mindoodb 0.0.2 → 0.0.4

package/dist/node/server/SystemAdminAuth.js

@@ -0,0 +1,200 @@
+"use strict";
+/**
+ * System admin authentication service.
+ *
+ * Reuses the existing `AuthenticationService` by providing a
+ * `SystemAdminDirectory` adapter that derives user lookup data from
+ * the capabilities section of `config.json` rather than a tenant
+ * directory.  Challenges require both username and publicsignkey so
+ * the issued JWT can carry both fields for capability matching.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SystemAdminAuthService = void 0;
+const uuid_1 = require("uuid");
+const config_1 = require("./config");
+// ---------------------------------------------------------------------------
+// SystemAdminAuthService
+// ---------------------------------------------------------------------------
+class SystemAdminAuthService {
+    constructor(cryptoAdapter, config, options) {
+        this.challenges = new Map();
+        this.cryptoAdapter = cryptoAdapter;
+        this.principals = (0, config_1.extractAllPrincipals)(config);
+        this.allowTenantCreationWildcardPrincipal =
+            (0, config_1.hasTenantCreationWildcardPrincipal)(config);
+        this.jwtSecret =
+            options?.jwtSecret ?? cryptoAdapter.getRandomValues(new Uint8Array(32));
+        this.challengeExpirationMs = options?.challengeExpirationMs ?? 5 * 60 * 1000;
+        this.tokenExpirationMs = options?.tokenExpirationMs ?? 60 * 60 * 1000;
+    }
+    /**
+     * Hot-swap the principal list from a new config.
+     * In-flight challenges and existing JWTs remain valid (same HMAC secret);
+     * removed principals will fail the CapabilityMatcher check on their next request.
+     */
+    reloadPrincipals(config) {
+        this.principals = (0, config_1.extractAllPrincipals)(config);
+        this.allowTenantCreationWildcardPrincipal =
+            (0, config_1.hasTenantCreationWildcardPrincipal)(config);
+    }
+    /**
+     * Generate a challenge for a system admin.
+     * Both `username` and `publicsignkey` are required so we can bind
+     * the issued JWT to a specific keypair.
+     */
+    async generateChallenge(username, publicsignkey) {
+        const normalizedUsername = username.toLowerCase();
+        const found = this.principals.some((p) => p.username.toLowerCase() === normalizedUsername &&
+            p.publicsignkey === publicsignkey);
+        if (!found && !this.allowTenantCreationWildcardPrincipal) {
+            throw new Error("Unknown system admin principal");
+        }
+        const challenge = (0, uuid_1.v7)();
+        const now = Date.now();
+        this.challenges.set(challenge, {
+            challenge,
+            username,
+            publicsignkey,
+            createdAt: now,
+            expiresAt: now + this.challengeExpirationMs,
+            used: false,
+        });
+        this.cleanupExpiredChallenges();
+        return challenge;
+    }
+    /**
+     * Verify a signed challenge and return a JWT containing both
+     * `sub` (username) and `publicsignkey`.
+     */
+    async authenticate(challenge, signature) {
+        const stored = this.challenges.get(challenge);
+        if (!stored) {
+            return { success: false, error: "Challenge not found or expired" };
+        }
+        if (Date.now() > stored.expiresAt) {
+            this.challenges.delete(challenge);
+            return { success: false, error: "Challenge expired" };
+        }
+        if (stored.used) {
+            return { success: false, error: "Challenge already used" };
+        }
+        stored.used = true;
+        const isValid = await this.verifySignature(challenge, signature, stored.publicsignkey);
+        if (!isValid) {
+            return { success: false, error: "Invalid signature" };
+        }
+        const token = await this.generateToken(stored.username, stored.publicsignkey);
+        return { success: true, token };
+    }
+    /**
+     * Validate and decode a system admin JWT.
+     */
+    async validateToken(token) {
+        const parts = token.split(".");
+        if (parts.length !== 3)
+            return null;
+        const [headerB64, payloadB64, signatureB64] = parts;
+        try {
+            const subtle = this.cryptoAdapter.getSubtle();
+            const signingKey = await subtle.importKey("raw", this.jwtSecret.buffer, { name: "HMAC", hash: "SHA-256" }, false, ["verify"]);
+            const dataToVerify = new TextEncoder().encode(`${headerB64}.${payloadB64}`);
+            const sig = this.base64UrlToUint8Array(signatureB64);
+            const isValid = await subtle.verify("HMAC", signingKey, sig.buffer.slice(sig.byteOffset, sig.byteOffset + sig.byteLength), dataToVerify.buffer);
+            if (!isValid)
+                return null;
+            const payload = JSON.parse(this.base64UrlDecode(payloadB64));
+            const now = Math.floor(Date.now() / 1000);
+            if (payload.exp < now)
+                return null;
+            return payload;
+        }
+        catch {
+            return null;
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Private helpers
+    // -----------------------------------------------------------------------
+    async verifySignature(message, signature, publicKeyPem) {
+        const subtle = this.cryptoAdapter.getSubtle();
+        try {
+            const pemContents = publicKeyPem
+                .replace(/-----BEGIN PUBLIC KEY-----/g, "")
+                .replace(/-----END PUBLIC KEY-----/g, "")
+                .replace(/\s/g, "");
+            const keyData = this.base64ToUint8Array(pemContents);
+            const publicKey = await subtle.importKey("spki", keyData.buffer, { name: "Ed25519" }, false, ["verify"]);
+            const messageBytes = new TextEncoder().encode(message);
+            return await subtle.verify({ name: "Ed25519" }, publicKey, signature.buffer.slice(signature.byteOffset, signature.byteOffset + signature.byteLength), messageBytes.buffer);
+        }
+        catch {
+            return false;
+        }
+    }
+    async generateToken(username, publicsignkey) {
+        const subtle = this.cryptoAdapter.getSubtle();
+        const now = Math.floor(Date.now() / 1000);
+        const payload = {
+            sub: username,
+            publicsignkey,
+            iat: now,
+            exp: now + Math.floor(this.tokenExpirationMs / 1000),
+        };
+        const header = { alg: "HS256", typ: "JWT" };
+        const headerB64 = this.base64UrlEncode(JSON.stringify(header));
+        const payloadB64 = this.base64UrlEncode(JSON.stringify(payload));
+        const signingKey = await subtle.importKey("raw", this.jwtSecret.buffer, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+        const dataToSign = new TextEncoder().encode(`${headerB64}.${payloadB64}`);
+        const signature = await subtle.sign("HMAC", signingKey, dataToSign.buffer);
+        const signatureB64 = this.uint8ArrayToBase64Url(new Uint8Array(signature));
+        return `${headerB64}.${payloadB64}.${signatureB64}`;
+    }
+    cleanupExpiredChallenges() {
+        const now = Date.now();
+        for (const [key, ch] of this.challenges) {
+            if (ch.expiresAt < now) {
+                this.challenges.delete(key);
+            }
+        }
+    }
+    // Base64 utilities
+    base64UrlEncode(str) {
+        const base64 = btoa(str);
+        return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+    }
+    base64UrlDecode(str) {
+        let base64 = str.replace(/-/g, "+").replace(/_/g, "/");
+        while (base64.length % 4)
+            base64 += "=";
+        return atob(base64);
+    }
+    uint8ArrayToBase64Url(bytes) {
+        let binary = "";
+        for (let i = 0; i < bytes.length; i++) {
+            binary += String.fromCharCode(bytes[i]);
+        }
+        const base64 = btoa(binary);
+        return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+    }
+    base64UrlToUint8Array(str) {
+        let base64 = str.replace(/-/g, "+").replace(/_/g, "/");
+        while (base64.length % 4)
+            base64 += "=";
+        const binary = atob(base64);
+        const bytes = new Uint8Array(binary.length);
+        for (let i = 0; i < binary.length; i++) {
+            bytes[i] = binary.charCodeAt(i);
+        }
+        return bytes;
+    }
+    base64ToUint8Array(base64) {
+        const binary = atob(base64);
+        const bytes = new Uint8Array(binary.length);
+        for (let i = 0; i < binary.length; i++) {
+            bytes[i] = binary.charCodeAt(i);
+        }
+        return bytes;
+    }
+}
+exports.SystemAdminAuthService = SystemAdminAuthService;
+//# sourceMappingURL=SystemAdminAuth.js.map

package/dist/node/server/SystemAdminAuth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SystemAdminAuth.js","sourceRoot":"","sources":["../../../src/node/server/SystemAdminAuth.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;;AAEH,+BAAoC;AAGpC,qCAGkB;AAsBlB,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E,MAAa,sBAAsB;IASjC,YACE,aAA4B,EAC5B,MAAoB,EACpB,OAIC;QAfK,eAAU,GAAiC,IAAI,GAAG,EAAE,CAAC;QAiB3D,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,IAAI,CAAC,UAAU,GAAG,IAAA,6BAAoB,EAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,CAAC,oCAAoC;YACvC,IAAA,2CAAkC,EAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,SAAS;YACZ,OAAO,EAAE,SAAS,IAAI,aAAa,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1E,IAAI,CAAC,qBAAqB,GAAG,OAAO,EAAE,qBAAqB,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAC7E,IAAI,CAAC,iBAAiB,GAAG,OAAO,EAAE,iBAAiB,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACxE,CAAC;IAED;;;;OAIG;IACH,gBAAgB,CAAC,MAAoB;QACnC,IAAI,CAAC,UAAU,GAAG,IAAA,6BAAoB,EAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,CAAC,oCAAoC;YACvC,IAAA,2CAAkC,EAAC,MAAM,CAAC,CAAC;IAC/C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,iBAAiB,CACrB,QAAgB,EAChB,aAAqB;QAErB,MAAM,kBAAkB,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;QAElD,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAChC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,kBAAkB;YAC/C,CAAC,CAAC,aAAa,KAAK,aAAa,CACpC,CAAC;QACF,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,oCAAoC,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,SAAS,GAAG,IAAA,SAAM,GAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,EAAE;YAC7B,SAAS;YACT,QAAQ;YACR,aAAa;YACb,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG,GAAG,IAAI,CAAC,qBAAqB;YAC3C,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;QAEH,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAChC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY,CAChB,SAAiB,EACjB,SAAqB;QAErB,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC;QACrE,CAAC;QAED,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;YAClC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAClC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;QACxD,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAChB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC;QAC7D,CAAC;QAED,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC;QAEnB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CACxC,SAAS,EACT,SAAS,EACT,MAAM,CAAC,aAAa,CACrB,CAAC;QAEF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;QACxD,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;QAC9E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CACjB,KAAa;QAEb,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAEpC,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,CAAC,GAAG,KAAK,CAAC;QAEpD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,CAAC;YAC9C,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,IAAI,CAAC,SAAS,CAAC,MAAqB,EACpC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;YAEF,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAC3C,GAAG,SAAS,IAAI,UAAU,EAAE,CAC7B,CAAC;YACF,MAAM,GAAG,GAAG,IAAI,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC;YAErD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CACjC,MAAM,EACN,UAAU,EACV,GAAG,CAAC,MAAM,CAAC,KAAK,CACd,GAAG,CAAC,UAAU,EACd,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,UAAU,CACjB,EAChB,YAAY,CAAC,MAAqB,CACnC,CAAC;YAEF,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAE1B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACxB,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CACN,CAAC;YAE7B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YAC1C,IAAI,OAAO,CAAC,GAAG,GAAG,GAAG;gBAAE,OAAO,IAAI,CAAC;YAEnC,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,kBAAkB;IAClB,0EAA0E;IAElE,KAAK,CAAC,eAAe,CAC3B,OAAe,EACf,SAAqB,EACrB,YAAoB;QAEpB,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,CAAC;QAE9C,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,YAAY;iBAC7B,OAAO,CAAC,6BAA6B,EAAE,EAAE,CAAC;iBAC1C,OAAO,CAAC,2BAA2B,EAAE,EAAE,CAAC;iBACxC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAEtB,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC;YAErD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,SAAS,CACtC,MAAM,EACN,OAAO,CAAC,MAAqB,EAC7B,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;YAEF,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACvD,OAAO,MAAM,MAAM,CAAC,MAAM,CACxB,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,SAAS,EACT,SAAS,CAAC,MAAM,CAAC,KAAK,CACpB,SAAS,CAAC,UAAU,EACpB,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAC7B,EAChB,YAAY,CAAC,MAAqB,CACnC,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,aAAa,CACzB,QAAgB,EAChB,aAAqB;QAErB,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAE1C,MAAM,OAAO,GAA4B;YACvC,GAAG,EAAE,QAAQ;YACb,aAAa;YACb,GAAG,EAAE,GAAG;YACR,GAAG,EAAE,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;SACrD,CAAC;QAEF,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;QAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QAEjE,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,IAAI,CAAC,SAAS,CAAC,MAAqB,EACpC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;QAEF,MAAM,UAAU,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CACzC,GAAG,SAAS,IAAI,UAAU,EAAE,CAC7B,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,IAAI,CACjC,MAAM,EACN,UAAU,EACV,UAAU,CAAC,MAAqB,CACjC,CAAC;QAEF,MAAM,YAAY,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;QAC3E,OAAO,GAAG,SAAS,IAAI,UAAU,IAAI,YAAY,EAAE,CAAC;IACtD,CAAC;IAEO,wBAAwB;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACxC,IAAI,EAAE,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;gBACvB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;IACH,CAAC;IAED,mBAAmB;IAEX,eAAe,CAAC,GAAW;QACjC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QACzB,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC1E,CAAC;IAEO,eAAe,CAAC,GAAW;QACjC,IAAI,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACvD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,IAAI,GAAG,CAAC;QACxC,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;IAEO,qBAAqB,CAAC,KAAiB;QAC7C,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1C,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5B,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC1E,CAAC;IAEO,qBAAqB,CAAC,GAAW;QACvC,IAAI,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACvD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,IAAI,GAAG,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,kBAAkB,CAAC,MAAc;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAvSD,wDAuSC"}

package/dist/node/server/SystemIpAllowlist.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Optional IP allowlist for /system/* routes (MINDOODB_ADMIN_ALLOWED_IPS).
+ *
+ * Comma-separated IPv4/IPv6 addresses or IPv4/IPv6 CIDRs. Use `*` to allow all.
+ * IPv4-mapped IPv6 (::ffff:x.x.x.x) is normalized to the IPv4 form for matching.
+ */
+import type { NextFunction, Request, Response } from "express";
+export declare function readSystemIpAllowListFromEnv(): string | undefined;
+/**
+ * When unset or `*`, no IP restriction (JWT + capabilities still apply).
+ */
+export declare function isSystemIpAllowListDisabled(raw: string | undefined): boolean;
+/**
+ * Returns true if clientIp is allowed by the allowlist string (non-empty, not `*`).
+ */
+export declare function isClientIpAllowedForSystemList(clientIpRaw: string, allowListRaw: string): boolean;
+/**
+ * Express middleware: 403 if client IP not in allowlist (when env is set).
+ */
+export declare function systemIpAllowlistMiddleware(req: Request, res: Response, next: NextFunction): void;
+//# sourceMappingURL=SystemIpAllowlist.d.ts.map

package/dist/node/server/SystemIpAllowlist.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SystemIpAllowlist.d.ts","sourceRoot":"","sources":["../../../src/node/server/SystemIpAllowlist.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAK/D,wBAAgB,4BAA4B,IAAI,MAAM,GAAG,SAAS,CAMjE;AAED;;GAEG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAK5E;AAwJD;;GAEG;AACH,wBAAgB,8BAA8B,CAC5C,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAuBT;AAED;;GAEG;AACH,wBAAgB,2BAA2B,CACzC,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,IAAI,EAAE,YAAY,GACjB,IAAI,CAwBN"}

package/dist/node/server/SystemIpAllowlist.js

@@ -0,0 +1,210 @@
+"use strict";
+/**
+ * Optional IP allowlist for /system/* routes (MINDOODB_ADMIN_ALLOWED_IPS).
+ *
+ * Comma-separated IPv4/IPv6 addresses or IPv4/IPv6 CIDRs. Use `*` to allow all.
+ * IPv4-mapped IPv6 (::ffff:x.x.x.x) is normalized to the IPv4 form for matching.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readSystemIpAllowListFromEnv = readSystemIpAllowListFromEnv;
+exports.isSystemIpAllowListDisabled = isSystemIpAllowListDisabled;
+exports.isClientIpAllowedForSystemList = isClientIpAllowedForSystemList;
+exports.systemIpAllowlistMiddleware = systemIpAllowlistMiddleware;
+const net_1 = require("net");
+const ENV_KEY = "MINDOODB_ADMIN_ALLOWED_IPS";
+function readSystemIpAllowListFromEnv() {
+    const raw = process.env[ENV_KEY];
+    if (raw === undefined || raw.trim() === "") {
+        return undefined;
+    }
+    return raw.trim();
+}
+/**
+ * When unset or `*`, no IP restriction (JWT + capabilities still apply).
+ */
+function isSystemIpAllowListDisabled(raw) {
+    if (raw === undefined || raw === "*") {
+        return true;
+    }
+    return false;
+}
+function normalizeClientIp(ip) {
+    if (ip.startsWith("::ffff:")) {
+        const v4 = ip.slice(7);
+        if ((0, net_1.isIPv4)(v4)) {
+            return v4;
+        }
+    }
+    return ip;
+}
+function ipv4ToInt(ip) {
+    const parts = ip.split(".").map((p) => parseInt(p, 10));
+    if (parts.length !== 4 || parts.some((n) => Number.isNaN(n) || n < 0 || n > 255)) {
+        return -1;
+    }
+    return (((parts[0] << 24) | (parts[1] << 16) | (parts[2] << 8) | parts[3]) >>> 0);
+}
+function ipv4MatchesCidr(ip, cidr) {
+    const slash = cidr.indexOf("/");
+    if (slash === -1) {
+        return false;
+    }
+    const base = cidr.slice(0, slash);
+    const bits = parseInt(cidr.slice(slash + 1), 10);
+    if (!(0, net_1.isIPv4)(base) || Number.isNaN(bits) || bits < 0 || bits > 32) {
+        return false;
+    }
+    const ipNum = ipv4ToInt(ip);
+    const baseNum = ipv4ToInt(base);
+    if (ipNum < 0 || baseNum < 0) {
+        return false;
+    }
+    if (bits === 0) {
+        return true;
+    }
+    const mask = bits === 32 ? 0xffffffff : ((0xffffffff << (32 - bits)) >>> 0);
+    return (ipNum & mask) === (baseNum & mask);
+}
+function parseIpv4Parts(ip) {
+    if (!(0, net_1.isIPv4)(ip)) {
+        return null;
+    }
+    const parts = ip.split(".").map((p) => parseInt(p, 10));
+    if (parts.length !== 4 || parts.some((n) => Number.isNaN(n) || n < 0 || n > 255)) {
+        return null;
+    }
+    return parts;
+}
+function parseIpv6SegmentList(part) {
+    if (part === "") {
+        return [];
+    }
+    const segments = [];
+    for (const token of part.split(":")) {
+        if (token.length === 0) {
+            return null;
+        }
+        if (token.includes(".")) {
+            const ipv4Parts = parseIpv4Parts(token);
+            if (!ipv4Parts) {
+                return null;
+            }
+            segments.push((ipv4Parts[0] << 8) | ipv4Parts[1]);
+            segments.push((ipv4Parts[2] << 8) | ipv4Parts[3]);
+            continue;
+        }
+        if (!/^[0-9a-fA-F]{1,4}$/.test(token)) {
+            return null;
+        }
+        segments.push(parseInt(token, 16));
+    }
+    return segments;
+}
+function ipv6ToBigInt(ip) {
+    if (!(0, net_1.isIPv6)(ip)) {
+        return null;
+    }
+    const doubleColonCount = ip.split("::").length - 1;
+    if (doubleColonCount > 1) {
+        return null;
+    }
+    let parts;
+    if (ip.includes("::")) {
+        const [leftRaw, rightRaw] = ip.split("::");
+        const left = parseIpv6SegmentList(leftRaw);
+        const right = parseIpv6SegmentList(rightRaw);
+        if (!left || !right) {
+            return null;
+        }
+        const missing = 8 - (left.length + right.length);
+        if (missing < 1) {
+            return null;
+        }
+        parts = [...left, ...new Array(missing).fill(0), ...right];
+    }
+    else {
+        const parsed = parseIpv6SegmentList(ip);
+        if (!parsed || parsed.length !== 8) {
+            return null;
+        }
+        parts = parsed;
+    }
+    if (parts.length !== 8 || parts.some((n) => n < 0 || n > 0xffff)) {
+        return null;
+    }
+    let result = 0n;
+    for (const part of parts) {
+        result = (result << 16n) | BigInt(part);
+    }
+    return result;
+}
+function ipv6MatchesCidr(ip, cidr) {
+    const slash = cidr.indexOf("/");
+    if (slash === -1) {
+        return false;
+    }
+    const base = cidr.slice(0, slash);
+    const bits = parseInt(cidr.slice(slash + 1), 10);
+    if (!(0, net_1.isIPv6)(base) || Number.isNaN(bits) || bits < 0 || bits > 128) {
+        return false;
+    }
+    const ipNum = ipv6ToBigInt(ip);
+    const baseNum = ipv6ToBigInt(base);
+    if (ipNum === null || baseNum === null) {
+        return false;
+    }
+    if (bits === 0) {
+        return true;
+    }
+    const shift = 128n - BigInt(bits);
+    return (ipNum >> shift) === (baseNum >> shift);
+}
+/**
+ * Returns true if clientIp is allowed by the allowlist string (non-empty, not `*`).
+ */
+function isClientIpAllowedForSystemList(clientIpRaw, allowListRaw) {
+    const clientIp = normalizeClientIp(clientIpRaw.trim());
+    const entries = allowListRaw.split(",").map((s) => s.trim()).filter(Boolean);
+    for (const entry of entries) {
+        if (entry.includes("/")) {
+            if ((0, net_1.isIPv4)(clientIp) && ipv4MatchesCidr(clientIp, entry)) {
+                return true;
+            }
+            if ((0, net_1.isIPv6)(clientIp) && ipv6MatchesCidr(clientIp, entry)) {
+                return true;
+            }
+            continue;
+        }
+        if (clientIp === entry) {
+            return true;
+        }
+        if ((0, net_1.isIPv6)(clientIp) && (0, net_1.isIPv6)(entry) && ipv6ToBigInt(clientIp) === ipv6ToBigInt(entry)) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Express middleware: 403 if client IP not in allowlist (when env is set).
+ */
+function systemIpAllowlistMiddleware(req, res, next) {
+    const raw = readSystemIpAllowListFromEnv();
+    if (isSystemIpAllowListDisabled(raw)) {
+        next();
+        return;
+    }
+    const ip = (typeof req.ip === "string" && req.ip.length > 0
+        ? req.ip
+        : req.socket?.remoteAddress) || "";
+    const normalized = normalizeClientIp(ip);
+    if (!normalized || (!(0, net_1.isIPv4)(normalized) && !(0, net_1.isIPv6)(normalized))) {
+        res.status(403).json({ error: "Forbidden: system admin IP not allowed" });
+        return;
+    }
+    if (!isClientIpAllowedForSystemList(normalized, raw)) {
+        res.status(403).json({ error: "Forbidden: system admin IP not allowed" });
+        return;
+    }
+    next();
+}
+//# sourceMappingURL=SystemIpAllowlist.js.map

package/dist/node/server/SystemIpAllowlist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SystemIpAllowlist.js","sourceRoot":"","sources":["../../../src/node/server/SystemIpAllowlist.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;AAOH,oEAMC;AAKD,kEAKC;AA2JD,wEA0BC;AAKD,kEA4BC;AA1OD,6BAAqC;AAErC,MAAM,OAAO,GAAG,4BAA4B,CAAC;AAE7C,SAAgB,4BAA4B;IAC1C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC3C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;AACpB,CAAC;AAED;;GAEG;AACH,SAAgB,2BAA2B,CAAC,GAAuB;IACjE,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CAAC,EAAU;IACnC,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,IAAA,YAAM,EAAC,EAAE,CAAC,EAAE,CAAC;YACf,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,SAAS,CAAC,EAAU;IAC3B,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACxD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC;QACjF,OAAO,CAAC,CAAC,CAAC;IACZ,CAAC;IACD,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAW,CAAC;AAC9F,CAAC;AAED,SAAS,eAAe,CAAC,EAAU,EAAE,IAAY;IAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;QACjB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjD,IAAI,CAAC,IAAA,YAAM,EAAC,IAAI,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,EAAE,EAAE,CAAC;QACjE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;IAC5B,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACf,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GACR,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACjE,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,cAAc,CAAC,EAAU;IAChC,IAAI,CAAC,IAAA,YAAM,EAAC,EAAE,CAAC,EAAE,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACxD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC;QACjF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY;IACxC,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAChB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;YACxC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC;YACd,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;YAClD,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;YAClD,SAAS;QACX,CAAC;QAED,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACtC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,YAAY,CAAC,EAAU;IAC9B,IAAI,CAAC,IAAA,YAAM,EAAC,EAAE,CAAC,EAAE,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,gBAAgB,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACnD,IAAI,gBAAgB,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,KAAe,CAAC;IAEpB,IAAI,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,IAAI,KAAK,CAAS,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC;IACrE,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,GAAG,oBAAoB,CAAC,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,GAAG,MAAM,CAAC;IACjB,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC;QACjE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,EAAU,EAAE,IAAY;IAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;QACjB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjD,IAAI,CAAC,IAAA,YAAM,EAAC,IAAI,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,GAAG,EAAE,CAAC;QAClE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;IAC/B,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACf,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAClC,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,CAAC;AACjD,CAAC;AAED;;GAEG;AACH,SAAgB,8BAA8B,CAC5C,WAAmB,EACnB,YAAoB;IAEpB,MAAM,QAAQ,GAAG,iBAAiB,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAE7E,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,IAAI,IAAA,YAAM,EAAC,QAAQ,CAAC,IAAI,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;gBACzD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,IAAA,YAAM,EAAC,QAAQ,CAAC,IAAI,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;gBACzD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,IAAA,YAAM,EAAC,QAAQ,CAAC,IAAI,IAAA,YAAM,EAAC,KAAK,CAAC,IAAI,YAAY,CAAC,QAAQ,CAAC,KAAK,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;YACxF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAgB,2BAA2B,CACzC,GAAY,EACZ,GAAa,EACb,IAAkB;IAElB,MAAM,GAAG,GAAG,4BAA4B,EAAE,CAAC;IAC3C,IAAI,2BAA2B,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IAED,MAAM,EAAE,GACN,CAAC,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,GAAG,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC;QAC9C,CAAC,CAAC,GAAG,CAAC,EAAE;QACR,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,IAAI,EAAE,CAAC;IACvC,MAAM,UAAU,GAAG,iBAAiB,CAAC,EAAE,CAAC,CAAC;IAEzC,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,IAAA,YAAM,EAAC,UAAU,CAAC,IAAI,CAAC,IAAA,YAAM,EAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC,CAAC;QAC1E,OAAO;IACT,CAAC;IAED,IAAI,CAAC,8BAA8B,CAAC,UAAU,EAAE,GAAI,CAAC,EAAE,CAAC;QACtD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC,CAAC;QAC1E,OAAO;IACT,CAAC;IAED,IAAI,EAAE,CAAC;AACT,CAAC"}

package/dist/node/server/TenantManager.d.ts

@@ -0,0 +1,85 @@
+/**
+ * TenantManager handles loading, caching, and registration of tenants.
+ *
+ * Uses a global server identity (one per server, not per tenant) for
+ * authenticating with remote servers and opening tenant directories.
+ *
+ * When a tenant has a $publicinfos key (sent during publishToServer), the
+ * manager creates a real BaseMindooTenant for directory reading. User
+ * authentication is then validated against the admin-signed directory DB
+ * rather than a static JSON config.
+ *
+ * When no $publicinfos key is available, a SimpleMindooDirectory backed
+ * by config.json users[] is used as a fallback (useful for tests).
+ *
+ * A CompositeMindooDirectory wraps whichever directory source is used and
+ * also checks the global trusted-servers list, enabling server-to-server
+ * auth without servers being in each tenant's user directory.
+ */
+import { NodeCryptoAdapter } from "../crypto/NodeCryptoAdapter";
+import { AuthenticationService } from "../../core/appendonlystores/network/AuthenticationService";
+import { ServerNetworkContentAddressedStore } from "../../appendonlystores/network/ServerNetworkContentAddressedStore";
+import type { MindooTenant, MindooTenantDirectory, ContentAddressedStore } from "../../core/types";
+import type { PrivateUserId } from "../../core/userid";
+import { StoreFactory } from "./StoreFactory";
+import type { TenantConfig, TenantContext, RegisterTenantRequest, TrustedServer, NamedRemoteServerConfig } from "./types";
+interface LoadedTenant {
+    context: TenantContext;
+    storeFactory: StoreFactory;
+    authService: AuthenticationService;
+    directory: MindooTenantDirectory;
+    mindooTenant?: MindooTenant;
+    serverStores: Map<string, ServerNetworkContentAddressedStore>;
+}
+/**
+ * TenantManager is responsible for:
+ * - Loading the global server identity and trusted servers
+ * - Loading tenant configurations from disk
+ * - Caching loaded tenants
+ * - Registering new tenants
+ * - Managing tenant stores and authentication services
+ * - Creating a real MindooDB tenant for directory reading (when keys available)
+ * - Runtime management of trusted servers
+ */
+export declare class TenantManager {
+    private dataDir;
+    private serverPassword;
+    private cryptoAdapter;
+    private loadedTenants;
+    private serverIdentity;
+    private trustedServers;
+    constructor(dataDir: string, serverPassword?: string);
+    getServerIdentity(): PrivateUserId | null;
+    getServerPublicInfo(): TrustedServer | null;
+    listTrustedServers(): TrustedServer[];
+    addTrustedServer(server: TrustedServer): void;
+    removeTrustedServer(name: string): boolean;
+    private persistTrustedServers;
+    registerTenant(request: RegisterTenantRequest): TenantContext;
+    getTenant(tenantId: string): Promise<LoadedTenant>;
+    tenantExists(tenantId: string): boolean;
+    listTenants(): string[];
+    /**
+     * Update operator-owned fields of an existing tenant configuration.
+     * Only the fields present in `updates` are overwritten.
+     */
+    updateTenantConfig(tenantId: string, updates: Partial<Pick<TenantConfig, "defaultStoreType" | "remoteServers">>): void;
+    removeTenant(tenantId: string): void;
+    getTenantSyncServers(tenantId: string): NamedRemoteServerConfig[];
+    addTenantSyncServer(tenantId: string, server: NamedRemoteServerConfig): void;
+    removeTenantSyncServer(tenantId: string, serverName: string): boolean;
+    getServerStore(tenantId: string, dbId: string): Promise<ServerNetworkContentAddressedStore>;
+    getStore(tenantId: string, dbId: string): Promise<ContentAddressedStore>;
+    getAuthService(tenantId: string): Promise<AuthenticationService>;
+    getCryptoAdapter(): NodeCryptoAdapter;
+    reloadTenant(tenantId: string): Promise<LoadedTenant>;
+    clearCache(): void;
+    private loadTenant;
+    /**
+     * Create a real BaseMindooTenant for directory reading using the global
+     * server identity.
+     */
+    private createDirectoryTenant;
+}
+export {};
+//# sourceMappingURL=TenantManager.d.ts.map

package/dist/node/server/TenantManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantManager.d.ts","sourceRoot":"","sources":["../../../src/node/server/TenantManager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAKH,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,2DAA2D,CAAC;AAClG,OAAO,EAAE,kCAAkC,EAAE,MAAM,mEAAmE,CAAC;AAGvH,OAAO,KAAK,EACV,YAAY,EACZ,qBAAqB,EACrB,qBAAqB,EAKtB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEvD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,KAAK,EACV,YAAY,EACZ,aAAa,EACb,qBAAqB,EAErB,aAAa,EACb,uBAAuB,EACxB,MAAM,SAAS,CAAC;AAMjB,UAAU,YAAY;IACpB,OAAO,EAAE,aAAa,CAAC;IACvB,YAAY,EAAE,YAAY,CAAC;IAC3B,WAAW,EAAE,qBAAqB,CAAC;IACnC,SAAS,EAAE,qBAAqB,CAAC;IACjC,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,kCAAkC,CAAC,CAAC;CAC/D;AAuKD;;;;;;;;;GASG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,cAAc,CAAqB;IAC3C,OAAO,CAAC,aAAa,CAAoB;IACzC,OAAO,CAAC,aAAa,CAAwC;IAE7D,OAAO,CAAC,cAAc,CAA8B;IACpD,OAAO,CAAC,cAAc,CAAuB;gBAEjC,OAAO,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM;IA+BpD,iBAAiB,IAAI,aAAa,GAAG,IAAI;IAIzC,mBAAmB,IAAI,aAAa,GAAG,IAAI;IAa3C,kBAAkB,IAAI,aAAa,EAAE;IAIrC,gBAAgB,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI;IAY7C,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAW1C,OAAO,CAAC,qBAAqB;IAS7B,cAAc,CAAC,OAAO,EAAE,qBAAqB,GAAG,aAAa;IA6BvD,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAcxD,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAOvC,WAAW,IAAI,MAAM,EAAE;IAoBvB;;;OAGG;IACH,kBAAkB,CAChB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,kBAAkB,GAAG,eAAe,CAAC,CAAC,GACzE,IAAI;IAoBP,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAkBpC,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,uBAAuB,EAAE;IAUjE,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,uBAAuB,GAAG,IAAI;IAyB5E,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO;IA2B/D,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,kCAAkC,CAAC;IAsB3F,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAKxE,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAKtE,gBAAgB,IAAI,iBAAiB;IAI/B,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAM3D,UAAU,IAAI,IAAI;YASJ,UAAU;IAqExB;;;OAGG;YACW,qBAAqB;CAyCpC"}