libre-webui 0.22.1 → 0.23.1

package/backend/dist/services/resourceGrantService.js

@@ -0,0 +1,192 @@
+/*
+ * Libre WebUI
+ * Copyright (C) 2025 Kroonen AI, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Common resource grants (IAM-03).
+ *
+ * One private-by-default grant model for every shareable resource family:
+ * owner/user/group principals with read/write/admin permissions. Only the
+ * resource owner (or a principal holding an `admin` grant on it) may manage
+ * shares — the global administrator role deliberately confers no access to
+ * private content. Every grant mutation commits in the same transaction as
+ * its audit event.
+ */
+import { randomUUID } from 'node:crypto';
+import { getPersistence } from '../persistence/index.js';
+import { encryptionService } from './encryptionService.js';
+import { buildAuditEvent } from './securityAuditService.js';
+import { authorize, isShareableResourceType, } from './authorizationService.js';
+import { userModel } from '../models/userModel.js';
+export class ResourceGrantError extends Error {
+    constructor(message, statusCode) {
+        super(message);
+        this.statusCode = statusCode;
+        this.name = 'ResourceGrantError';
+    }
+}
+const security = () => getPersistence(encryptionService).repositories.security;
+const archive = () => getPersistence(encryptionService).repositories.resources.archive;
+const isPermission = (value) => value === 'read' || value === 'write' || value === 'admin';
+const isPrincipalType = (value) => value === 'user' || value === 'group';
+/**
+ * Whether the actor may manage sharing for a resource: the owner always
+ * can; other users need an `admin` grant on that resource.
+ */
+export const canManageGrants = async (actor, resourceType, resourceId) => {
+    const ownerUserId = await archive().ownerOf(resourceType, resourceId);
+    if (ownerUserId === null)
+        return { allowed: false, ownerUserId: null };
+    if (ownerUserId === actor.userId)
+        return { allowed: true, ownerUserId };
+    const decision = await authorize(actor, 'manage', {
+        type: resourceType,
+        id: resourceId,
+        ownerUserId,
+    });
+    return { allowed: decision.allowed, ownerUserId };
+};
+export const listGrantsForResource = async (actor, resourceType, resourceId) => {
+    if (!isShareableResourceType(resourceType)) {
+        throw new ResourceGrantError('Unknown resource type', 400);
+    }
+    const manage = await canManageGrants(actor, resourceType, resourceId);
+    if (!manage.allowed) {
+        // Non-enumerating: a denied caller learns nothing about existence.
+        throw new ResourceGrantError('Resource not found', 404);
+    }
+    return security().grants.listForResource(resourceType, resourceId);
+};
+export const createGrant = async (actor, input) => {
+    if (!isShareableResourceType(input.resourceType)) {
+        throw new ResourceGrantError('Unknown resource type', 400);
+    }
+    if (!isPrincipalType(input.principalType)) {
+        throw new ResourceGrantError('Unknown principal type', 400);
+    }
+    if (!isPermission(input.permission)) {
+        throw new ResourceGrantError('Unknown permission', 400);
+    }
+    const manage = await canManageGrants(actor, input.resourceType, input.resourceId);
+    if (!manage.allowed || manage.ownerUserId === null) {
+        throw new ResourceGrantError('Resource not found', 404);
+    }
+    if (input.principalType === 'user' &&
+        input.principalId === manage.ownerUserId) {
+        throw new ResourceGrantError('The owner already has full access', 400);
+    }
+    if (input.principalType === 'user') {
+        const principal = await userModel.getUserById(input.principalId);
+        if (!principal)
+            throw new ResourceGrantError('User not found', 404);
+    }
+    else {
+        const group = await security().groups.findById(input.principalId);
+        if (!group)
+            throw new ResourceGrantError('Group not found', 404);
+    }
+    const record = {
+        id: randomUUID(),
+        resource_type: input.resourceType,
+        resource_id: input.resourceId,
+        owner_user_id: manage.ownerUserId,
+        principal_type: input.principalType,
+        principal_id: input.principalId,
+        permission: input.permission,
+        created_by: actor.userId,
+        created_at: Date.now(),
+    };
+    const audit = buildAuditEvent({
+        action: 'grant.create',
+        result: 'success',
+        actorUserId: actor.userId,
+        targetType: input.resourceType,
+        targetId: input.resourceId,
+        details: {
+            principalType: input.principalType,
+            principalId: input.principalId,
+            permission: input.permission,
+        },
+    });
+    const persistence = getPersistence(encryptionService);
+    if (persistence.dialect === 'sqlite') {
+        await persistence.transaction(({ security: tx }) => {
+            tx.grants.upsert(record);
+            tx.audit.insert(audit);
+            return undefined;
+        });
+        return record;
+    }
+    await persistence.transaction(async ({ security: tx }) => {
+        await tx.grants.upsert(record);
+        await tx.audit.insert(audit);
+    });
+    return record;
+};
+export const deleteGrant = async (actor, grantId) => {
+    const record = await security().grants.findById(grantId);
+    if (!record)
+        return false;
+    if (!isShareableResourceType(record.resource_type)) {
+        throw new ResourceGrantError('Unknown resource type', 400);
+    }
+    const manage = await canManageGrants(actor, record.resource_type, record.resource_id);
+    // A principal may always remove a grant that points at itself
+    // (leave a share), even without manage rights.
+    const selfRemoval = record.principal_type === 'user' && record.principal_id === actor.userId;
+    if (!manage.allowed && !selfRemoval) {
+        throw new ResourceGrantError('Resource not found', 404);
+    }
+    const audit = buildAuditEvent({
+        action: 'grant.delete',
+        result: 'success',
+        actorUserId: actor.userId,
+        targetType: record.resource_type,
+        targetId: record.resource_id,
+        details: {
+            principalType: record.principal_type,
+            principalId: record.principal_id,
+        },
+    });
+    const persistence = getPersistence(encryptionService);
+    if (persistence.dialect === 'sqlite') {
+        return persistence.transaction(({ security: tx }) => {
+            const deleted = tx.grants.delete(grantId);
+            if (deleted)
+                tx.audit.insert(audit);
+            return deleted;
+        });
+    }
+    return persistence.transaction(async ({ security: tx }) => {
+        const deleted = await tx.grants.delete(grantId);
+        if (deleted)
+            await tx.audit.insert(audit);
+        return deleted;
+    });
+};
+/** Resources shared with the actor (directly or via groups). */
+export const listGrantsForActor = async (actor) => {
+    const grants = [
+        ...(await security().grants.listForPrincipal('user', actor.userId)),
+    ];
+    const groups = await security().groups.listGroupIdsForUser(actor.userId);
+    for (const groupId of groups) {
+        grants.push(...(await security().grants.listForPrincipal('group', groupId)));
+    }
+    return grants;
+};
+/** Deletion hygiene: called when a resource is removed. */
+export const deleteGrantsForResource = (resourceType, resourceId) => security().grants.deleteForResource(resourceType, resourceId);
+//# sourceMappingURL=resourceGrantService.js.map

package/backend/dist/services/resourceGrantService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resourceGrantService.js","sourceRoot":"","sources":["../../src/services/resourceGrantService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;;;;;;;GASG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAMzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EACL,SAAS,EACT,uBAAuB,GAGxB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAEnD,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,YACE,OAAe,EACN,UAAkB;QAE3B,KAAK,CAAC,OAAO,CAAC,CAAC;0BAFN,UAAU;QAGnB,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC;AAE/E,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,cAAc,CAAC,iBAAiB,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,CAAC;AAEnE,MAAM,YAAY,GAAG,CAAC,KAAc,EAA4B,EAAE,CAChE,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,OAAO,CAAC;AAE7D,MAAM,eAAe,GAAG,CAAC,KAAc,EAA+B,EAAE,CACtE,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,OAAO,CAAC;AAExC;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAClC,KAAiB,EACjB,YAAmC,EACnC,UAAkB,EACyC,EAAE;IAC7D,MAAM,WAAW,GAAG,MAAM,OAAO,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IACtE,IAAI,WAAW,KAAK,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACvE,IAAI,WAAW,KAAK,KAAK,CAAC,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IACxE,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,QAAQ,EAAE;QAChD,IAAI,EAAE,YAAY;QAClB,EAAE,EAAE,UAAU;QACd,WAAW;KACZ,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,WAAW,EAAE,CAAC;AACpD,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,EACxC,KAAiB,EACjB,YAAoB,EACpB,UAAkB,EACoB,EAAE;IACxC,IAAI,CAAC,uBAAuB,CAAC,YAAY,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,kBAAkB,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;IACtE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,mEAAmE;QACnE,MAAM,IAAI,kBAAkB,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,QAAQ,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;AACrE,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAC9B,KAAiB,EACjB,KAMC,EACmC,EAAE;IACtC,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,kBAAkB,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,kBAAkB,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,kBAAkB,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,eAAe,CAClC,KAAK,EACL,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,UAAU,CACjB,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;QACnD,MAAM,IAAI,kBAAkB,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;IAC1D,CAAC;IACD,IACE,KAAK,CAAC,aAAa,KAAK,MAAM;QAC9B,KAAK,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW,EACxC,CAAC;QACD,MAAM,IAAI,kBAAkB,CAAC,mCAAmC,EAAE,GAAG,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,KAAK,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;QACnC,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACjE,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,kBAAkB,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;IACtE,CAAC;SAAM,CAAC;QACN,MAAM,KAAK,GAAG,MAAM,QAAQ,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAClE,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,MAAM,GAA8B;QACxC,EAAE,EAAE,UAAU,EAAE;QAChB,aAAa,EAAE,KAAK,CAAC,YAAY;QACjC,WAAW,EAAE,KAAK,CAAC,UAAU;QAC7B,aAAa,EAAE,MAAM,CAAC,WAAW;QACjC,cAAc,EAAE,KAAK,CAAC,aAAa;QACnC,YAAY,EAAE,KAAK,CAAC,WAAW;QAC/B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,UAAU,EAAE,KAAK,CAAC,MAAM;QACxB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;KACvB,CAAC;IACF,MAAM,KAAK,GAAG,eAAe,CAAC;QAC5B,MAAM,EAAE,cAAc;QACtB,MAAM,EAAE,SAAS;QACjB,WAAW,EAAE,KAAK,CAAC,MAAM;QACzB,UAAU,EAAE,KAAK,CAAC,YAAY;QAC9B,QAAQ,EAAE,KAAK,CAAC,UAAU;QAC1B,OAAO,EAAE;YACP,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B;KACF,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG,cAAc,CAAC,iBAAiB,CAAC,CAAC;IACtD,IAAI,WAAW,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,WAAW,CAAC,WAAW,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE;YACjD,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACzB,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvB,OAAO,SAAS,CAAC;QACnB,CAAC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,WAAW,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE;QACvD,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/B,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAC9B,KAAiB,EACjB,OAAe,EACG,EAAE;IACpB,MAAM,MAAM,GAAG,MAAM,QAAQ,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,kBAAkB,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,eAAe,CAClC,KAAK,EACL,MAAM,CAAC,aAAa,EACpB,MAAM,CAAC,WAAW,CACnB,CAAC;IACF,8DAA8D;IAC9D,+CAA+C;IAC/C,MAAM,WAAW,GACf,MAAM,CAAC,cAAc,KAAK,MAAM,IAAI,MAAM,CAAC,YAAY,KAAK,KAAK,CAAC,MAAM,CAAC;IAC3E,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;QACpC,MAAM,IAAI,kBAAkB,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,KAAK,GAAG,eAAe,CAAC;QAC5B,MAAM,EAAE,cAAc;QACtB,MAAM,EAAE,SAAS;QACjB,WAAW,EAAE,KAAK,CAAC,MAAM;QACzB,UAAU,EAAE,MAAM,CAAC,aAAa;QAChC,QAAQ,EAAE,MAAM,CAAC,WAAW;QAC5B,OAAO,EAAE;YACP,aAAa,EAAE,MAAM,CAAC,cAAc;YACpC,WAAW,EAAE,MAAM,CAAC,YAAY;SACjC;KACF,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,cAAc,CAAC,iBAAiB,CAAC,CAAC;IACtD,IAAI,WAAW,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACrC,OAAO,WAAW,CAAC,WAAW,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE;YAClD,MAAM,OAAO,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC1C,IAAI,OAAO;gBAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACpC,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,WAAW,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE;QACxD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,OAAO;YAAE,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1C,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,gEAAgE;AAChE,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EACrC,KAAiB,EACqB,EAAE;IACxC,MAAM,MAAM,GAAG;QACb,GAAG,CAAC,MAAM,QAAQ,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;KACpE,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,QAAQ,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACzE,KAAK,MAAM,OAAO,IAAI,MAAM,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CACT,GAAG,CAAC,MAAM,QAAQ,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAChE,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,2DAA2D;AAC3D,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,YAAoB,EACpB,UAAkB,EACD,EAAE,CACnB,QAAQ,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC"}

package/backend/dist/services/securityAuditService.d.ts

@@ -0,0 +1,35 @@
+import type { AuditResult, StoredSecurityAuditEventRecord } from '../persistence/index.js';
+export type AuditActorKind = 'user' | 'api-token' | 'system' | 'anonymous';
+export interface SecurityAuditEventInput {
+    action: string;
+    result: AuditResult;
+    actorUserId?: string | null;
+    actorKind?: AuditActorKind;
+    targetType?: string;
+    targetId?: string;
+    requestId?: string;
+    ipHash?: string | null;
+    details?: Record<string, unknown>;
+}
+export declare const auditRetentionMs: () => number;
+/** Serialize event details with secret keys removed and size bounded. */
+export declare const redactAuditDetails: (details: Record<string, unknown> | undefined) => string | null;
+/** One-way IP digest: correlates events without storing addresses. */
+export declare const hashClientIp: (ip: string | undefined) => string | null;
+/** Build the persisted row shape for direct or transactional inserts. */
+export declare const buildAuditEvent: (input: SecurityAuditEventInput) => StoredSecurityAuditEventRecord;
+/**
+ * Best-effort audit write for observations. Never throws: an audit outage
+ * must not turn into an authentication or authorization outage.
+ */
+export declare const recordAuditEvent: (input: SecurityAuditEventInput) => Promise<void>;
+export declare const queryAuditEvents: (query: {
+    action?: string;
+    actorUserId?: string;
+    result?: AuditResult;
+    targetType?: string;
+    before?: number;
+    after?: number;
+    limit?: number;
+}) => Promise<StoredSecurityAuditEventRecord[]>;
+//# sourceMappingURL=securityAuditService.d.ts.map

package/backend/dist/services/securityAuditService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"securityAuditService.d.ts","sourceRoot":"","sources":["../../src/services/securityAuditService.ts"],"names":[],"mappings":"AAqCA,OAAO,KAAK,EACV,WAAW,EAEX,8BAA8B,EAC/B,MAAM,yBAAyB,CAAC;AAMjC,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,WAAW,GAAG,QAAQ,GAAG,WAAW,CAAC;AAE3E,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,WAAW,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAYD,eAAO,MAAM,gBAAgB,QAAO,MAOnC,CAAC;AAyBF,yEAAyE;AACzE,eAAO,MAAM,kBAAkB,YACpB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,KAC3C,MAAM,GAAG,IAYX,CAAC;AAEF,sEAAsE;AACtE,eAAO,MAAM,YAAY,OAAQ,MAAM,GAAG,SAAS,KAAG,MAAM,GAAG,IAG9D,CAAC;AAEF,yEAAyE;AACzE,eAAO,MAAM,eAAe,UACnB,uBAAuB,KAC7B,8BAYD,CAAC;AAgBH;;;GAGG;AACH,eAAO,MAAM,gBAAgB,UACpB,uBAAuB,KAC7B,OAAO,CAAC,IAAI,CAad,CAAC;AAEF,eAAO,MAAM,gBAAgB,UAAiB;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,KAAG,OAAO,CAAC,8BAA8B,EAAE,CAY3C,CAAC"}

package/backend/dist/services/securityAuditService.js

@@ -0,0 +1,159 @@
+/*
+ * Libre WebUI
+ * Copyright (C) 2025 Kroonen AI, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Security audit log (AUDIT-01/02).
+ *
+ * Records security-sensitive actions and denials as append-only events that
+ * are separate from usage analytics. Details are redacted before persistence:
+ * secret-like keys are dropped, strings are truncated, and the serialized
+ * payload is capped, so prompts, passwords, tokens, and provider bodies can
+ * never enter the log.
+ *
+ * Two write paths exist:
+ * - `recordAuditEvent` for observations (logins, denials): best-effort, never
+ *   throws, so a logging failure cannot block authentication.
+ * - `buildAuditEvent` + the transactional audit repositories for
+ *   security-critical mutations (group/grant/token/user changes): the caller
+ *   writes the event inside the same database transaction as the mutation,
+ *   so the mutation cannot commit without its audit trail.
+ */
+import { createHash, randomUUID } from 'node:crypto';
+import { getPersistence } from '../persistence/index.js';
+import { encryptionService } from './encryptionService.js';
+import { createLogger } from '../utils/logger.js';
+const logger = createLogger('services:security-audit');
+const SECRET_KEY_PATTERN = /pass(word)?|secret|token|key|authorization|cookie|credential|bearer|jwt/i;
+const MAX_DETAIL_STRING = 256;
+const MAX_DETAIL_BYTES = 4096;
+const MAX_DETAIL_DEPTH = 4;
+const AUDIT_RETENTION_DAYS_DEFAULT = 180;
+const PRUNE_EVERY_N_WRITES = 512;
+let writesSincePrune = 0;
+export const auditRetentionMs = () => {
+    const parsed = Number.parseInt(process.env.AUDIT_RETENTION_DAYS ?? '', 10);
+    const days = Number.isFinite(parsed) && parsed > 0
+        ? parsed
+        : AUDIT_RETENTION_DAYS_DEFAULT;
+    return days * 24 * 60 * 60 * 1000;
+};
+const redactValue = (value, depth) => {
+    if (value === null || value === undefined)
+        return value;
+    if (typeof value === 'string') {
+        return value.length > MAX_DETAIL_STRING
+            ? `${value.slice(0, MAX_DETAIL_STRING)}…`
+            : value;
+    }
+    if (typeof value === 'number' || typeof value === 'boolean')
+        return value;
+    if (depth >= MAX_DETAIL_DEPTH)
+        return '[truncated]';
+    if (Array.isArray(value)) {
+        return value.slice(0, 32).map(item => redactValue(item, depth + 1));
+    }
+    if (typeof value === 'object') {
+        const redacted = {};
+        for (const [key, item] of Object.entries(value)) {
+            if (SECRET_KEY_PATTERN.test(key))
+                continue;
+            redacted[key] = redactValue(item, depth + 1);
+        }
+        return redacted;
+    }
+    return String(value);
+};
+/** Serialize event details with secret keys removed and size bounded. */
+export const redactAuditDetails = (details) => {
+    if (!details)
+        return null;
+    try {
+        const serialized = JSON.stringify(redactValue(details, 0));
+        if (!serialized || serialized === '{}')
+            return null;
+        if (Buffer.byteLength(serialized, 'utf8') > MAX_DETAIL_BYTES) {
+            return JSON.stringify({ truncated: true });
+        }
+        return serialized;
+    }
+    catch {
+        return null;
+    }
+};
+/** One-way IP digest: correlates events without storing addresses. */
+export const hashClientIp = (ip) => {
+    if (!ip)
+        return null;
+    return createHash('sha256').update(ip).digest('hex').slice(0, 32);
+};
+/** Build the persisted row shape for direct or transactional inserts. */
+export const buildAuditEvent = (input) => ({
+    id: randomUUID(),
+    occurred_at: Date.now(),
+    actor_user_id: input.actorUserId ?? null,
+    actor_kind: input.actorKind ?? (input.actorUserId ? 'user' : 'anonymous'),
+    action: input.action,
+    target_type: input.targetType ?? null,
+    target_id: input.targetId ?? null,
+    result: input.result,
+    request_id: input.requestId ?? null,
+    ip_hash: input.ipHash ?? null,
+    details: redactAuditDetails(input.details),
+});
+const pruneOpportunistically = async () => {
+    writesSincePrune += 1;
+    if (writesSincePrune < PRUNE_EVERY_N_WRITES)
+        return;
+    writesSincePrune = 0;
+    try {
+        const persistence = getPersistence(encryptionService);
+        await persistence.repositories.security.audit.deleteBefore(Date.now() - auditRetentionMs());
+    }
+    catch (error) {
+        logger.warn('Audit retention prune failed', { error });
+    }
+};
+/**
+ * Best-effort audit write for observations. Never throws: an audit outage
+ * must not turn into an authentication or authorization outage.
+ */
+export const recordAuditEvent = async (input) => {
+    try {
+        const persistence = getPersistence(encryptionService);
+        await persistence.repositories.security.audit.insert(buildAuditEvent(input));
+        await pruneOpportunistically();
+    }
+    catch (error) {
+        logger.error('Failed to record security audit event', {
+            action: input.action,
+            error,
+        });
+    }
+};
+export const queryAuditEvents = async (query) => {
+    const persistence = getPersistence(encryptionService);
+    const bounded = {
+        ...(query.action ? { action: query.action } : {}),
+        ...(query.actorUserId ? { actorUserId: query.actorUserId } : {}),
+        ...(query.result ? { result: query.result } : {}),
+        ...(query.targetType ? { targetType: query.targetType } : {}),
+        ...(query.before !== undefined ? { before: query.before } : {}),
+        ...(query.after !== undefined ? { after: query.after } : {}),
+        limit: Math.min(Math.max(query.limit ?? 100, 1), 500),
+    };
+    return persistence.repositories.security.audit.query(bounded);
+};
+//# sourceMappingURL=securityAuditService.js.map

package/backend/dist/services/securityAuditService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"securityAuditService.js","sourceRoot":"","sources":["../../src/services/securityAuditService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAMzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,MAAM,GAAG,YAAY,CAAC,yBAAyB,CAAC,CAAC;AAgBvD,MAAM,kBAAkB,GACtB,0EAA0E,CAAC;AAC7E,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAC9B,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAE3B,MAAM,4BAA4B,GAAG,GAAG,CAAC;AACzC,MAAM,oBAAoB,GAAG,GAAG,CAAC;AACjC,IAAI,gBAAgB,GAAG,CAAC,CAAC;AAEzB,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAW,EAAE;IAC3C,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAC3E,MAAM,IAAI,GACR,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC;QACnC,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,4BAA4B,CAAC;IACnC,OAAO,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACpC,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CAAC,KAAc,EAAE,KAAa,EAAW,EAAE;IAC7D,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACxD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC,MAAM,GAAG,iBAAiB;YACrC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,GAAG;YACzC,CAAC,CAAC,KAAK,CAAC;IACZ,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC1E,IAAI,KAAK,IAAI,gBAAgB;QAAE,OAAO,aAAa,CAAC;IACpD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAA4B,EAAE,CAAC;QAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAe,CAAC,EAAE,CAAC;YAC1D,IAAI,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC3C,QAAQ,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC,CAAC;AAEF,yEAAyE;AACzE,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,OAA4C,EAC7B,EAAE;IACjB,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3D,IAAI,CAAC,UAAU,IAAI,UAAU,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACpD,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,gBAAgB,EAAE,CAAC;YAC7D,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,sEAAsE;AACtE,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,EAAsB,EAAiB,EAAE;IACpE,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACpE,CAAC,CAAC;AAEF,yEAAyE;AACzE,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,KAA8B,EACE,EAAE,CAAC,CAAC;IACpC,EAAE,EAAE,UAAU,EAAE;IAChB,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE;IACvB,aAAa,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;IACxC,UAAU,EAAE,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC;IACzE,MAAM,EAAE,KAAK,CAAC,MAAM;IACpB,WAAW,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;IACrC,SAAS,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;IACjC,MAAM,EAAE,KAAK,CAAC,MAAM;IACpB,UAAU,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;IACnC,OAAO,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI;IAC7B,OAAO,EAAE,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC;CAC3C,CAAC,CAAC;AAEH,MAAM,sBAAsB,GAAG,KAAK,IAAmB,EAAE;IACvD,gBAAgB,IAAI,CAAC,CAAC;IACtB,IAAI,gBAAgB,GAAG,oBAAoB;QAAE,OAAO;IACpD,gBAAgB,GAAG,CAAC,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,cAAc,CAAC,iBAAiB,CAAC,CAAC;QACtD,MAAM,WAAW,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CACxD,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,EAAE,CAChC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACzD,CAAC;AACH,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EACnC,KAA8B,EACf,EAAE;IACjB,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,cAAc,CAAC,iBAAiB,CAAC,CAAC;QACtD,MAAM,WAAW,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAClD,eAAe,CAAC,KAAK,CAAC,CACvB,CAAC;QACF,MAAM,sBAAsB,EAAE,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,uCAAuC,EAAE;YACpD,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,KAAK;SACN,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EAAE,KAQtC,EAA6C,EAAE;IAC9C,MAAM,WAAW,GAAG,cAAc,CAAC,iBAAiB,CAAC,CAAC;IACtD,MAAM,OAAO,GAAuB;QAClC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC;KACtD,CAAC;IACF,OAAO,WAAW,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AAChE,CAAC,CAAC"}

package/backend/dist/services/simpleGitHubOAuth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"simpleGitHubOAuth.d.ts","sourceRoot":"","sources":["../../src/services/simpleGitHubOAuth.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAa,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAM/D,UAAU,aAAa;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,qBAAa,kBAAkB;IAC7B,cAEC;IAED,OAAO,KAAK,QAAQ,GAEnB;IAED,OAAO,KAAK,YAAY,GAEvB;IAED,OAAO,KAAK,WAAW,GAKtB;IAED;;OAEG;IACH,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAgBhC;IAED;;OAEG;IACH,YAAY,IAAI,OAAO,CAEtB;IAED;;OAEG;IACG,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAiC/D;IAED;;OAEG;IACG,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CA2CvE;IAED;;OAEG;IACG,eAAe,CACnB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;QAAE,IAAI,EAAE,UAAU,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAuBrD;IAED;;OAEG;IACG,WAAW,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAEpE;IAED;;OAEG;YACW,gBAAgB;CAiD/B;AAGD,eAAO,MAAM,kBAAkB,oBAA2B,CAAC"}
+{"version":3,"file":"simpleGitHubOAuth.d.ts","sourceRoot":"","sources":["../../src/services/simpleGitHubOAuth.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAa,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAM/D,UAAU,aAAa;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,qBAAa,kBAAkB;IAC7B,cAEC;IAED,OAAO,KAAK,QAAQ,GAEnB;IAED,OAAO,KAAK,YAAY,GAEvB;IAED,OAAO,KAAK,WAAW,GAKtB;IAED;;OAEG;IACH,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAgBhC;IAED;;OAEG;IACH,YAAY,IAAI,OAAO,CAEtB;IAED;;OAEG;IACG,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAiC/D;IAED;;OAEG;IACG,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CA2CvE;IAED;;OAEG;IACG,eAAe,CACnB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;QAAE,IAAI,EAAE,UAAU,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAyBrD;IAED;;OAEG;IACG,WAAW,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAEpE;IAED;;OAEG;YACW,gBAAgB;CAiD/B;AAGD,eAAO,MAAM,kBAAkB,oBAA2B,CAAC"}

package/backend/dist/services/simpleGitHubOAuth.js

@@ -141,8 +141,10 @@ export class GitHubOAuthService {
                 return null;
             if (user.status !== 'active')
                 return null;
-            // Generate JWT token
-            const jwtToken = authService.generateToken(user);
+            // Issue a revocable session-bound JWT
+            const jwtToken = await authService.issueSession(user, {
+                kind: 'oauth:github',
+            });
             return { user, token: jwtToken };
         }
         catch (error) {

package/backend/dist/services/simpleGitHubOAuth.js.map

@@ -1 +1 @@
-{"version":3,"file":"simpleGitHubOAuth.js","sourceRoot":"","sources":["../../src/services/simpleGitHubOAuth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAc,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,MAAM,GAAG,YAAY,CAAC,+BAA+B,CAAC,CAAC;AAU7D,MAAM,OAAO,kBAAkB;IAC7B;QACE,oDAAoD;IACtD,CAAC;IAED,IAAY,QAAQ;QAClB,OAAO,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IACtC,CAAC;IAED,IAAY,YAAY;QACtB,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IAC1C,CAAC;IAED,IAAY,WAAW;QACrB,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,mBAAmB;YAC/B,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,uBAAuB,iCAAiC,CACpF,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,KAAa;QACtB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,wFAAwF,CACzF,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,SAAS,EAAE,IAAI,CAAC,QAAQ;YACxB,YAAY,EAAE,IAAI,CAAC,WAAW;YAC9B,KAAK,EAAE,YAAY;YACnB,aAAa,EAAE,MAAM;YACrB,KAAK;SACN,CAAC,CAAC;QAEH,OAAO,4CAA4C,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IACzE,CAAC;IAED;;OAEG;IACH,YAAY;QACV,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,oBAAoB,CAAC,IAAY;QACrC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACzC,MAAM,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;YACxD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,6CAA6C,EAC7C;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,MAAM,EAAE,kBAAkB;oBAC1B,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,SAAS,EAAE,IAAI,CAAC,QAAQ;oBACxB,aAAa,EAAE,IAAI,CAAC,YAAY;oBAChC,IAAI;oBACJ,YAAY,EAAE,IAAI,CAAC,WAAW;iBAC/B,CAAC;aACH,CACF,CAAC;YAEF,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAGlC,CAAC;YACF,OAAO,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;YACpD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAAC,WAAmB;QACtC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,6BAA6B,EAAE;gBAC1D,OAAO,EAAE;oBACP,aAAa,EAAE,SAAS,WAAW,EAAE;oBACrC,MAAM,EAAE,kBAAkB;iBAC3B;aACF,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;YAE9B,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAkB,CAAC;YAEzD,iCAAiC;YACjC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;gBACnB,MAAM,aAAa,GAAG,MAAM,KAAK,CAC/B,oCAAoC,EACpC;oBACE,OAAO,EAAE;wBACP,aAAa,EAAE,SAAS,WAAW,EAAE;wBACrC,MAAM,EAAE,kBAAkB;qBAC3B;iBACF,CACF,CAAC;gBAEF,IAAI,aAAa,CAAC,EAAE,EAAE,CAAC;oBACrB,MAAM,MAAM,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,CAIvC,CAAC;oBACJ,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;oBACzD,IAAI,YAAY,EAAE,CAAC;wBACjB,OAAO,CAAC,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC;oBACrC,CAAC;gBACH,CAAC;YACH,CAAC;YAED,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAC;YACnD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe,CACnB,IAAY;QAEZ,IAAI,CAAC;YACH,iCAAiC;YACjC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;YAC1D,IAAI,CAAC,WAAW;gBAAE,OAAO,IAAI,CAAC;YAE9B,mBAAmB;YACnB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;YACvD,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAE1B,sBAAsB;YACtB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YAClD,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YACvB,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAE1C,qBAAqB;YACrB,MAAM,QAAQ,GAAG,WAAW,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;YAEjD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;YACpD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,OAAsB;QACtC,OAAO,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,gBAAgB,CAC5B,OAAsB;QAEtB,IAAI,CAAC;YACH,qCAAqC;YACrC,IAAI,cAAc,GAAG,MAAM,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;YAEzD,+BAA+B;YAC/B,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC;YAEvE,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC;gBACnE,OAAO,MAAM,SAAS,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;YACtD,CAAC;YAED,IAAI,CAAC,WAAW,CAAC,2BAA2B,EAAE,EAAE,CAAC;gBAC/C,MAAM,CAAC,IAAI,CACT,wEAAwE,CACzE,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;YAED,gCAAgC;YAChC,IAAI,cAAc,GAAG,cAAc,CAAC;YACpC,IAAI,OAAO,GAAG,CAAC,CAAC;YAChB,OAAO,MAAM,SAAS,CAAC,cAAc,CAAC,cAAc,CAAC,EAAE,CAAC;gBACtD,cAAc,GAAG,GAAG,cAAc,IAAI,OAAO,EAAE,CAAC;gBAChD,OAAO,EAAE,CAAC;YACZ,CAAC;YAED,kBAAkB;YAClB,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,cAAc,CAAC,CAAC;YAE1D,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,gBAAgB,CAAC;gBAC/C,QAAQ,EAAE,cAAc;gBACxB,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,IAAI;gBAC5B,4FAA4F;gBAC5F,4EAA4E;gBAC5E,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;aAC/D,CAAC,CAAC;YACH,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAE1B,MAAM,CAAC,KAAK,CAAC,0BAA0B,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC3D,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE,KAAK,CAAC,CAAC;YAC3D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF;AAED,4BAA4B;AAC5B,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,kBAAkB,EAAE,CAAC"}
+{"version":3,"file":"simpleGitHubOAuth.js","sourceRoot":"","sources":["../../src/services/simpleGitHubOAuth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAc,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,MAAM,GAAG,YAAY,CAAC,+BAA+B,CAAC,CAAC;AAU7D,MAAM,OAAO,kBAAkB;IAC7B;QACE,oDAAoD;IACtD,CAAC;IAED,IAAY,QAAQ;QAClB,OAAO,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IACtC,CAAC;IAED,IAAY,YAAY;QACtB,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IAC1C,CAAC;IAED,IAAY,WAAW;QACrB,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,mBAAmB;YAC/B,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,uBAAuB,iCAAiC,CACpF,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,KAAa;QACtB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,wFAAwF,CACzF,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,SAAS,EAAE,IAAI,CAAC,QAAQ;YACxB,YAAY,EAAE,IAAI,CAAC,WAAW;YAC9B,KAAK,EAAE,YAAY;YACnB,aAAa,EAAE,MAAM;YACrB,KAAK;SACN,CAAC,CAAC;QAEH,OAAO,4CAA4C,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IACzE,CAAC;IAED;;OAEG;IACH,YAAY;QACV,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,oBAAoB,CAAC,IAAY;QACrC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACzC,MAAM,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;YACxD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,6CAA6C,EAC7C;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,MAAM,EAAE,kBAAkB;oBAC1B,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,SAAS,EAAE,IAAI,CAAC,QAAQ;oBACxB,aAAa,EAAE,IAAI,CAAC,YAAY;oBAChC,IAAI;oBACJ,YAAY,EAAE,IAAI,CAAC,WAAW;iBAC/B,CAAC;aACH,CACF,CAAC;YAEF,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAGlC,CAAC;YACF,OAAO,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;YACpD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAAC,WAAmB;QACtC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,6BAA6B,EAAE;gBAC1D,OAAO,EAAE;oBACP,aAAa,EAAE,SAAS,WAAW,EAAE;oBACrC,MAAM,EAAE,kBAAkB;iBAC3B;aACF,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;YAE9B,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAkB,CAAC;YAEzD,iCAAiC;YACjC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;gBACnB,MAAM,aAAa,GAAG,MAAM,KAAK,CAC/B,oCAAoC,EACpC;oBACE,OAAO,EAAE;wBACP,aAAa,EAAE,SAAS,WAAW,EAAE;wBACrC,MAAM,EAAE,kBAAkB;qBAC3B;iBACF,CACF,CAAC;gBAEF,IAAI,aAAa,CAAC,EAAE,EAAE,CAAC;oBACrB,MAAM,MAAM,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,CAIvC,CAAC;oBACJ,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;oBACzD,IAAI,YAAY,EAAE,CAAC;wBACjB,OAAO,CAAC,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC;oBACrC,CAAC;gBACH,CAAC;YACH,CAAC;YAED,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAC;YACnD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe,CACnB,IAAY;QAEZ,IAAI,CAAC;YACH,iCAAiC;YACjC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;YAC1D,IAAI,CAAC,WAAW;gBAAE,OAAO,IAAI,CAAC;YAE9B,mBAAmB;YACnB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;YACvD,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAE1B,sBAAsB;YACtB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YAClD,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YACvB,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAE1C,sCAAsC;YACtC,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC,IAAI,EAAE;gBACpD,IAAI,EAAE,cAAc;aACrB,CAAC,CAAC;YAEH,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;YACpD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,OAAsB;QACtC,OAAO,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,gBAAgB,CAC5B,OAAsB;QAEtB,IAAI,CAAC;YACH,qCAAqC;YACrC,IAAI,cAAc,GAAG,MAAM,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;YAEzD,+BAA+B;YAC/B,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC;YAEvE,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC;gBACnE,OAAO,MAAM,SAAS,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;YACtD,CAAC;YAED,IAAI,CAAC,WAAW,CAAC,2BAA2B,EAAE,EAAE,CAAC;gBAC/C,MAAM,CAAC,IAAI,CACT,wEAAwE,CACzE,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;YAED,gCAAgC;YAChC,IAAI,cAAc,GAAG,cAAc,CAAC;YACpC,IAAI,OAAO,GAAG,CAAC,CAAC;YAChB,OAAO,MAAM,SAAS,CAAC,cAAc,CAAC,cAAc,CAAC,EAAE,CAAC;gBACtD,cAAc,GAAG,GAAG,cAAc,IAAI,OAAO,EAAE,CAAC;gBAChD,OAAO,EAAE,CAAC;YACZ,CAAC;YAED,kBAAkB;YAClB,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,cAAc,CAAC,CAAC;YAE1D,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,gBAAgB,CAAC;gBAC/C,QAAQ,EAAE,cAAc;gBACxB,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,IAAI;gBAC5B,4FAA4F;gBAC5F,4EAA4E;gBAC5E,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;aAC/D,CAAC,CAAC;YACH,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAE1B,MAAM,CAAC,KAAK,CAAC,0BAA0B,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC3D,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE,KAAK,CAAC,CAAC;YAC3D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF;AAED,4BAA4B;AAC5B,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,kBAAkB,EAAE,CAAC"}

package/backend/dist/services/simpleOidcOAuth.d.ts

@@ -0,0 +1,62 @@
+import { type UserPublic } from '../models/userModel.js';
+interface DiscoveryDocument {
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    jwks_uri: string;
+    userinfo_endpoint?: string;
+}
+export interface OidcClaims {
+    sub: string;
+    email?: string;
+    email_verified?: boolean;
+    preferred_username?: string;
+    name?: string;
+    nonce?: string;
+    [claim: string]: unknown;
+}
+export declare class OidcError extends Error {
+    readonly code: string;
+    constructor(message: string, code: string);
+}
+export declare class OidcOAuthService {
+    private discoveryCache;
+    private jwksCache;
+    private get issuerUrl();
+    private get clientId();
+    private get clientSecret();
+    private get callbackUrl();
+    private get scopes();
+    get displayName(): string;
+    private get allowedEmailDomains();
+    private get groupClaim();
+    private get adminGroups();
+    private get syncGroups();
+    isConfigured(): boolean;
+    discover(): Promise<DiscoveryDocument>;
+    /** PKCE pair for one flow. */
+    createPkcePair(): {
+        verifier: string;
+        challenge: string;
+    };
+    createNonce(): string;
+    getAuthUrl(state: string, nonce: string, codeChallenge: string): Promise<string>;
+    exchangeCode(code: string, verifier: string): Promise<{
+        idToken: string;
+        accessToken?: string;
+    }>;
+    private signingKeyFor;
+    /** Verify signature, issuer, audience, expiry, and nonce. */
+    verifyIdToken(idToken: string, expectedNonce: string): Promise<OidcClaims>;
+    private claimGroups;
+    private assertEmailPolicy;
+    private syncRoleAndGroups;
+    /**
+     * Resolve the verified claims to a Libre account: linked identity first,
+     * then policy-checked account creation. Never links by bare email.
+     */
+    processClaims(claims: OidcClaims): Promise<UserPublic>;
+}
+export declare const oidcOAuthService: OidcOAuthService;
+export {};
+//# sourceMappingURL=simpleOidcOAuth.d.ts.map

package/backend/dist/services/simpleOidcOAuth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"simpleOidcOAuth.d.ts","sourceRoot":"","sources":["../../src/services/simpleOidcOAuth.ts"],"names":[],"mappings":"AA+CA,OAAO,EAAa,KAAK,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAMpE,UAAU,iBAAiB;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,sBAAsB,EAAE,MAAM,CAAC;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CAC1B;AAED,qBAAa,SAAU,SAAQ,KAAK;IAGhC,QAAQ,CAAC,IAAI,EAAE,MAAM;IAFvB,YACE,OAAO,EAAE,MAAM,EACN,IAAI,EAAE,MAAM,EAItB;CACF;AAoBD,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,cAAc,CAER;IACd,OAAO,CAAC,SAAS,CAEH;IAEd,OAAO,KAAK,SAAS,GAEpB;IAED,OAAO,KAAK,QAAQ,GAEnB;IAED,OAAO,KAAK,YAAY,GAEvB;IAED,OAAO,KAAK,WAAW,GAKtB;IAED,OAAO,KAAK,MAAM,GAEjB;IAED,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,OAAO,KAAK,mBAAmB,GAK9B;IAED,OAAO,KAAK,UAAU,GAErB;IAED,OAAO,KAAK,WAAW,GAKtB;IAED,OAAO,KAAK,UAAU,GAErB;IAED,YAAY,IAAI,OAAO,CAEtB;IAEK,QAAQ,IAAI,OAAO,CAAC,iBAAiB,CAAC,CA8B3C;IAED,8BAA8B;IAC9B,cAAc,IAAI;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAIxD;IAED,WAAW,IAAI,MAAM,CAEpB;IAEK,UAAU,CACd,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC,CAajB;IAEK,YAAY,CAChB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAwBpD;YAEa,aAAa;IAoC3B,6DAA6D;IACvD,aAAa,CACjB,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,UAAU,CAAC,CAmCrB;IAED,OAAO,CAAC,WAAW;IAWnB,OAAO,CAAC,iBAAiB;YAiBX,iBAAiB;IAmD/B;;;OAGG;IACG,aAAa,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAqF3D;CACF;AAED,eAAO,MAAM,gBAAgB,kBAAyB,CAAC"}