agor-live 0.22.0 → 0.23.2

package/dist/daemon/auth/launch-auth.js

@@ -1,7 +1,22 @@
 // src/auth/launch-auth.ts
 import { createHash, createPublicKey, randomBytes } from "crypto";
-import { eq, generateId, hash, insert, select, update, users } from "@agor/core/db";
-import { BadRequest, NotAuthenticated } from "@agor/core/feathers";
+import {
+  resolveMultiTenancyConfig,
+  resolveTenantContext,
+  TenantResolutionError
+} from "@agor/core/config";
+import {
+  eq,
+  generateId,
+  hash,
+  insert,
+  reattributeLegacyAnonymousRows,
+  runWithTenantDatabaseScope,
+  select,
+  update,
+  users
+} from "@agor/core/db";
+import { BadRequest, NotAuthenticated as NotAuthenticated2 } from "@agor/core/feathers";
 import { normalizeRole, ROLES } from "@agor/core/types";
 import jwt2 from "jsonwebtoken";
 
@@ -9,6 +24,11 @@ import jwt2 from "jsonwebtoken";
 import jwt from "jsonwebtoken";
 var RUNTIME_JWT_ISSUER = "agor";
 var RUNTIME_JWT_AUDIENCE = "https://agor.dev";
+function runtimeTenantClaims(tenantId, claimName = "tenant_id") {
+  if (!tenantId) return {};
+  if (claimName === "tenant_id") return { tenant_id: tenantId };
+  return { tenant_id: tenantId, [claimName]: tenantId };
+}
 function issueRuntimeToken(payload, jwtSecret, expiresIn, options = {}) {
   return jwt.sign(payload, jwtSecret, {
     expiresIn,
@@ -16,21 +36,46 @@ function issueRuntimeToken(payload, jwtSecret, expiresIn, options = {}) {
     audience: options.audience ?? RUNTIME_JWT_AUDIENCE
   });
 }
-function issueRuntimeTokenPair(user, jwtSecret, accessTokenTtl, refreshTokenTtl) {
+function issueRuntimeTokenPair(user, jwtSecret, accessTokenTtl, refreshTokenTtl, extraClaims = {}) {
   return {
     accessToken: issueRuntimeToken(
-      { sub: user.user_id, type: "access" },
+      { sub: user.user_id, type: "access", ...extraClaims },
       jwtSecret,
       accessTokenTtl
     ),
     refreshToken: issueRuntimeToken(
-      { sub: user.user_id, type: "refresh" },
+      { sub: user.user_id, type: "refresh", ...extraClaims },
       jwtSecret,
       refreshTokenTtl
     )
   };
 }
 
+// src/auth/token-invalidation.ts
+import { NotAuthenticated } from "@agor/core/feathers";
+var AUTH_TOKEN_ISSUED_AT_MS_CLAIM = "auth_time_ms";
+function dateToMillis(value) {
+  if (value === void 0) return null;
+  const millis = value instanceof Date ? value.getTime() : new Date(value).getTime();
+  return Number.isFinite(millis) ? millis : null;
+}
+function authTokenIssuedAtClaim(now = Date.now(), user) {
+  const validAfterMs = dateToMillis(user?.tokens_valid_after);
+  const issuedAtMs = validAfterMs !== null && now <= validAfterMs ? validAfterMs + 1 : now;
+  return { [AUTH_TOKEN_ISSUED_AT_MS_CLAIM]: issuedAtMs };
+}
+
+// src/auth/user-redaction.ts
+function redactUserAuthMetadata(user) {
+  const {
+    tokens_valid_after: _tokensValidAfter,
+    password: _password,
+    tenant_id: _tenantId,
+    ...publicUser
+  } = user;
+  return publicUser;
+}
+
 // src/auth/launch-auth.ts
 var DEFAULT_TIMEOUT_MS = 1e4;
 var DEFAULT_SERVICE_TOKEN_ENV = "AGOR_EXTERNAL_LAUNCH_SERVICE_TOKEN";
@@ -59,6 +104,7 @@ function resolveLaunchSettings(config) {
     devSharedSecret: process.env[sharedSecretEnv] || raw?.dev_shared_secret,
     serviceCredential: process.env[serviceTokenEnv] || raw?.service_credential,
     allowAdminRoles: raw?.allow_admin_roles === true,
+    trustVerifiedEmailForLinking: raw?.trust_verified_email_for_linking === true,
     requestTimeoutMs: raw?.request_timeout_ms ?? DEFAULT_TIMEOUT_MS,
     algorithms: raw?.algorithms
   };
@@ -74,7 +120,7 @@ function resolvePublicLaunchAuthSettings(config) {
 function assertConfigured(settings) {
   const rejectConfig = (reason) => {
     console.warn(`[auth/launch] ${reason}`);
-    throw new NotAuthenticated("One-time launch authentication is unavailable");
+    throw new NotAuthenticated2("One-time launch authentication is unavailable");
   };
   if (!settings.enabled) {
     rejectConfig("disabled");
@@ -149,11 +195,27 @@ async function findUserByExternalIdentity(db, key) {
   }
   return null;
 }
-async function upsertLaunchUser(options, claims) {
+async function findUserByTrustedEmail(db, email, key, settings, claims) {
+  if (!settings.trustVerifiedEmailForLinking || claims.email_verified !== true || !email) {
+    return null;
+  }
+  const existing = await select(db).from(users).where(eq(users.email, email)).one();
+  if (!existing) return null;
+  const identities = getExternalIdentities(existing.data);
+  if (identities.length > 0 && !identities.some((identity) => identity.key === key)) {
+    return null;
+  }
+  return existing;
+}
+async function upsertLaunchUser(options, claims, tenant) {
   const { db, config, usersService } = options;
   const issuer = claims.iss;
   const subject = claims.sub;
   const settings = resolveLaunchSettings(config);
+  const userLookupParams = {
+    provider: void 0,
+    ...tenant ? { tenant } : {}
+  };
   const provider = claims.provider || settings.providerId || issuer;
   const key = identityKey(provider, issuer, subject);
   const now = /* @__PURE__ */ new Date();
@@ -170,7 +232,7 @@ async function upsertLaunchUser(options, claims) {
     name,
     last_login_at: nowIso
   };
-  const existing = await findUserByExternalIdentity(db, key);
+  const existing = await findUserByExternalIdentity(db, key) ?? await findUserByTrustedEmail(db, email, key, settings, claims);
   if (existing) {
     const role2 = mapRole(
       claims.role,
@@ -192,11 +254,13 @@ async function upsertLaunchUser(options, claims) {
       updated_at: now,
       data: {
         ...data,
-        avatar: avatar ?? data.avatar,
+        avatar_url: avatar ?? data.avatar_url ?? data.avatar,
+        avatar_source: avatar ? "launch-auth" : data.avatar_source,
         external_identities: nextIdentities
       }
     }).where(eq(users.user_id, existing.user_id)).run();
-    return usersService.get(existing.user_id, { provider: void 0 });
+    await reattributeLegacyAnonymousRows(db, existing.user_id);
+    return usersService.get(existing.user_id, userLookupParams);
   }
   const role = mapRole(claims.role, settings, config.execution?.allow_superadmin);
   const localEmail = await chooseLocalEmail(db, email, key, provider, issuer, subject);
@@ -214,12 +278,15 @@ async function upsertLaunchUser(options, claims) {
     onboarding_completed: false,
     must_change_password: false,
     data: {
+      avatar_url: avatar,
       avatar,
+      avatar_source: avatar ? "launch-auth" : void 0,
       preferences: {},
       external_identities: [identity]
     }
   }).run();
-  return usersService.get(userId, { provider: void 0 });
+  await reattributeLegacyAnonymousRows(db, userId);
+  return usersService.get(userId, userLookupParams);
 }
 async function fetchJson(url, init, timeoutMs) {
   const controller = new AbortController();
@@ -227,7 +294,7 @@ async function fetchJson(url, init, timeoutMs) {
   try {
     const response = await fetch(url, { ...init, signal: controller.signal });
     if (!response.ok) {
-      throw new NotAuthenticated("Invalid or expired one-time launch code");
+      throw new NotAuthenticated2("Invalid or expired one-time launch code");
     }
     return response.json();
   } finally {
@@ -251,32 +318,32 @@ async function exchangeLaunchCode(launchCode, settings) {
     settings.requestTimeoutMs
   );
   if (!json || typeof json !== "object") {
-    throw new NotAuthenticated("Invalid one-time launch exchange response");
+    throw new NotAuthenticated2("Invalid one-time launch exchange response");
   }
   return json;
 }
 async function resolveVerificationKey(header, settings) {
   if (settings.devSharedSecret) return settings.devSharedSecret;
   if (settings.publicKey) return settings.publicKey;
-  if (!settings.jwksUrl) throw new NotAuthenticated("Launch assertion verification failed");
+  if (!settings.jwksUrl) throw new NotAuthenticated2("Launch assertion verification failed");
   if (!header.kid) {
-    throw new NotAuthenticated("Launch assertion verification failed");
+    throw new NotAuthenticated2("Launch assertion verification failed");
   }
   const jwks = await fetchJson(settings.jwksUrl, { method: "GET" }, settings.requestTimeoutMs);
   const keys = jwks?.keys;
   const jwk = keys?.find((candidate) => candidate.kid === header.kid);
-  if (!jwk) throw new NotAuthenticated("Launch assertion verification failed");
+  if (!jwk) throw new NotAuthenticated2("Launch assertion verification failed");
   if (jwk.use && jwk.use !== "sig")
-    throw new NotAuthenticated("Launch assertion verification failed");
+    throw new NotAuthenticated2("Launch assertion verification failed");
   if (header.alg && jwk.alg && jwk.alg !== header.alg) {
-    throw new NotAuthenticated("Launch assertion verification failed");
+    throw new NotAuthenticated2("Launch assertion verification failed");
   }
   return createPublicKey({ key: jwk, format: "jwk" });
 }
 async function verifyLaunchAssertion(assertion, settings) {
   const decoded = jwt2.decode(assertion, { complete: true });
   if (!decoded || typeof decoded !== "object") {
-    throw new NotAuthenticated("Invalid one-time launch assertion");
+    throw new NotAuthenticated2("Invalid one-time launch assertion");
   }
   const key = await resolveVerificationKey(decoded.header, settings);
   const algorithms = settings.algorithms ?? (settings.devSharedSecret ? ["HS256"] : void 0);
@@ -290,38 +357,43 @@ async function verifyLaunchAssertion(assertion, settings) {
 }
 function validateLaunchClaims(claims, settings) {
   if (!claims.iss || claims.iss !== settings.issuer) {
-    throw new NotAuthenticated("Invalid one-time launch assertion issuer");
+    throw new NotAuthenticated2("Invalid one-time launch assertion issuer");
   }
   if (!claims.sub || typeof claims.sub !== "string") {
-    throw new NotAuthenticated("Invalid one-time launch assertion subject");
+    throw new NotAuthenticated2("Invalid one-time launch assertion subject");
   }
   if (typeof claims.exp !== "number") {
-    throw new NotAuthenticated("Invalid one-time launch assertion expiration");
+    throw new NotAuthenticated2("Invalid one-time launch assertion expiration");
   }
   if (settings.instanceId) {
     const claimInstance = claims.instance_id || claims.runtime_instance_id;
     if (typeof claimInstance !== "string" || claimInstance !== settings.instanceId) {
-      throw new NotAuthenticated("Invalid one-time launch assertion instance");
+      throw new NotAuthenticated2("Invalid one-time launch assertion instance");
     }
   }
   if (claims.jti !== void 0 && typeof claims.jti !== "string") {
-    throw new NotAuthenticated("Invalid one-time launch assertion id");
+    throw new NotAuthenticated2("Invalid one-time launch assertion id");
   }
   if (claims.nonce !== void 0 && typeof claims.nonce !== "string") {
-    throw new NotAuthenticated("Invalid one-time launch assertion nonce");
+    throw new NotAuthenticated2("Invalid one-time launch assertion nonce");
   }
 }
-function issueRuntimeTokens(user, jwtSecret, accessTokenTtl, refreshTokenTtl) {
-  const tokens = issueRuntimeTokenPair(user, jwtSecret, accessTokenTtl, refreshTokenTtl);
+function issueRuntimeTokens(user, jwtSecret, accessTokenTtl, refreshTokenTtl, tenantClaim = "tenant_id", tenantId) {
+  const tokens = issueRuntimeTokenPair(user, jwtSecret, accessTokenTtl, refreshTokenTtl, {
+    ...authTokenIssuedAtClaim(Date.now(), user),
+    ...runtimeTenantClaims(tenantId ?? user.tenant_id, tenantClaim)
+  });
   return {
     ...tokens,
     authentication: { strategy: "launch" },
-    user
+    user: redactUserAuthMetadata(user)
   };
 }
 function createLaunchAuthService(options) {
+  const multiTenancy = resolveMultiTenancyConfig(options.config);
+  const tenantClaim = multiTenancy.auth_claim ?? "tenant_id";
   return {
-    async create(data, _params) {
+    async create(data, params) {
       const launchCode = typeof data?.launchCode === "string" ? data.launchCode.trim() : typeof data?.launch_code === "string" ? data.launch_code.trim() : "";
       if (!launchCode) {
         throw new BadRequest("launchCode is required");
@@ -334,21 +406,33 @@ function createLaunchAuthService(options) {
       try {
         const exchange = await exchangeLaunchCode(launchCode, settings);
         if (!exchange.assertion) {
-          throw new NotAuthenticated("Invalid one-time launch exchange response");
+          throw new NotAuthenticated2("Invalid one-time launch exchange response");
         }
         const claims = await verifyLaunchAssertion(exchange.assertion, settings);
-        const user = await upsertLaunchUser(options, claims);
-        return issueRuntimeTokens(
-          user,
-          options.jwtSecret,
-          options.accessTokenTtl,
-          options.refreshTokenTtl
-        );
+        const tenant = resolveTenantContext(multiTenancy, {
+          params,
+          authPayload: claims,
+          headers: params?.headers
+        });
+        return await runWithTenantDatabaseScope(options.db, tenant.tenant_id, async () => {
+          const user = await upsertLaunchUser(options, claims, tenant);
+          return issueRuntimeTokens(
+            user,
+            options.jwtSecret,
+            options.accessTokenTtl,
+            options.refreshTokenTtl,
+            tenantClaim,
+            tenant.tenant_id
+          );
+        });
       } catch (error) {
-        if (error instanceof BadRequest || error instanceof NotAuthenticated) {
+        if (error instanceof BadRequest || error instanceof NotAuthenticated2) {
           throw error;
         }
-        throw new NotAuthenticated("Invalid or expired one-time launch code");
+        if (error instanceof TenantResolutionError) {
+          throw new NotAuthenticated2(error.message);
+        }
+        throw new NotAuthenticated2("Invalid or expired one-time launch code");
       }
     }
   };

package/dist/daemon/auth/refresh-token-service.d.ts

@@ -0,0 +1,22 @@
+import type { Params, User, UserID } from '@agor/core/types';
+import { type SignOptions } from 'jsonwebtoken';
+interface RefreshTokenServiceOptions {
+    jwtSecret: string;
+    accessTokenTtl: SignOptions['expiresIn'];
+    refreshTokenTtl: SignOptions['expiresIn'];
+    tenantClaim?: string;
+    usersService: {
+        get(id: UserID, params?: Params): Promise<User>;
+    };
+}
+export declare function createRefreshTokenService(options: RefreshTokenServiceOptions): {
+    create(data: {
+        refreshToken: string;
+    }, _params?: Params): Promise<{
+        accessToken: string;
+        refreshToken: string;
+        user: User;
+    }>;
+};
+export {};
+//# sourceMappingURL=refresh-token-service.d.ts.map

package/dist/daemon/auth/refresh-token-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh-token-service.d.ts","sourceRoot":"","sources":["../../src/auth/refresh-token-service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAY,EAAE,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AAerD,UAAU,0BAA0B;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC;IACzC,eAAe,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC;IAC1C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE;QACZ,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KACjD,CAAC;CACH;AAED,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,0BAA0B;iBAEtD;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,YAAY,MAAM;;;;;EAmDhE"}

package/dist/daemon/auth/refresh-token-service.js

@@ -0,0 +1,133 @@
+// src/auth/refresh-token-service.ts
+import { NotAuthenticated as NotAuthenticated2 } from "@agor/core/feathers";
+import jwt2 from "jsonwebtoken";
+
+// src/auth/runtime-tokens.ts
+import jwt from "jsonwebtoken";
+var RUNTIME_JWT_ISSUER = "agor";
+var RUNTIME_JWT_AUDIENCE = "https://agor.dev";
+function runtimeTenantClaims(tenantId, claimName = "tenant_id") {
+  if (!tenantId) return {};
+  if (claimName === "tenant_id") return { tenant_id: tenantId };
+  return { tenant_id: tenantId, [claimName]: tenantId };
+}
+function readRuntimeTenantClaim(payload, claimName = "tenant_id") {
+  if (!payload || typeof payload !== "object") return void 0;
+  const record = payload;
+  const value = record[claimName] ?? record.tenant_id;
+  return typeof value === "string" && value.trim() ? value.trim() : void 0;
+}
+function issueRuntimeToken(payload, jwtSecret, expiresIn, options = {}) {
+  return jwt.sign(payload, jwtSecret, {
+    expiresIn,
+    issuer: RUNTIME_JWT_ISSUER,
+    audience: options.audience ?? RUNTIME_JWT_AUDIENCE
+  });
+}
+function issueRuntimeTokenPair(user, jwtSecret, accessTokenTtl, refreshTokenTtl, extraClaims = {}) {
+  return {
+    accessToken: issueRuntimeToken(
+      { sub: user.user_id, type: "access", ...extraClaims },
+      jwtSecret,
+      accessTokenTtl
+    ),
+    refreshToken: issueRuntimeToken(
+      { sub: user.user_id, type: "refresh", ...extraClaims },
+      jwtSecret,
+      refreshTokenTtl
+    )
+  };
+}
+
+// src/auth/token-invalidation.ts
+import { NotAuthenticated } from "@agor/core/feathers";
+var AUTH_TOKEN_ISSUED_AT_MS_CLAIM = "auth_time_ms";
+function dateToMillis(value) {
+  if (value === void 0) return null;
+  const millis = value instanceof Date ? value.getTime() : new Date(value).getTime();
+  return Number.isFinite(millis) ? millis : null;
+}
+function getAuthTokenIssuedAtMs(payload) {
+  const authTimeMs = payload?.[AUTH_TOKEN_ISSUED_AT_MS_CLAIM];
+  if (typeof authTimeMs === "number" && Number.isFinite(authTimeMs)) {
+    return authTimeMs;
+  }
+  if (typeof authTimeMs === "string") {
+    const parsed = Number(authTimeMs);
+    if (Number.isFinite(parsed)) return parsed;
+  }
+  return typeof payload?.iat === "number" && Number.isFinite(payload.iat) ? payload.iat * 1e3 : null;
+}
+function assertUserTokenNotInvalidated(user, payload) {
+  const validAfterMs = dateToMillis(user.tokens_valid_after);
+  if (validAfterMs === null) return;
+  const issuedAtMs = getAuthTokenIssuedAtMs(payload);
+  if (issuedAtMs === null || issuedAtMs <= validAfterMs) {
+    throw new NotAuthenticated("Session expired, please login again");
+  }
+}
+function authTokenIssuedAtClaim(now = Date.now(), user) {
+  const validAfterMs = dateToMillis(user?.tokens_valid_after);
+  const issuedAtMs = validAfterMs !== null && now <= validAfterMs ? validAfterMs + 1 : now;
+  return { [AUTH_TOKEN_ISSUED_AT_MS_CLAIM]: issuedAtMs };
+}
+
+// src/auth/user-redaction.ts
+function redactUserAuthMetadata(user) {
+  const {
+    tokens_valid_after: _tokensValidAfter,
+    password: _password,
+    tenant_id: _tenantId,
+    ...publicUser
+  } = user;
+  return publicUser;
+}
+
+// src/auth/refresh-token-service.ts
+function createRefreshTokenService(options) {
+  return {
+    async create(data, _params) {
+      try {
+        const decoded = jwt2.verify(data.refreshToken, options.jwtSecret, {
+          issuer: RUNTIME_JWT_ISSUER,
+          audience: RUNTIME_JWT_AUDIENCE
+        });
+        if (decoded.type !== "refresh") {
+          throw new Error("Invalid token type");
+        }
+        const tenantId = readRuntimeTenantClaim(decoded, options.tenantClaim);
+        const user = await options.usersService.get(
+          decoded.sub,
+          tenantId ? {
+            tenant: { tenant_id: tenantId, source: "auth_claim" },
+            authentication: { payload: decoded }
+          } : { authentication: { payload: decoded } }
+        );
+        assertUserTokenNotInvalidated(user, decoded);
+        const tokens = issueRuntimeTokenPair(
+          user,
+          options.jwtSecret,
+          options.accessTokenTtl,
+          options.refreshTokenTtl,
+          {
+            ...authTokenIssuedAtClaim(Date.now(), user),
+            ...runtimeTenantClaims(
+              tenantId ?? user.tenant_id,
+              options.tenantClaim
+            )
+          }
+        );
+        return {
+          accessToken: tokens.accessToken,
+          refreshToken: tokens.refreshToken,
+          user: redactUserAuthMetadata(user)
+        };
+      } catch (_error) {
+        throw new NotAuthenticated2("Invalid or expired refresh token");
+      }
+    }
+  };
+}
+export {
+  createRefreshTokenService
+};

package/dist/daemon/auth/runtime-tokens.d.ts

@@ -13,6 +13,8 @@ export interface RuntimeTokenPair {
     accessToken: string;
     refreshToken: string;
 }
+export declare function runtimeTenantClaims(tenantId: string | undefined, claimName?: string): Record<string, string>;
+export declare function readRuntimeTenantClaim(payload: unknown, claimName?: string): string | undefined;
 export declare function issueRuntimeToken(payload: RuntimeTokenPayload, jwtSecret: string, expiresIn: SignOptions['expiresIn'], options?: Pick<SignOptions, 'audience'>): string;
-export declare function issueRuntimeTokenPair(user: Pick<User, 'user_id'>, jwtSecret: string, accessTokenTtl: SignOptions['expiresIn'], refreshTokenTtl: SignOptions['expiresIn']): RuntimeTokenPair;
+export declare function issueRuntimeTokenPair(user: Pick<User, 'user_id'>, jwtSecret: string, accessTokenTtl: SignOptions['expiresIn'], refreshTokenTtl: SignOptions['expiresIn'], extraClaims?: Record<string, unknown>): RuntimeTokenPair;
 //# sourceMappingURL=runtime-tokens.d.ts.map

package/dist/daemon/auth/runtime-tokens.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-tokens.d.ts","sourceRoot":"","sources":["../../src/auth/runtime-tokens.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAY,EAAE,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AAErD,eAAO,MAAM,kBAAkB,SAAS,CAAC;AACzC,eAAO,MAAM,oBAAoB,qBAAqB,CAAC;AACvD,eAAO,MAAM,6BAA6B,0BAA0B,CAAC;AAErE,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,kBAAkB,GAAG,UAAU,CAAC;AAElG,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;IACrB,IAAI,EAAE,gBAAgB,CAAC;IACvB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,mBAAmB,EAC5B,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,WAAW,CAAC,WAAW,CAAC,EACnC,OAAO,GAAE,IAAI,CAAC,WAAW,EAAE,UAAU,CAAM,GAC1C,MAAM,CAMR;AAED,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,EAC3B,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,WAAW,CAAC,WAAW,CAAC,EACxC,eAAe,EAAE,WAAW,CAAC,WAAW,CAAC,GACxC,gBAAgB,CAalB"}
+{"version":3,"file":"runtime-tokens.d.ts","sourceRoot":"","sources":["../../src/auth/runtime-tokens.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAY,EAAE,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AAErD,eAAO,MAAM,kBAAkB,SAAS,CAAC;AACzC,eAAO,MAAM,oBAAoB,qBAAqB,CAAC;AACvD,eAAO,MAAM,6BAA6B,0BAA0B,CAAC;AAErE,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,kBAAkB,GAAG,UAAU,CAAC;AAElG,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;IACrB,IAAI,EAAE,gBAAgB,CAAC;IACvB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,SAAS,SAAc,GACtB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAIxB;AAED,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,OAAO,EAChB,SAAS,SAAc,GACtB,MAAM,GAAG,SAAS,CAKpB;AAED,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,mBAAmB,EAC5B,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,WAAW,CAAC,WAAW,CAAC,EACnC,OAAO,GAAE,IAAI,CAAC,WAAW,EAAE,UAAU,CAAM,GAC1C,MAAM,CAMR;AAED,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,EAC3B,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,WAAW,CAAC,WAAW,CAAC,EACxC,eAAe,EAAE,WAAW,CAAC,WAAW,CAAC,EACzC,WAAW,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GACxC,gBAAgB,CAalB"}

package/dist/daemon/auth/runtime-tokens.js

@@ -3,6 +3,17 @@ import jwt from "jsonwebtoken";
 var RUNTIME_JWT_ISSUER = "agor";
 var RUNTIME_JWT_AUDIENCE = "https://agor.dev";
 var ARTIFACT_RUNTIME_JWT_AUDIENCE = "agor:artifact-runtime";
+function runtimeTenantClaims(tenantId, claimName = "tenant_id") {
+  if (!tenantId) return {};
+  if (claimName === "tenant_id") return { tenant_id: tenantId };
+  return { tenant_id: tenantId, [claimName]: tenantId };
+}
+function readRuntimeTenantClaim(payload, claimName = "tenant_id") {
+  if (!payload || typeof payload !== "object") return void 0;
+  const record = payload;
+  const value = record[claimName] ?? record.tenant_id;
+  return typeof value === "string" && value.trim() ? value.trim() : void 0;
+}
 function issueRuntimeToken(payload, jwtSecret, expiresIn, options = {}) {
   return jwt.sign(payload, jwtSecret, {
     expiresIn,
@@ -10,15 +21,15 @@ function issueRuntimeToken(payload, jwtSecret, expiresIn, options = {}) {
     audience: options.audience ?? RUNTIME_JWT_AUDIENCE
   });
 }
-function issueRuntimeTokenPair(user, jwtSecret, accessTokenTtl, refreshTokenTtl) {
+function issueRuntimeTokenPair(user, jwtSecret, accessTokenTtl, refreshTokenTtl, extraClaims = {}) {
   return {
     accessToken: issueRuntimeToken(
-      { sub: user.user_id, type: "access" },
+      { sub: user.user_id, type: "access", ...extraClaims },
       jwtSecret,
       accessTokenTtl
     ),
     refreshToken: issueRuntimeToken(
-      { sub: user.user_id, type: "refresh" },
+      { sub: user.user_id, type: "refresh", ...extraClaims },
       jwtSecret,
       refreshTokenTtl
     )
@@ -29,5 +40,7 @@ export {
   RUNTIME_JWT_AUDIENCE,
   RUNTIME_JWT_ISSUER,
   issueRuntimeToken,
-  issueRuntimeTokenPair
+  issueRuntimeTokenPair,
+  readRuntimeTenantClaim,
+  runtimeTenantClaims
 };

package/dist/daemon/auth/service-jwt-strategy.d.ts

@@ -20,7 +20,8 @@ import type { SessionTokenService } from '../services/session-token-service.js';
  */
 export declare class ServiceJWTStrategy extends JWTStrategy {
     private sessionTokenService?;
-    constructor(sessionTokenService?: SessionTokenService | undefined);
+    private tenantClaim?;
+    constructor(sessionTokenService?: SessionTokenService | undefined, tenantClaim?: string | undefined);
     /**
      * Override getEntity to handle service tokens
      *

package/dist/daemon/auth/service-jwt-strategy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service-jwt-strategy.d.ts","sourceRoot":"","sources":["../../src/auth/service-jwt-strategy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAEhF;;;;;GAKG;AACH,qBAAa,kBAAmB,SAAQ,WAAW;IACrC,OAAO,CAAC,mBAAmB,CAAC;gBAApB,mBAAmB,CAAC,EAAE,mBAAmB,YAAA;IAG7D;;;;;OAKG;IAEG,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IAgBzD;;;;;OAKG;IAEG,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;CAmEnE"}
+{"version":3,"file":"service-jwt-strategy.d.ts","sourceRoot":"","sources":["../../src/auth/service-jwt-strategy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,MAAM,EAAoB,MAAM,kBAAkB,CAAC;AAEjE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAwDhF;;;;;GAKG;AACH,qBAAa,kBAAmB,SAAQ,WAAW;IAE/C,OAAO,CAAC,mBAAmB,CAAC;IAC5B,OAAO,CAAC,WAAW,CAAC;gBADZ,mBAAmB,CAAC,EAAE,mBAAmB,YAAA,EACzC,WAAW,CAAC,EAAE,MAAM,YAAA;IAI9B;;;;;OAKG;IAEG,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IA0BzD;;;;;OAKG;IAEG,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;CA8EnE"}