@vorionsys/security 1.0.0

package/dist/common/telemetry/tracer.js

@@ -0,0 +1,343 @@
+/**
+ * OpenTelemetry Tracer Configuration
+ *
+ * Core tracer setup with SDK initialization, exporter configuration,
+ * and sampling strategies for the Vorion security platform.
+ *
+ * Features:
+ * - OTLP exporter for Jaeger, Tempo, and other backends
+ * - Configurable sampling strategies (always, probability, rate-limiting)
+ * - Resource attributes for service identification
+ * - Environment-aware configuration
+ *
+ * @packageDocumentation
+ */
+import { NodeSDK } from '@opentelemetry/sdk-node';
+import { resourceFromAttributes } from '@opentelemetry/resources';
+import { SEMRESATTRS_SERVICE_NAME, SEMRESATTRS_SERVICE_VERSION, SEMRESATTRS_DEPLOYMENT_ENVIRONMENT, SEMRESATTRS_SERVICE_INSTANCE_ID, } from '@opentelemetry/semantic-conventions';
+import { OTLPTraceExporter } from '@opentelemetry/exporter-trace-otlp-http';
+import { BatchSpanProcessor, SimpleSpanProcessor, ConsoleSpanExporter, } from '@opentelemetry/sdk-trace-node';
+import { SamplingDecision, AlwaysOnSampler, AlwaysOffSampler, TraceIdRatioBasedSampler, ParentBasedSampler, } from '@opentelemetry/sdk-trace-base';
+import { trace, } from '@opentelemetry/api';
+import { randomUUID } from 'node:crypto';
+import { createLogger } from '../logger.js';
+import { getConfig } from '../config.js';
+const logger = createLogger({ component: 'telemetry-tracer' });
+/**
+ * Rate-limiting sampler implementation
+ *
+ * Limits the number of sampled traces per second to prevent
+ * overwhelming the trace backend during high-traffic periods.
+ */
+export class RateLimitingSampler {
+    maxTracesPerSecond;
+    tracesThisSecond = 0;
+    currentSecond = 0;
+    constructor(maxTracesPerSecond) {
+        this.maxTracesPerSecond = maxTracesPerSecond;
+    }
+    shouldSample(_context, _traceId, _spanName, _spanKind, _attributes, _links) {
+        const now = Math.floor(Date.now() / 1000);
+        // Reset counter for new second
+        if (now !== this.currentSecond) {
+            this.currentSecond = now;
+            this.tracesThisSecond = 0;
+        }
+        // Check if we've exceeded rate limit
+        if (this.tracesThisSecond >= this.maxTracesPerSecond) {
+            return {
+                decision: SamplingDecision.NOT_RECORD,
+                attributes: {},
+            };
+        }
+        this.tracesThisSecond++;
+        return {
+            decision: SamplingDecision.RECORD_AND_SAMPLED,
+            attributes: {},
+        };
+    }
+    toString() {
+        return `RateLimitingSampler{maxTracesPerSecond=${this.maxTracesPerSecond}}`;
+    }
+}
+/**
+ * Security-aware sampler that always samples high-risk operations
+ *
+ * Ensures security-critical operations are always traced regardless
+ * of the base sampling strategy.
+ */
+export class SecurityAwareSampler {
+    baseSampler;
+    alwaysSampleOperations;
+    constructor(baseSampler, alwaysSampleOperations = [
+        'auth.login',
+        'auth.logout',
+        'auth.token.refresh',
+        'auth.mfa.verify',
+        'security.violation',
+        'policy.deny',
+        'escalation.create',
+        'escalation.resolve',
+        'admin.action',
+        'data.export',
+        'webhook.security',
+    ]) {
+        this.baseSampler = baseSampler;
+        this.alwaysSampleOperations = new Set(alwaysSampleOperations);
+    }
+    shouldSample(context, traceId, spanName, spanKind, attributes, links) {
+        // Always sample security-critical operations
+        if (this.alwaysSampleOperations.has(spanName)) {
+            return {
+                decision: SamplingDecision.RECORD_AND_SAMPLED,
+                attributes: {
+                    'sampling.reason': 'security-critical-operation',
+                },
+            };
+        }
+        // Check for security-related attributes
+        const isSecurityRelated = attributes['security.event'] === true ||
+            attributes['security.risk'] === 'high' ||
+            attributes['auth.failure'] === true;
+        if (isSecurityRelated) {
+            return {
+                decision: SamplingDecision.RECORD_AND_SAMPLED,
+                attributes: {
+                    'sampling.reason': 'security-related-attributes',
+                },
+            };
+        }
+        // Delegate to base sampler for other operations
+        return this.baseSampler.shouldSample(context, traceId, spanName, spanKind, attributes, links);
+    }
+    toString() {
+        return `SecurityAwareSampler{base=${this.baseSampler.toString()}}`;
+    }
+}
+/**
+ * Create a sampler based on the configured strategy
+ */
+function createSampler(config) {
+    let baseSampler;
+    switch (config.samplingStrategy) {
+        case 'always':
+            baseSampler = new AlwaysOnSampler();
+            break;
+        case 'never':
+            baseSampler = new AlwaysOffSampler();
+            break;
+        case 'probability':
+            baseSampler = new TraceIdRatioBasedSampler(config.samplingRate);
+            break;
+        case 'rate-limiting':
+            baseSampler = new RateLimitingSampler(config.rateLimitPerSecond ?? 100);
+            break;
+        case 'parent-based':
+            baseSampler = new ParentBasedSampler({
+                root: new TraceIdRatioBasedSampler(config.samplingRate),
+            });
+            break;
+        default:
+            logger.warn({ strategy: config.samplingStrategy }, 'Unknown sampling strategy, using probability');
+            baseSampler = new TraceIdRatioBasedSampler(config.samplingRate);
+    }
+    // Wrap with security-aware sampler
+    return new SecurityAwareSampler(baseSampler);
+}
+/**
+ * Create resource attributes for service identification
+ */
+function createResourceAttributes(config) {
+    const instanceId = randomUUID();
+    return {
+        [SEMRESATTRS_SERVICE_NAME]: config.serviceName,
+        [SEMRESATTRS_SERVICE_VERSION]: config.serviceVersion,
+        [SEMRESATTRS_DEPLOYMENT_ENVIRONMENT]: config.environment,
+        [SEMRESATTRS_SERVICE_INSTANCE_ID]: instanceId,
+        // Vorion-specific attributes
+        'vorion.platform': 'security',
+        'vorion.component': 'intent-engine',
+        ...config.resourceAttributes,
+    };
+}
+/**
+ * Create OTLP exporter with configuration
+ */
+function createOtlpExporter(config) {
+    return new OTLPTraceExporter({
+        url: config.otlpEndpoint,
+        headers: config.otlpHeaders,
+        timeoutMillis: 30000,
+    });
+}
+/**
+ * Create span processor based on configuration
+ */
+function createSpanProcessor(exporter, config) {
+    if (config.useBatchProcessor !== false) {
+        // Use batch processor for production (default)
+        return new BatchSpanProcessor(exporter, {
+            maxExportBatchSize: config.batchConfig?.maxExportBatchSize ?? 512,
+            maxQueueSize: config.batchConfig?.maxQueueSize ?? 2048,
+            scheduledDelayMillis: config.batchConfig?.scheduledDelayMillis ?? 5000,
+            exportTimeoutMillis: config.batchConfig?.exportTimeoutMillis ?? 30000,
+        });
+    }
+    // Use simple processor for debugging
+    return new SimpleSpanProcessor(exporter);
+}
+// Global SDK instance
+let sdk = null;
+let isInitialized = false;
+/**
+ * Get default telemetry configuration from environment
+ */
+export function getDefaultTelemetryConfig() {
+    const config = getConfig();
+    return {
+        serviceName: config.telemetry.serviceName,
+        serviceVersion: config.app.version,
+        environment: config.env,
+        otlpEndpoint: config.telemetry.otlpEndpoint,
+        otlpHeaders: config.telemetry.otlpHeaders,
+        samplingStrategy: 'probability',
+        samplingRate: config.telemetry.sampleRate,
+        enabled: config.telemetry.enabled,
+        useBatchProcessor: config.env === 'production',
+        enableConsoleExporter: config.env === 'development',
+    };
+}
+/**
+ * Initialize the OpenTelemetry SDK
+ *
+ * @param config - Telemetry configuration (optional, uses defaults)
+ * @returns void
+ * @throws Error if already initialized
+ */
+export function initializeTracer(config) {
+    if (isInitialized) {
+        logger.warn('Tracer already initialized, skipping');
+        return;
+    }
+    const fullConfig = {
+        ...getDefaultTelemetryConfig(),
+        ...config,
+    };
+    if (fullConfig.enabled === false) {
+        logger.info('Telemetry disabled by configuration');
+        isInitialized = true;
+        return;
+    }
+    const resourceAttributes = createResourceAttributes(fullConfig);
+    const sampler = createSampler(fullConfig);
+    // Create exporters
+    const spanProcessors = [];
+    // OTLP exporter (primary)
+    const otlpExporter = createOtlpExporter(fullConfig);
+    spanProcessors.push(createSpanProcessor(otlpExporter, fullConfig));
+    // Console exporter (debugging)
+    if (fullConfig.enableConsoleExporter) {
+        spanProcessors.push(new SimpleSpanProcessor(new ConsoleSpanExporter()));
+    }
+    // Initialize SDK with resource attributes
+    sdk = new NodeSDK({
+        serviceName: fullConfig.serviceName,
+        resource: resourceFromAttributes(resourceAttributes),
+        sampler,
+        spanProcessors,
+    });
+    sdk.start();
+    isInitialized = true;
+    logger.info({
+        serviceName: fullConfig.serviceName,
+        environment: fullConfig.environment,
+        samplingStrategy: fullConfig.samplingStrategy,
+        samplingRate: fullConfig.samplingRate,
+        endpoint: fullConfig.otlpEndpoint,
+    }, 'OpenTelemetry tracer initialized');
+}
+/**
+ * Shutdown the OpenTelemetry SDK gracefully
+ *
+ * Should be called during application shutdown to ensure
+ * all pending spans are exported.
+ */
+export async function shutdownTracer() {
+    if (!sdk) {
+        logger.debug('Tracer not initialized, nothing to shutdown');
+        return;
+    }
+    try {
+        await sdk.shutdown();
+        sdk = null;
+        isInitialized = false;
+        logger.info('OpenTelemetry tracer shutdown complete');
+    }
+    catch (error) {
+        logger.error({ error }, 'Error shutting down tracer');
+        throw error;
+    }
+}
+/**
+ * Get a tracer instance for a specific component
+ *
+ * @param name - Component name (e.g., 'vorion.intent', 'vorion.policy')
+ * @param version - Component version (optional)
+ * @returns Tracer instance
+ */
+export function getTracer(name, version) {
+    return trace.getTracer(name, version);
+}
+/**
+ * Get the global tracer provider
+ */
+export function getTracerProvider() {
+    return trace.getTracerProvider();
+}
+/**
+ * Check if the tracer is initialized
+ */
+export function isTracerInitialized() {
+    return isInitialized;
+}
+/**
+ * Vorion-specific tracer names
+ */
+export const VorionTracers = {
+    INTENT: 'vorion.intent',
+    POLICY: 'vorion.policy',
+    TRUST: 'vorion.trust',
+    SECURITY: 'vorion.security',
+    API: 'vorion.api',
+    QUEUE: 'vorion.queue',
+    DATABASE: 'vorion.database',
+    CACHE: 'vorion.cache',
+    WEBHOOK: 'vorion.webhook',
+    AUDIT: 'vorion.audit',
+    GOVERNANCE: 'vorion.governance',
+};
+/**
+ * Get the intent tracer
+ */
+export function getIntentTracer() {
+    return getTracer(VorionTracers.INTENT, '1.0.0');
+}
+/**
+ * Get the policy tracer
+ */
+export function getPolicyTracer() {
+    return getTracer(VorionTracers.POLICY, '1.0.0');
+}
+/**
+ * Get the security tracer
+ */
+export function getSecurityTracer() {
+    return getTracer(VorionTracers.SECURITY, '1.0.0');
+}
+/**
+ * Get the API tracer
+ */
+export function getApiTracer() {
+    return getTracer(VorionTracers.API, '1.0.0');
+}
+//# sourceMappingURL=tracer.js.map

package/dist/common/telemetry/tracer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tracer.js","sourceRoot":"","sources":["../../../src/common/telemetry/tracer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAY,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAC5E,OAAO,EACL,wBAAwB,EACxB,2BAA2B,EAC3B,kCAAkC,EAClC,+BAA+B,GAChC,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AAC5E,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,GAGpB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAEL,gBAAgB,EAEhB,eAAe,EACf,gBAAgB,EAChB,wBAAwB,EACxB,kBAAkB,GACnB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,KAAK,GAON,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC,CAAC;AAqD/D;;;;;GAKG;AACH,MAAM,OAAO,mBAAmB;IACb,kBAAkB,CAAS;IACpC,gBAAgB,GAAG,CAAC,CAAC;IACrB,aAAa,GAAG,CAAC,CAAC;IAE1B,YAAY,kBAA0B;QACpC,IAAI,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;IAC/C,CAAC;IAED,YAAY,CACV,QAAiB,EACjB,QAAgB,EAChB,SAAiB,EACjB,SAAmB,EACnB,WAAuB,EACvB,MAAc;QAEd,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAE1C,+BAA+B;QAC/B,IAAI,GAAG,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC;YAC/B,IAAI,CAAC,aAAa,GAAG,GAAG,CAAC;YACzB,IAAI,CAAC,gBAAgB,GAAG,CAAC,CAAC;QAC5B,CAAC;QAED,qCAAqC;QACrC,IAAI,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACrD,OAAO;gBACL,QAAQ,EAAE,gBAAgB,CAAC,UAAU;gBACrC,UAAU,EAAE,EAAE;aACf,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACxB,OAAO;YACL,QAAQ,EAAE,gBAAgB,CAAC,kBAAkB;YAC7C,UAAU,EAAE,EAAE;SACf,CAAC;IACJ,CAAC;IAED,QAAQ;QACN,OAAO,0CAA0C,IAAI,CAAC,kBAAkB,GAAG,CAAC;IAC9E,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,oBAAoB;IACd,WAAW,CAAU;IACrB,sBAAsB,CAAc;IAErD,YACE,WAAoB,EACpB,yBAAmC;QACjC,YAAY;QACZ,aAAa;QACb,oBAAoB;QACpB,iBAAiB;QACjB,oBAAoB;QACpB,aAAa;QACb,mBAAmB;QACnB,oBAAoB;QACpB,cAAc;QACd,aAAa;QACb,kBAAkB;KACnB;QAED,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,sBAAsB,GAAG,IAAI,GAAG,CAAC,sBAAsB,CAAC,CAAC;IAChE,CAAC;IAED,YAAY,CACV,OAAgB,EAChB,OAAe,EACf,QAAgB,EAChB,QAAkB,EAClB,UAAsB,EACtB,KAAa;QAEb,6CAA6C;QAC7C,IAAI,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9C,OAAO;gBACL,QAAQ,EAAE,gBAAgB,CAAC,kBAAkB;gBAC7C,UAAU,EAAE;oBACV,iBAAiB,EAAE,6BAA6B;iBACjD;aACF,CAAC;QACJ,CAAC;QAED,wCAAwC;QACxC,MAAM,iBAAiB,GACrB,UAAU,CAAC,gBAAgB,CAAC,KAAK,IAAI;YACrC,UAAU,CAAC,eAAe,CAAC,KAAK,MAAM;YACtC,UAAU,CAAC,cAAc,CAAC,KAAK,IAAI,CAAC;QAEtC,IAAI,iBAAiB,EAAE,CAAC;YACtB,OAAO;gBACL,QAAQ,EAAE,gBAAgB,CAAC,kBAAkB;gBAC7C,UAAU,EAAE;oBACV,iBAAiB,EAAE,6BAA6B;iBACjD;aACF,CAAC;QACJ,CAAC;QAED,gDAAgD;QAChD,OAAO,IAAI,CAAC,WAAW,CAAC,YAAY,CAClC,OAAO,EACP,OAAO,EACP,QAAQ,EACR,QAAQ,EACR,UAAU,EACV,KAAK,CACN,CAAC;IACJ,CAAC;IAED,QAAQ;QACN,OAAO,6BAA6B,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,GAAG,CAAC;IACrE,CAAC;CACF;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,MAAuB;IAC5C,IAAI,WAAoB,CAAC;IAEzB,QAAQ,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAChC,KAAK,QAAQ;YACX,WAAW,GAAG,IAAI,eAAe,EAAE,CAAC;YACpC,MAAM;QAER,KAAK,OAAO;YACV,WAAW,GAAG,IAAI,gBAAgB,EAAE,CAAC;YACrC,MAAM;QAER,KAAK,aAAa;YAChB,WAAW,GAAG,IAAI,wBAAwB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAChE,MAAM;QAER,KAAK,eAAe;YAClB,WAAW,GAAG,IAAI,mBAAmB,CAAC,MAAM,CAAC,kBAAkB,IAAI,GAAG,CAAC,CAAC;YACxE,MAAM;QAER,KAAK,cAAc;YACjB,WAAW,GAAG,IAAI,kBAAkB,CAAC;gBACnC,IAAI,EAAE,IAAI,wBAAwB,CAAC,MAAM,CAAC,YAAY,CAAC;aACxD,CAAC,CAAC;YACH,MAAM;QAER;YACE,MAAM,CAAC,IAAI,CACT,EAAE,QAAQ,EAAE,MAAM,CAAC,gBAAgB,EAAE,EACrC,8CAA8C,CAC/C,CAAC;YACF,WAAW,GAAG,IAAI,wBAAwB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACpE,CAAC;IAED,mCAAmC;IACnC,OAAO,IAAI,oBAAoB,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED;;GAEG;AACH,SAAS,wBAAwB,CAAC,MAAuB;IACvD,MAAM,UAAU,GAAG,UAAU,EAAE,CAAC;IAEhC,OAAO;QACL,CAAC,wBAAwB,CAAC,EAAE,MAAM,CAAC,WAAW;QAC9C,CAAC,2BAA2B,CAAC,EAAE,MAAM,CAAC,cAAc;QACpD,CAAC,kCAAkC,CAAC,EAAE,MAAM,CAAC,WAAW;QACxD,CAAC,+BAA+B,CAAC,EAAE,UAAU;QAC7C,6BAA6B;QAC7B,iBAAiB,EAAE,UAAU;QAC7B,kBAAkB,EAAE,eAAe;QACnC,GAAG,MAAM,CAAC,kBAAkB;KAC7B,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,kBAAkB,CAAC,MAAuB;IACjD,OAAO,IAAI,iBAAiB,CAAC;QAC3B,GAAG,EAAE,MAAM,CAAC,YAAY;QACxB,OAAO,EAAE,MAAM,CAAC,WAAW;QAC3B,aAAa,EAAE,KAAK;KACrB,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAC1B,QAAsB,EACtB,MAAuB;IAEvB,IAAI,MAAM,CAAC,iBAAiB,KAAK,KAAK,EAAE,CAAC;QACvC,+CAA+C;QAC/C,OAAO,IAAI,kBAAkB,CAAC,QAAQ,EAAE;YACtC,kBAAkB,EAAE,MAAM,CAAC,WAAW,EAAE,kBAAkB,IAAI,GAAG;YACjE,YAAY,EAAE,MAAM,CAAC,WAAW,EAAE,YAAY,IAAI,IAAI;YACtD,oBAAoB,EAAE,MAAM,CAAC,WAAW,EAAE,oBAAoB,IAAI,IAAI;YACtE,mBAAmB,EAAE,MAAM,CAAC,WAAW,EAAE,mBAAmB,IAAI,KAAK;SACtE,CAAC,CAAC;IACL,CAAC;IAED,qCAAqC;IACrC,OAAO,IAAI,mBAAmB,CAAC,QAAQ,CAAC,CAAC;AAC3C,CAAC;AAED,sBAAsB;AACtB,IAAI,GAAG,GAAmB,IAAI,CAAC;AAC/B,IAAI,aAAa,GAAG,KAAK,CAAC;AAE1B;;GAEG;AACH,MAAM,UAAU,yBAAyB;IACvC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAE3B,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW;QACzC,cAAc,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO;QAClC,WAAW,EAAE,MAAM,CAAC,GAAG;QACvB,YAAY,EAAE,MAAM,CAAC,SAAS,CAAC,YAAY;QAC3C,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW;QACzC,gBAAgB,EAAE,aAAa;QAC/B,YAAY,EAAE,MAAM,CAAC,SAAS,CAAC,UAAU;QACzC,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,OAAO;QACjC,iBAAiB,EAAE,MAAM,CAAC,GAAG,KAAK,YAAY;QAC9C,qBAAqB,EAAE,MAAM,CAAC,GAAG,KAAK,aAAa;KACpD,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAiC;IAChE,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;QACpD,OAAO;IACT,CAAC;IAED,MAAM,UAAU,GAAoB;QAClC,GAAG,yBAAyB,EAAE;QAC9B,GAAG,MAAM;KACV,CAAC;IAEF,IAAI,UAAU,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;QACnD,aAAa,GAAG,IAAI,CAAC;QACrB,OAAO;IACT,CAAC;IAED,MAAM,kBAAkB,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;IAE1C,mBAAmB;IACnB,MAAM,cAAc,GAAoB,EAAE,CAAC;IAE3C,0BAA0B;IAC1B,MAAM,YAAY,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;IACpD,cAAc,CAAC,IAAI,CAAC,mBAAmB,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC;IAEnE,+BAA+B;IAC/B,IAAI,UAAU,CAAC,qBAAqB,EAAE,CAAC;QACrC,cAAc,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,IAAI,mBAAmB,EAAE,CAAC,CAAC,CAAC;IAC1E,CAAC;IAED,0CAA0C;IAC1C,GAAG,GAAG,IAAI,OAAO,CAAC;QAChB,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,QAAQ,EAAE,sBAAsB,CAAC,kBAAkB,CAAC;QACpD,OAAO;QACP,cAAc;KACf,CAAC,CAAC;IAEH,GAAG,CAAC,KAAK,EAAE,CAAC;IACZ,aAAa,GAAG,IAAI,CAAC;IAErB,MAAM,CAAC,IAAI,CACT;QACE,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;QAC7C,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,QAAQ,EAAE,UAAU,CAAC,YAAY;KAClC,EACD,kCAAkC,CACnC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAC5D,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC;QACrB,GAAG,GAAG,IAAI,CAAC;QACX,aAAa,GAAG,KAAK,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,4BAA4B,CAAC,CAAC;QACtD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,OAAgB;IACtD,OAAO,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACxC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,KAAK,CAAC,iBAAiB,EAAE,CAAC;AACnC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,eAAe;IACvB,KAAK,EAAE,cAAc;IACrB,QAAQ,EAAE,iBAAiB;IAC3B,GAAG,EAAE,YAAY;IACjB,KAAK,EAAE,cAAc;IACrB,QAAQ,EAAE,iBAAiB;IAC3B,KAAK,EAAE,cAAc;IACrB,OAAO,EAAE,gBAAgB;IACzB,KAAK,EAAE,cAAc;IACrB,UAAU,EAAE,mBAAmB;CACvB,CAAC;AAEX;;GAEG;AACH,MAAM,UAAU,eAAe;IAC7B,OAAO,SAAS,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAClD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe;IAC7B,OAAO,SAAS,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAClD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,SAAS,CAAC,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AACpD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAC/C,CAAC"}

package/dist/common/telemetry.d.ts

@@ -0,0 +1,15 @@
+/**
+ * OpenTelemetry SDK Setup
+ *
+ * Initializes distributed tracing with configurable exporters.
+ * Supports OTLP export for Jaeger, Tempo, or other OTLP-compatible backends.
+ */
+/**
+ * Initialize OpenTelemetry SDK
+ */
+export declare function initTelemetry(): void;
+/**
+ * Shutdown OpenTelemetry SDK gracefully
+ */
+export declare function shutdownTelemetry(): Promise<void>;
+//# sourceMappingURL=telemetry.d.ts.map

package/dist/common/telemetry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry.d.ts","sourceRoot":"","sources":["../../src/common/telemetry.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAYH;;GAEG;AACH,wBAAgB,aAAa,IAAI,IAAI,CAqCpC;AAED;;GAEG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CASvD"}

package/dist/common/telemetry.js

@@ -0,0 +1,61 @@
+/**
+ * OpenTelemetry SDK Setup
+ *
+ * Initializes distributed tracing with configurable exporters.
+ * Supports OTLP export for Jaeger, Tempo, or other OTLP-compatible backends.
+ */
+import { NodeSDK } from '@opentelemetry/sdk-node';
+import { getNodeAutoInstrumentations } from '@opentelemetry/auto-instrumentations-node';
+import { OTLPTraceExporter } from '@opentelemetry/exporter-trace-otlp-http';
+import { getConfig } from './config.js';
+import { createLogger } from './logger.js';
+const logger = createLogger({ component: 'telemetry' });
+let sdk = null;
+/**
+ * Initialize OpenTelemetry SDK
+ */
+export function initTelemetry() {
+    const config = getConfig();
+    if (!config.telemetry.enabled) {
+        logger.info('Telemetry disabled');
+        return;
+    }
+    const exporter = new OTLPTraceExporter({
+        url: config.telemetry.otlpEndpoint,
+        headers: config.telemetry.otlpHeaders,
+    });
+    sdk = new NodeSDK({
+        serviceName: config.telemetry.serviceName,
+        traceExporter: exporter,
+        instrumentations: [
+            getNodeAutoInstrumentations({
+                // Disable some noisy auto-instrumentations
+                '@opentelemetry/instrumentation-fs': { enabled: false },
+                '@opentelemetry/instrumentation-dns': { enabled: false },
+                // Enable HTTP instrumentation for API tracing
+                '@opentelemetry/instrumentation-http': { enabled: true },
+                // Enable Redis instrumentation for queue tracing
+                '@opentelemetry/instrumentation-ioredis': { enabled: true },
+                // Enable Fastify instrumentation
+                '@opentelemetry/instrumentation-fastify': { enabled: true },
+            }),
+        ],
+    });
+    sdk.start();
+    logger.info({ endpoint: config.telemetry.otlpEndpoint, service: config.telemetry.serviceName }, 'Telemetry initialized');
+}
+/**
+ * Shutdown OpenTelemetry SDK gracefully
+ */
+export async function shutdownTelemetry() {
+    if (sdk) {
+        try {
+            await sdk.shutdown();
+            logger.info('Telemetry shutdown complete');
+        }
+        catch (error) {
+            logger.error({ error }, 'Error shutting down telemetry');
+        }
+    }
+}
+//# sourceMappingURL=telemetry.js.map

package/dist/common/telemetry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry.js","sourceRoot":"","sources":["../../src/common/telemetry.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,2BAA2B,EAAE,MAAM,2CAA2C,CAAC;AACxF,OAAO,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AAC5E,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC;AAExD,IAAI,GAAG,GAAmB,IAAI,CAAC;AAE/B;;GAEG;AACH,MAAM,UAAU,aAAa;IAC3B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAE3B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAClC,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,iBAAiB,CAAC;QACrC,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC,YAAY;QAClC,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW;KACtC,CAAC,CAAC;IAEH,GAAG,GAAG,IAAI,OAAO,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW;QACzC,aAAa,EAAE,QAAQ;QACvB,gBAAgB,EAAE;YAChB,2BAA2B,CAAC;gBAC1B,2CAA2C;gBAC3C,mCAAmC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;gBACvD,oCAAoC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;gBACxD,8CAA8C;gBAC9C,qCAAqC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;gBACxD,iDAAiD;gBACjD,wCAAwC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;gBAC3D,iCAAiC;gBACjC,wCAAwC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;aAC5D,CAAC;SACH;KACF,CAAC,CAAC;IAEH,GAAG,CAAC,KAAK,EAAE,CAAC;IAEZ,MAAM,CAAC,IAAI,CACT,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,YAAY,EAAE,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,EAClF,uBAAuB,CACxB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,+BAA+B,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/common/tenant-verification.d.ts

@@ -0,0 +1,86 @@
+/**
+ * Tenant Membership Verification Service
+ *
+ * Provides secure verification that a user is a member of a tenant before
+ * allowing access to tenant-scoped resources. Uses Redis caching for performance.
+ *
+ * SECURITY: This service is critical for preventing cross-tenant data exposure.
+ * The JWT tenantId claim cannot be trusted alone - it must be verified against
+ * actual membership records.
+ *
+ * @packageDocumentation
+ */
+/**
+ * Tenant membership verification result
+ */
+export interface TenantMembershipResult {
+    /** Whether the user is a member of the tenant */
+    isMember: boolean;
+    /** The user's role in the tenant (if member) */
+    role?: string;
+    /** Whether the result was served from cache */
+    cached: boolean;
+}
+/**
+ * Verify that a user is a member of a tenant.
+ *
+ * This function first checks Redis cache for a cached membership result.
+ * If not cached, it queries the database and caches the result.
+ *
+ * @param userId - The user ID from the JWT `sub` claim
+ * @param tenantId - The tenant ID from the JWT `tenantId` claim
+ * @returns Promise resolving to membership verification result
+ *
+ * @example
+ * ```typescript
+ * const result = await verifyTenantMembership(userId, tenantId);
+ * if (!result.isMember) {
+ *   throw new ForbiddenError('User is not a member of this tenant');
+ * }
+ * ```
+ */
+export declare function verifyTenantMembership(userId: string, tenantId: string): Promise<TenantMembershipResult>;
+/**
+ * Verify tenant membership and throw ForbiddenError if user is not a member.
+ *
+ * This is a convenience function that combines verification with error handling
+ * for use in request handlers.
+ *
+ * @param userId - The user ID from the JWT `sub` claim
+ * @param tenantId - The tenant ID from the JWT `tenantId` claim
+ * @throws ForbiddenError if the user is not a member of the tenant
+ *
+ * @example
+ * ```typescript
+ * // In a request handler:
+ * await requireTenantMembership(user.sub, payload.tenantId);
+ * // If we reach here, user is verified as tenant member
+ * ```
+ */
+export declare function requireTenantMembership(userId: string, tenantId: string): Promise<void>;
+/**
+ * Invalidate the cached membership for a user-tenant pair.
+ *
+ * Call this when a user's membership changes (added, removed, or role changed).
+ *
+ * @param userId - The user ID
+ * @param tenantId - The tenant ID
+ */
+export declare function invalidateMembershipCache(userId: string, tenantId: string): Promise<void>;
+/**
+ * Invalidate all cached memberships for a user.
+ *
+ * Call this when a user is removed from the system or all their memberships change.
+ *
+ * @param userId - The user ID
+ */
+export declare function invalidateUserMembershipCache(userId: string): Promise<void>;
+/**
+ * Invalidate all cached memberships for a tenant.
+ *
+ * Call this when tenant membership rules change globally.
+ *
+ * @param tenantId - The tenant ID
+ */
+export declare function invalidateTenantMembershipCache(tenantId: string): Promise<void>;
+//# sourceMappingURL=tenant-verification.d.ts.map

package/dist/common/tenant-verification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-verification.d.ts","sourceRoot":"","sources":["../../src/common/tenant-verification.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAwBH;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,iDAAiD;IACjD,QAAQ,EAAE,OAAO,CAAC;IAClB,gDAAgD;IAChD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+CAA+C;IAC/C,MAAM,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,sBAAsB,CAAC,CAuEjC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAaf;AAED;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAaf;AAED;;;;;;GAMG;AACH,wBAAsB,6BAA6B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBjF;AAED;;;;;;GAMG;AACH,wBAAsB,+BAA+B,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBrF"}