@x12i/memorix-service 3.3.0 → 3.6.0

package/dist/routes/restricted-store.js

@@ -0,0 +1,117 @@
+import { ServiceError } from "../errors.js";
+import { BREAK_GLASS_HEADER, BREAK_GLASS_REASON_HEADER, } from "../restricted-store/index.js";
+import { resolveConnectorOpsOrg } from "./connector-ops.js";
+function header(headers, name) {
+    const v = headers[name] ?? headers[name.toLowerCase()];
+    if (Array.isArray(v))
+        return v[0];
+    return typeof v === "string" ? v : undefined;
+}
+function requireBreakGlass(req) {
+    const grant = header(req.headers, BREAK_GLASS_HEADER) ??
+        header(req.headers, "x-memorix-break-glass");
+    const g = grant?.trim().toLowerCase() ?? "";
+    if (g !== "1" && g !== "true") {
+        throw new ServiceError("BREAK_GLASS_REQUIRED", "full restricted body requires break-glass grant (x-memorix-break-glass: true)", 403);
+    }
+    const reason = header(req.headers, BREAK_GLASS_REASON_HEADER) ??
+        header(req.headers, "x-memorix-break-glass-reason") ??
+        "";
+    if (!reason.trim()) {
+        throw new ServiceError("BREAK_GLASS_REASON_REQUIRED", "x-memorix-break-glass-reason is required for full body access", 400);
+    }
+    const actor = header(req.headers, "x-memorix-actor") ??
+        header(req.headers, "x-actor") ??
+        undefined;
+    return { actor, reason: reason.trim() };
+}
+/** FG-A3 restricted encrypted object store. */
+export async function registerRestrictedStoreRoutes(app, platform) {
+    const prefix = "/api/restricted-store/v1";
+    app.put(`${prefix}/orgs/:orgId/objects`, async (req, reply) => {
+        const orgId = resolveConnectorOpsOrg(req);
+        const body = (req.body ?? {});
+        try {
+            const meta = await platform.restrictedObjectsFor(orgId).put(body);
+            return reply.code(201).send(meta);
+        }
+        catch (err) {
+            throw new ServiceError("VALIDATION_ERROR", err instanceof Error ? err.message : String(err), 400);
+        }
+    });
+    app.get(`${prefix}/orgs/:orgId/objects/:objectId/metadata`, async (req) => {
+        const orgId = resolveConnectorOpsOrg(req);
+        const objectId = req.params.objectId?.trim() ?? "";
+        if (!objectId) {
+            throw new ServiceError("VALIDATION_ERROR", "objectId required", 400);
+        }
+        const meta = await platform.restrictedObjectsFor(orgId).getMeta(objectId);
+        if (!meta) {
+            throw new ServiceError("NOT_FOUND", "restricted object not found", 404);
+        }
+        // Redacted by construction — no body fields.
+        return meta;
+    });
+    app.get(`${prefix}/orgs/:orgId/objects/:objectId/content`, async (req) => {
+        const orgId = resolveConnectorOpsOrg(req);
+        const objectId = req.params.objectId?.trim() ?? "";
+        if (!objectId) {
+            throw new ServiceError("VALIDATION_ERROR", "objectId required", 400);
+        }
+        const bg = requireBreakGlass(req);
+        let result;
+        try {
+            result = await platform.restrictedObjectsFor(orgId).getContent(objectId);
+        }
+        catch (err) {
+            throw new ServiceError("RESTRICTED_READ_FAILED", err instanceof Error ? err.message : String(err), 500);
+        }
+        if (!result) {
+            throw new ServiceError("NOT_FOUND", "restricted object not found", 404);
+        }
+        await platform.restrictedObjectsFor(orgId).recordAccessAudit({
+            objectId,
+            contentHash: result.meta.contentHash,
+            actor: bg.actor,
+            reason: bg.reason,
+            action: "content-get",
+        });
+        return {
+            objectId: result.meta.objectId,
+            contentHash: result.meta.contentHash,
+            sizeBytes: result.meta.sizeBytes,
+            contentType: result.meta.contentType,
+            classification: result.meta.classification,
+            /** Full body as base64 — only on break-glass path. */
+            bodyBase64: result.body.toString("base64"),
+        };
+    });
+    app.delete(`${prefix}/orgs/:orgId/objects/:objectId`, async (req, reply) => {
+        const orgId = resolveConnectorOpsOrg(req);
+        const objectId = req.params.objectId?.trim() ?? "";
+        if (!objectId) {
+            throw new ServiceError("VALIDATION_ERROR", "objectId required", 400);
+        }
+        const ok = await platform.restrictedObjectsFor(orgId).delete(objectId);
+        if (!ok) {
+            throw new ServiceError("NOT_FOUND", "restricted object not found", 404);
+        }
+        return reply.code(204).send();
+    });
+    app.post(`${prefix}/orgs/:orgId/purge-expired`, async (req) => {
+        const orgId = resolveConnectorOpsOrg(req);
+        const purged = await platform.restrictedObjectsFor(orgId).purgeExpired();
+        return { orgId, purged };
+    });
+    app.get(`${prefix}/orgs/:orgId/access-audits`, async (req) => {
+        const orgId = resolveConnectorOpsOrg(req);
+        const q = (req.query ?? {});
+        const objectId = typeof q.objectId === "string" ? q.objectId.trim() : undefined;
+        const limit = q.limit != null ? Number(q.limit) : undefined;
+        const audits = await platform
+            .restrictedObjectsFor(orgId)
+            .listAccessAudits({ objectId, limit });
+        return { orgId, audits };
+    });
+}
+//# sourceMappingURL=restricted-store.js.map

package/dist/routes/restricted-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"restricted-store.js","sourceRoot":"","sources":["../../src/routes/restricted-store.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EACL,kBAAkB,EAClB,yBAAyB,GAE1B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAE5D,SAAS,MAAM,CACb,OAAsD,EACtD,IAAY;IAEZ,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACvD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/C,CAAC;AAED,SAAS,iBAAiB,CACxB,GAA+D;IAE/D,MAAM,KAAK,GACT,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,kBAAkB,CAAC;QACvC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,uBAAuB,CAAC,CAAC;IAC/C,MAAM,CAAC,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;IAC5C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,MAAM,EAAE,CAAC;QAC9B,MAAM,IAAI,YAAY,CACpB,sBAAsB,EACtB,+EAA+E,EAC/E,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GACV,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,yBAAyB,CAAC;QAC9C,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,8BAA8B,CAAC;QACnD,EAAE,CAAC;IACL,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,YAAY,CACpB,6BAA6B,EAC7B,+DAA+D,EAC/D,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GACT,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,iBAAiB,CAAC;QACtC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC;QAC9B,SAAS,CAAC;IACZ,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;AAC1C,CAAC;AAED,+CAA+C;AAC/C,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,GAAoB,EACpB,QAAyB;IAEzB,MAAM,MAAM,GAAG,0BAA0B,CAAC;IAE1C,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,sBAAsB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC5D,MAAM,KAAK,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAuB,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,YAAY,CACpB,kBAAkB,EAClB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAChD,GAAG,CACJ,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,yCAAyC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACxE,MAAM,KAAK,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,QAAQ,GACX,GAAG,CAAC,MAAgC,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC/D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,YAAY,CAAC,kBAAkB,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC1E,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,YAAY,CAAC,WAAW,EAAE,6BAA6B,EAAE,GAAG,CAAC,CAAC;QAC1E,CAAC;QACD,6CAA6C;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,wCAAwC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACvE,MAAM,KAAK,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,QAAQ,GACX,GAAG,CAAC,MAAgC,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC/D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,YAAY,CAAC,kBAAkB,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,EAAE,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,MAEH,CAAC;QACF,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,QAAQ,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC3E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,YAAY,CACpB,wBAAwB,EACxB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAChD,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,YAAY,CAAC,WAAW,EAAE,6BAA6B,EAAE,GAAG,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,QAAQ,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,iBAAiB,CAAC;YAC3D,QAAQ;YACR,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW;YACpC,KAAK,EAAE,EAAE,CAAC,KAAK;YACf,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,MAAM,EAAE,aAAa;SACtB,CAAC,CAAC;QACH,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ;YAC9B,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW;YACpC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS;YAChC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW;YACpC,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc;YAC1C,sDAAsD;YACtD,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;SAC3C,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CACR,GAAG,MAAM,gCAAgC,EACzC,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,KAAK,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,QAAQ,GACX,GAAG,CAAC,MAAgC,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC/D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,YAAY,CAAC,kBAAkB,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvE,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,MAAM,IAAI,YAAY,CAAC,WAAW,EAAE,6BAA6B,EAAE,GAAG,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,4BAA4B,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC5D,MAAM,KAAK,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,YAAY,EAAE,CAAC;QACzE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,4BAA4B,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC3D,MAAM,KAAK,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAA4B,CAAC;QACvD,MAAM,QAAQ,GACZ,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACjE,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5D,MAAM,MAAM,GAAG,MAAM,QAAQ;aAC1B,oBAAoB,CAAC,KAAK,CAAC;aAC3B,gBAAgB,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QACzC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC"}