChC,IAAI,CAAC;QACH,8CAA8C;QAC9C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAEpC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACtE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAEnC,sCAAsC;QACtC,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC5D,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC;YAC9B,6CAA6C;YAC7C,MAAM,CAAC,IAAI,CACT;gBACE,MAAM,EAAE,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBAChD,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;oBACtB,OAAO,EAAE,CAAC,CAAC,OAAO;iBACnB,CAAC,CAAC;gBACH,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,EACD,sDAAsD,CACvD,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,gBAAgB,CAAC,IAAI,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CACT;YACE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YAC7D,SAAS,EAAE,aAAa;YACxB,WAAW,EAAE,KAAK,EAAE,MAAM;SAC3B,EACD,4BAA4B,CAC7B,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,eAAe,CAAC,KAAa,EAAE,MAAc;IAC1D,IAAI,CAAC;QACH,mEAAmE;QACnE,mDAAmD;QACnD,2EAA2E;QAE3E,qDAAqD;QACrD,gEAAgE;QAChE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAErC,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC;QAC3C,MAAM,IAAI,GAAG,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC;QAEpC,sCAAsC;QACtC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,OAAO,EACP,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;QAEF,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,SAAU,EAAE,WAAW,CAAC,CAAC;QAC5D,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAC/B,MAAM,EACN,GAAG,EACH,cAAc,EACd,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CACrB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CACT;YACE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YAC7D,SAAS,EAAE,iBAAiB;SAC7B,EACD,mCAAmC,CACpC,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAuB,EACvB,KAAmB;IAEnB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAE3B,0CAA0C;IAC1C,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;IACjD,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACvC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACrB,KAAK,EAAE;gBACL,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,yCAAyC;aACnD;SACF,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAElC,mBAAmB;IACnB,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,yBAAyB,CAAC,CAAC;QAClE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACrB,KAAK,EAAE;gBACL,IAAI,EAAE,eAAe;gBACrB,OAAO,EAAE,0BAA0B;aACpC;SACF,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,iBAAiB;IACjB,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QAC7C,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACrB,KAAK,EAAE;gBACL,IAAI,EAAE,eAAe;gBACrB,OAAO,EAAE,uBAAuB;aACjC;SACF,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,mBAAmB;IACnB,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACnD,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACrB,KAAK,EAAE;gBACL,IAAI,EAAE,eAAe;gBACrB,OAAO,EAAE,mBAAmB;aAC7B;SACF,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,mBAAmB;IACnB,OAAO,CAAC,IAAI,GAAG;QACb,MAAM,EAAE,OAAO,CAAC,GAAG;QACnB,QAAQ,EAAE,OAAO,CAAC,GAAG;QACrB,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE;QAC1B,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,EAAE;KACvC,CAAC;IAEF,MAAM,CAAC,KAAK,CACV;QACE,MAAM,EAAE,OAAO,CAAC,GAAG;QACnB,QAAQ,EAAE,OAAO,CAAC,GAAG;QACrB,SAAS,EAAE,OAAO,CAAC,EAAE;KACtB,EACD,uBAAuB,CACxB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAkB;IAClD,OAAO,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAiB,EAAE;QAC3E,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACrB,KAAK,EAAE;oBACL,IAAI,EAAE,cAAc;oBACpB,OAAO,EAAE,yBAAyB;iBACnC;aACF,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACnD,MAAM,CAAC,IAAI,CACT;gBACE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM;gBAC3B,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ;gBAC/B,kBAAkB,EAAE,UAAU;gBAC9B,SAAS,EAAE,OAAO,CAAC,EAAE;aACtB,EACD,mBAAmB,CACpB,CAAC;YAEF,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACrB,KAAK,EAAE;oBACL,IAAI,EAAE,WAAW;oBACjB,OAAO,EAAE,0BAA0B;iBACpC;aACF,CAAC,CAAC;YACH,OAAO;QACT,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,WAA4D;IAC9F,OAAO,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAiB,EAAE;QAC3E,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACrB,KAAK,EAAE;oBACL,IAAI,EAAE,cAAc;oBACpB,OAAO,EAAE,yBAAyB;iBACnC;aACF,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,gBAAgB,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACrB,KAAK,EAAE;oBACL,IAAI,EAAE,iBAAiB;oBACvB,OAAO,EAAE,oBAAoB;iBAC9B;aACF,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,KAAK,gBAAgB,CAAC;QAChE,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QAChE,MAAM,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAE5D,2DAA2D;QAC3D,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,CAAC,IAAI,CACT;gBACE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM;gBAC3B,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ;gBACnC,gBAAgB;gBAChB,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK;gBAC7B,YAAY;gBACZ,SAAS,EAAE,OAAO,CAAC,EAAE;gBACrB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,EACD,oCAAoC,CACrC,CAAC;QACJ,CAAC;QAED,iDAAiD;QACjD,qEAAqE;QACrE,oDAAoD;QACpD,MAAM,SAAS,GAAG,YAAY,IAAI,YAAY,CAAC;QAE/C,4DAA4D;QAC5D,IAAI,CAAC,YAAY,IAAI,cAAc,IAAI,CAAC,YAAY,EAAE,CAAC;YACrD,MAAM,CAAC,IAAI,CACT;gBACE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM;gBAC3B,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ;gBACnC,gBAAgB;gBAChB,SAAS,EAAE,OAAO,CAAC,EAAE;aACtB,EACD,gFAAgF,CACjF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CACT;gBACE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM;gBAC3B,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ;gBACnC,gBAAgB;gBAChB,SAAS,EAAE,OAAO,CAAC,EAAE;aACtB,EACD,sBAAsB,CACvB,CAAC;YAEF,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACrB,KAAK,EAAE;oBACL,IAAI,EAAE,sBAAsB;oBAC5B,OAAO,EAAE,uCAAuC;iBACjD;aACF,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,oDAAoD;QACpD,IAAI,CAAC,YAAY,IAAI,YAAY,EAAE,CAAC;YAClC,MAAM,CAAC,IAAI,CACT;gBACE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM;gBAC3B,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ;gBACnC,gBAAgB;gBAChB,SAAS,EAAE,OAAO,CAAC,EAAE;aACtB,EACD,gDAAgD,CACjD,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,GAAG,KAAe;IAC5C,OAAO,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAiB,EAAE;QAC3E,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACrB,KAAK,EAAE;oBACL,IAAI,EAAE,cAAc;oBACpB,OAAO,EAAE,yBAAyB;iBACnC;aACF,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QACzE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CACT;gBACE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM;gBAC3B,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ;gBAC/B,aAAa,EAAE,KAAK;gBACpB,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK;gBAC7B,SAAS,EAAE,OAAO,CAAC,EAAE;aACtB,EACD,mBAAmB,CACpB,CAAC;YAEF,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACrB,KAAK,EAAE;oBACL,IAAI,EAAE,WAAW;oBACjB,OAAO,EAAE,mBAAmB;iBAC7B;aACF,CAAC,CAAC;YACH,OAAO;QACT,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/api/errors.d.ts

@@ -0,0 +1,146 @@
+/**
+ * API Error Handling
+ *
+ * Provides standardized error classes, error handler middleware,
+ * and error serialization for consistent API error responses.
+ *
+ * @packageDocumentation
+ */
+import type { FastifyError, FastifyRequest, FastifyReply } from 'fastify';
+import { ZodError } from 'zod';
+import type { VorionErrorResponse } from '../common/contracts/output.js';
+/**
+ * Standard error codes for API responses
+ */
+export declare enum ErrorCode {
+    VALIDATION_ERROR = "VALIDATION_ERROR",
+    INVALID_INPUT = "INVALID_INPUT",
+    INVALID_PARAMS = "INVALID_PARAMS",
+    INVALID_QUERY = "INVALID_QUERY",
+    MISSING_FIELD = "MISSING_FIELD",
+    INVALID_FORMAT = "INVALID_FORMAT",
+    PAYLOAD_TOO_LARGE = "PAYLOAD_TOO_LARGE",
+    INJECTION_DETECTED = "INJECTION_DETECTED",
+    UNAUTHORIZED = "UNAUTHORIZED",
+    TOKEN_INVALID = "TOKEN_INVALID",
+    TOKEN_EXPIRED = "TOKEN_EXPIRED",
+    TOKEN_REVOKED = "TOKEN_REVOKED",
+    MISSING_AUTH = "MISSING_AUTH",
+    FORBIDDEN = "FORBIDDEN",
+    INSUFFICIENT_PERMISSIONS = "INSUFFICIENT_PERMISSIONS",
+    TENANT_MISMATCH = "TENANT_MISMATCH",
+    NOT_FOUND = "NOT_FOUND",
+    RESOURCE_NOT_FOUND = "RESOURCE_NOT_FOUND",
+    INTENT_NOT_FOUND = "INTENT_NOT_FOUND",
+    POLICY_NOT_FOUND = "POLICY_NOT_FOUND",
+    ESCALATION_NOT_FOUND = "ESCALATION_NOT_FOUND",
+    CONFLICT = "CONFLICT",
+    RESOURCE_EXISTS = "RESOURCE_EXISTS",
+    INVALID_STATE = "INVALID_STATE",
+    RATE_LIMIT_EXCEEDED = "RATE_LIMIT_EXCEEDED",
+    QUOTA_EXCEEDED = "QUOTA_EXCEEDED",
+    INTERNAL_ERROR = "INTERNAL_ERROR",
+    DATABASE_ERROR = "DATABASE_ERROR",
+    EXTERNAL_SERVICE_ERROR = "EXTERNAL_SERVICE_ERROR",
+    TIMEOUT = "TIMEOUT",
+    SERVICE_UNAVAILABLE = "SERVICE_UNAVAILABLE"
+}
+/**
+ * Base API error class
+ */
+export declare class ApiError extends Error {
+    readonly code: ErrorCode;
+    readonly statusCode: number;
+    readonly details?: Record<string, unknown>;
+    readonly retryAfter?: number;
+    constructor(code: ErrorCode, message: string, details?: Record<string, unknown>, retryAfter?: number);
+    /**
+     * Serialize to VorionErrorResponse format
+     */
+    toResponse(requestId: string, includeDetails?: boolean): VorionErrorResponse;
+}
+/**
+ * Not Found error (404)
+ */
+export declare class NotFoundError extends ApiError {
+    constructor(resource?: string, message?: string, details?: Record<string, unknown>);
+}
+/**
+ * Validation error (400)
+ */
+export declare class ValidationError extends ApiError {
+    constructor(message?: string, details?: Record<string, unknown>);
+    /**
+     * Create from Zod error
+     */
+    static fromZodError(error: ZodError): ValidationError;
+}
+/**
+ * Authentication error (401)
+ */
+export declare class AuthError extends ApiError {
+    constructor(message?: string, code?: ErrorCode, details?: Record<string, unknown>);
+    static tokenInvalid(message?: string): AuthError;
+    static tokenExpired(message?: string): AuthError;
+    static tokenRevoked(message?: string): AuthError;
+    static missingAuth(message?: string): AuthError;
+}
+/**
+ * Rate limit error (429)
+ */
+export declare class RateLimitError extends ApiError {
+    constructor(message: string, retryAfter: number, details?: Record<string, unknown>);
+}
+/**
+ * Conflict error (409)
+ */
+export declare class ConflictError extends ApiError {
+    constructor(message?: string, details?: Record<string, unknown>);
+    static invalidState(currentState: string, allowedStates: string[]): ConflictError;
+}
+/**
+ * Forbidden error (403)
+ */
+export declare class ForbiddenError extends ApiError {
+    constructor(message?: string, details?: Record<string, unknown>);
+    static insufficientPermissions(requiredPermission: string): ForbiddenError;
+    static tenantMismatch(): ForbiddenError;
+}
+/**
+ * Internal server error (500)
+ */
+export declare class InternalError extends ApiError {
+    constructor(message?: string, details?: Record<string, unknown>);
+}
+/**
+ * Get status code for an error code
+ */
+export declare function getStatusForErrorCode(code: ErrorCode): number;
+/**
+ * Check if an error is an API error
+ */
+export declare function isApiError(error: unknown): error is ApiError;
+/**
+ * Create error response from any error
+ */
+export declare function createErrorResponse(error: unknown, requestId: string, isProduction?: boolean): {
+    response: VorionErrorResponse;
+    statusCode: number;
+};
+/**
+ * Create standard error handler middleware for Fastify
+ *
+ * @param options - Error handler options
+ * @returns Fastify error handler
+ */
+export declare function createErrorHandler(options?: {
+    /** Include stack traces in non-production */
+    includeStack?: boolean;
+    /** Custom error transform */
+    transformError?: (error: unknown) => unknown;
+}): (error: FastifyError, request: FastifyRequest, reply: FastifyReply) => Promise<void>;
+/**
+ * Wrap an async handler to catch and format errors
+ */
+export declare function wrapHandler<T>(handler: (request: FastifyRequest, reply: FastifyReply) => Promise<T>): (request: FastifyRequest, reply: FastifyReply) => Promise<T | VorionErrorResponse>;
+//# sourceMappingURL=errors.d.ts.map

package/dist/api/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/api/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAC;AAM/B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAKzE;;GAEG;AACH,oBAAY,SAAS;IAEnB,gBAAgB,qBAAqB;IACrC,aAAa,kBAAkB;IAC/B,cAAc,mBAAmB;IACjC,aAAa,kBAAkB;IAC/B,aAAa,kBAAkB;IAC/B,cAAc,mBAAmB;IACjC,iBAAiB,sBAAsB;IACvC,kBAAkB,uBAAuB;IAEzC,YAAY,iBAAiB;IAC7B,aAAa,kBAAkB;IAC/B,aAAa,kBAAkB;IAC/B,aAAa,kBAAkB;IAC/B,YAAY,iBAAiB;IAE7B,SAAS,cAAc;IACvB,wBAAwB,6BAA6B;IACrD,eAAe,oBAAoB;IAEnC,SAAS,cAAc;IACvB,kBAAkB,uBAAuB;IACzC,gBAAgB,qBAAqB;IACrC,gBAAgB,qBAAqB;IACrC,oBAAoB,yBAAyB;IAE7C,QAAQ,aAAa;IACrB,eAAe,oBAAoB;IACnC,aAAa,kBAAkB;IAE/B,mBAAmB,wBAAwB;IAC3C,cAAc,mBAAmB;IAGjC,cAAc,mBAAmB;IACjC,cAAc,mBAAmB;IACjC,sBAAsB,2BAA2B;IACjD,OAAO,YAAY;IACnB,mBAAmB,wBAAwB;CAC5C;AA4DD;;GAEG;AACH,qBAAa,QAAS,SAAQ,KAAK;IACjC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;gBAG3B,IAAI,EAAE,SAAS,EACf,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,UAAU,CAAC,EAAE,MAAM;IAcrB;;OAEG;IACH,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,cAAc,GAAE,OAAc,GAAG,mBAAmB;CAuBnF;AAED;;GAEG;AACH,qBAAa,aAAc,SAAQ,QAAQ;gBAEvC,QAAQ,GAAE,MAAmB,EAC7B,OAAO,CAAC,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CASpC;AAED;;GAEG;AACH,qBAAa,eAAgB,SAAQ,QAAQ;gBAEzC,OAAO,GAAE,MAA4B,EACrC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAMnC;;OAEG;IACH,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,QAAQ,GAAG,eAAe;CAStD;AAED;;GAEG;AACH,qBAAa,SAAU,SAAQ,QAAQ;gBAEnC,OAAO,GAAE,MAAkC,EAC3C,IAAI,GAAE,SAAkC,EACxC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAMnC,MAAM,CAAC,YAAY,CAAC,OAAO,GAAE,MAAwB,GAAG,SAAS;IAIjE,MAAM,CAAC,YAAY,CAAC,OAAO,GAAE,MAA4B,GAAG,SAAS;IAIrE,MAAM,CAAC,YAAY,CAAC,OAAO,GAAE,MAAiC,GAAG,SAAS;IAI1E,MAAM,CAAC,WAAW,CAAC,OAAO,GAAE,MAA2C,GAAG,SAAS;CAGpF;AAED;;GAEG;AACH,qBAAa,cAAe,SAAQ,QAAQ;gBAExC,OAAO,EAAE,MAA8B,EACvC,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAKpC;AAED;;GAEG;AACH,qBAAa,aAAc,SAAQ,QAAQ;gBAEvC,OAAO,GAAE,MAA4B,EACrC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAMnC,MAAM,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,aAAa;CAMlF;AAED;;GAEG;AACH,qBAAa,cAAe,SAAQ,QAAQ;gBAExC,OAAO,GAAE,MAAwB,EACjC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAMnC,MAAM,CAAC,uBAAuB,CAAC,kBAAkB,EAAE,MAAM,GAAG,cAAc;IAO1E,MAAM,CAAC,cAAc,IAAI,cAAc;CAMxC;AAED;;GAEG;AACH,qBAAa,aAAc,SAAQ,QAAQ;gBAEvC,OAAO,GAAE,MAAuC,EAChD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAKpC;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,CAE7D;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,QAAQ,CAE5D;AAiCD;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,OAAO,EACd,SAAS,EAAE,MAAM,EACjB,YAAY,GAAE,OAAe,GAC5B;IAAE,QAAQ,EAAE,mBAAmB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CA+GvD;AAcD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,CAAC,EAAE;IAC3C,6CAA6C;IAC7C,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,6BAA6B;IAC7B,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC;CAC9C,GAAG,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CA+DvF;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAC3B,OAAO,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,CAAC,CAAC,GACpE,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,CAAC,GAAG,mBAAmB,CAAC,CAgBpF"}