@vorionsys/security 1.0.0

package/dist/security/service-auth/service-account.js

@@ -0,0 +1,475 @@
+/**
+ * Service Account Management
+ *
+ * Provides types, interfaces, and management functions for service accounts
+ * used in service-to-service authentication.
+ *
+ * @packageDocumentation
+ */
+import { z } from 'zod';
+import { randomBytes, createHash, timingSafeEqual } from 'node:crypto';
+import { createLogger } from '../../common/logger.js';
+import { VorionError, NotFoundError, ConflictError, ValidationError } from '../../common/errors.js';
+const logger = createLogger({ component: 'service-account' });
+// =============================================================================
+// TYPES AND SCHEMAS
+// =============================================================================
+/**
+ * Service account status
+ */
+export const ServiceAccountStatus = {
+    ACTIVE: 'active',
+    REVOKED: 'revoked',
+    SUSPENDED: 'suspended',
+};
+export const serviceAccountStatusSchema = z.nativeEnum(ServiceAccountStatus);
+/**
+ * Service account schema for validation
+ */
+export const serviceAccountSchema = z.object({
+    clientId: z.string().uuid(),
+    clientSecret: z.string().min(64), // SHA-256 hash is 64 hex chars
+    name: z.string().min(1).max(255),
+    permissions: z.array(z.string()),
+    ipWhitelist: z.array(z.string().ip()).optional(),
+    status: serviceAccountStatusSchema,
+    tenantId: z.string().uuid(),
+    description: z.string().max(1000).optional(),
+    createdAt: z.coerce.date(),
+    lastUsedAt: z.coerce.date().optional(),
+    secretRotatedAt: z.coerce.date().optional(),
+    metadata: z.record(z.unknown()).optional(),
+});
+export const createServiceAccountInputSchema = z.object({
+    name: z.string().min(1).max(255),
+    permissions: z.array(z.string()).min(1),
+    tenantId: z.string().uuid(),
+    ipWhitelist: z.array(z.string().ip()).optional(),
+    description: z.string().max(1000).optional(),
+    metadata: z.record(z.unknown()).optional(),
+});
+export const updateServiceAccountInputSchema = z.object({
+    name: z.string().min(1).max(255).optional(),
+    permissions: z.array(z.string()).optional(),
+    ipWhitelist: z.array(z.string().ip()).optional(),
+    description: z.string().max(1000).optional(),
+    metadata: z.record(z.unknown()).optional(),
+});
+// =============================================================================
+// ERRORS
+// =============================================================================
+/**
+ * Service account specific error
+ */
+export class ServiceAccountError extends VorionError {
+    code = 'SERVICE_ACCOUNT_ERROR';
+    statusCode = 400;
+    constructor(message, details) {
+        super(message, details);
+        this.name = 'ServiceAccountError';
+    }
+}
+/**
+ * Service account not found error
+ */
+export class ServiceAccountNotFoundError extends NotFoundError {
+    code = 'SERVICE_ACCOUNT_NOT_FOUND';
+    constructor(clientId) {
+        super(`Service account not found: ${clientId}`, { clientId });
+        this.name = 'ServiceAccountNotFoundError';
+    }
+}
+/**
+ * Service account revoked error
+ */
+export class ServiceAccountRevokedError extends VorionError {
+    code = 'SERVICE_ACCOUNT_REVOKED';
+    statusCode = 401;
+    constructor(clientId) {
+        super(`Service account has been revoked: ${clientId}`, { clientId });
+        this.name = 'ServiceAccountRevokedError';
+    }
+}
+/**
+ * Service account suspended error
+ */
+export class ServiceAccountSuspendedError extends VorionError {
+    code = 'SERVICE_ACCOUNT_SUSPENDED';
+    statusCode = 403;
+    constructor(clientId) {
+        super(`Service account is suspended: ${clientId}`, { clientId });
+        this.name = 'ServiceAccountSuspendedError';
+    }
+}
+// =============================================================================
+// CONSTANTS
+// =============================================================================
+/** Length of generated client secrets in bytes */
+const CLIENT_SECRET_LENGTH = 32;
+/** Prefix for client IDs */
+export const SERVICE_CLIENT_ID_PREFIX = 'svc_';
+// =============================================================================
+// UTILITY FUNCTIONS
+// =============================================================================
+/**
+ * Generate a cryptographically secure client secret
+ */
+export function generateClientSecret() {
+    return randomBytes(CLIENT_SECRET_LENGTH).toString('hex');
+}
+/**
+ * Generate a unique client ID
+ */
+export function generateClientId() {
+    const id = randomBytes(16).toString('hex');
+    return `${SERVICE_CLIENT_ID_PREFIX}${id}`;
+}
+/**
+ * Hash a client secret using SHA-256
+ */
+export function hashClientSecret(secret) {
+    return createHash('sha256').update(secret).digest('hex');
+}
+/**
+ * Verify a client secret against its hash using timing-safe comparison
+ */
+export function verifyClientSecret(secret, hashedSecret) {
+    const hashedInput = hashClientSecret(secret);
+    // Use timing-safe comparison to prevent timing attacks
+    if (hashedInput.length !== hashedSecret.length) {
+        return false;
+    }
+    return timingSafeEqual(Buffer.from(hashedInput), Buffer.from(hashedSecret));
+}
+// =============================================================================
+// IN-MEMORY STORE (for testing/development)
+// =============================================================================
+/**
+ * In-memory implementation of service account store
+ */
+export class InMemoryServiceAccountStore {
+    accounts = new Map();
+    async create(account) {
+        if (this.accounts.has(account.clientId)) {
+            throw new ConflictError(`Service account already exists: ${account.clientId}`);
+        }
+        this.accounts.set(account.clientId, { ...account });
+        return { ...account };
+    }
+    async findByClientId(clientId) {
+        const account = this.accounts.get(clientId);
+        return account ? { ...account } : null;
+    }
+    async findByTenantId(tenantId) {
+        const results = [];
+        for (const account of this.accounts.values()) {
+            if (account.tenantId === tenantId) {
+                results.push({ ...account });
+            }
+        }
+        return results;
+    }
+    async update(clientId, updates) {
+        const account = this.accounts.get(clientId);
+        if (!account) {
+            throw new ServiceAccountNotFoundError(clientId);
+        }
+        const updated = { ...account, ...updates };
+        this.accounts.set(clientId, updated);
+        return { ...updated };
+    }
+    async delete(clientId) {
+        return this.accounts.delete(clientId);
+    }
+    async updateLastUsed(clientId) {
+        const account = this.accounts.get(clientId);
+        if (account) {
+            account.lastUsedAt = new Date();
+        }
+    }
+    /** Clear all accounts (for testing) */
+    clear() {
+        this.accounts.clear();
+    }
+}
+/**
+ * Service account manager
+ */
+export class ServiceAccountManager {
+    store;
+    minSecretRotationDays;
+    maxAccountsPerTenant;
+    constructor(config) {
+        this.store = config.store;
+        this.minSecretRotationDays = config.minSecretRotationDays ?? 90;
+        this.maxAccountsPerTenant = config.maxAccountsPerTenant ?? 100;
+    }
+    /**
+     * Create a new service account
+     */
+    async createAccount(input) {
+        // Validate input
+        const validated = createServiceAccountInputSchema.parse(input);
+        // Check tenant account limit
+        const existingAccounts = await this.store.findByTenantId(validated.tenantId);
+        if (existingAccounts.length >= this.maxAccountsPerTenant) {
+            throw new ValidationError(`Maximum service accounts per tenant exceeded (${this.maxAccountsPerTenant})`, { tenantId: validated.tenantId, current: existingAccounts.length });
+        }
+        // Generate credentials
+        const clientId = generateClientId();
+        const clientSecretPlaintext = generateClientSecret();
+        const clientSecretHash = hashClientSecret(clientSecretPlaintext);
+        const now = new Date();
+        const account = {
+            clientId,
+            clientSecret: clientSecretHash,
+            name: validated.name,
+            permissions: validated.permissions,
+            ipWhitelist: validated.ipWhitelist,
+            status: ServiceAccountStatus.ACTIVE,
+            tenantId: validated.tenantId,
+            description: validated.description,
+            createdAt: now,
+            secretRotatedAt: now,
+            metadata: validated.metadata,
+        };
+        const created = await this.store.create(account);
+        logger.info({ clientId, tenantId: validated.tenantId, name: validated.name }, 'Service account created');
+        return {
+            account: created,
+            clientSecretPlaintext,
+        };
+    }
+    /**
+     * Get a service account by client ID
+     */
+    async getAccount(clientId) {
+        const account = await this.store.findByClientId(clientId);
+        if (!account) {
+            throw new ServiceAccountNotFoundError(clientId);
+        }
+        return account;
+    }
+    /**
+     * Get a service account if it exists
+     */
+    async findAccount(clientId) {
+        return this.store.findByClientId(clientId);
+    }
+    /**
+     * List all service accounts for a tenant
+     */
+    async listAccounts(tenantId) {
+        return this.store.findByTenantId(tenantId);
+    }
+    /**
+     * Update a service account
+     */
+    async updateAccount(clientId, input) {
+        const validated = updateServiceAccountInputSchema.parse(input);
+        // Verify account exists
+        await this.getAccount(clientId);
+        const updated = await this.store.update(clientId, validated);
+        logger.info({ clientId }, 'Service account updated');
+        return updated;
+    }
+    /**
+     * Revoke a service account
+     */
+    async revokeAccount(clientId) {
+        const account = await this.getAccount(clientId);
+        if (account.status === ServiceAccountStatus.REVOKED) {
+            throw new ServiceAccountError('Service account is already revoked', { clientId });
+        }
+        const updated = await this.store.update(clientId, {
+            status: ServiceAccountStatus.REVOKED,
+        });
+        logger.warn({ clientId }, 'Service account revoked');
+        return updated;
+    }
+    /**
+     * Suspend a service account
+     */
+    async suspendAccount(clientId) {
+        const account = await this.getAccount(clientId);
+        if (account.status === ServiceAccountStatus.REVOKED) {
+            throw new ServiceAccountError('Cannot suspend a revoked account', { clientId });
+        }
+        const updated = await this.store.update(clientId, {
+            status: ServiceAccountStatus.SUSPENDED,
+        });
+        logger.warn({ clientId }, 'Service account suspended');
+        return updated;
+    }
+    /**
+     * Reactivate a suspended service account
+     */
+    async reactivateAccount(clientId) {
+        const account = await this.getAccount(clientId);
+        if (account.status === ServiceAccountStatus.REVOKED) {
+            throw new ServiceAccountError('Cannot reactivate a revoked account', { clientId });
+        }
+        if (account.status === ServiceAccountStatus.ACTIVE) {
+            throw new ServiceAccountError('Account is already active', { clientId });
+        }
+        const updated = await this.store.update(clientId, {
+            status: ServiceAccountStatus.ACTIVE,
+        });
+        logger.info({ clientId }, 'Service account reactivated');
+        return updated;
+    }
+    /**
+     * Delete a service account permanently
+     */
+    async deleteAccount(clientId) {
+        // Verify account exists
+        await this.getAccount(clientId);
+        const deleted = await this.store.delete(clientId);
+        if (deleted) {
+            logger.warn({ clientId }, 'Service account deleted');
+        }
+        return deleted;
+    }
+    /**
+     * Rotate a service account's secret
+     */
+    async rotateSecret(clientId) {
+        const account = await this.getAccount(clientId);
+        if (account.status !== ServiceAccountStatus.ACTIVE) {
+            throw new ServiceAccountError('Cannot rotate secret for inactive account', {
+                clientId,
+                status: account.status,
+            });
+        }
+        const previousSecretHash = account.clientSecret;
+        const newClientSecretPlaintext = generateClientSecret();
+        const newSecretHash = hashClientSecret(newClientSecretPlaintext);
+        const updated = await this.store.update(clientId, {
+            clientSecret: newSecretHash,
+            secretRotatedAt: new Date(),
+        });
+        logger.info({ clientId }, 'Service account secret rotated');
+        return {
+            account: updated,
+            newClientSecretPlaintext,
+            previousSecretHash,
+        };
+    }
+    /**
+     * Verify credentials for a service account
+     */
+    async verifyCredentials(clientId, clientSecret) {
+        const account = await this.findAccount(clientId);
+        if (!account) {
+            // Use same error to prevent enumeration
+            throw new ServiceAccountError('Invalid credentials');
+        }
+        if (account.status === ServiceAccountStatus.REVOKED) {
+            throw new ServiceAccountRevokedError(clientId);
+        }
+        if (account.status === ServiceAccountStatus.SUSPENDED) {
+            throw new ServiceAccountSuspendedError(clientId);
+        }
+        if (!verifyClientSecret(clientSecret, account.clientSecret)) {
+            throw new ServiceAccountError('Invalid credentials');
+        }
+        // Update last used timestamp asynchronously
+        this.store.updateLastUsed(clientId).catch((err) => {
+            logger.error({ err, clientId }, 'Failed to update lastUsedAt');
+        });
+        return account;
+    }
+    /**
+     * Check if an IP address is allowed for a service account
+     */
+    async isIpAllowed(clientId, ipAddress) {
+        const account = await this.getAccount(clientId);
+        // If no whitelist, allow all
+        if (!account.ipWhitelist || account.ipWhitelist.length === 0) {
+            return true;
+        }
+        return account.ipWhitelist.includes(ipAddress);
+    }
+    /**
+     * Check if a service account has a specific permission
+     */
+    async hasPermission(clientId, permission) {
+        const account = await this.getAccount(clientId);
+        // Check for wildcard permission
+        if (account.permissions.includes('*')) {
+            return true;
+        }
+        // Check for exact match
+        if (account.permissions.includes(permission)) {
+            return true;
+        }
+        // Check for prefix match (e.g., 'read:*' matches 'read:users')
+        for (const perm of account.permissions) {
+            if (perm.endsWith(':*')) {
+                const prefix = perm.slice(0, -1); // Remove '*'
+                if (permission.startsWith(prefix)) {
+                    return true;
+                }
+            }
+        }
+        return false;
+    }
+    /**
+     * Check if secret rotation is recommended
+     */
+    async isSecretRotationRecommended(clientId) {
+        const account = await this.getAccount(clientId);
+        if (!account.secretRotatedAt) {
+            return true;
+        }
+        const daysSinceRotation = Math.floor((Date.now() - account.secretRotatedAt.getTime()) / (1000 * 60 * 60 * 24));
+        return daysSinceRotation >= this.minSecretRotationDays;
+    }
+}
+// =============================================================================
+// SINGLETON MANAGEMENT
+// =============================================================================
+let defaultStore = null;
+let defaultManager = null;
+/**
+ * Get the default service account store
+ */
+export function getServiceAccountStore() {
+    if (!defaultStore) {
+        defaultStore = new InMemoryServiceAccountStore();
+    }
+    return defaultStore;
+}
+/**
+ * Set a custom service account store
+ */
+export function setServiceAccountStore(store) {
+    defaultStore = store;
+    // Reset manager to use new store
+    defaultManager = null;
+}
+/**
+ * Get the default service account manager
+ */
+export function getServiceAccountManager() {
+    if (!defaultManager) {
+        defaultManager = new ServiceAccountManager({
+            store: getServiceAccountStore(),
+        });
+    }
+    return defaultManager;
+}
+/**
+ * Create a service account manager with custom config
+ */
+export function createServiceAccountManager(config) {
+    return new ServiceAccountManager(config);
+}
+/**
+ * Reset singleton instances (for testing)
+ */
+export function resetServiceAccountSingletons() {
+    defaultStore = null;
+    defaultManager = null;
+}
+//# sourceMappingURL=service-account.js.map

package/dist/security/service-auth/service-account.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-account.js","sourceRoot":"","sources":["../../../src/security/service-auth/service-account.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEpG,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAC;AAE9D,gFAAgF;AAChF,oBAAoB;AACpB,gFAAgF;AAEhF;;GAEG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,MAAM,EAAE,QAAQ;IAChB,OAAO,EAAE,SAAS;IAClB,SAAS,EAAE,WAAW;CACd,CAAC;AAIX,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;AAgC7E;;GAEG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC3B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,+BAA+B;IACjE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAChC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;IAChD,MAAM,EAAE,0BAA0B;IAClC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC3B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IAC5C,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;IAC1B,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACtC,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC3C,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAcH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACvC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC3B,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;IAChD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IAC5C,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAiCH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC3C,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3C,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;IAChD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IAC5C,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAEH,gFAAgF;AAChF,SAAS;AACT,gFAAgF;AAEhF;;GAEG;AACH,MAAM,OAAO,mBAAoB,SAAQ,WAAW;IACzC,IAAI,GAAG,uBAAuB,CAAC;IAC/B,UAAU,GAAG,GAAG,CAAC;IAE1B,YAAY,OAAe,EAAE,OAAiC;QAC5D,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,2BAA4B,SAAQ,aAAa;IACnD,IAAI,GAAG,2BAA2B,CAAC;IAE5C,YAAY,QAAgB;QAC1B,KAAK,CAAC,8BAA8B,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC9D,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;IAC5C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,0BAA2B,SAAQ,WAAW;IAChD,IAAI,GAAG,yBAAyB,CAAC;IACjC,UAAU,GAAG,GAAG,CAAC;IAE1B,YAAY,QAAgB;QAC1B,KAAK,CAAC,qCAAqC,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,4BAA6B,SAAQ,WAAW;IAClD,IAAI,GAAG,2BAA2B,CAAC;IACnC,UAAU,GAAG,GAAG,CAAC;IAE1B,YAAY,QAAgB;QAC1B,KAAK,CAAC,iCAAiC,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjE,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF;AAED,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,kDAAkD;AAClD,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAEhC,4BAA4B;AAC5B,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAE/C,gFAAgF;AAChF,oBAAoB;AACpB,gFAAgF;AAEhF;;GAEG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO,WAAW,CAAC,oBAAoB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC3D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC3C,OAAO,GAAG,wBAAwB,GAAG,EAAE,EAAE,CAAC;AAC5C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC3D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,YAAoB;IACrE,MAAM,WAAW,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAE7C,uDAAuD;IACvD,IAAI,WAAW,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,EAAE,CAAC;QAC/C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;AAC9E,CAAC;AA6BD,gFAAgF;AAChF,4CAA4C;AAC5C,gFAAgF;AAEhF;;GAEG;AACH,MAAM,OAAO,2BAA2B;IAC9B,QAAQ,GAAgC,IAAI,GAAG,EAAE,CAAC;IAE1D,KAAK,CAAC,MAAM,CAAC,OAAuB;QAClC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,aAAa,CAAC,mCAAmC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;QACpD,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,QAAgB;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5C,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,QAAgB;QACnC,MAAM,OAAO,GAAqB,EAAE,CAAC;QACrC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAC7C,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAClC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAgB,EAAE,OAAgC;QAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,2BAA2B,CAAC,QAAQ,CAAC,CAAC;QAClD,CAAC;QACD,MAAM,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC;QAC3C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACrC,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAgB;QAC3B,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,QAAgB;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC;QAClC,CAAC;IACH,CAAC;IAED,uCAAuC;IACvC,KAAK;QACH,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;CACF;AAkBD;;GAEG;AACH,MAAM,OAAO,qBAAqB;IACf,KAAK,CAAuB;IAC5B,qBAAqB,CAAS;IAC9B,oBAAoB,CAAS;IAE9C,YAAY,MAAmC;QAC7C,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAC1B,IAAI,CAAC,qBAAqB,GAAG,MAAM,CAAC,qBAAqB,IAAI,EAAE,CAAC;QAChE,IAAI,CAAC,oBAAoB,GAAG,MAAM,CAAC,oBAAoB,IAAI,GAAG,CAAC;IACjE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CAAC,KAAgC;QAClD,iBAAiB;QACjB,MAAM,SAAS,GAAG,+BAA+B,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAE/D,6BAA6B;QAC7B,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC7E,IAAI,gBAAgB,CAAC,MAAM,IAAI,IAAI,CAAC,oBAAoB,EAAE,CAAC;YACzD,MAAM,IAAI,eAAe,CACvB,iDAAiD,IAAI,CAAC,oBAAoB,GAAG,EAC7E,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,gBAAgB,CAAC,MAAM,EAAE,CACnE,CAAC;QACJ,CAAC;QAED,uBAAuB;QACvB,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;QACpC,MAAM,qBAAqB,GAAG,oBAAoB,EAAE,CAAC;QACrD,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,qBAAqB,CAAC,CAAC;QAEjE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,OAAO,GAAmB;YAC9B,QAAQ;YACR,YAAY,EAAE,gBAAgB;YAC9B,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,MAAM,EAAE,oBAAoB,CAAC,MAAM;YACnC,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,SAAS,EAAE,GAAG;YACd,eAAe,EAAE,GAAG;YACpB,QAAQ,EAAE,SAAS,CAAC,QAAQ;SAC7B,CAAC;QAEF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAEjD,MAAM,CAAC,IAAI,CACT,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,EAChE,yBAAyB,CAC1B,CAAC;QAEF,OAAO;YACL,OAAO,EAAE,OAAO;YAChB,qBAAqB;SACtB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CAAC,QAAgB;QAC/B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC1D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,2BAA2B,CAAC,QAAQ,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,QAAgB;QAChC,OAAO,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAAC,QAAgB;QACjC,OAAO,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CAAC,QAAgB,EAAE,KAAgC;QACpE,MAAM,SAAS,GAAG,+BAA+B,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAE/D,wBAAwB;QACxB,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAEhC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAE7D,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,yBAAyB,CAAC,CAAC;QAErD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CAAC,QAAgB;QAClC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAEhD,IAAI,OAAO,CAAC,MAAM,KAAK,oBAAoB,CAAC,OAAO,EAAE,CAAC;YACpD,MAAM,IAAI,mBAAmB,CAAC,oCAAoC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QACpF,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE;YAChD,MAAM,EAAE,oBAAoB,CAAC,OAAO;SACrC,CAAC,CAAC;QAEH,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,yBAAyB,CAAC,CAAC;QAErD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAAC,QAAgB;QACnC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAEhD,IAAI,OAAO,CAAC,MAAM,KAAK,oBAAoB,CAAC,OAAO,EAAE,CAAC;YACpD,MAAM,IAAI,mBAAmB,CAAC,kCAAkC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAClF,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE;YAChD,MAAM,EAAE,oBAAoB,CAAC,SAAS;SACvC,CAAC,CAAC;QAEH,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,2BAA2B,CAAC,CAAC;QAEvD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,iBAAiB,CAAC,QAAgB;QACtC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAEhD,IAAI,OAAO,CAAC,MAAM,KAAK,oBAAoB,CAAC,OAAO,EAAE,CAAC;YACpD,MAAM,IAAI,mBAAmB,CAAC,qCAAqC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QACrF,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,oBAAoB,CAAC,MAAM,EAAE,CAAC;YACnD,MAAM,IAAI,mBAAmB,CAAC,2BAA2B,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE;YAChD,MAAM,EAAE,oBAAoB,CAAC,MAAM;SACpC,CAAC,CAAC;QAEH,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,6BAA6B,CAAC,CAAC;QAEzD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CAAC,QAAgB;QAClC,wBAAwB;QACxB,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAEhC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAElD,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,yBAAyB,CAAC,CAAC;QACvD,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAAC,QAAgB;QACjC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAEhD,IAAI,OAAO,CAAC,MAAM,KAAK,oBAAoB,CAAC,MAAM,EAAE,CAAC;YACnD,MAAM,IAAI,mBAAmB,CAAC,2CAA2C,EAAE;gBACzE,QAAQ;gBACR,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,kBAAkB,GAAG,OAAO,CAAC,YAAY,CAAC;QAChD,MAAM,wBAAwB,GAAG,oBAAoB,EAAE,CAAC;QACxD,MAAM,aAAa,GAAG,gBAAgB,CAAC,wBAAwB,CAAC,CAAC;QAEjE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE;YAChD,YAAY,EAAE,aAAa;YAC3B,eAAe,EAAE,IAAI,IAAI,EAAE;SAC5B,CAAC,CAAC;QAEH,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,gCAAgC,CAAC,CAAC;QAE5D,OAAO;YACL,OAAO,EAAE,OAAO;YAChB,wBAAwB;YACxB,kBAAkB;SACnB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,iBAAiB,CAAC,QAAgB,EAAE,YAAoB;QAC5D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QAEjD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,wCAAwC;YACxC,MAAM,IAAI,mBAAmB,CAAC,qBAAqB,CAAC,CAAC;QACvD,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,oBAAoB,CAAC,OAAO,EAAE,CAAC;YACpD,MAAM,IAAI,0BAA0B,CAAC,QAAQ,CAAC,CAAC;QACjD,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,oBAAoB,CAAC,SAAS,EAAE,CAAC;YACtD,MAAM,IAAI,4BAA4B,CAAC,QAAQ,CAAC,CAAC;QACnD,CAAC;QAED,IAAI,CAAC,kBAAkB,CAAC,YAAY,EAAE,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,mBAAmB,CAAC,qBAAqB,CAAC,CAAC;QACvD,CAAC;QAED,4CAA4C;QAC5C,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAChD,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,6BAA6B,CAAC,CAAC;QACjE,CAAC,CAAC,CAAC;QAEH,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,QAAgB,EAAE,SAAiB;QACnD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAEhD,6BAA6B;QAC7B,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACjD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CAAC,QAAgB,EAAE,UAAkB;QACtD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAEhD,gCAAgC;QAChC,IAAI,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACtC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,wBAAwB;QACxB,IAAI,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,+DAA+D;QAC/D,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACvC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa;gBAC/C,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;oBAClC,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,2BAA2B,CAAC,QAAgB;QAChD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAEhD,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,iBAAiB,GAAG,IAAI,CAAC,KAAK,CAClC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CACzE,CAAC;QAEF,OAAO,iBAAiB,IAAI,IAAI,CAAC,qBAAqB,CAAC;IACzD,CAAC;CACF;AAED,gFAAgF;AAChF,uBAAuB;AACvB,gFAAgF;AAEhF,IAAI,YAAY,GAAgC,IAAI,CAAC;AACrD,IAAI,cAAc,GAAiC,IAAI,CAAC;AAExD;;GAEG;AACH,MAAM,UAAU,sBAAsB;IACpC,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,IAAI,2BAA2B,EAAE,CAAC;IACnD,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAA2B;IAChE,YAAY,GAAG,KAAK,CAAC;IACrB,iCAAiC;IACjC,cAAc,GAAG,IAAI,CAAC;AACxB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB;IACtC,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,cAAc,GAAG,IAAI,qBAAqB,CAAC;YACzC,KAAK,EAAE,sBAAsB,EAAE;SAChC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,2BAA2B,CACzC,MAAmC;IAEnC,OAAO,IAAI,qBAAqB,CAAC,MAAM,CAAC,CAAC;AAC3C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,6BAA6B;IAC3C,YAAY,GAAG,IAAI,CAAC;IACpB,cAAc,GAAG,IAAI,CAAC;AACxB,CAAC"}

package/dist/security/service-auth/service-auth-middleware.d.ts

@@ -0,0 +1,174 @@
+/**
+ * Service Authentication Middleware
+ *
+ * Fastify preHandler middleware for service-to-service authentication.
+ * Validates HMAC signatures in request headers and optionally issues JWT tokens.
+ *
+ * @packageDocumentation
+ */
+import type { FastifyRequest, FastifyReply, preHandlerHookHandler } from 'fastify';
+import { UnauthorizedError, ForbiddenError } from '../../common/errors.js';
+import { ServiceAccountManager, type ServiceAccount } from './service-account.js';
+import { ServiceTokenService, type ServiceTokenPayload } from './service-token.js';
+/**
+ * Service authentication context added to request
+ */
+export interface ServiceAuthContext {
+    /** The authenticated service account */
+    serviceAccount: ServiceAccount;
+    /** The client ID */
+    clientId: string;
+    /** The tenant ID */
+    tenantId: string;
+    /** Service name */
+    serviceName: string;
+    /** Permissions granted to the service */
+    permissions: string[];
+    /** Whether request was authenticated via signature or token */
+    authMethod: 'signature' | 'token';
+    /** The service token if one was issued/verified */
+    token?: string;
+    /** Token payload if authenticated via token */
+    tokenPayload?: ServiceTokenPayload;
+}
+/**
+ * Extended Fastify request with service auth context
+ */
+export interface ServiceAuthenticatedRequest extends FastifyRequest {
+    serviceAuth?: ServiceAuthContext;
+}
+/**
+ * Middleware configuration options
+ */
+export interface ServiceAuthMiddlewareOptions {
+    /** Service account manager instance */
+    accountManager?: ServiceAccountManager;
+    /** Service token service instance */
+    tokenService?: ServiceTokenService;
+    /** Whether to allow token-based auth (in addition to signature) */
+    allowTokenAuth?: boolean;
+    /** Whether to issue a token after successful signature auth */
+    issueToken?: boolean;
+    /** Paths to skip authentication */
+    skipPaths?: string[];
+    /** Custom skip function */
+    skipFn?: (request: FastifyRequest) => boolean;
+    /** Whether to validate IP whitelist */
+    validateIpWhitelist?: boolean;
+    /** Required permissions (all must be present) */
+    requiredPermissions?: string[];
+    /** Required permissions (any one must be present) */
+    anyPermissions?: string[];
+    /** Custom error handler */
+    onError?: (error: Error, request: FastifyRequest, reply: FastifyReply) => Promise<void>;
+}
+/**
+ * Service authentication error
+ */
+export declare class ServiceAuthError extends UnauthorizedError {
+    code: string;
+    constructor(message: string, details?: Record<string, unknown>);
+}
+/**
+ * Missing authentication headers error
+ */
+export declare class MissingAuthHeadersError extends ServiceAuthError {
+    code: string;
+    constructor();
+}
+/**
+ * Invalid signature error
+ */
+export declare class InvalidServiceSignatureError extends ServiceAuthError {
+    code: string;
+    constructor(reason?: string);
+}
+/**
+ * IP not allowed error
+ */
+export declare class IpNotAllowedError extends ForbiddenError {
+    code: string;
+    constructor(clientId: string, ip: string);
+}
+/**
+ * Insufficient permissions error
+ */
+export declare class InsufficientPermissionsError extends ForbiddenError {
+    code: string;
+    constructor(required: string[], actual: string[]);
+}
+/**
+ * Create service authentication middleware
+ */
+export declare function createServiceAuthMiddleware(options?: ServiceAuthMiddlewareOptions): preHandlerHookHandler;
+/**
+ * Create middleware that requires specific permissions
+ */
+export declare function requireServicePermissions(permissions: string[], options?: {
+    all?: boolean;
+}): preHandlerHookHandler;
+/**
+ * Create middleware that requires any of the specified permissions
+ */
+export declare function requireAnyServicePermission(permissions: string[]): preHandlerHookHandler;
+/**
+ * Create middleware that validates service belongs to a specific tenant
+ */
+export declare function requireServiceTenant(tenantId: string): preHandlerHookHandler;
+/**
+ * Get service auth context from request
+ */
+export declare function getServiceAuth(request: FastifyRequest): ServiceAuthContext | undefined;
+/**
+ * Require service auth context from request
+ */
+export declare function requireServiceAuth(request: FastifyRequest): ServiceAuthContext;
+/**
+ * Check if request has service auth
+ */
+export declare function hasServiceAuth(request: FastifyRequest): boolean;
+/**
+ * Get service client ID from request
+ */
+export declare function getServiceClientId(request: FastifyRequest): string | undefined;
+/**
+ * Get service tenant ID from request
+ */
+export declare function getServiceTenantId(request: FastifyRequest): string | undefined;
+/**
+ * Get service permissions from request
+ */
+export declare function getServicePermissions(request: FastifyRequest): string[];
+/**
+ * Check if service has a specific permission
+ */
+export declare function serviceHasPermission(request: FastifyRequest, permission: string): boolean;
+import type { FastifyPluginAsync } from 'fastify';
+/**
+ * Service auth plugin options
+ */
+export interface ServiceAuthPluginOptions extends ServiceAuthMiddlewareOptions {
+    /** Register as global preHandler */
+    global?: boolean;
+    /** Decorate request with helper methods */
+    decorateRequest?: boolean;
+}
+/**
+ * Service auth Fastify plugin
+ */
+export declare const serviceAuthPlugin: FastifyPluginAsync<ServiceAuthPluginOptions>;
+declare module 'fastify' {
+    interface FastifyRequest {
+        serviceAuth?: ServiceAuthContext;
+        getServiceAuth?: () => ServiceAuthContext | undefined;
+        requireServiceAuth?: () => ServiceAuthContext;
+        hasServiceAuth?: () => boolean;
+        serviceHasPermission?: (permission: string) => boolean;
+    }
+    interface FastifyInstance {
+        serviceAuthMiddleware?: typeof createServiceAuthMiddleware;
+        requireServicePermissions?: typeof requireServicePermissions;
+        requireAnyServicePermission?: typeof requireAnyServicePermission;
+    }
+}
+//# sourceMappingURL=service-auth-middleware.d.ts.map

package/dist/security/service-auth/service-auth-middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-auth-middleware.d.ts","sourceRoot":"","sources":["../../../src/security/service-auth/service-auth-middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAEnF,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC3E,OAAO,EACL,qBAAqB,EAGrB,KAAK,cAAc,EAGpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,mBAAmB,EAGnB,KAAK,mBAAmB,EACzB,MAAM,oBAAoB,CAAC;AAQ5B;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,wCAAwC;IACxC,cAAc,EAAE,cAAc,CAAC;IAC/B,oBAAoB;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,oBAAoB;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,mBAAmB;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,yCAAyC;IACzC,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,+DAA+D;IAC/D,UAAU,EAAE,WAAW,GAAG,OAAO,CAAC;IAClC,mDAAmD;IACnD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,YAAY,CAAC,EAAE,mBAAmB,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,2BAA4B,SAAQ,cAAc;IACjE,WAAW,CAAC,EAAE,kBAAkB,CAAC;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC3C,uCAAuC;IACvC,cAAc,CAAC,EAAE,qBAAqB,CAAC;IACvC,qCAAqC;IACrC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC,mEAAmE;IACnE,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,+DAA+D;IAC/D,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,mCAAmC;IACnC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,2BAA2B;IAC3B,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC;IAC9C,uCAAuC;IACvC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,iDAAiD;IACjD,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,qDAAqD;IACrD,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,2BAA2B;IAC3B,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACzF;AAMD;;GAEG;AACH,qBAAa,gBAAiB,SAAQ,iBAAiB;IAC5C,IAAI,SAAwB;gBAEzB,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAI/D;AAED;;GAEG;AACH,qBAAa,uBAAwB,SAAQ,gBAAgB;IAClD,IAAI,SAA0B;;CAMxC;AAED;;GAEG;AACH,qBAAa,4BAA6B,SAAQ,gBAAgB;IACvD,IAAI,SAA+B;gBAEhC,MAAM,CAAC,EAAE,MAAM;CAI5B;AAED;;GAEG;AACH,qBAAa,iBAAkB,SAAQ,cAAc;IAC1C,IAAI,SAAoB;gBAErB,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM;CAIzC;AAED;;GAEG;AACH,qBAAa,4BAA6B,SAAQ,cAAc;IACrD,IAAI,SAA8B;gBAE/B,QAAQ,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;CAIjD;AAMD;;GAEG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,GAAE,4BAAiC,GACzC,qBAAqB,CAyIvB;AA+MD;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,WAAW,EAAE,MAAM,EAAE,EACrB,OAAO,GAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAA;CAAkB,GACzC,qBAAqB,CAMvB;AAED;;GAEG;AACH,wBAAgB,2BAA2B,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,qBAAqB,CAExF;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,qBAAqB,CAe5E;AAMD;;GAEG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,cAAc,GAAG,kBAAkB,GAAG,SAAS,CAEtF;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,cAAc,GAAG,kBAAkB,CAM9E;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAE/D;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,GAAG,SAAS,CAE9E;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,GAAG,SAAS,CAE9E;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,EAAE,CAEvE;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAYzF;AAOD,OAAO,KAAK,EAAmB,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAEnE;;GAEG;AACH,MAAM,WAAW,wBAAyB,SAAQ,4BAA4B;IAC5E,oCAAoC;IACpC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,2CAA2C;IAC3C,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AA+CD;;GAEG;AACH,eAAO,MAAM,iBAAiB,8CAG5B,CAAC;AAMH,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,cAAc;QACtB,WAAW,CAAC,EAAE,kBAAkB,CAAC;QACjC,cAAc,CAAC,EAAE,MAAM,kBAAkB,GAAG,SAAS,CAAC;QACtD,kBAAkB,CAAC,EAAE,MAAM,kBAAkB,CAAC;QAC9C,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC;QAC/B,oBAAoB,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC;KACxD;IAED,UAAU,eAAe;QACvB,qBAAqB,CAAC,EAAE,OAAO,2BAA2B,CAAC;QAC3D,yBAAyB,CAAC,EAAE,OAAO,yBAAyB,CAAC;QAC7D,2BAA2B,CAAC,EAAE,OAAO,2BAA2B,CAAC;KAClE;CACF"}