mindoodb 0.0.2 → 0.0.4

package/dist/node/server/MindooDBServer.js

@@ -0,0 +1,1040 @@
+"use strict";
+/**
+ * MindooDB Server - Express HTTP server implementing the sync API.
+ *
+ * Security features:
+ * - Capabilities-based system admin authorization via config.json
+ * - Challenge/response (Ed25519) authentication for /system/* endpoints
+ * - JWT-based session management for system admins
+ * - Input validation on all identifiers (path traversal prevention)
+ * - Rate limiting per endpoint tier
+ * - Security headers (helmet) and CORS
+ * - Error sanitization (no internal details leaked)
+ * - Request size limits and timeouts
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MindooDBServer = void 0;
+const express_1 = __importStar(require("express"));
+const https_1 = __importDefault(require("https"));
+const path_1 = __importDefault(require("path"));
+const fs_1 = require("fs");
+const helmet_1 = __importDefault(require("helmet"));
+const cors_1 = __importDefault(require("cors"));
+const express_rate_limit_1 = __importDefault(require("express-rate-limit"));
+const types_1 = require("../../core/appendonlystores/network/types");
+const TenantManager_1 = require("./TenantManager");
+const CapabilityMatcher_1 = require("./CapabilityMatcher");
+const SystemAdminAuth_1 = require("./SystemAdminAuth");
+const config_1 = require("./config");
+const SystemIpAllowlist_1 = require("./SystemIpAllowlist");
+const validation_1 = require("./validation");
+class MindooDBServer {
+    constructor(dataDir, serverPassword, staticDir, config, configPath) {
+        this.app = (0, express_1.default)();
+        this.tenantManager = new TenantManager_1.TenantManager(dataDir, serverPassword);
+        this.staticDir = staticDir;
+        this.configPath = configPath ?? path_1.default.join(dataDir, "config.json");
+        this.serverConfig = config ?? { capabilities: {} };
+        this.capabilityMatcher = new CapabilityMatcher_1.CapabilityMatcher(this.serverConfig);
+        const cryptoAdapter = this.tenantManager.getCryptoAdapter();
+        this.systemAdminAuth = new SystemAdminAuth_1.SystemAdminAuthService(cryptoAdapter, this.serverConfig);
+        const principalCount = Object.values(this.serverConfig.capabilities).reduce((sum, arr) => sum + arr.length, 0);
+        if (principalCount === 0) {
+            console.log(`[MindooDBServer] WARNING: No system admin principals configured. All /system/* endpoints are locked down.`);
+        }
+        else {
+            console.log(`[MindooDBServer] System admin auth configured with ${principalCount} principal(s)`);
+        }
+        this.setupMiddleware();
+        this.setupRoutes();
+    }
+    getApp() {
+        return this.app;
+    }
+    getTenantManager() {
+        return this.tenantManager;
+    }
+    getSystemAdminAuth() {
+        return this.systemAdminAuth;
+    }
+    getServerConfig() {
+        return this.serverConfig;
+    }
+    getConfigPath() {
+        return this.configPath;
+    }
+    reloadConfig(newConfig) {
+        this.serverConfig = newConfig;
+        this.capabilityMatcher.reload(newConfig);
+        this.systemAdminAuth.reloadPrincipals(newConfig);
+    }
+    listen(port) {
+        const server = this.app.listen(port, () => {
+            console.log(`[MindooDBServer] Listening on port ${port}`);
+        });
+        server.setTimeout(30000);
+    }
+    listenTls(port, certPath, keyPath) {
+        const tlsOptions = {
+            cert: (0, fs_1.readFileSync)(certPath),
+            key: (0, fs_1.readFileSync)(keyPath),
+        };
+        const server = https_1.default.createServer(tlsOptions, this.app);
+        server.listen(port, () => {
+            console.log(`[MindooDBServer] Listening on HTTPS port ${port}`);
+        });
+        server.setTimeout(30000);
+    }
+    setupMiddleware() {
+        this.app.use((0, helmet_1.default)());
+        const corsOrigin = process.env.MINDOODB_CORS_ORIGIN;
+        this.app.use((0, cors_1.default)({
+            origin: corsOrigin || false,
+            methods: ["GET", "POST", "PUT", "DELETE"],
+            allowedHeaders: ["Content-Type", "Authorization"],
+        }));
+        this.app.use((0, express_rate_limit_1.default)({
+            windowMs: 60000,
+            max: 500,
+            standardHeaders: true,
+            legacyHeaders: false,
+            message: { error: "Too many requests, please try again later" },
+        }));
+        this.app.use(express_1.default.json({ limit: "5mb" }));
+        this.app.use((req, res, next) => {
+            console.log(`[${new Date().toISOString()}] ${req.method} ${req.path}`);
+            next();
+        });
+    }
+    setupRoutes() {
+        // Root redirect
+        this.app.get("/", (req, res) => {
+            if (this.staticDir && (0, fs_1.existsSync)(path_1.default.join(this.staticDir, "index.html"))) {
+                res.redirect(302, "/statics/index.html");
+            }
+            else {
+                res.status(404).json({ error: "Not found" });
+            }
+        });
+        this.app.get("/health", (req, res) => {
+            res.json({ status: "ok", timestamp: Date.now() });
+        });
+        this.app.get("/.well-known/mindoodb-server-info", (req, res) => {
+            const info = this.tenantManager.getServerPublicInfo();
+            if (!info) {
+                res.status(503).json({ error: "Server identity not initialized" });
+                return;
+            }
+            res.json(info);
+        });
+        // Static file serving
+        if (this.staticDir) {
+            const resolvedStaticDir = path_1.default.resolve(this.staticDir);
+            this.app.use("/statics", (req, res, next) => {
+                if (req.path.includes("..")) {
+                    res.status(400).json({ error: "Invalid path" });
+                    return;
+                }
+                next();
+            }, express_1.default.static(resolvedStaticDir, { dotfiles: "deny", etag: true }));
+            console.log(`[MindooDBServer] Serving static files from ${resolvedStaticDir} at /statics/`);
+        }
+        // System admin routes (replaces former /admin/*)
+        const systemIpRaw = (0, SystemIpAllowlist_1.readSystemIpAllowListFromEnv)();
+        if (!(0, SystemIpAllowlist_1.isSystemIpAllowListDisabled)(systemIpRaw)) {
+            console.log(`[MindooDBServer] MINDOODB_ADMIN_ALLOWED_IPS is set — /system/* limited to: ${systemIpRaw}`);
+        }
+        const systemRateLimit = (0, express_rate_limit_1.default)({
+            windowMs: 60000,
+            max: 30,
+            standardHeaders: true,
+            legacyHeaders: false,
+            message: { error: "Too many system requests, please try again later" },
+        });
+        const systemRouter = (0, express_1.Router)();
+        this.setupSystemRoutes(systemRouter);
+        this.app.use("/system", SystemIpAllowlist_1.systemIpAllowlistMiddleware, systemRateLimit, systemRouter);
+        // Tenant-scoped routes
+        this.app.use("/:tenantId", this.tenantMiddleware.bind(this), this.createTenantRouter());
+        this.app.use(this.errorHandler.bind(this));
+    }
+    // ==================== System Admin Auth Middleware ====================
+    /**
+     * JWT-based middleware for /system/* routes (excluding /system/auth/*).
+     * Extracts and validates the bearer token, then checks capabilities
+     * for the current (method, path, username, publicsignkey).
+     */
+    async systemAdminMiddleware(req, res, next) {
+        const auth = req.headers.authorization;
+        if (!auth || !auth.startsWith("Bearer ")) {
+            res.status(401).json({ error: "Missing or invalid Authorization header" });
+            return;
+        }
+        const token = auth.substring(7);
+        const payload = await this.systemAdminAuth.validateToken(token);
+        if (!payload) {
+            res.status(401).json({ error: "Invalid or expired token" });
+            return;
+        }
+        // The original request path relative to the /system mount is in req.path,
+        // but we need the full path for capability matching.
+        const fullPath = `/system${req.path}`;
+        const method = req.method.toUpperCase();
+        if (!this.capabilityMatcher.isAuthorized(method, fullPath, payload.sub, payload.publicsignkey)) {
+            res.status(403).json({ error: "Forbidden: insufficient capabilities" });
+            return;
+        }
+        req.systemAdmin = {
+            username: payload.sub,
+            publicsignkey: payload.publicsignkey,
+        };
+        next();
+    }
+    // ==================== Tenant Middleware ====================
+    tenantMiddleware(req, res, next) {
+        const rawTenantId = req.params.tenantId?.toLowerCase();
+        if (!rawTenantId) {
+            res.status(400).json({ error: "Tenant ID required" });
+            return;
+        }
+        try {
+            (0, validation_1.validateTenantIdFormat)(rawTenantId);
+        }
+        catch {
+            res.status(400).json({ error: "Invalid tenant ID format" });
+            return;
+        }
+        if (!this.tenantManager.tenantExists(rawTenantId)) {
+            res.status(404).json({ error: "Tenant not found" });
+            return;
+        }
+        req.tenantId = rawTenantId;
+        next();
+    }
+    // ==================== System Routes ====================
+    setupSystemRoutes(router) {
+        // Auth endpoints — no JWT required (these *produce* JWTs)
+        const authRateLimit = (0, express_rate_limit_1.default)({
+            windowMs: 60000,
+            max: 20,
+            standardHeaders: true,
+            legacyHeaders: false,
+            message: { error: "Too many authentication attempts, please try again later" },
+        });
+        router.post("/auth/challenge", authRateLimit, this.handleSystemChallenge.bind(this));
+        router.post("/auth/authenticate", authRateLimit, this.handleSystemAuthenticate.bind(this));
+        // All other /system/* routes require JWT + capability check
+        const authMiddleware = this.systemAdminMiddleware.bind(this);
+        // Tenant CRUD
+        router.get("/tenants", authMiddleware, (req, res) => {
+            try {
+                const tenants = this.tenantManager.listTenants();
+                const response = { tenants };
+                res.json(response);
+            }
+            catch (error) {
+                console.error("[MindooDBServer] Error listing tenants:", error);
+                res.status(500).json({ error: "Failed to list tenants" });
+            }
+        });
+        router.post("/tenants/:tenantId", authMiddleware, (req, res) => {
+            try {
+                const tenantId = req.params.tenantId.toLowerCase();
+                try {
+                    (0, validation_1.validateTenantId)(tenantId);
+                }
+                catch (validationError) {
+                    res.status(400).json({
+                        error: validationError instanceof validation_1.ValidationError
+                            ? validationError.message
+                            : "Invalid tenantId format",
+                    });
+                    return;
+                }
+                const request = {
+                    ...req.body,
+                    tenantId,
+                };
+                if (!request.adminSigningPublicKey) {
+                    res.status(400).json({ error: "adminSigningPublicKey is required" });
+                    return;
+                }
+                if (!request.adminEncryptionPublicKey) {
+                    res.status(400).json({ error: "adminEncryptionPublicKey is required" });
+                    return;
+                }
+                if (request.adminUsername !== undefined) {
+                    (0, validation_1.validateUsername)(request.adminUsername);
+                }
+                (0, validation_1.validateStringLength)(request.adminSigningPublicKey, validation_1.MAX_PEM_KEY_LENGTH, "adminSigningPublicKey");
+                (0, validation_1.validateStringLength)(request.adminEncryptionPublicKey, validation_1.MAX_PEM_KEY_LENGTH, "adminEncryptionPublicKey");
+                if (this.tenantManager.tenantExists(tenantId)) {
+                    res.status(409).json({ error: `Tenant ${tenantId} already exists` });
+                    return;
+                }
+                const context = this.tenantManager.registerTenant(request);
+                const response = {
+                    success: true,
+                    tenantId: context.tenantId,
+                    message: `Tenant ${context.tenantId} registered successfully`,
+                };
+                res.status(201).json(response);
+            }
+            catch (error) {
+                if (error instanceof validation_1.ValidationError) {
+                    res.status(400).json({ error: error.message });
+                    return;
+                }
+                console.error("[MindooDBServer] Error registering tenant:", error);
+                res.status(500).json({ error: "Failed to register tenant" });
+            }
+        });
+        router.put("/tenants/:tenantId", authMiddleware, (req, res) => {
+            try {
+                const tenantId = req.params.tenantId.toLowerCase();
+                try {
+                    (0, validation_1.validateTenantId)(tenantId);
+                }
+                catch {
+                    res.status(400).json({ error: "Invalid tenantId format" });
+                    return;
+                }
+                if (!this.tenantManager.tenantExists(tenantId)) {
+                    res.status(404).json({ error: "Tenant not found" });
+                    return;
+                }
+                this.tenantManager.updateTenantConfig(tenantId, req.body);
+                res.json({ success: true, message: `Tenant ${tenantId} updated` });
+            }
+            catch (error) {
+                if (error instanceof validation_1.ValidationError) {
+                    res.status(400).json({ error: error.message });
+                    return;
+                }
+                console.error("[MindooDBServer] Error updating tenant:", error);
+                res.status(500).json({ error: "Failed to update tenant" });
+            }
+        });
+        router.delete("/tenants/:tenantId", authMiddleware, (req, res) => {
+            try {
+                const tenantId = req.params.tenantId.toLowerCase();
+                try {
+                    (0, validation_1.validateTenantId)(tenantId);
+                }
+                catch {
+                    res.status(400).json({ error: "Invalid tenantId format" });
+                    return;
+                }
+                if (!this.tenantManager.tenantExists(tenantId)) {
+                    res.status(404).json({ error: "Tenant not found" });
+                    return;
+                }
+                this.tenantManager.removeTenant(tenantId);
+                res.json({ success: true, message: `Tenant ${tenantId} removed` });
+            }
+            catch (error) {
+                console.error("[MindooDBServer] Error removing tenant:", error);
+                res.status(500).json({ error: "Failed to remove tenant" });
+            }
+        });
+        // Trusted server management
+        router.get("/trusted-servers", authMiddleware, (req, res) => {
+            try {
+                res.json({ servers: this.tenantManager.listTrustedServers() });
+            }
+            catch (error) {
+                console.error("[MindooDBServer] Error listing trusted servers:", error);
+                res.status(500).json({ error: "Failed to list trusted servers" });
+            }
+        });
+        router.post("/trusted-servers", authMiddleware, (req, res) => {
+            try {
+                const { name, signingPublicKey, encryptionPublicKey } = req.body;
+                if (!name || !signingPublicKey || !encryptionPublicKey) {
+                    res.status(400).json({ error: "name, signingPublicKey, and encryptionPublicKey are required" });
+                    return;
+                }
+                (0, validation_1.validateStringLength)(name, 256, "name");
+                (0, validation_1.validateStringLength)(signingPublicKey, validation_1.MAX_PEM_KEY_LENGTH, "signingPublicKey");
+                (0, validation_1.validateStringLength)(encryptionPublicKey, validation_1.MAX_PEM_KEY_LENGTH, "encryptionPublicKey");
+                const server = { name, signingPublicKey, encryptionPublicKey };
+                this.tenantManager.addTrustedServer(server);
+                res.status(201).json({ success: true, message: `Trusted server "${name}" added` });
+            }
+            catch (error) {
+                if (error instanceof validation_1.ValidationError) {
+                    res.status(400).json({ error: error.message });
+                    return;
+                }
+                if (error instanceof Error && error.message.includes("already exists")) {
+                    res.status(409).json({ error: error.message });
+                    return;
+                }
+                console.error("[MindooDBServer] Error adding trusted server:", error);
+                res.status(500).json({ error: "Failed to add trusted server" });
+            }
+        });
+        router.delete("/trusted-servers/:serverName", authMiddleware, (req, res) => {
+            try {
+                const serverName = req.params.serverName;
+                (0, validation_1.validateStringLength)(serverName, 256, "serverName");
+                const removed = this.tenantManager.removeTrustedServer(serverName);
+                if (!removed) {
+                    res.status(404).json({ error: "Trusted server not found" });
+                    return;
+                }
+                res.json({ success: true, message: `Trusted server "${serverName}" removed` });
+            }
+            catch (error) {
+                if (error instanceof validation_1.ValidationError) {
+                    res.status(400).json({ error: error.message });
+                    return;
+                }
+                console.error("[MindooDBServer] Error removing trusted server:", error);
+                res.status(500).json({ error: "Failed to remove trusted server" });
+            }
+        });
+        // Per-tenant sync server management
+        router.get("/tenants/:tenantId/sync-servers", authMiddleware, (req, res) => {
+            try {
+                const tenantId = req.params.tenantId.toLowerCase();
+                try {
+                    (0, validation_1.validateTenantId)(tenantId);
+                }
+                catch {
+                    res.status(400).json({ error: "Invalid tenantId format" });
+                    return;
+                }
+                if (!this.tenantManager.tenantExists(tenantId)) {
+                    res.status(404).json({ error: "Tenant not found" });
+                    return;
+                }
+                const servers = this.tenantManager.getTenantSyncServers(tenantId);
+                res.json({ servers });
+            }
+            catch (error) {
+                console.error("[MindooDBServer] Error listing sync servers:", error);
+                res.status(500).json({ error: "Failed to list sync servers" });
+            }
+        });
+        router.post("/tenants/:tenantId/sync-servers", authMiddleware, (req, res) => {
+            try {
+                const tenantId = req.params.tenantId.toLowerCase();
+                try {
+                    (0, validation_1.validateTenantId)(tenantId);
+                }
+                catch {
+                    res.status(400).json({ error: "Invalid tenantId format" });
+                    return;
+                }
+                if (!this.tenantManager.tenantExists(tenantId)) {
+                    res.status(404).json({ error: "Tenant not found" });
+                    return;
+                }
+                const { name, url, syncIntervalMs, databases } = req.body;
+                if (!name || !url) {
+                    res.status(400).json({ error: "name and url are required" });
+                    return;
+                }
+                if (!databases || !Array.isArray(databases) || databases.length === 0) {
+                    res.status(400).json({ error: "databases array is required and must not be empty" });
+                    return;
+                }
+                (0, validation_1.validateStringLength)(name, 256, "name");
+                (0, validation_1.validateStringLength)(url, 2048, "url");
+                const config = { name, url, databases };
+                if (syncIntervalMs !== undefined) {
+                    config.syncIntervalMs = syncIntervalMs;
+                }
+                this.tenantManager.addTenantSyncServer(tenantId, config);
+                res.status(201).json({ success: true, message: `Sync server "${name}" configured for tenant ${tenantId}` });
+            }
+            catch (error) {
+                if (error instanceof validation_1.ValidationError) {
+                    res.status(400).json({ error: error.message });
+                    return;
+                }
+                console.error("[MindooDBServer] Error adding sync server:", error);
+                res.status(500).json({ error: "Failed to add sync server" });
+            }
+        });
+        router.delete("/tenants/:tenantId/sync-servers/:serverName", authMiddleware, (req, res) => {
+            try {
+                const tenantId = req.params.tenantId.toLowerCase();
+                try {
+                    (0, validation_1.validateTenantId)(tenantId);
+                }
+                catch {
+                    res.status(400).json({ error: "Invalid tenantId format" });
+                    return;
+                }
+                if (!this.tenantManager.tenantExists(tenantId)) {
+                    res.status(404).json({ error: "Tenant not found" });
+                    return;
+                }
+                const serverName = decodeURIComponent(req.params.serverName);
+                (0, validation_1.validateStringLength)(serverName, 256, "serverName");
+                const removed = this.tenantManager.removeTenantSyncServer(tenantId, serverName);
+                if (!removed) {
+                    res.status(404).json({ error: "Sync server not found" });
+                    return;
+                }
+                res.json({ success: true, message: `Sync server "${serverName}" removed from tenant ${tenantId}` });
+            }
+            catch (error) {
+                if (error instanceof validation_1.ValidationError) {
+                    res.status(400).json({ error: error.message });
+                    return;
+                }
+                console.error("[MindooDBServer] Error removing sync server:", error);
+                res.status(500).json({ error: "Failed to remove sync server" });
+            }
+        });
+        // Per-tenant trigger-sync (moved from /:tenantId/admin/trigger-sync)
+        router.post("/tenants/:tenantId/trigger-sync", authMiddleware, this.handleTriggerSync.bind(this));
+        // Runtime config management
+        router.get("/config/backups", authMiddleware, (req, res) => {
+            try {
+                res.json({ backups: (0, config_1.listConfigBackups)(this.configPath) });
+            }
+            catch (error) {
+                console.error("[MindooDBServer] Error listing config backups:", error);
+                res.status(500).json({ error: "Failed to list config backups" });
+            }
+        });
+        router.get("/config/backups/:backupFile", authMiddleware, (req, res) => {
+            try {
+                const backupFile = decodeURIComponent(req.params.backupFile);
+                if (!(0, config_1.isConfigBackupFilename)(backupFile)) {
+                    res.status(400).json({ error: "Invalid config backup filename" });
+                    return;
+                }
+                const config = (0, config_1.loadConfigBackup)(this.configPath, backupFile);
+                res.json({ file: backupFile, config });
+            }
+            catch (error) {
+                if (error instanceof Error && error.message.startsWith("Config backup not found:")) {
+                    res.status(404).json({ error: "Config backup not found" });
+                    return;
+                }
+                if (error instanceof Error && error.message.startsWith("Invalid config backup filename:")) {
+                    res.status(400).json({ error: "Invalid config backup filename" });
+                    return;
+                }
+                console.error("[MindooDBServer] Error reading config backup:", error);
+                res.status(500).json({ error: "Failed to read config backup" });
+            }
+        });
+        router.get("/config", authMiddleware, (req, res) => {
+            res.json(this.serverConfig);
+        });
+        router.put("/config", authMiddleware, this.handleUpdateConfig.bind(this));
+    }
+    // ==================== System Auth Handlers ====================
+    async handleSystemChallenge(req, res) {
+        try {
+            const { username, publicsignkey } = req.body;
+            if (!username || typeof username !== "string") {
+                res.status(400).json({ error: "username is required" });
+                return;
+            }
+            if (!publicsignkey || typeof publicsignkey !== "string") {
+                res.status(400).json({ error: "publicsignkey is required" });
+                return;
+            }
+            (0, validation_1.validateUsername)(username);
+            (0, validation_1.validateStringLength)(publicsignkey, validation_1.MAX_PEM_KEY_LENGTH, "publicsignkey");
+            const challenge = await this.systemAdminAuth.generateChallenge(username, publicsignkey);
+            res.json({ challenge });
+        }
+        catch (error) {
+            if (error instanceof Error && error.message === "Unknown system admin principal") {
+                res.status(404).json({ error: "System admin principal not found" });
+                return;
+            }
+            if (error instanceof validation_1.ValidationError) {
+                res.status(400).json({ error: error.message });
+                return;
+            }
+            console.error("[MindooDBServer] System challenge error:", error);
+            res.status(500).json({ error: "Internal server error" });
+        }
+    }
+    async handleSystemAuthenticate(req, res) {
+        try {
+            const { challenge, signature } = req.body;
+            if (!challenge || !signature) {
+                res.status(400).json({ error: "challenge and signature are required" });
+                return;
+            }
+            (0, validation_1.validateStringLength)(challenge, validation_1.MAX_CHALLENGE_LENGTH, "challenge");
+            (0, validation_1.validateStringLength)(signature, validation_1.MAX_SIGNATURE_LENGTH, "signature");
+            const signatureBytes = this.base64ToUint8Array(signature);
+            const result = await this.systemAdminAuth.authenticate(challenge, signatureBytes);
+            res.json(result);
+        }
+        catch (error) {
+            if (error instanceof validation_1.ValidationError) {
+                res.status(400).json({ error: error.message });
+                return;
+            }
+            console.error("[MindooDBServer] System authenticate error:", error);
+            res.status(500).json({ error: "Internal server error" });
+        }
+    }
+    // ==================== Config Update Handler ====================
+    async handleUpdateConfig(req, res) {
+        try {
+            let newConfig;
+            try {
+                newConfig = (0, config_1.validateServerConfig)(req.body, "request body");
+            }
+            catch (err) {
+                res.status(400).json({
+                    error: err instanceof Error ? err.message : "Invalid config format",
+                });
+                return;
+            }
+            // Self-lockout protection: verify the calling admin retains PUT /system/config access
+            const callingAdmin = req.systemAdmin;
+            const proposedMatcher = new CapabilityMatcher_1.CapabilityMatcher(newConfig);
+            if (!proposedMatcher.isAuthorized("PUT", "/system/config", callingAdmin.username, callingAdmin.publicsignkey)) {
+                res.status(400).json({
+                    error: "This change would remove your own access to PUT /system/config",
+                });
+                return;
+            }
+            // Backup the current config before overwriting
+            const { existsSync: fsExists } = await import("fs");
+            let backupFile = null;
+            if (fsExists(this.configPath)) {
+                backupFile = (0, config_1.backupConfig)(this.configPath);
+            }
+            // Persist new config to disk
+            (0, config_1.writeConfig)(this.configPath, newConfig);
+            // Hot-swap in-memory state
+            this.reloadConfig(newConfig);
+            console.log(`[MindooDBServer] Config updated by ${callingAdmin.username}` +
+                (backupFile ? ` (backup: ${backupFile})` : ""));
+            res.json({
+                success: true,
+                ...(backupFile ? { backupFile } : {}),
+            });
+        }
+        catch (error) {
+            console.error("[MindooDBServer] Error updating config:", error);
+            res.status(500).json({ error: "Failed to update config" });
+        }
+    }
+    // ==================== Tenant Routes ====================
+    createTenantRouter() {
+        const router = (0, express_1.Router)({ mergeParams: true });
+        // Auth endpoints get stricter rate limiting
+        const authRateLimit = (0, express_rate_limit_1.default)({
+            windowMs: 60000,
+            max: 20,
+            standardHeaders: true,
+            legacyHeaders: false,
+            message: { error: "Too many authentication attempts, please try again later" },
+        });
+        // Sync endpoints get a higher limit
+        const syncRateLimit = (0, express_rate_limit_1.default)({
+            windowMs: 60000,
+            max: 200,
+            standardHeaders: true,
+            legacyHeaders: false,
+            message: { error: "Too many sync requests, please try again later" },
+        });
+        router.post("/auth/challenge", authRateLimit, this.handleChallenge.bind(this));
+        router.post("/auth/authenticate", authRateLimit, this.handleAuthenticate.bind(this));
+        router.post("/sync/findNewEntries", syncRateLimit, this.handleFindNewEntries.bind(this));
+        router.post("/sync/findNewEntriesForDoc", syncRateLimit, this.handleFindNewEntriesForDoc.bind(this));
+        router.post("/sync/findEntries", syncRateLimit, this.handleFindEntries.bind(this));
+        router.post("/sync/scanEntriesSince", syncRateLimit, this.handleScanEntriesSince.bind(this));
+        router.post("/sync/getIdBloomSummary", syncRateLimit, this.handleGetIdBloomSummary.bind(this));
+        router.post("/sync/getCompactionStatus", syncRateLimit, this.handleGetCompactionStatus.bind(this));
+        router.get("/sync/capabilities", syncRateLimit, this.handleGetCapabilities.bind(this));
+        router.post("/sync/getEntries", syncRateLimit, this.handleGetEntries.bind(this));
+        router.post("/sync/putEntries", syncRateLimit, this.handlePutEntries.bind(this));
+        router.post("/sync/hasEntries", syncRateLimit, this.handleHasEntries.bind(this));
+        router.get("/sync/getAllIds", syncRateLimit, this.handleGetAllIds.bind(this));
+        router.post("/sync/resolveDependencies", syncRateLimit, this.handleResolveDependencies.bind(this));
+        router.post("/sync/planDocumentMaterialization", syncRateLimit, this.handlePlanDocumentMaterialization.bind(this));
+        router.post("/sync/planDocumentMaterializationBatch", syncRateLimit, this.handlePlanDocumentMaterializationBatch.bind(this));
+        return router;
+    }
+    // ==================== Validation Helpers ====================
+    validateDbId(dbId) {
+        return (0, validation_1.validateIdentifier)(dbId, "dbId");
+    }
+    // ==================== Tenant Auth Handlers ====================
+    async handleChallenge(req, res) {
+        try {
+            const { username } = req.body;
+            (0, validation_1.validateUsername)(username);
+            const authService = await this.tenantManager.getAuthService(req.tenantId);
+            const challenge = await authService.generateChallenge(username);
+            res.json({ challenge });
+        }
+        catch (error) {
+            this.handleRequestError(error, res);
+        }
+    }
+    async handleAuthenticate(req, res) {
+        try {
+            const { challenge, signature } = req.body;
+            if (!challenge || !signature) {
+                res.status(400).json({ error: "challenge and signature are required" });
+                return;
+            }
+            (0, validation_1.validateStringLength)(challenge, validation_1.MAX_CHALLENGE_LENGTH, "challenge");
+            (0, validation_1.validateStringLength)(signature, validation_1.MAX_SIGNATURE_LENGTH, "signature");
+            const authService = await this.tenantManager.getAuthService(req.tenantId);
+            const signatureBytes = this.base64ToUint8Array(signature);
+            const result = await authService.authenticate(challenge, signatureBytes);
+            res.json(result);
+        }
+        catch (error) {
+            this.handleRequestError(error, res);
+        }
+    }
+    // ==================== Sync Handlers ====================
+    async handleFindNewEntries(req, res) {
+        try {
+            const token = this.extractToken(req);
+            const { dbId, haveIds } = req.body;
+            const validDbId = this.validateDbId(dbId);
+            (0, validation_1.validateArraySize)(haveIds, validation_1.MAX_HAVE_IDS, "haveIds");
+            const serverStore = await this.tenantManager.getServerStore(req.tenantId, validDbId);
+            const entries = await serverStore.handleFindNewEntries(token, haveIds || []);
+            res.json({
+                entries: entries.map((e) => this.serializeEntryMetadata(e)),
+            });
+        }
+        catch (error) {
+            this.handleRequestError(error, res);
+        }
+    }
+    async handleFindNewEntriesForDoc(req, res) {
+        try {
+            const token = this.extractToken(req);
+            const { dbId, haveIds, docId } = req.body;
+            const validDbId = this.validateDbId(dbId);
+            if (!docId) {
+                res.status(400).json({ error: "docId is required" });
+                return;
+            }
+            (0, validation_1.validateArraySize)(haveIds, validation_1.MAX_HAVE_IDS, "haveIds");
+            const serverStore = await this.tenantManager.getServerStore(req.tenantId, validDbId);
+            const entries = await serverStore.handleFindNewEntriesForDoc(token, haveIds || [], docId);
+            res.json({
+                entries: entries.map((e) => this.serializeEntryMetadata(e)),
+            });
+        }
+        catch (error) {
+            this.handleRequestError(error, res);
+        }
+    }
+    async handleFindEntries(req, res) {
+        try {
+            const token = this.extractToken(req);
+            const { dbId, type, creationDateFrom, creationDateUntil } = req.body;
+            const validDbId = this.validateDbId(dbId);
+            const serverStore = await this.tenantManager.getServerStore(req.tenantId, validDbId);
+            const entries = await serverStore.handleFindEntries(token, type, creationDateFrom ?? null, creationDateUntil ?? null);
+            res.json({
+                entries: entries.map((e) => this.serializeEntryMetadata(e)),
+            });
+        }
+        catch (error) {
+            this.handleRequestError(error, res);
+        }
+    }
+    async handleScanEntriesSince(req, res) {
+        try {
+            const token = this.extractToken(req);
+            const { dbId, cursor, limit, filters } = req.body;
+            const validDbId = this.validateDbId(dbId);
+            const serverStore = await this.tenantManager.getServerStore(req.tenantId, validDbId);
+            const result = await serverStore.handleScanEntriesSince(token, cursor ?? null, limit, filters);
+            res.json({
+                entries: result.entries.map((e) => this.serializeEntryMetadata(e)),
+                nextCursor: result.nextCursor,
+                hasMore: result.hasMore,
+            });
+        }
+        catch (error) {
+            this.handleRequestError(error, res);
+        }
+    }
+    async handleGetIdBloomSummary(req, res) {
+        try {
+            const token = this.extractToken(req);
+            const { dbId } = req.body;
+            const validDbId = this.validateDbId(dbId);
+            const serverStore = await this.tenantManager.getServerStore(req.tenantId, validDbId);
+            const summary = await serverStore.handleGetIdBloomSummary(token);
+            res.json({ summary: summary });
+        }
+        catch (error) {
+            this.handleRequestError(error, res);
+        }
+    }
+    async handleGetCapabilities(req, res) {
+        try {
+            const token = this.extractToken(req);
+            const rawDbId = req.query.dbId || "directory";
+            const validDbId = this.validateDbId(rawDbId);
+            const serverStore = await this.tenantManager.getServerStore(req.tenantId, validDbId);
+            const capabilities = await serverStore.handleGetCapabilities(token);
+            res.json({ capabilities: capabilities });
+        }
+        catch (error) {
+            this.handleRequestError(error, res);
+        }
+    }
+    async handleGetCompactionStatus(req, res) {
+        try {
+            const token = this.extractToken(req);
+            const { dbId } = req.body;
+            const validDbId = this.validateDbId(dbId);
+            const serverStore = await this.tenantManager.getServerStore(req.tenantId, validDbId);
+            const status = await serverStore.handleGetCompactionStatus(token);
+            res.json({ status: status });
+        }
+        catch (error) {
+            this.handleRequestError(error, res);
+        }
+    }
+    async handleGetEntries(req, res) {
+        try {
+            const token = this.extractToken(req);
+            const { dbId, ids } = req.body;
+            const validDbId = this.validateDbId(dbId);
+            (0, validation_1.validateArraySize)(ids, validation_1.MAX_ENTRY_IDS, "ids");
+            const serverStore = await this.tenantManager.getServerStore(req.tenantId, validDbId);
+            const entries = await serverStore.handleGetEntries(token, ids || []);
+            res.json({
+                entries: entries.map((e) => ({
+                    ...this.serializeEntryMetadata(e),
+                    rsaEncryptedPayload: this.uint8ArrayToBase64(e.rsaEncryptedPayload),
+                })),
+            });
+        }
+        catch (error) {
+            this.handleRequestError(error, res);
+        }
+    }
+    async handlePutEntries(req, res) {
+        try {
+            const token = this.extractToken(req);
+            const { dbId, entries } = req.body;
+            const validDbId = this.validateDbId(dbId);
+            (0, validation_1.validateArraySize)(entries, validation_1.MAX_PUT_ENTRIES, "entries");
+            const serverStore = await this.tenantManager.getServerStore(req.tenantId, validDbId);
+            const deserializedEntries = (entries || []).map((e) => this.deserializeEntry(e));
+            await serverStore.handlePutEntries(token, deserializedEntries);
+            res.json({ success: true });
+        }
+        catch (error) {
+            this.handleRequestError(error, res);
+        }
+    }
+    async handleHasEntries(req, res) {
+        try {
+            const token = this.extractToken(req);
+            const { dbId, ids } = req.body;
+            const validDbId = this.validateDbId(dbId);
+            (0, validation_1.validateArraySize)(ids, validation_1.MAX_ENTRY_IDS, "ids");
+            const serverStore = await this.tenantManager.getServerStore(req.tenantId, validDbId);
+            const existingIds = await serverStore.handleHasEntries(token, ids || []);
+            res.json({ ids: existingIds });
+        }
+        catch (error) {
+            this.handleRequestError(error, res);
+        }
+    }
+    async handleGetAllIds(req, res) {
+        try {
+            const token = this.extractToken(req);
+            const rawDbId = req.query.dbId || "directory";
+            const validDbId = this.validateDbId(rawDbId);
+            const serverStore = await this.tenantManager.getServerStore(req.tenantId, validDbId);
+            const ids = await serverStore.handleGetAllIds(token);
+            res.json({ ids });
+        }
+        catch (error) {
+            this.handleRequestError(error, res);
+        }
+    }
+    async handleResolveDependencies(req, res) {
+        try {
+            const token = this.extractToken(req);
+            const { dbId, startId, options } = req.body;
+            const validDbId = this.validateDbId(dbId);
+            if (!startId) {
+                res.status(400).json({ error: "startId is required" });
+                return;
+            }
+            const serverStore = await this.tenantManager.getServerStore(req.tenantId, validDbId);
+            const ids = await serverStore.handleResolveDependencies(token, startId, options);
+            res.json({ ids });
+        }
+        catch (error) {
+            this.handleRequestError(error, res);
+        }
+    }
+    async handlePlanDocumentMaterialization(req, res) {
+        try {
+            const token = this.extractToken(req);
+            const { dbId, docId, options } = req.body;
+            const validDbId = this.validateDbId(dbId);
+            if (!docId) {
+                res.status(400).json({ error: "docId is required" });
+                return;
+            }
+            const serverStore = await this.tenantManager.getServerStore(req.tenantId, validDbId);
+            const plan = await serverStore.handlePlanDocumentMaterialization(token, docId, options);
+            res.json({ plan: plan });
+        }
+        catch (error) {
+            this.handleRequestError(error, res);
+        }
+    }
+    async handlePlanDocumentMaterializationBatch(req, res) {
+        try {
+            const token = this.extractToken(req);
+            const { dbId, docIds, options } = req.body;
+            const validDbId = this.validateDbId(dbId);
+            (0, validation_1.validateArraySize)(docIds, validation_1.MAX_HAVE_IDS, "docIds");
+            const serverStore = await this.tenantManager.getServerStore(req.tenantId, validDbId);
+            const batchPlan = await serverStore.handlePlanDocumentMaterializationBatch(token, docIds || [], options);
+            res.json({ batchPlan: batchPlan });
+        }
+        catch (error) {
+            this.handleRequestError(error, res);
+        }
+    }
+    // ==================== Management Handlers ====================
+    async handleTriggerSync(req, res) {
+        res.json({ success: true, message: "Sync triggered (not yet implemented)" });
+    }
+    // ==================== Helper Methods ====================
+    extractToken(req) {
+        const auth = req.headers.authorization;
+        if (!auth || !auth.startsWith("Bearer ")) {
+            throw new types_1.NetworkError("INVALID_TOKEN", "Missing or invalid Authorization header");
+        }
+        return auth.substring(7);
+    }
+    handleRequestError(error, res) {
+        if (error instanceof validation_1.ValidationError) {
+            res.status(400).json({ error: error.message });
+            return;
+        }
+        if (error instanceof Error && error.name === "NetworkError") {
+            const networkError = error;
+            const status = this.getStatusForErrorType(networkError.type);
+            res.status(status).json({ error: networkError.message });
+            return;
+        }
+        console.error("[MindooDBServer] Request error:", error);
+        res.status(500).json({ error: "Internal server error" });
+    }
+    getStatusForErrorType(type) {
+        switch (type) {
+            case "INVALID_TOKEN":
+                return 401;
+            case "USER_REVOKED":
+                return 403;
+            case "USER_NOT_FOUND":
+                return 404;
+            case "INVALID_SIGNATURE":
+                return 403;
+            case "CHALLENGE_EXPIRED":
+                return 401;
+            default:
+                return 500;
+        }
+    }
+    errorHandler(err, req, res, next) {
+        console.error("[MindooDBServer] Unhandled error:", err);
+        res.status(500).json({ error: "Internal server error" });
+    }
+    // ==================== Serialization ====================
+    serializeEntryMetadata(metadata) {
+        return {
+            entryType: metadata.entryType,
+            id: metadata.id,
+            contentHash: metadata.contentHash,
+            docId: metadata.docId,
+            dependencyIds: metadata.dependencyIds,
+            createdAt: metadata.createdAt,
+            createdByPublicKey: metadata.createdByPublicKey,
+            decryptionKeyId: metadata.decryptionKeyId,
+            signature: this.uint8ArrayToBase64(metadata.signature),
+            originalSize: metadata.originalSize,
+            encryptedSize: metadata.encryptedSize,
+        };
+    }
+    deserializeEntry(serialized) {
+        return {
+            entryType: serialized.entryType,
+            id: serialized.id,
+            contentHash: serialized.contentHash,
+            docId: serialized.docId,
+            dependencyIds: serialized.dependencyIds,
+            createdAt: serialized.createdAt,
+            createdByPublicKey: serialized.createdByPublicKey,
+            decryptionKeyId: serialized.decryptionKeyId,
+            signature: this.base64ToUint8Array(serialized.signature),
+            originalSize: serialized.originalSize,
+            encryptedSize: serialized.encryptedSize,
+            encryptedData: this.base64ToUint8Array(serialized.encryptedData),
+        };
+    }
+    uint8ArrayToBase64(bytes) {
+        return Buffer.from(bytes).toString("base64");
+    }
+    base64ToUint8Array(base64) {
+        return new Uint8Array(Buffer.from(base64, "base64"));
+    }
+}
+exports.MindooDBServer = MindooDBServer;
+//# sourceMappingURL=MindooDBServer.js.map