libre-webui 0.22.1 → 0.23.1

package/backend/dist/services/simpleOidcOAuth.js

@@ -0,0 +1,397 @@
+/*
+ * Libre WebUI
+ * Copyright (C) 2025 Kroonen AI, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Generic OIDC sign-in (IAM-06).
+ *
+ * Discovery-based OpenID Connect with the full browser-flow defenses:
+ * CSRF state, PKCE (S256), and a nonce bound into the verified ID token.
+ * ID tokens are validated against the provider's JWKS (fetched and cached)
+ * with issuer, audience, expiry, and nonce checks — no unverified decode.
+ *
+ * Identity is linked through the `oauth_identities` table on the stable
+ * `sub` claim, so a renamed IdP account keeps its Libre account. An email
+ * already used by an unlinked local account is rejected rather than
+ * silently merged. Optional policies: allowed email domains, admin-role
+ * mapping from a group claim, and per-login group membership sync.
+ *
+ * Configuration (environment):
+ *   OIDC_ISSUER_URL, OIDC_CLIENT_ID, OIDC_CLIENT_SECRET  — required
+ *   OIDC_DISPLAY_NAME     — login button label (default 'Single Sign-On')
+ *   OIDC_SCOPES           — default 'openid profile email'
+ *   OIDC_CALLBACK_URL     — default BASE_URL + /api/auth/oauth/oidc/callback
+ *   OIDC_ALLOWED_EMAIL_DOMAINS — comma list; when set, a verified email in
+ *                                one of these domains is required
+ *   OIDC_GROUP_CLAIM      — claim holding group names (default 'groups')
+ *   OIDC_ADMIN_GROUPS     — comma list; when set, the admin role is granted
+ *                           and removed based on claim membership
+ *   OIDC_SYNC_GROUPS      — 'true' reconciles Libre group memberships with
+ *                           the group claim on every login
+ */
+import { createHash, createPublicKey, randomBytes } from 'node:crypto';
+import jwt from 'jsonwebtoken';
+import { userModel } from '../models/userModel.js';
+import { authService } from './authService.js';
+import { getPersistence } from '../persistence/index.js';
+import { encryptionService } from './encryptionService.js';
+import { recordAuditEvent } from './securityAuditService.js';
+export class OidcError extends Error {
+    constructor(message, code) {
+        super(message);
+        this.code = code;
+        this.name = 'OidcError';
+    }
+}
+const DISCOVERY_CACHE_MS = 10 * 60 * 1000;
+const JWKS_CACHE_MS = 10 * 60 * 1000;
+const HTTP_TIMEOUT_MS = 10000;
+const fetchJson = async (url, init) => {
+    const response = await fetch(url, {
+        ...init,
+        signal: AbortSignal.timeout(HTTP_TIMEOUT_MS),
+    });
+    if (!response.ok) {
+        throw new OidcError(`Request to ${new URL(url).origin} failed with ${response.status}`, 'upstream-error');
+    }
+    return response.json();
+};
+export class OidcOAuthService {
+    get issuerUrl() {
+        return process.env.OIDC_ISSUER_URL?.trim().replace(/\/$/, '') || undefined;
+    }
+    get clientId() {
+        return process.env.OIDC_CLIENT_ID?.trim() || undefined;
+    }
+    get clientSecret() {
+        return process.env.OIDC_CLIENT_SECRET?.trim() || undefined;
+    }
+    get callbackUrl() {
+        return (process.env.OIDC_CALLBACK_URL ||
+            `${process.env.BASE_URL || 'http://localhost:3001'}/api/auth/oauth/oidc/callback`);
+    }
+    get scopes() {
+        return process.env.OIDC_SCOPES?.trim() || 'openid profile email';
+    }
+    get displayName() {
+        return process.env.OIDC_DISPLAY_NAME?.trim() || 'Single Sign-On';
+    }
+    get allowedEmailDomains() {
+        return (process.env.OIDC_ALLOWED_EMAIL_DOMAINS ?? '')
+            .split(',')
+            .map(domain => domain.trim().toLowerCase())
+            .filter(Boolean);
+    }
+    get groupClaim() {
+        return process.env.OIDC_GROUP_CLAIM?.trim() || 'groups';
+    }
+    get adminGroups() {
+        return (process.env.OIDC_ADMIN_GROUPS ?? '')
+            .split(',')
+            .map(group => group.trim())
+            .filter(Boolean);
+    }
+    get syncGroups() {
+        return process.env.OIDC_SYNC_GROUPS?.trim().toLowerCase() === 'true';
+    }
+    isConfigured() {
+        return Boolean(this.issuerUrl && this.clientId && this.clientSecret);
+    }
+    async discover() {
+        const issuer = this.issuerUrl;
+        if (!issuer)
+            throw new OidcError('OIDC is not configured', 'unconfigured');
+        if (this.discoveryCache &&
+            this.discoveryCache.issuer === issuer &&
+            Date.now() - this.discoveryCache.fetchedAt < DISCOVERY_CACHE_MS) {
+            return this.discoveryCache.document;
+        }
+        const raw = (await fetchJson(`${issuer}/.well-known/openid-configuration`));
+        if (typeof raw.issuer !== 'string' ||
+            typeof raw.authorization_endpoint !== 'string' ||
+            typeof raw.token_endpoint !== 'string' ||
+            typeof raw.jwks_uri !== 'string') {
+            throw new OidcError('Invalid discovery document', 'discovery-invalid');
+        }
+        if (raw.issuer.replace(/\/$/, '') !== issuer) {
+            throw new OidcError('Discovery issuer does not match OIDC_ISSUER_URL', 'issuer-mismatch');
+        }
+        const document = raw;
+        this.discoveryCache = { document, fetchedAt: Date.now(), issuer };
+        return document;
+    }
+    /** PKCE pair for one flow. */
+    createPkcePair() {
+        const verifier = randomBytes(48).toString('base64url');
+        const challenge = createHash('sha256').update(verifier).digest('base64url');
+        return { verifier, challenge };
+    }
+    createNonce() {
+        return randomBytes(24).toString('base64url');
+    }
+    async getAuthUrl(state, nonce, codeChallenge) {
+        const discovery = await this.discover();
+        const params = new URLSearchParams({
+            client_id: this.clientId ?? '',
+            redirect_uri: this.callbackUrl,
+            response_type: 'code',
+            scope: this.scopes,
+            state,
+            nonce,
+            code_challenge: codeChallenge,
+            code_challenge_method: 'S256',
+        });
+        return `${discovery.authorization_endpoint}?${params.toString()}`;
+    }
+    async exchangeCode(code, verifier) {
+        const discovery = await this.discover();
+        const body = new URLSearchParams({
+            grant_type: 'authorization_code',
+            code,
+            redirect_uri: this.callbackUrl,
+            client_id: this.clientId ?? '',
+            client_secret: this.clientSecret ?? '',
+            code_verifier: verifier,
+        });
+        const data = (await fetchJson(discovery.token_endpoint, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: body.toString(),
+        }));
+        if (typeof data.id_token !== 'string') {
+            throw new OidcError('Token response is missing id_token', 'no-id-token');
+        }
+        return {
+            idToken: data.id_token,
+            ...(typeof data.access_token === 'string'
+                ? { accessToken: data.access_token }
+                : {}),
+        };
+    }
+    async signingKeyFor(kid) {
+        const discovery = await this.discover();
+        const stale = !this.jwksCache ||
+            this.jwksCache.uri !== discovery.jwks_uri ||
+            Date.now() - this.jwksCache.fetchedAt > JWKS_CACHE_MS;
+        if (stale) {
+            const raw = (await fetchJson(discovery.jwks_uri));
+            if (!Array.isArray(raw.keys)) {
+                throw new OidcError('Invalid JWKS document', 'jwks-invalid');
+            }
+            this.jwksCache = {
+                keys: raw.keys,
+                fetchedAt: Date.now(),
+                uri: discovery.jwks_uri,
+            };
+        }
+        const keys = this.jwksCache?.keys ?? [];
+        const jwk = keys.find(key => kid !== undefined && key.kid === kid) ??
+            (kid === undefined && keys.length === 1 ? keys[0] : undefined);
+        if (!jwk) {
+            // One refetch on rotation: the kid may be newer than the cache.
+            this.jwksCache = undefined;
+            throw new OidcError('No matching signing key', 'jwks-no-key');
+        }
+        return createPublicKey({
+            key: jwk,
+            format: 'jwk',
+        })
+            .export({ type: 'spki', format: 'pem' })
+            .toString();
+    }
+    /** Verify signature, issuer, audience, expiry, and nonce. */
+    async verifyIdToken(idToken, expectedNonce) {
+        const discovery = await this.discover();
+        const decoded = jwt.decode(idToken, { complete: true });
+        if (!decoded || typeof decoded === 'string') {
+            throw new OidcError('Malformed ID token', 'id-token-invalid');
+        }
+        const kid = typeof decoded.header.kid === 'string' ? decoded.header.kid : undefined;
+        let pem;
+        try {
+            pem = await this.signingKeyFor(kid);
+        }
+        catch (error) {
+            if (error instanceof OidcError && error.code === 'jwks-no-key') {
+                pem = await this.signingKeyFor(kid);
+            }
+            else {
+                throw error;
+            }
+        }
+        let claims;
+        try {
+            claims = jwt.verify(idToken, pem, {
+                algorithms: ['RS256', 'RS384', 'RS512', 'ES256', 'ES384', 'PS256'],
+                audience: this.clientId,
+                issuer: discovery.issuer,
+            });
+        }
+        catch {
+            throw new OidcError('ID token verification failed', 'id-token-invalid');
+        }
+        if (typeof claims.sub !== 'string' || !claims.sub) {
+            throw new OidcError('ID token is missing sub', 'id-token-invalid');
+        }
+        if (claims.nonce !== expectedNonce) {
+            throw new OidcError('ID token nonce mismatch', 'nonce-mismatch');
+        }
+        return claims;
+    }
+    claimGroups(claims) {
+        const value = claims[this.groupClaim];
+        if (Array.isArray(value)) {
+            return value.filter((item) => typeof item === 'string');
+        }
+        if (typeof value === 'string') {
+            return value.split(/[\s,]+/).filter(Boolean);
+        }
+        return [];
+    }
+    assertEmailPolicy(claims) {
+        const domains = this.allowedEmailDomains;
+        if (domains.length === 0)
+            return;
+        const email = typeof claims.email === 'string' ? claims.email : '';
+        const domain = email.split('@')[1]?.toLowerCase();
+        if (!domain ||
+            !domains.includes(domain) ||
+            claims.email_verified !== true) {
+            throw new OidcError('This identity provider account is not allowed to sign in', 'email-domain-denied');
+        }
+    }
+    async syncRoleAndGroups(user, claims) {
+        const groups = this.claimGroups(claims);
+        let current = user;
+        const adminGroups = this.adminGroups;
+        if (adminGroups.length > 0) {
+            const shouldBeAdmin = groups.some(group => adminGroups.includes(group));
+            const mappedRole = shouldBeAdmin ? 'admin' : 'user';
+            if (current.role !== mappedRole) {
+                const updated = await userModel.updateUser(current.id, {
+                    role: mappedRole,
+                });
+                if (updated)
+                    current = updated;
+                void recordAuditEvent({
+                    action: 'oidc.role-sync',
+                    result: 'success',
+                    actorUserId: current.id,
+                    targetType: 'user',
+                    targetId: current.id,
+                    details: { role: mappedRole },
+                });
+            }
+        }
+        if (this.syncGroups) {
+            const security = getPersistence(encryptionService).repositories.security;
+            const allGroups = await security.groups.list();
+            const memberships = new Set(await security.groups.listGroupIdsForUser(current.id));
+            for (const group of allGroups) {
+                const claimed = groups.includes(group.name);
+                const isMember = memberships.has(group.id);
+                if (claimed && !isMember) {
+                    await security.groups.addMember({
+                        group_id: group.id,
+                        user_id: current.id,
+                        added_by: 'oidc-sync',
+                        added_at: Date.now(),
+                    });
+                }
+                else if (!claimed && isMember) {
+                    await security.groups.removeMember(group.id, current.id);
+                }
+            }
+        }
+        return current;
+    }
+    /**
+     * Resolve the verified claims to a Libre account: linked identity first,
+     * then policy-checked account creation. Never links by bare email.
+     */
+    async processClaims(claims) {
+        this.assertEmailPolicy(claims);
+        const security = getPersistence(encryptionService).repositories.security;
+        const subject = claims.sub;
+        const email = typeof claims.email === 'string' && claims.email.trim()
+            ? claims.email.trim()
+            : null;
+        const identity = await security.oauthIdentities.find('oidc', subject);
+        if (identity) {
+            const user = await userModel.getUserById(identity.user_id);
+            if (!user) {
+                throw new OidcError('The linked account no longer exists', 'account-missing');
+            }
+            await security.oauthIdentities.upsert({
+                ...identity,
+                email,
+                updated_at: Date.now(),
+            });
+            return this.syncRoleAndGroups(user, claims);
+        }
+        if (!authService.isPublicRegistrationEnabled()) {
+            const userCount = await userModel.getUserCount();
+            if (userCount > 0) {
+                throw new OidcError('Registration is disabled on this server', 'registration-disabled');
+            }
+        }
+        if (email && (await userModel.emailExists(email))) {
+            // A local account already owns this email. Refuse a silent merge —
+            // the user should sign in locally and link explicitly.
+            throw new OidcError('An account with this email already exists', 'email-in-use');
+        }
+        const preferred = typeof claims.preferred_username === 'string' &&
+            claims.preferred_username.trim()
+            ? claims.preferred_username.trim()
+            : subject;
+        const base = `oidc_${preferred.replace(/[^A-Za-z0-9._-]/g, '_').slice(0, 48)}`;
+        let username = base;
+        let counter = 1;
+        while (await userModel.usernameExists(username)) {
+            username = `${base}_${counter}`;
+            counter += 1;
+        }
+        const user = await userModel.createPublicUser({
+            username,
+            email,
+            password: 'oauth:' + randomBytes(24).toString('base64'),
+        });
+        if (!user) {
+            throw new OidcError('Account creation failed', 'account-create-failed');
+        }
+        const now = Date.now();
+        await security.oauthIdentities.upsert({
+            provider: 'oidc',
+            subject,
+            user_id: user.id,
+            email,
+            created_at: now,
+            updated_at: now,
+        });
+        void recordAuditEvent({
+            action: 'oidc.link',
+            result: 'success',
+            actorUserId: user.id,
+            targetType: 'user',
+            targetId: user.id,
+            details: { username, created: true },
+        });
+        if (user.status !== 'active')
+            return user;
+        return this.syncRoleAndGroups(user, claims);
+    }
+}
+export const oidcOAuthService = new OidcOAuthService();
+//# sourceMappingURL=simpleOidcOAuth.js.map

package/backend/dist/services/simpleOidcOAuth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"simpleOidcOAuth.js","sourceRoot":"","sources":["../../src/services/simpleOidcOAuth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAe,EAAE,UAAU,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/E,OAAO,GAAG,MAAM,cAAc,CAAC;AAC/B,OAAO,EAAE,SAAS,EAAmB,MAAM,wBAAwB,CAAC;AACpE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAoB7D,MAAM,OAAO,SAAU,SAAQ,KAAK;IAClC,YACE,OAAe,EACN,IAAY;QAErB,KAAK,CAAC,OAAO,CAAC,CAAC;oBAFN,IAAI;QAGb,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;CACF;AAED,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC1C,MAAM,aAAa,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACrC,MAAM,eAAe,GAAG,KAAM,CAAC;AAE/B,MAAM,SAAS,GAAG,KAAK,EAAE,GAAW,EAAE,IAAkB,EAAoB,EAAE;IAC5E,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAChC,GAAG,IAAI;QACP,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,eAAe,CAAC;KAC7C,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,SAAS,CACjB,cAAc,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,gBAAgB,QAAQ,CAAC,MAAM,EAAE,EAClE,gBAAgB,CACjB,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;AACzB,CAAC,CAAC;AAEF,MAAM,OAAO,gBAAgB;IAQ3B,IAAY,SAAS;QACnB,OAAO,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC;IAC7E,CAAC;IAED,IAAY,QAAQ;QAClB,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IACzD,CAAC;IAED,IAAY,YAAY;QACtB,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IAC7D,CAAC;IAED,IAAY,WAAW;QACrB,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,iBAAiB;YAC7B,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,uBAAuB,+BAA+B,CAClF,CAAC;IACJ,CAAC;IAED,IAAY,MAAM;QAChB,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,sBAAsB,CAAC;IACnE,CAAC;IAED,IAAI,WAAW;QACb,OAAO,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,gBAAgB,CAAC;IACnE,CAAC;IAED,IAAY,mBAAmB;QAC7B,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,EAAE,CAAC;aAClD,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;aAC1C,MAAM,CAAC,OAAO,CAAC,CAAC;IACrB,CAAC;IAED,IAAY,UAAU;QACpB,OAAO,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC;IAC1D,CAAC;IAED,IAAY,WAAW;QACrB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC;aACzC,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;aAC1B,MAAM,CAAC,OAAO,CAAC,CAAC;IACrB,CAAC;IAED,IAAY,UAAU;QACpB,OAAO,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;IACvE,CAAC;IAED,YAAY;QACV,OAAO,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC;QAC9B,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,SAAS,CAAC,wBAAwB,EAAE,cAAc,CAAC,CAAC;QAC3E,IACE,IAAI,CAAC,cAAc;YACnB,IAAI,CAAC,cAAc,CAAC,MAAM,KAAK,MAAM;YACrC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,cAAc,CAAC,SAAS,GAAG,kBAAkB,EAC/D,CAAC;YACD,OAAO,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC;QACtC,CAAC;QACD,MAAM,GAAG,GAAG,CAAC,MAAM,SAAS,CAC1B,GAAG,MAAM,mCAAmC,CAC7C,CAA+B,CAAC;QACjC,IACE,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ;YAC9B,OAAO,GAAG,CAAC,sBAAsB,KAAK,QAAQ;YAC9C,OAAO,GAAG,CAAC,cAAc,KAAK,QAAQ;YACtC,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAChC,CAAC;YACD,MAAM,IAAI,SAAS,CAAC,4BAA4B,EAAE,mBAAmB,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,MAAM,EAAE,CAAC;YAC7C,MAAM,IAAI,SAAS,CACjB,iDAAiD,EACjD,iBAAiB,CAClB,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,GAAwB,CAAC;QAC1C,IAAI,CAAC,cAAc,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC;QAClE,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,8BAA8B;IAC9B,cAAc;QACZ,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACvD,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC5E,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACjC,CAAC;IAED,WAAW;QACT,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,UAAU,CACd,KAAa,EACb,KAAa,EACb,aAAqB;QAErB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,SAAS,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE;YAC9B,YAAY,EAAE,IAAI,CAAC,WAAW;YAC9B,aAAa,EAAE,MAAM;YACrB,KAAK,EAAE,IAAI,CAAC,MAAM;YAClB,KAAK;YACL,KAAK;YACL,cAAc,EAAE,aAAa;YAC7B,qBAAqB,EAAE,MAAM;SAC9B,CAAC,CAAC;QACH,OAAO,GAAG,SAAS,CAAC,sBAAsB,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,IAAY,EACZ,QAAgB;QAEhB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,UAAU,EAAE,oBAAoB;YAChC,IAAI;YACJ,YAAY,EAAE,IAAI,CAAC,WAAW;YAC9B,SAAS,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE;YAC9B,aAAa,EAAE,IAAI,CAAC,YAAY,IAAI,EAAE;YACtC,aAAa,EAAE,QAAQ;SACxB,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,SAAS,CAAC,SAAS,CAAC,cAAc,EAAE;YACtD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;SACtB,CAAC,CAAiD,CAAC;QACpD,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,IAAI,SAAS,CAAC,oCAAoC,EAAE,aAAa,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,QAAQ;YACtB,GAAG,CAAC,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ;gBACvC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,YAAY,EAAE;gBACpC,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,GAAuB;QACjD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACxC,MAAM,KAAK,GACT,CAAC,IAAI,CAAC,SAAS;YACf,IAAI,CAAC,SAAS,CAAC,GAAG,KAAK,SAAS,CAAC,QAAQ;YACzC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,GAAG,aAAa,CAAC;QACxD,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,GAAG,GAAG,CAAC,MAAM,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,CAE/C,CAAC;YACF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,SAAS,CAAC,uBAAuB,EAAE,cAAc,CAAC,CAAC;YAC/D,CAAC;YACD,IAAI,CAAC,SAAS,GAAG;gBACf,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;gBACrB,GAAG,EAAE,SAAS,CAAC,QAAQ;aACxB,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC;QACxC,MAAM,GAAG,GACP,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC;YACtD,CAAC,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACjE,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,gEAAgE;YAChE,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;YAC3B,MAAM,IAAI,SAAS,CAAC,yBAAyB,EAAE,aAAa,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,eAAe,CAAC;YACrB,GAAG,EAAE,GAAoC;YACzC,MAAM,EAAE,KAAK;SACd,CAAC;aACC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;aACvC,QAAQ,EAAE,CAAC;IAChB,CAAC;IAED,6DAA6D;IAC7D,KAAK,CAAC,aAAa,CACjB,OAAe,EACf,aAAqB;QAErB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC5C,MAAM,IAAI,SAAS,CAAC,oBAAoB,EAAE,kBAAkB,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,GAAG,GACP,OAAO,OAAO,CAAC,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1E,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;gBAC/D,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;YACtC,CAAC;iBAAM,CAAC;gBACN,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QACD,IAAI,MAAkB,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE;gBAChC,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;gBAClE,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,MAAM,EAAE,SAAS,CAAC,MAAM;aACzB,CAAe,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,SAAS,CAAC,8BAA8B,EAAE,kBAAkB,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;YAClD,MAAM,IAAI,SAAS,CAAC,yBAAyB,EAAE,kBAAkB,CAAC,CAAC;QACrE,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,KAAK,aAAa,EAAE,CAAC;YACnC,MAAM,IAAI,SAAS,CAAC,yBAAyB,EAAE,gBAAgB,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,WAAW,CAAC,MAAkB;QACpC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACtC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAEO,iBAAiB,CAAC,MAAkB;QAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,mBAAmB,CAAC;QACzC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACjC,MAAM,KAAK,GAAG,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QAClD,IACE,CAAC,MAAM;YACP,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;YACzB,MAAM,CAAC,cAAc,KAAK,IAAI,EAC9B,CAAC;YACD,MAAM,IAAI,SAAS,CACjB,0DAA0D,EAC1D,qBAAqB,CACtB,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAC7B,IAAgB,EAChB,MAAkB;QAElB,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,OAAO,GAAG,IAAI,CAAC;QAEnB,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACrC,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;YACxE,MAAM,UAAU,GAAG,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;YACpD,IAAI,OAAO,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAChC,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE;oBACrD,IAAI,EAAE,UAAU;iBACjB,CAAC,CAAC;gBACH,IAAI,OAAO;oBAAE,OAAO,GAAG,OAAO,CAAC;gBAC/B,KAAK,gBAAgB,CAAC;oBACpB,MAAM,EAAE,gBAAgB;oBACxB,MAAM,EAAE,SAAS;oBACjB,WAAW,EAAE,OAAO,CAAC,EAAE;oBACvB,UAAU,EAAE,MAAM;oBAClB,QAAQ,EAAE,OAAO,CAAC,EAAE;oBACpB,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;iBAC9B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,MAAM,QAAQ,GAAG,cAAc,CAAC,iBAAiB,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC;YACzE,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAC/C,MAAM,WAAW,GAAG,IAAI,GAAG,CACzB,MAAM,QAAQ,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC,CACtD,CAAC;YACF,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;gBAC9B,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC5C,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBAC3C,IAAI,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACzB,MAAM,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;wBAC9B,QAAQ,EAAE,KAAK,CAAC,EAAE;wBAClB,OAAO,EAAE,OAAO,CAAC,EAAE;wBACnB,QAAQ,EAAE,WAAW;wBACrB,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE;qBACrB,CAAC,CAAC;gBACL,CAAC;qBAAM,IAAI,CAAC,OAAO,IAAI,QAAQ,EAAE,CAAC;oBAChC,MAAM,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;gBAC3D,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,aAAa,CAAC,MAAkB;QACpC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC/B,MAAM,QAAQ,GAAG,cAAc,CAAC,iBAAiB,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC;QACzE,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC;QAC3B,MAAM,KAAK,GACT,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE;YACrD,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE;YACrB,CAAC,CAAC,IAAI,CAAC;QAEX,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACtE,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC3D,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,SAAS,CACjB,qCAAqC,EACrC,iBAAiB,CAClB,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC;gBACpC,GAAG,QAAQ;gBACX,KAAK;gBACL,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;aACvB,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC9C,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,2BAA2B,EAAE,EAAE,CAAC;YAC/C,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,YAAY,EAAE,CAAC;YACjD,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;gBAClB,MAAM,IAAI,SAAS,CACjB,yCAAyC,EACzC,uBAAuB,CACxB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,KAAK,IAAI,CAAC,MAAM,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAClD,mEAAmE;YACnE,uDAAuD;YACvD,MAAM,IAAI,SAAS,CACjB,2CAA2C,EAC3C,cAAc,CACf,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GACb,OAAO,MAAM,CAAC,kBAAkB,KAAK,QAAQ;YAC7C,MAAM,CAAC,kBAAkB,CAAC,IAAI,EAAE;YAC9B,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,IAAI,EAAE;YAClC,CAAC,CAAC,OAAO,CAAC;QACd,MAAM,IAAI,GAAG,QAAQ,SAAS,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QAC/E,IAAI,QAAQ,GAAG,IAAI,CAAC;QACpB,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,OAAO,MAAM,SAAS,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChD,QAAQ,GAAG,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC,CAAC;QACf,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,gBAAgB,CAAC;YAC5C,QAAQ;YACR,KAAK;YACL,QAAQ,EAAE,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;SACxD,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,SAAS,CAAC,yBAAyB,EAAE,uBAAuB,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC;YACpC,QAAQ,EAAE,MAAM;YAChB,OAAO;YACP,OAAO,EAAE,IAAI,CAAC,EAAE;YAChB,KAAK;YACL,UAAU,EAAE,GAAG;YACf,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;QACH,KAAK,gBAAgB,CAAC;YACpB,MAAM,EAAE,WAAW;YACnB,MAAM,EAAE,SAAS;YACjB,WAAW,EAAE,IAAI,CAAC,EAAE;YACpB,UAAU,EAAE,MAAM;YAClB,QAAQ,EAAE,IAAI,CAAC,EAAE;YACjB,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE;SACrC,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC1C,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;CACF;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,EAAE,CAAC"}

package/backend/dist/services/webSearchService.d.ts

@@ -41,6 +41,7 @@ export declare function getWebSearchAccessMode(): Promise<WebSearchAccessMode>;
 export declare function setWebSearchAccessMode(mode: WebSearchAccessMode): Promise<void>;
 /** Whether this user may run web searches right now (search must also be available). */
 export declare function userCanUseWebSearch(user: {
+    id?: string;
     role?: string;
     status?: string;
 } | undefined | null): Promise<boolean>;

package/backend/dist/services/webSearchService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webSearchService.d.ts","sourceRoot":"","sources":["../../src/services/webSearchService.ts"],"names":[],"mappings":"AAuCA,eAAO,MAAM,sBAAsB,uBAAuB,CAAC;AAC3D,eAAO,MAAM,kBAAkB,mBAAmB,CAAC;AACnD,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AACzD,eAAO,MAAM,0BAA0B,2BAA2B,CAAC;AACnE,eAAO,MAAM,0BAA0B,2BAA2B,CAAC;AAEnE,eAAO,MAAM,8BAA8B,IAAI,CAAC;AAChD,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAE7C,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,WAAW,CAAC;AAEzD,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,mBAAmB,CAE9B;AAMD,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,0DAA0D;IAC1D,SAAS,EAAE,OAAO,CAAC;IACnB,iDAAiD;IACjD,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAInE;AAUD,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAqB5D;AAED,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,eAAe,CAAC,CAuBnE;AAED,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB,GAAG,OAAO,CAAC,eAAe,CAAC,CAmB3B;AAED,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,OAAO,CAAC,CAE7D;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAG3E;AAED,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,IAAI,CAAC,CAKf;AAED,wFAAwF;AACxF,wBAAsB,mBAAmB,CACvC,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,GAAG,IAAI,GAC1D,OAAO,CAAC,OAAO,CAAC,CAKlB;AAcD,wBAAsB,SAAS,CAC7B,KAAK,EAAE,MAAM,EACb,UAAU,CAAC,EAAE,MAAM,EACnB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,eAAe,EAAE,CAAC,CAuE5B;AAED;;;GAGG;AACH,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,SAAS,eAAe,EAAE,EACnC,KAAK,EAAE,MAAM,GACZ,MAAM,CAWR"}
+{"version":3,"file":"webSearchService.d.ts","sourceRoot":"","sources":["../../src/services/webSearchService.ts"],"names":[],"mappings":"AAuCA,eAAO,MAAM,sBAAsB,uBAAuB,CAAC;AAC3D,eAAO,MAAM,kBAAkB,mBAAmB,CAAC;AACnD,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AACzD,eAAO,MAAM,0BAA0B,2BAA2B,CAAC;AACnE,eAAO,MAAM,0BAA0B,2BAA2B,CAAC;AAEnE,eAAO,MAAM,8BAA8B,IAAI,CAAC;AAChD,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAE7C,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,WAAW,CAAC;AAEzD,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,mBAAmB,CAE9B;AAMD,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,0DAA0D;IAC1D,SAAS,EAAE,OAAO,CAAC;IACnB,iDAAiD;IACjD,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAInE;AAUD,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAqB5D;AAED,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,eAAe,CAAC,CAuBnE;AAED,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB,GAAG,OAAO,CAAC,eAAe,CAAC,CAmB3B;AAED,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,OAAO,CAAC,CAE7D;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAG3E;AAED,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,IAAI,CAAC,CAKf;AAED,wFAAwF;AACxF,wBAAsB,mBAAmB,CACvC,IAAI,EAAE;IAAE,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,GAAG,IAAI,GACvE,OAAO,CAAC,OAAO,CAAC,CASlB;AAcD,wBAAsB,SAAS,CAC7B,KAAK,EAAE,MAAM,EACb,UAAU,CAAC,EAAE,MAAM,EACnB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,eAAe,EAAE,CAAC,CAuE5B;AAED;;;GAGG;AACH,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,SAAS,eAAe,EAAE,EACnC,KAAK,EAAE,MAAM,GACZ,MAAM,CAWR"}

package/backend/dist/services/webSearchService.js

@@ -142,11 +142,9 @@ export async function setWebSearchAccessMode(mode) {
 export async function userCanUseWebSearch(user) {
     if (!user)
         return false;
-    if (user.status !== undefined && user.status !== 'active')
-        return false;
-    if (user.role === 'admin')
-        return true;
-    return (await getWebSearchAccessMode()) === 'all-users';
+    const { authorize } = await import('./authorizationService.js');
+    const decision = await authorize({ userId: user.id ?? '', role: user.role, status: user.status }, 'use', { type: 'feature', id: 'web-search' });
+    return decision.allowed;
 }
 const bounded = (value, max) => typeof value === 'string'
     ? value.replace(/\s+/g, ' ').trim().slice(0, max)

package/backend/dist/services/webSearchService.js.map

@@ -1 +1 @@
-{"version":3,"file":"webSearchService.js","sourceRoot":"","sources":["../../src/services/webSearchService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;;;;;;;GASG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,8BAA8B,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,4BAA4B,CAAC;AAEpC,MAAM,MAAM,GAAG,YAAY,CAAC,qBAAqB,CAAC,CAAC;AAEnD,MAAM,CAAC,MAAM,sBAAsB,GAAG,oBAAoB,CAAC;AAC3D,MAAM,CAAC,MAAM,kBAAkB,GAAG,gBAAgB,CAAC;AACnD,MAAM,CAAC,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AACzD,MAAM,CAAC,MAAM,0BAA0B,GAAG,wBAAwB,CAAC;AACnE,MAAM,CAAC,MAAM,0BAA0B,GAAG,wBAAwB,CAAC;AAEnE,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC;AAChD,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAI7C,MAAM,UAAU,qBAAqB,CACnC,KAAc;IAEd,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,WAAW,CAAC;AACrD,CAAC;AAED,MAAM,iBAAiB,GAAG,KAAM,CAAC;AACjC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAClC,MAAM,eAAe,GAAG,GAAG,CAAC;AAmB5B,MAAM,UAAU,4BAA4B,CAAC,KAAc;IACzD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC;QAAE,OAAO,8BAA8B,CAAC;IACrE,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC;AACnE,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,GAAW;IACpC,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC,IAAI,SAAS,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACzC,4EAA4E;IAC5E,sEAAsE;IACtE,IAAI,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC;IACzB,OAAO,GAAG,GAAG,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACvD,GAAG,EAAE,CAAC;IACR,CAAC;IACD,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;QACrC,sBAAsB;QACtB,kBAAkB;QAClB,0BAA0B;QAC1B,0BAA0B;KAC3B,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,CAAC,sBAAsB,CAAC,KAAK,MAAM,CAAC;IAC1D,MAAM,SAAS,GAAG,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAC7C,MAAM,GAAG,GACP,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IACxE,MAAM,SAAS,GAAG,MAAM,CAAC,0BAA0B,CAAC,CAAC;IACrD,OAAO;QACL,OAAO;QACP,GAAG;QACH,SAAS,EAAE,OAAO,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;QACpC,UAAU,EACR,SAAS,KAAK,SAAS;YACrB,CAAC,CAAC,4BAA4B,CAAC,SAAS,CAAC;YACzC,CAAC,CAAC,8BAA8B;QACpC,2DAA2D;QAC3D,UAAU,EAAE,MAAM,CAAC,0BAA0B,CAAC,KAAK,OAAO;KAC3D,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAKxC;IACC,MAAM,GAAG,GAAG,qBAAqB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,KAAK,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,OAAO,GAA2B;QACtC,CAAC,sBAAsB,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;QAC1D,CAAC,kBAAkB,CAAC,EAAE,GAAG;KAC1B,CAAC;IACF,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,CAAC,0BAA0B,CAAC,GAAG,MAAM,CAC1C,4BAA4B,CAAC,KAAK,CAAC,UAAU,CAAC,CAC/C,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,CAAC,0BAA0B,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;IAC5E,CAAC;IACD,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACjC,OAAO,kBAAkB,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACxC,OAAO,CAAC,MAAM,kBAAkB,EAAE,CAAC,CAAC,SAAS,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB;IAC1C,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,qBAAqB,CAAC,CAAC;IACvD,OAAO,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;AACzD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAAyB;IAEzB,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,mCAAmC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,gBAAgB,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;AACtD,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAA2D;IAE3D,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACxE,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,CAAC,MAAM,sBAAsB,EAAE,CAAC,KAAK,WAAW,CAAC;AAC1D,CAAC;AASD,MAAM,OAAO,GAAG,CAAC,KAAc,EAAE,GAAW,EAAU,EAAE,CACtD,OAAO,KAAK,KAAK,QAAQ;IACvB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;IACjD,CAAC,CAAC,EAAE,CAAC;AAET,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,KAAa,EACb,UAAmB,EACnB,MAAoB;IAEpB,8BAA8B,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,MAAM,kBAAkB,EAAE,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;IAC5D,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,wEAAwE;IACxE,yCAAyC;IACzC,MAAM,SAAS,GACb,UAAU,KAAK,SAAS;QACtB,CAAC,CAAC,MAAM,CAAC,UAAU;QACnB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IAErD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC;IAC/C,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAC3C,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1C,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAErE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,iBAAiB,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtD,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,IAAI,MAAM,EAAE,OAAO;QAAE,MAAM,EAAE,CAAC;IAC9B,IAAI,QAA6B,CAAC;IAClC,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE;YAC7B,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACxC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,8BAA8B,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,KAAK,CAAC,CAAC;QACjD,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,yCAAyC,QAAQ,CAAC,MAAM,gDAAgD,CACzG,CAAC;IACJ,CAAC;IACD,IAAI,OAAsC,CAAC;IAC3C,IAAI,CAAC;QACH,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAkC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,SAAS;QACzC,OAAO,CAAC,IAAI,CAAC;YACX,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,GAAG;YACrC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,IAAK,CAAC;YACxB,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,qBAAqB,CAAC;YACpD,GAAG,CAAC,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClE,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,MAAM,IAAI,KAAK;YAAE,MAAM;IACrC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,6BAA6B,CAC3C,OAAe,EACf,OAAmC,EACnC,KAAa;IAEb,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IACzC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CACxB,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAChB,IAAI,KAAK,GAAG,CAAC,KAAK,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,GAAG,GAC3C,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAC3C,EAAE,CACL,CAAC;IACF,OAAO,2BAA2B,KAAK,SAAS,MAAM,CAAC,IAAI,CACzD,MAAM,CACP,6LAA6L,OAAO,EAAE,CAAC;AAC1M,CAAC;AAED,eAAe;IACb,kBAAkB;IAClB,kBAAkB;IAClB,oBAAoB;IACpB,sBAAsB;IACtB,sBAAsB;IACtB,mBAAmB;IACnB,SAAS;IACT,6BAA6B;CAC9B,CAAC"}
+{"version":3,"file":"webSearchService.js","sourceRoot":"","sources":["../../src/services/webSearchService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;;;;;;;GASG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,8BAA8B,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,4BAA4B,CAAC;AAEpC,MAAM,MAAM,GAAG,YAAY,CAAC,qBAAqB,CAAC,CAAC;AAEnD,MAAM,CAAC,MAAM,sBAAsB,GAAG,oBAAoB,CAAC;AAC3D,MAAM,CAAC,MAAM,kBAAkB,GAAG,gBAAgB,CAAC;AACnD,MAAM,CAAC,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AACzD,MAAM,CAAC,MAAM,0BAA0B,GAAG,wBAAwB,CAAC;AACnE,MAAM,CAAC,MAAM,0BAA0B,GAAG,wBAAwB,CAAC;AAEnE,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC;AAChD,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAI7C,MAAM,UAAU,qBAAqB,CACnC,KAAc;IAEd,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,WAAW,CAAC;AACrD,CAAC;AAED,MAAM,iBAAiB,GAAG,KAAM,CAAC;AACjC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAClC,MAAM,eAAe,GAAG,GAAG,CAAC;AAmB5B,MAAM,UAAU,4BAA4B,CAAC,KAAc;IACzD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC;QAAE,OAAO,8BAA8B,CAAC;IACrE,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC;AACnE,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,GAAW;IACpC,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC,IAAI,SAAS,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACzC,4EAA4E;IAC5E,sEAAsE;IACtE,IAAI,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC;IACzB,OAAO,GAAG,GAAG,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACvD,GAAG,EAAE,CAAC;IACR,CAAC;IACD,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;QACrC,sBAAsB;QACtB,kBAAkB;QAClB,0BAA0B;QAC1B,0BAA0B;KAC3B,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,CAAC,sBAAsB,CAAC,KAAK,MAAM,CAAC;IAC1D,MAAM,SAAS,GAAG,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAC7C,MAAM,GAAG,GACP,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IACxE,MAAM,SAAS,GAAG,MAAM,CAAC,0BAA0B,CAAC,CAAC;IACrD,OAAO;QACL,OAAO;QACP,GAAG;QACH,SAAS,EAAE,OAAO,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;QACpC,UAAU,EACR,SAAS,KAAK,SAAS;YACrB,CAAC,CAAC,4BAA4B,CAAC,SAAS,CAAC;YACzC,CAAC,CAAC,8BAA8B;QACpC,2DAA2D;QAC3D,UAAU,EAAE,MAAM,CAAC,0BAA0B,CAAC,KAAK,OAAO;KAC3D,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAKxC;IACC,MAAM,GAAG,GAAG,qBAAqB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,KAAK,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,OAAO,GAA2B;QACtC,CAAC,sBAAsB,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;QAC1D,CAAC,kBAAkB,CAAC,EAAE,GAAG;KAC1B,CAAC;IACF,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,CAAC,0BAA0B,CAAC,GAAG,MAAM,CAC1C,4BAA4B,CAAC,KAAK,CAAC,UAAU,CAAC,CAC/C,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,CAAC,0BAA0B,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;IAC5E,CAAC;IACD,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACjC,OAAO,kBAAkB,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACxC,OAAO,CAAC,MAAM,kBAAkB,EAAE,CAAC,CAAC,SAAS,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB;IAC1C,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,qBAAqB,CAAC,CAAC;IACvD,OAAO,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;AACzD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAAyB;IAEzB,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,mCAAmC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,gBAAgB,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;AACtD,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAwE;IAExE,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,MAAM,SAAS,CAC9B,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAC/D,KAAK,EACL,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,YAAY,EAAE,CACtC,CAAC;IACF,OAAO,QAAQ,CAAC,OAAO,CAAC;AAC1B,CAAC;AASD,MAAM,OAAO,GAAG,CAAC,KAAc,EAAE,GAAW,EAAU,EAAE,CACtD,OAAO,KAAK,KAAK,QAAQ;IACvB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;IACjD,CAAC,CAAC,EAAE,CAAC;AAET,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,KAAa,EACb,UAAmB,EACnB,MAAoB;IAEpB,8BAA8B,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,MAAM,kBAAkB,EAAE,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;IAC5D,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,wEAAwE;IACxE,yCAAyC;IACzC,MAAM,SAAS,GACb,UAAU,KAAK,SAAS;QACtB,CAAC,CAAC,MAAM,CAAC,UAAU;QACnB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IAErD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC;IAC/C,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAC3C,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1C,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAErE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,iBAAiB,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtD,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,IAAI,MAAM,EAAE,OAAO;QAAE,MAAM,EAAE,CAAC;IAC9B,IAAI,QAA6B,CAAC;IAClC,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE;YAC7B,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACxC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,8BAA8B,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,KAAK,CAAC,CAAC;QACjD,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,yCAAyC,QAAQ,CAAC,MAAM,gDAAgD,CACzG,CAAC;IACJ,CAAC;IACD,IAAI,OAAsC,CAAC;IAC3C,IAAI,CAAC;QACH,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAkC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,SAAS;QACzC,OAAO,CAAC,IAAI,CAAC;YACX,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,GAAG;YACrC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,IAAK,CAAC;YACxB,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,qBAAqB,CAAC;YACpD,GAAG,CAAC,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClE,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,MAAM,IAAI,KAAK;YAAE,MAAM;IACrC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,6BAA6B,CAC3C,OAAe,EACf,OAAmC,EACnC,KAAa;IAEb,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IACzC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CACxB,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAChB,IAAI,KAAK,GAAG,CAAC,KAAK,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,GAAG,GAC3C,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAC3C,EAAE,CACL,CAAC;IACF,OAAO,2BAA2B,KAAK,SAAS,MAAM,CAAC,IAAI,CACzD,MAAM,CACP,6LAA6L,OAAO,EAAE,CAAC;AAC1M,CAAC;AAED,eAAe;IACb,kBAAkB;IAClB,kBAAkB;IAClB,oBAAoB;IACpB,sBAAsB;IACtB,sBAAsB;IACtB,mBAAmB;IACnB,SAAS;IACT,6BAA6B;CAC9B,CAAC"}

package/backend/dist/services/websocketTicketService.d.ts

@@ -6,6 +6,8 @@ export interface IssuedWebSocketTicket {
 export interface ConsumedWebSocketTicket {
     userId: string;
     sessionExpiresAt: number;
+    /** Auth session backing the ticket; used to close sockets on revocation. */
+    sessionId?: string;
 }
 export type WebSocketTicketAudience = 'chat' | 'work-terminal';
 export declare class WebSocketTicketRateLimitError extends Error {
@@ -28,7 +30,7 @@ export declare class WebSocketTicketService {
     private readonly operationTimeoutMs;
     private readonly tickets;
     constructor(ttlMs?: number, now?: () => number, coordinatorProvider?: (() => Coordinator) | undefined, operationTimeoutMs?: number);
-    issue(userId: string, sessionExpiresAt: number, audience: WebSocketTicketAudience, resourceId?: string): Promise<IssuedWebSocketTicket>;
+    issue(userId: string, sessionExpiresAt: number, audience: WebSocketTicketAudience, resourceId?: string, sessionId?: string): Promise<IssuedWebSocketTicket>;
     consume(ticket: string, audience: WebSocketTicketAudience, resourceId?: string): Promise<ConsumedWebSocketTicket | null>;
     private consumeLocal;
     private pruneExpired;

package/backend/dist/services/websocketTicketService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"websocketTicketService.d.ts","sourceRoot":"","sources":["../../src/services/websocketTicketService.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mCAAmC,CAAC;AAiBrE,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,MAAM,uBAAuB,GAAG,MAAM,GAAG,eAAe,CAAC;AAE/D,qBAAa,6BAA8B,SAAQ,KAAK;IACtD,cAGC;CACF;AAED,qBAAa,gCAAiC,SAAQ,KAAK;IACzD,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAEzB,YAAY,KAAK,CAAC,EAAE,OAAO,EAI1B;CACF;AAoCD;;;;;GAKG;AACH,qBAAa,sBAAsB;IAI/B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC;IACrC,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IANrC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmC;IAE3D,YACmB,KAAK,SAA0B,EAC/B,GAAG,GAAE,MAAM,MAAiB,EAC5B,mBAAmB,CAAC,GAAE,MAAM,WAAW,aAAA,EACvC,kBAAkB,SAA2C,EAC5E;IAEE,KAAK,CACT,MAAM,EAAE,MAAM,EACd,gBAAgB,EAAE,MAAM,EACxB,QAAQ,EAAE,uBAAuB,EACjC,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,qBAAqB,CAAC,CA6DhC;IAEK,OAAO,CACX,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,uBAAuB,EACjC,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CA8BzC;IAED,OAAO,CAAC,YAAY;IAQpB,OAAO,CAAC,YAAY;IAMpB,OAAO,CAAC,kBAAkB;IAW1B,OAAO,CAAC,iBAAiB;CAa1B;AAED,eAAO,MAAM,sBAAsB,wBAIlC,CAAC"}
+{"version":3,"file":"websocketTicketService.d.ts","sourceRoot":"","sources":["../../src/services/websocketTicketService.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mCAAmC,CAAC;AAkBrE,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,CAAC;IACzB,4EAA4E;IAC5E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,uBAAuB,GAAG,MAAM,GAAG,eAAe,CAAC;AAE/D,qBAAa,6BAA8B,SAAQ,KAAK;IACtD,cAGC;CACF;AAED,qBAAa,gCAAiC,SAAQ,KAAK;IACzD,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAEzB,YAAY,KAAK,CAAC,EAAE,OAAO,EAI1B;CACF;AAqCD;;;;;GAKG;AACH,qBAAa,sBAAsB;IAI/B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC;IACrC,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IANrC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmC;IAE3D,YACmB,KAAK,SAA0B,EAC/B,GAAG,GAAE,MAAM,MAAiB,EAC5B,mBAAmB,CAAC,GAAE,MAAM,WAAW,aAAA,EACvC,kBAAkB,SAA2C,EAC5E;IAEE,KAAK,CACT,MAAM,EAAE,MAAM,EACd,gBAAgB,EAAE,MAAM,EACxB,QAAQ,EAAE,uBAAuB,EACjC,UAAU,CAAC,EAAE,MAAM,EACnB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,qBAAqB,CAAC,CA8DhC;IAEK,OAAO,CACX,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,uBAAuB,EACjC,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CA+BzC;IAED,OAAO,CAAC,YAAY;IAQpB,OAAO,CAAC,YAAY;IAMpB,OAAO,CAAC,kBAAkB;IAW1B,OAAO,CAAC,iBAAiB;CAa1B;AAED,eAAO,MAAM,sBAAsB,wBAIlC,CAAC"}

package/backend/dist/services/websocketTicketService.js

@@ -51,6 +51,7 @@ const isTicketRecord = (value) => {
         (record.audience === 'chat' || record.audience === 'work-terminal') &&
         (record.resourceId === undefined ||
             typeof record.resourceId === 'string') &&
+        (record.sessionId === undefined || typeof record.sessionId === 'string') &&
         Number.isSafeInteger(record.expiresAt) &&
         Number.isSafeInteger(record.sessionExpiresAt) &&
         Number.isSafeInteger(record.issuedAt));
@@ -69,7 +70,7 @@ export class WebSocketTicketService {
         this.operationTimeoutMs = operationTimeoutMs;
         this.tickets = new Map();
     }
-    async issue(userId, sessionExpiresAt, audience, resourceId) {
+    async issue(userId, sessionExpiresAt, audience, resourceId, sessionId) {
         const normalizedUserId = userId.trim();
         if (!normalizedUserId) {
             throw new Error('A user ID is required to issue a WebSocket ticket.');
@@ -87,6 +88,7 @@ export class WebSocketTicketService {
             userId: normalizedUserId,
             audience,
             ...(resourceId?.trim() ? { resourceId: resourceId.trim() } : {}),
+            ...(sessionId?.trim() ? { sessionId: sessionId.trim() } : {}),
             expiresAt,
             sessionExpiresAt,
             issuedAt: now,
@@ -139,6 +141,7 @@ export class WebSocketTicketService {
         return {
             userId: record.userId,
             sessionExpiresAt: record.sessionExpiresAt,
+            ...(record.sessionId ? { sessionId: record.sessionId } : {}),
         };
     }
     consumeLocal(digest) {

package/backend/dist/services/websocketTicketService.js.map

@@ -1 +1 @@
-{"version":3,"file":"websocketTicketService.js","sourceRoot":"","sources":["../../src/services/websocketTicketService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAC;AACrE,OAAO,EACL,wCAAwC,EACxC,uBAAuB,GACxB,MAAM,6CAA6C,CAAC;AAGrD,MAAM,qBAAqB,GAAG,KAAM,CAAC;AACrC,MAAM,iBAAiB,GAAG,KAAM,CAAC;AACjC,MAAM,gCAAgC,GAAG,CAAC,CAAC;AAC3C,MAAM,uBAAuB,GAAG,KAAM,CAAC;AACvC,MAAM,mCAAmC,GAAG,GAAG,CAAC;AAuBhD,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IACtD;QACE,KAAK,CAAC,4CAA4C,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC9C,CAAC;CACF;AAED,MAAM,OAAO,gCAAiC,SAAQ,KAAK;IAGzD,YAAY,KAAe;QACzB,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAC;QAC/C,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;CACF;AAED,MAAM,eAAe,GAAG,CACtB,KAAyB,EACzB,QAAgB,EACR,EAAE;IACV,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAChD,OAAO,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;AACpE,CAAC,CAAC;AAEF,MAAM,qBAAqB,GAAG,GAAW,EAAE,CACzC,IAAI,CAAC,GAAG,CACN,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,qBAAqB,CAAC,EAC3E,iBAAiB,CAClB,CAAC;AAEJ,MAAM,YAAY,GAAG,CAAC,MAAc,EAAU,EAAE,CAC9C,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAE1D,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAU,EAAE,CAAC,oBAAoB,MAAM,EAAE,CAAC;AAE1E,MAAM,cAAc,GAAG,CAAC,KAAc,EAAyB,EAAE;IAC/D,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,MAAM,GAAG,KAA8B,CAAC;IAC9C,OAAO,CACL,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;QACjC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QACxB,CAAC,MAAM,CAAC,QAAQ,KAAK,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,eAAe,CAAC;QACnE,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS;YAC9B,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC;QACxC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC;QACtC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,gBAAgB,CAAC;QAC7C,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CACtC,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,OAAO,sBAAsB;IAGjC,YACmB,KAAK,GAAG,qBAAqB,EAAE,EAC/B,GAAG,GAAiB,IAAI,CAAC,GAAG,EAC5B,mBAAuC,EACvC,kBAAkB,GAAG,wCAAwC;QAH7D,UAAK,GAAL,KAAK,CAA0B;QAC/B,QAAG,GAAH,GAAG,CAAyB;QAC5B,wBAAmB,GAAnB,mBAAmB,CAAoB;QACvC,uBAAkB,GAAlB,kBAAkB,CAA2C;QAN/D,YAAO,GAAG,IAAI,GAAG,EAAwB,CAAC;IAOxD,CAAC;IAEJ,KAAK,CAAC,KAAK,CACT,MAAc,EACd,gBAAwB,EACxB,QAAiC,EACjC,UAAmB;QAEnB,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QACvC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,gBAAgB,CAAC,IAAI,gBAAgB,IAAI,GAAG,EAAE,CAAC;YACvE,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,KAAK,eAAe,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAiB;YAC3B,MAAM,EAAE,gBAAgB;YACxB,QAAQ;YACR,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,SAAS;YACT,gBAAgB;YAChB,QAAQ,EAAE,GAAG;SACd,CAAC;QACF,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,WAAW,GAAG,IAAI,CAAC,mBAAmB,EAAE,EAAE,CAAC;QACjD,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,GAAG,MAAM,uBAAuB,CAC5D,OAAO,CAAC,GAAG,CAAC;gBACV,WAAW,CAAC,gBAAgB,CAC1B,yBAAyB,gBAAgB,EAAE,EAC3C,mCAAmC,EACnC,IAAI,CAAC,KAAK,CACX;gBACD,WAAW,CAAC,gBAAgB,CAC1B,yBAAyB,EACzB,uBAAuB,EACvB,IAAI,CAAC,KAAK,CACX;aACF,CAAC,EACF,IAAI,CAAC,kBAAkB,CACxB,CAAC;YACF,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;gBAC/C,MAAM,IAAI,6BAA6B,EAAE,CAAC;YAC5C,CAAC;YACD,MAAM,uBAAuB,CAC3B,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,GAAG,GAAG,CAAC,EAC/D,IAAI,CAAC,kBAAkB,CACxB,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;YACvB,IAAI,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;YAC1C,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACzB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACnC,CAAC;QAED,OAAO;YACL,MAAM;YACN,SAAS,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;SAC7C,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CACX,MAAc,EACd,QAAiC,EACjC,UAAmB;QAEnB,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QACvC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,gBAAgB,CAAC;YAAE,OAAO,IAAI,CAAC;QAE/D,MAAM,MAAM,GAAG,YAAY,CAAC,gBAAgB,CAAC,CAAC;QAC9C,MAAM,WAAW,GAAG,IAAI,CAAC,mBAAmB,EAAE,EAAE,CAAC;QACjD,IAAI,MAA2B,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,GAAG,WAAW;gBAClB,CAAC,CAAC,MAAM,uBAAuB,CAC3B,WAAW,CAAC,YAAY,CAAe,QAAQ,CAAC,MAAM,CAAC,CAAC,EACxD,IAAI,CAAC,kBAAkB,CACxB;gBACH,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,gCAAgC,CAAC,KAAK,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACzC,IACE,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;YAC9B,MAAM,CAAC,QAAQ,KAAK,QAAQ;YAC5B,MAAM,CAAC,UAAU,KAAK,UAAU,EAAE,IAAI,EAAE,EACxC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO;YACL,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;SAC1C,CAAC;IACJ,CAAC;IAEO,YAAY,CAAC,MAAc;QACjC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;QAChD,yEAAyE;QACzE,kEAAkE;QAClE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5B,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,YAAY,CAAC,GAAW;QAC9B,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC5C,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAEO,kBAAkB,CAAC,MAAc;QACvC,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;aACzC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC;aAChD,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;QAEjE,OAAO,QAAQ,CAAC,MAAM,IAAI,gCAAgC,EAAE,CAAC;YAC3D,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC;YAChC,IAAI,MAAM;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IAEO,iBAAiB;QACvB,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,uBAAuB;YAAE,OAAO;QAExD,IAAI,YAAgC,CAAC;QACrC,IAAI,cAAc,GAAG,MAAM,CAAC,iBAAiB,CAAC;QAC9C,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC5C,IAAI,MAAM,CAAC,QAAQ,GAAG,cAAc,EAAE,CAAC;gBACrC,YAAY,GAAG,MAAM,CAAC;gBACtB,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC;YACnC,CAAC;QACH,CAAC;QACD,IAAI,YAAY;YAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACtD,CAAC;CACF;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,sBAAsB,CAC9D,qBAAqB,EAAE,EACvB,IAAI,CAAC,GAAG,EACR,cAAc,CACf,CAAC"}
+{"version":3,"file":"websocketTicketService.js","sourceRoot":"","sources":["../../src/services/websocketTicketService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAC;AACrE,OAAO,EACL,wCAAwC,EACxC,uBAAuB,GACxB,MAAM,6CAA6C,CAAC;AAGrD,MAAM,qBAAqB,GAAG,KAAM,CAAC;AACrC,MAAM,iBAAiB,GAAG,KAAM,CAAC;AACjC,MAAM,gCAAgC,GAAG,CAAC,CAAC;AAC3C,MAAM,uBAAuB,GAAG,KAAM,CAAC;AACvC,MAAM,mCAAmC,GAAG,GAAG,CAAC;AA0BhD,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IACtD;QACE,KAAK,CAAC,4CAA4C,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC9C,CAAC;CACF;AAED,MAAM,OAAO,gCAAiC,SAAQ,KAAK;IAGzD,YAAY,KAAe;QACzB,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAC;QAC/C,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;CACF;AAED,MAAM,eAAe,GAAG,CACtB,KAAyB,EACzB,QAAgB,EACR,EAAE;IACV,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAChD,OAAO,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;AACpE,CAAC,CAAC;AAEF,MAAM,qBAAqB,GAAG,GAAW,EAAE,CACzC,IAAI,CAAC,GAAG,CACN,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,qBAAqB,CAAC,EAC3E,iBAAiB,CAClB,CAAC;AAEJ,MAAM,YAAY,GAAG,CAAC,MAAc,EAAU,EAAE,CAC9C,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAE1D,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAU,EAAE,CAAC,oBAAoB,MAAM,EAAE,CAAC;AAE1E,MAAM,cAAc,GAAG,CAAC,KAAc,EAAyB,EAAE;IAC/D,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,MAAM,GAAG,KAA8B,CAAC;IAC9C,OAAO,CACL,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;QACjC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QACxB,CAAC,MAAM,CAAC,QAAQ,KAAK,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,eAAe,CAAC;QACnE,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS;YAC9B,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC;QACxC,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC;QACxE,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC;QACtC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,gBAAgB,CAAC;QAC7C,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CACtC,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,OAAO,sBAAsB;IAGjC,YACmB,KAAK,GAAG,qBAAqB,EAAE,EAC/B,GAAG,GAAiB,IAAI,CAAC,GAAG,EAC5B,mBAAuC,EACvC,kBAAkB,GAAG,wCAAwC;QAH7D,UAAK,GAAL,KAAK,CAA0B;QAC/B,QAAG,GAAH,GAAG,CAAyB;QAC5B,wBAAmB,GAAnB,mBAAmB,CAAoB;QACvC,uBAAkB,GAAlB,kBAAkB,CAA2C;QAN/D,YAAO,GAAG,IAAI,GAAG,EAAwB,CAAC;IAOxD,CAAC;IAEJ,KAAK,CAAC,KAAK,CACT,MAAc,EACd,gBAAwB,EACxB,QAAiC,EACjC,UAAmB,EACnB,SAAkB;QAElB,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QACvC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,gBAAgB,CAAC,IAAI,gBAAgB,IAAI,GAAG,EAAE,CAAC;YACvE,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,KAAK,eAAe,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAiB;YAC3B,MAAM,EAAE,gBAAgB;YACxB,QAAQ;YACR,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,SAAS;YACT,gBAAgB;YAChB,QAAQ,EAAE,GAAG;SACd,CAAC;QACF,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,WAAW,GAAG,IAAI,CAAC,mBAAmB,EAAE,EAAE,CAAC;QACjD,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,GAAG,MAAM,uBAAuB,CAC5D,OAAO,CAAC,GAAG,CAAC;gBACV,WAAW,CAAC,gBAAgB,CAC1B,yBAAyB,gBAAgB,EAAE,EAC3C,mCAAmC,EACnC,IAAI,CAAC,KAAK,CACX;gBACD,WAAW,CAAC,gBAAgB,CAC1B,yBAAyB,EACzB,uBAAuB,EACvB,IAAI,CAAC,KAAK,CACX;aACF,CAAC,EACF,IAAI,CAAC,kBAAkB,CACxB,CAAC;YACF,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;gBAC/C,MAAM,IAAI,6BAA6B,EAAE,CAAC;YAC5C,CAAC;YACD,MAAM,uBAAuB,CAC3B,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,GAAG,GAAG,CAAC,EAC/D,IAAI,CAAC,kBAAkB,CACxB,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;YACvB,IAAI,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;YAC1C,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACzB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACnC,CAAC;QAED,OAAO;YACL,MAAM;YACN,SAAS,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;SAC7C,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CACX,MAAc,EACd,QAAiC,EACjC,UAAmB;QAEnB,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QACvC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,gBAAgB,CAAC;YAAE,OAAO,IAAI,CAAC;QAE/D,MAAM,MAAM,GAAG,YAAY,CAAC,gBAAgB,CAAC,CAAC;QAC9C,MAAM,WAAW,GAAG,IAAI,CAAC,mBAAmB,EAAE,EAAE,CAAC;QACjD,IAAI,MAA2B,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,GAAG,WAAW;gBAClB,CAAC,CAAC,MAAM,uBAAuB,CAC3B,WAAW,CAAC,YAAY,CAAe,QAAQ,CAAC,MAAM,CAAC,CAAC,EACxD,IAAI,CAAC,kBAAkB,CACxB;gBACH,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,gCAAgC,CAAC,KAAK,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACzC,IACE,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;YAC9B,MAAM,CAAC,QAAQ,KAAK,QAAQ;YAC5B,MAAM,CAAC,UAAU,KAAK,UAAU,EAAE,IAAI,EAAE,EACxC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO;YACL,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7D,CAAC;IACJ,CAAC;IAEO,YAAY,CAAC,MAAc;QACjC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;QAChD,yEAAyE;QACzE,kEAAkE;QAClE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5B,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,YAAY,CAAC,GAAW;QAC9B,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC5C,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAEO,kBAAkB,CAAC,MAAc;QACvC,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;aACzC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC;aAChD,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;QAEjE,OAAO,QAAQ,CAAC,MAAM,IAAI,gCAAgC,EAAE,CAAC;YAC3D,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC;YAChC,IAAI,MAAM;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IAEO,iBAAiB;QACvB,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,uBAAuB;YAAE,OAAO;QAExD,IAAI,YAAgC,CAAC;QACrC,IAAI,cAAc,GAAG,MAAM,CAAC,iBAAiB,CAAC;QAC9C,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC5C,IAAI,MAAM,CAAC,QAAQ,GAAG,cAAc,EAAE,CAAC;gBACrC,YAAY,GAAG,MAAM,CAAC;gBACtB,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC;YACnC,CAAC;QACH,CAAC;QACD,IAAI,YAAY;YAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACtD,CAAC;CACF;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,sBAAsB,CAC9D,qBAAqB,EAAE,EACvB,IAAI,CAAC,GAAG,EACR,cAAc,CACf,CAAC"}

package/backend/dist/services/workAccessService.d.ts

@@ -9,6 +9,7 @@ export declare function setWorkAccessMode(mode: WorkAccessMode): Promise<void>;
  * active accounts may when the mode is opened to all users.
  */
 export declare function userHasWorkAccess(user: {
+    id?: string;
     role?: string;
     status?: string;
 }): Promise<boolean>;

package/backend/dist/services/workAccessService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workAccessService.d.ts","sourceRoot":"","sources":["../../src/services/workAccessService.ts"],"names":[],"mappings":"AA+BA,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,WAAW,CAAC;AAEpD,eAAO,MAAM,iBAAiB,EAAE,SAAS,cAAc,EAGtD,CAAC;AAEF,eAAO,MAAM,oBAAoB,qBAAqB,CAAC;AAEvD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,cAAc,CAKxE;AAED,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,cAAc,CAAC,CAGjE;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAK3E;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE;IAC5C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,OAAO,CAAC,CAInB"}
+{"version":3,"file":"workAccessService.d.ts","sourceRoot":"","sources":["../../src/services/workAccessService.ts"],"names":[],"mappings":"AA+BA,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,WAAW,CAAC;AAEpD,eAAO,MAAM,iBAAiB,EAAE,SAAS,cAAc,EAGtD,CAAC;AAEF,eAAO,MAAM,oBAAoB,qBAAqB,CAAC;AAEvD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,cAAc,CAKxE;AAED,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,cAAc,CAAC,CAGjE;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAK3E;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE;IAC5C,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,OAAO,CAAC,CAQnB"}

package/backend/dist/services/workAccessService.js

@@ -50,10 +50,8 @@ export async function setWorkAccessMode(mode) {
  * active accounts may when the mode is opened to all users.
  */
 export async function userHasWorkAccess(user) {
-    if (user.status !== undefined && user.status !== 'active')
-        return false;
-    if (user.role === 'admin')
-        return true;
-    return (await getWorkAccessMode()) === 'all-users';
+    const { authorize } = await import('./authorizationService.js');
+    const decision = await authorize({ userId: user.id ?? '', role: user.role, status: user.status }, 'use', { type: 'feature', id: 'work' });
+    return decision.allowed;
 }
 //# sourceMappingURL=workAccessService.js.map

package/backend/dist/services/workAccessService.js.map

@@ -1 +1 @@
-{"version":3,"file":"workAccessService.js","sourceRoot":"","sources":["../../src/services/workAccessService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAIhF,MAAM,CAAC,MAAM,iBAAiB,GAA8B;IAC1D,QAAQ;IACR,WAAW;CACZ,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AAEvD,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACxB,iBAAuC,CAAC,QAAQ,CAAC,KAAK,CAAC,CACzD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,oBAAoB,CAAC,CAAC;IAC3D,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;AACpD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAoB;IAC1D,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,gBAAgB,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC;AACrD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAGvC;IACC,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACxE,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,CAAC,MAAM,iBAAiB,EAAE,CAAC,KAAK,WAAW,CAAC;AACrD,CAAC"}
+{"version":3,"file":"workAccessService.js","sourceRoot":"","sources":["../../src/services/workAccessService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAIhF,MAAM,CAAC,MAAM,iBAAiB,GAA8B;IAC1D,QAAQ;IACR,WAAW;CACZ,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AAEvD,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACxB,iBAAuC,CAAC,QAAQ,CAAC,KAAK,CAAC,CACzD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,oBAAoB,CAAC,CAAC;IAC3D,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;AACpD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAoB;IAC1D,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,gBAAgB,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC;AACrD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAIvC;IACC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,MAAM,SAAS,CAC9B,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAC/D,KAAK,EACL,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,CAChC,CAAC;IACF,OAAO,QAAQ,CAAC,OAAO,CAAC;AAC1B,CAAC"}