@vorionsys/security 1.0.0

package/dist/api/rate-limit.js

@@ -0,0 +1,335 @@
+/**
+ * Per-Tenant Rate Limiting
+ *
+ * Provides tenant-scoped rate limiting with configurable limits per tier.
+ * Uses in-memory sliding window with Redis support for distributed deployments.
+ *
+ * @packageDocumentation
+ */
+import { createLogger } from '../common/logger.js';
+const logger = createLogger({ component: 'rate-limit' });
+/**
+ * Default tier configurations
+ */
+export const DEFAULT_TIER_LIMITS = {
+    free: {
+        requestsPerMinute: 60,
+        requestsPerHour: 1000,
+        burstLimit: 10,
+    },
+    pro: {
+        requestsPerMinute: 300,
+        requestsPerHour: 10000,
+        burstLimit: 50,
+    },
+    enterprise: {
+        requestsPerMinute: 1000,
+        requestsPerHour: 50000,
+        burstLimit: 100,
+    },
+    unlimited: {
+        requestsPerMinute: Infinity,
+        requestsPerHour: Infinity,
+        burstLimit: Infinity,
+    },
+};
+/**
+ * Per-Tenant Rate Limiter
+ */
+export class TenantRateLimiter {
+    state = new Map();
+    tierLimits;
+    cleanupInterval = null;
+    constructor(tierLimits = DEFAULT_TIER_LIMITS) {
+        this.tierLimits = tierLimits;
+        this.startCleanup();
+    }
+    /**
+     * Check and consume rate limit for a tenant
+     */
+    check(tenantId, tier = 'free') {
+        const now = Date.now();
+        const limits = this.tierLimits[tier] ?? this.tierLimits['free'];
+        // Get or create tenant state
+        let state = this.state.get(tenantId);
+        if (!state) {
+            state = this.createInitialState(tier, now);
+            this.state.set(tenantId, state);
+        }
+        // Update tier if changed
+        if (state.tier !== tier) {
+            state.tier = tier;
+        }
+        // Reset windows if expired
+        this.resetExpiredWindows(state, now);
+        // Check limits
+        const secondRemaining = limits.burstLimit - state.second.count;
+        const minuteRemaining = limits.requestsPerMinute - state.minute.count;
+        const hourRemaining = limits.requestsPerHour - state.hour.count;
+        const allowed = secondRemaining > 0 && minuteRemaining > 0 && hourRemaining > 0;
+        if (allowed) {
+            // Consume one request
+            state.second.count++;
+            state.minute.count++;
+            state.hour.count++;
+        }
+        const result = {
+            allowed,
+            remaining: {
+                minute: Math.max(0, minuteRemaining - (allowed ? 1 : 0)),
+                hour: Math.max(0, hourRemaining - (allowed ? 1 : 0)),
+                burst: Math.max(0, secondRemaining - (allowed ? 1 : 0)),
+            },
+            resetAt: {
+                minute: state.minute.resetAt,
+                hour: state.hour.resetAt,
+                burst: state.second.resetAt,
+            },
+        };
+        if (!allowed) {
+            // Calculate retry-after based on which limit was hit
+            if (secondRemaining <= 0) {
+                result.retryAfter = Math.ceil((state.second.resetAt - now) / 1000);
+            }
+            else if (minuteRemaining <= 0) {
+                result.retryAfter = Math.ceil((state.minute.resetAt - now) / 1000);
+            }
+            else {
+                result.retryAfter = Math.ceil((state.hour.resetAt - now) / 1000);
+            }
+            logger.warn({
+                tenantId,
+                tier,
+                remaining: result.remaining,
+                retryAfter: result.retryAfter,
+            }, 'Rate limit exceeded');
+        }
+        return result;
+    }
+    /**
+     * Get current state for a tenant (for monitoring)
+     */
+    getState(tenantId) {
+        const state = this.state.get(tenantId);
+        if (!state)
+            return null;
+        const limits = this.tierLimits[state.tier] ?? this.tierLimits['free'];
+        return {
+            tier: state.tier,
+            usage: {
+                second: state.second.count,
+                minute: state.minute.count,
+                hour: state.hour.count,
+            },
+            limits,
+        };
+    }
+    /**
+     * Reset rate limit for a tenant
+     */
+    reset(tenantId) {
+        this.state.delete(tenantId);
+        logger.info({ tenantId }, 'Rate limit reset');
+    }
+    /**
+     * Update tier limits
+     */
+    setTierLimits(tier, limits) {
+        this.tierLimits[tier] = limits;
+        logger.info({ tier, limits }, 'Tier limits updated');
+    }
+    /**
+     * Create initial state for a tenant
+     */
+    createInitialState(tier, now) {
+        return {
+            minute: { count: 0, resetAt: now + 60000 },
+            hour: { count: 0, resetAt: now + 3600000 },
+            second: { count: 0, resetAt: now + 1000 },
+            tier,
+        };
+    }
+    /**
+     * Reset expired windows
+     */
+    resetExpiredWindows(state, now) {
+        if (now >= state.second.resetAt) {
+            state.second = { count: 0, resetAt: now + 1000 };
+        }
+        if (now >= state.minute.resetAt) {
+            state.minute = { count: 0, resetAt: now + 60000 };
+        }
+        if (now >= state.hour.resetAt) {
+            state.hour = { count: 0, resetAt: now + 3600000 };
+        }
+    }
+    /**
+     * Start periodic cleanup of stale entries
+     */
+    startCleanup() {
+        // Clean up every 5 minutes
+        this.cleanupInterval = setInterval(() => {
+            const now = Date.now();
+            const staleThreshold = now - 3600000; // 1 hour
+            for (const [tenantId, state] of this.state.entries()) {
+                // Remove if all windows have been expired for over an hour
+                if (state.second.resetAt < staleThreshold &&
+                    state.minute.resetAt < staleThreshold &&
+                    state.hour.resetAt < staleThreshold) {
+                    this.state.delete(tenantId);
+                }
+            }
+        }, 300000);
+        // Don't prevent process exit
+        this.cleanupInterval.unref();
+    }
+    /**
+     * Stop the rate limiter
+     */
+    stop() {
+        if (this.cleanupInterval) {
+            clearInterval(this.cleanupInterval);
+            this.cleanupInterval = null;
+        }
+    }
+    /**
+     * Get statistics
+     */
+    getStats() {
+        const byTier = {};
+        for (const state of this.state.values()) {
+            byTier[state.tier] = (byTier[state.tier] ?? 0) + 1;
+        }
+        return {
+            activeTenants: this.state.size,
+            byTier,
+        };
+    }
+}
+// Singleton instance
+let rateLimiter = null;
+/**
+ * Get the rate limiter singleton
+ */
+export function getRateLimiter() {
+    if (!rateLimiter) {
+        rateLimiter = new TenantRateLimiter();
+    }
+    return rateLimiter;
+}
+/**
+ * Create rate limit middleware for Fastify
+ */
+export function createRateLimitMiddleware(options) {
+    const limiter = options?.tierLimits
+        ? new TenantRateLimiter(options.tierLimits)
+        : getRateLimiter();
+    const getTier = options?.getTier ?? ((req) => req.auth?.roles?.includes('enterprise')
+        ? 'enterprise'
+        : req.auth?.roles?.includes('pro')
+            ? 'pro'
+            : 'free');
+    const skip = options?.skip ?? (() => false);
+    return async (request, reply) => {
+        // Skip if configured
+        if (skip(request)) {
+            return;
+        }
+        // Skip if not authenticated (auth middleware will handle)
+        if (!request.auth?.tenantId) {
+            return;
+        }
+        const tenantId = request.auth.tenantId;
+        const tier = getTier(request);
+        const result = limiter.check(tenantId, tier);
+        // Set rate limit headers
+        reply.header('X-RateLimit-Limit-Minute', result.remaining.minute + (result.allowed ? 1 : 0));
+        reply.header('X-RateLimit-Remaining-Minute', result.remaining.minute);
+        reply.header('X-RateLimit-Reset-Minute', Math.ceil(result.resetAt.minute / 1000));
+        reply.header('X-RateLimit-Limit-Hour', result.remaining.hour + (result.allowed ? 1 : 0));
+        reply.header('X-RateLimit-Remaining-Hour', result.remaining.hour);
+        if (!result.allowed) {
+            reply.header('Retry-After', result.retryAfter);
+            reply.status(429).send({
+                error: {
+                    code: 'RATE_LIMIT_EXCEEDED',
+                    message: 'Too many requests',
+                    retryAfter: result.retryAfter,
+                    limits: {
+                        minute: result.remaining.minute,
+                        hour: result.remaining.hour,
+                    },
+                },
+            });
+            return;
+        }
+    };
+}
+// Cache for route-specific rate limiters to avoid creating new ones on each request
+// This prevents memory leaks from creating new TenantRateLimiter instances with intervals
+const routeLimiterCache = new Map();
+/**
+ * Rate limit decorator for specific routes
+ */
+export function withRateLimit(customLimits) {
+    return async (request, reply) => {
+        if (!request.auth?.tenantId) {
+            return;
+        }
+        // Get tier for limit calculation
+        const tier = request.auth.roles?.includes('enterprise')
+            ? 'enterprise'
+            : request.auth.roles?.includes('pro')
+                ? 'pro'
+                : 'free';
+        // Apply stricter limits if specified
+        if (customLimits) {
+            const baseLimits = DEFAULT_TIER_LIMITS[tier] ?? DEFAULT_TIER_LIMITS['free'];
+            const effectiveLimits = {
+                requestsPerMinute: Math.min(customLimits.requestsPerMinute ?? Infinity, baseLimits.requestsPerMinute),
+                requestsPerHour: Math.min(customLimits.requestsPerHour ?? Infinity, baseLimits.requestsPerHour),
+                burstLimit: Math.min(customLimits.burstLimit ?? Infinity, baseLimits.burstLimit),
+            };
+            // Create route-specific key
+            const routeKey = `${request.auth.tenantId}:${request.routeOptions.url}`;
+            // Create a cache key based on the effective limits
+            const limiterCacheKey = `${effectiveLimits.requestsPerMinute}:${effectiveLimits.requestsPerHour}:${effectiveLimits.burstLimit}`;
+            // Reuse existing limiter or create a new one (avoids memory leak from creating intervals)
+            let customLimiter = routeLimiterCache.get(limiterCacheKey);
+            if (!customLimiter) {
+                customLimiter = new TenantRateLimiter({
+                    custom: effectiveLimits,
+                });
+                routeLimiterCache.set(limiterCacheKey, customLimiter);
+            }
+            const result = customLimiter.check(routeKey, 'custom');
+            if (!result.allowed) {
+                reply.header('Retry-After', result.retryAfter);
+                reply.status(429).send({
+                    error: {
+                        code: 'RATE_LIMIT_EXCEEDED',
+                        message: 'Too many requests for this endpoint',
+                        retryAfter: result.retryAfter,
+                    },
+                });
+                return;
+            }
+        }
+    };
+}
+/**
+ * Stop the rate limiter singleton and cleanup route-specific limiters
+ */
+export function stopRateLimiter() {
+    if (rateLimiter) {
+        rateLimiter.stop();
+        rateLimiter = null;
+    }
+    // Stop all cached route-specific limiters
+    for (const limiter of routeLimiterCache.values()) {
+        limiter.stop();
+    }
+    routeLimiterCache.clear();
+    logger.info('Rate limiters stopped and cleaned up');
+}
+//# sourceMappingURL=rate-limit.js.map

package/dist/api/rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../../src/api/rate-limit.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC;AAWzD;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA+B;IAC7D,IAAI,EAAE;QACJ,iBAAiB,EAAE,EAAE;QACrB,eAAe,EAAE,IAAI;QACrB,UAAU,EAAE,EAAE;KACf;IACD,GAAG,EAAE;QACH,iBAAiB,EAAE,GAAG;QACtB,eAAe,EAAE,KAAK;QACtB,UAAU,EAAE,EAAE;KACf;IACD,UAAU,EAAE;QACV,iBAAiB,EAAE,IAAI;QACvB,eAAe,EAAE,KAAK;QACtB,UAAU,EAAE,GAAG;KAChB;IACD,SAAS,EAAE;QACT,iBAAiB,EAAE,QAAQ;QAC3B,eAAe,EAAE,QAAQ;QACzB,UAAU,EAAE,QAAQ;KACrB;CACF,CAAC;AAsCF;;GAEG;AACH,MAAM,OAAO,iBAAiB;IACpB,KAAK,GAA6B,IAAI,GAAG,EAAE,CAAC;IAC5C,UAAU,CAA6B;IACvC,eAAe,GAA0B,IAAI,CAAC;IAEtD,YAAY,aAAyC,mBAAmB;QACtE,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,YAAY,EAAE,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAgB,EAAE,OAAe,MAAM;QAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAE,CAAC;QAEjE,6BAA6B;QAC7B,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC3C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAClC,CAAC;QAED,yBAAyB;QACzB,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;QACpB,CAAC;QAED,2BAA2B;QAC3B,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAErC,eAAe;QACf,MAAM,eAAe,GAAG,MAAM,CAAC,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC;QAC/D,MAAM,eAAe,GAAG,MAAM,CAAC,iBAAiB,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC;QACtE,MAAM,aAAa,GAAG,MAAM,CAAC,eAAe,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;QAEhE,MAAM,OAAO,GACX,eAAe,GAAG,CAAC,IAAI,eAAe,GAAG,CAAC,IAAI,aAAa,GAAG,CAAC,CAAC;QAElE,IAAI,OAAO,EAAE,CAAC;YACZ,sBAAsB;YACtB,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACrB,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACrB,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;QAED,MAAM,MAAM,GAAoB;YAC9B,OAAO;YACP,SAAS,EAAE;gBACT,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,eAAe,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACxD,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,aAAa,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACpD,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,eAAe,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;aACxD;YACD,OAAO,EAAE;gBACP,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO;gBAC5B,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO;gBACxB,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO;aAC5B;SACF,CAAC;QAEF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,qDAAqD;YACrD,IAAI,eAAe,IAAI,CAAC,EAAE,CAAC;gBACzB,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;YACrE,CAAC;iBAAM,IAAI,eAAe,IAAI,CAAC,EAAE,CAAC;gBAChC,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;YACrE,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;YACnE,CAAC;YAED,MAAM,CAAC,IAAI,CACT;gBACE,QAAQ;gBACR,IAAI;gBACJ,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;aAC9B,EACD,qBAAqB,CACtB,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,QAAgB;QAKvB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAE,CAAC;QAEvE,OAAO;YACL,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,KAAK,EAAE;gBACL,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK;gBAC1B,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK;gBAC1B,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK;aACvB;YACD,MAAM;SACP,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAgB;QACpB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,kBAAkB,CAAC,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,IAAY,EAAE,MAAkB;QAC5C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,qBAAqB,CAAC,CAAC;IACvD,CAAC;IAED;;OAEG;IACK,kBAAkB,CAAC,IAAY,EAAE,GAAW;QAClD,OAAO;YACL,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,KAAK,EAAE;YAC1C,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,OAAO,EAAE;YAC1C,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,IAAI,EAAE;YACzC,IAAI;SACL,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,mBAAmB,CAAC,KAAkB,EAAE,GAAW;QACzD,IAAI,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAChC,KAAK,CAAC,MAAM,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,IAAI,EAAE,CAAC;QACnD,CAAC;QACD,IAAI,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAChC,KAAK,CAAC,MAAM,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,KAAK,EAAE,CAAC;QACpD,CAAC;QACD,IAAI,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,OAAO,EAAE,CAAC;QACpD,CAAC;IACH,CAAC;IAED;;OAEG;IACK,YAAY;QAClB,2BAA2B;QAC3B,IAAI,CAAC,eAAe,GAAG,WAAW,CAAC,GAAG,EAAE;YACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,cAAc,GAAG,GAAG,GAAG,OAAO,CAAC,CAAC,SAAS;YAE/C,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;gBACrD,2DAA2D;gBAC3D,IACE,KAAK,CAAC,MAAM,CAAC,OAAO,GAAG,cAAc;oBACrC,KAAK,CAAC,MAAM,CAAC,OAAO,GAAG,cAAc;oBACrC,KAAK,CAAC,IAAI,CAAC,OAAO,GAAG,cAAc,EACnC,CAAC;oBACD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAC9B,CAAC;YACH,CAAC;QACH,CAAC,EAAE,MAAM,CAAC,CAAC;QAEX,6BAA6B;QAC7B,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,IAAI;QACF,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YACpC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAC9B,CAAC;IACH,CAAC;IAED;;OAEG;IACH,QAAQ;QAIN,MAAM,MAAM,GAA2B,EAAE,CAAC;QAE1C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YACxC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACrD,CAAC;QAED,OAAO;YACL,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;YAC9B,MAAM;SACP,CAAC;IACJ,CAAC;CACF;AAED,qBAAqB;AACrB,IAAI,WAAW,GAA6B,IAAI,CAAC;AAEjD;;GAEG;AACH,MAAM,UAAU,cAAc;IAC5B,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,WAAW,GAAG,IAAI,iBAAiB,EAAE,CAAC;IACxC,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAIzC;IACC,MAAM,OAAO,GAAG,OAAO,EAAE,UAAU;QACjC,CAAC,CAAC,IAAI,iBAAiB,CAAC,OAAO,CAAC,UAAU,CAAC;QAC3C,CAAC,CAAC,cAAc,EAAE,CAAC;IAErB,MAAM,OAAO,GAAG,OAAO,EAAE,OAAO,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,YAAY,CAAC;QACnF,CAAC,CAAC,YAAY;QACd,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC;YAChC,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,MAAM,CAAC,CAAC;IAEd,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;IAE5C,OAAO,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAiB,EAAE;QAC3E,qBAAqB;QACrB,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAClB,OAAO;QACT,CAAC;QAED,0DAA0D;QAC1D,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC;YAC5B,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC;QACvC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAE9B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAE7C,yBAAyB;QACzB,KAAK,CAAC,MAAM,CAAC,0BAA0B,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7F,KAAK,CAAC,MAAM,CAAC,8BAA8B,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACtE,KAAK,CAAC,MAAM,CAAC,0BAA0B,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC;QAClF,KAAK,CAAC,MAAM,CAAC,wBAAwB,EAAE,MAAM,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzF,KAAK,CAAC,MAAM,CAAC,4BAA4B,EAAE,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAElE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;YAE/C,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACrB,KAAK,EAAE;oBACL,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EAAE,mBAAmB;oBAC5B,UAAU,EAAE,MAAM,CAAC,UAAU;oBAC7B,MAAM,EAAE;wBACN,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM;wBAC/B,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,IAAI;qBAC5B;iBACF;aACF,CAAC,CAAC;YACH,OAAO;QACT,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,0FAA0F;AAC1F,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAA6B,CAAC;AAE/D;;GAEG;AACH,MAAM,UAAU,aAAa,CAC3B,YAAkC;IAElC,OAAO,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAiB,EAAE;QAC3E,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC;YAC5B,OAAO;QACT,CAAC;QAED,iCAAiC;QACjC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,YAAY,CAAC;YACrD,CAAC,CAAC,YAAY;YACd,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC;gBACnC,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,MAAM,CAAC;QAEb,qCAAqC;QACrC,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,MAAM,CAAE,CAAC;YAC7E,MAAM,eAAe,GAAe;gBAClC,iBAAiB,EAAE,IAAI,CAAC,GAAG,CACzB,YAAY,CAAC,iBAAiB,IAAI,QAAQ,EAC1C,UAAU,CAAC,iBAAiB,CAC7B;gBACD,eAAe,EAAE,IAAI,CAAC,GAAG,CACvB,YAAY,CAAC,eAAe,IAAI,QAAQ,EACxC,UAAU,CAAC,eAAe,CAC3B;gBACD,UAAU,EAAE,IAAI,CAAC,GAAG,CAClB,YAAY,CAAC,UAAU,IAAI,QAAQ,EACnC,UAAU,CAAC,UAAU,CACtB;aACF,CAAC;YAEF,4BAA4B;YAC5B,MAAM,QAAQ,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC;YAExE,mDAAmD;YACnD,MAAM,eAAe,GAAG,GAAG,eAAe,CAAC,iBAAiB,IAAI,eAAe,CAAC,eAAe,IAAI,eAAe,CAAC,UAAU,EAAE,CAAC;YAEhI,0FAA0F;YAC1F,IAAI,aAAa,GAAG,iBAAiB,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YAC3D,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,aAAa,GAAG,IAAI,iBAAiB,CAAC;oBACpC,MAAM,EAAE,eAAe;iBACxB,CAAC,CAAC;gBACH,iBAAiB,CAAC,GAAG,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC;YACxD,CAAC;YAED,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAEvD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;gBAC/C,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACrB,KAAK,EAAE;wBACL,IAAI,EAAE,qBAAqB;wBAC3B,OAAO,EAAE,qCAAqC;wBAC9C,UAAU,EAAE,MAAM,CAAC,UAAU;qBAC9B;iBACF,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;QACH,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe;IAC7B,IAAI,WAAW,EAAE,CAAC;QAChB,WAAW,CAAC,IAAI,EAAE,CAAC;QACnB,WAAW,GAAG,IAAI,CAAC;IACrB,CAAC;IACD,0CAA0C;IAC1C,KAAK,MAAM,OAAO,IAAI,iBAAiB,CAAC,MAAM,EAAE,EAAE,CAAC;QACjD,OAAO,CAAC,IAAI,EAAE,CAAC;IACjB,CAAC;IACD,iBAAiB,CAAC,KAAK,EAAE,CAAC;IAC1B,MAAM,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;AACtD,CAAC"}

package/dist/api/routes/extensions.d.ts

@@ -0,0 +1,40 @@
+/**
+ * CAR Extension API Routes
+ *
+ * Exposes the CAR Extension framework via REST API endpoints.
+ * Provides extension listing, details, invocation, and health monitoring.
+ *
+ * @packageDocumentation
+ * @module @vorion/api/routes/extensions
+ * @license Apache-2.0
+ */
+import type { FastifyInstance } from 'fastify';
+import { type ACIExtensionService } from '../../car-extensions/index.js';
+/**
+ * Reset the extension service (for testing)
+ */
+export declare function resetExtensionService(): void;
+/**
+ * Set a custom extension service (for testing)
+ */
+export declare function setExtensionService(service: ACIExtensionService): void;
+/**
+ * Extension routes roles
+ */
+export declare const EXTENSION_ROLES: {
+    /** Roles that can list and read extensions */
+    readonly READ: readonly ["admin", "tenant:admin", "extension:admin", "extension_reader", "agent:operator"];
+    /** Roles that can invoke extensions */
+    readonly INVOKE: readonly ["admin", "tenant:admin", "extension:admin", "agent:operator"];
+};
+/**
+ * Register extension routes
+ *
+ * @param server - Fastify server instance
+ * @param options - Route options
+ */
+export declare function registerExtensionRoutes(server: FastifyInstance, options?: {
+    prefix?: string;
+}): Promise<void>;
+export default registerExtensionRoutes;
+//# sourceMappingURL=extensions.d.ts.map

package/dist/api/routes/extensions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"extensions.d.ts","sourceRoot":"","sources":["../../../src/api/routes/extensions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAK7E,OAAO,EAEL,KAAK,mBAAmB,EAMzB,MAAM,+BAA+B,CAAC;AA+IvC;;GAEG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,mBAAmB,GAAG,IAAI,CAEtE;AAuPD;;GAEG;AACH,eAAO,MAAM,eAAe;IAC1B,8CAA8C;;IAE9C,uCAAuC;;CAE/B,CAAC;AAoCX;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,eAAe,EACvB,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5B,OAAO,CAAC,IAAI,CAAC,CAiEf;AAED,eAAe,uBAAuB,CAAC"}