mindoodb 0.0.85 → 0.0.88

package/dist/server/SystemAdminAuth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SystemAdminAuth.js","sourceRoot":"","sources":["../../src/server/SystemAdminAuth.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;;AAEH,gEAAgG;AAGhG,iDAGwB;AAsBxB,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E,MAAa,sBAAsB;IAoBjC,YACE,aAA4B,EAC5B,MAAoB,EACpB,OAKC;QA3BK,eAAU,GAAiC,IAAI,GAAG,EAAE,CAAC;QA6B3D,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,IAAI,CAAC,UAAU,GAAG,IAAA,mCAAoB,EAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,CAAC,oCAAoC;YACvC,IAAA,iDAAkC,EAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,uBAAuB,GAAG,OAAO,EAAE,uBAAuB,CAAC;QAChE,IAAI,CAAC,SAAS;YACZ,OAAO,EAAE,SAAS,IAAI,aAAa,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1E,IAAI,CAAC,qBAAqB,GAAG,OAAO,EAAE,qBAAqB,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAC7E,IAAI,CAAC,iBAAiB,GAAG,OAAO,EAAE,iBAAiB,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACxE,CAAC;IAED;;;;OAIG;IACH,gBAAgB,CAAC,MAAoB;QACnC,IAAI,CAAC,UAAU,GAAG,IAAA,mCAAoB,EAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,CAAC,oCAAoC;YACvC,IAAA,iDAAkC,EAAC,MAAM,CAAC,CAAC;IAC/C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,iBAAiB,CACrB,QAAgB,EAChB,aAAqB;QAErB,MAAM,kBAAkB,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;QAElD,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAChC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,kBAAkB;YAC/C,CAAC,CAAC,aAAa,KAAK,aAAa,CACpC,CAAC;QACF,IACE,CAAC,KAAK;YACN,CAAC,IAAI,CAAC,oCAAoC;YAC1C,CAAC,IAAI,CAAC,uBAAuB,EAAE,CAAC,aAAa,CAAC,EAC9C,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,SAAS,GAAG,IAAA,kCAAkB,GAAE,CAAC;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,EAAE;YAC7B,SAAS;YACT,QAAQ;YACR,aAAa;YACb,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG,GAAG,IAAI,CAAC,qBAAqB;YAC3C,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;QAEH,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAChC,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC9B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY,CAChB,SAAiB,EACjB,SAAqB;QAErB,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC;QACrE,CAAC;QAED,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;YAClC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAClC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;QACxD,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAChB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC;QAC7D,CAAC;QAED,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC;QAEnB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CACxC,SAAS,EACT,SAAS,EACT,MAAM,CAAC,aAAa,CACrB,CAAC;QAEF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;QACxD,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;QAC9E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CACjB,KAAa;QAEb,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAEpC,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,CAAC,GAAG,KAAK,CAAC;QAEpD,IAAI,CAAC;YACH,uEAAuE;YACvE,6DAA6D;YAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAqB,CAAC;YAC/E,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO;gBAAE,OAAO,IAAI,CAAC;YAExC,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,CAAC;YAC9C,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,IAAI,CAAC,SAAS,CAAC,MAAqB,EACpC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;YAEF,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAC3C,GAAG,SAAS,IAAI,UAAU,EAAE,CAC7B,CAAC;YACF,MAAM,GAAG,GAAG,IAAI,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC;YAErD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CACjC,MAAM,EACN,UAAU,EACV,GAAG,CAAC,MAAM,CAAC,KAAK,CACd,GAAG,CAAC,UAAU,EACd,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,UAAU,CACjB,EAChB,YAAY,CAAC,MAAqB,CACnC,CAAC;YAEF,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAE1B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACxB,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CACN,CAAC;YAE7B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YAC1C,IAAI,OAAO,CAAC,GAAG,GAAG,GAAG;gBAAE,OAAO,IAAI,CAAC;YAEnC,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,kBAAkB;IAClB,0EAA0E;IAElE,KAAK,CAAC,eAAe,CAC3B,OAAe,EACf,SAAqB,EACrB,YAAoB;QAEpB,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,CAAC;QAE9C,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,YAAY;iBAC7B,OAAO,CAAC,6BAA6B,EAAE,EAAE,CAAC;iBAC1C,OAAO,CAAC,2BAA2B,EAAE,EAAE,CAAC;iBACxC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAEtB,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC;YAErD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,SAAS,CACtC,MAAM,EACN,OAAO,CAAC,MAAqB,EAC7B,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;YAEF,OAAO,MAAM,IAAA,4CAA4B,EAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QACnF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,aAAa,CACzB,QAAgB,EAChB,aAAqB;QAErB,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAE1C,MAAM,OAAO,GAA4B;YACvC,GAAG,EAAE,QAAQ;YACb,aAAa;YACb,GAAG,EAAE,GAAG;YACR,GAAG,EAAE,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;SACrD,CAAC;QAEF,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;QAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QAEjE,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,IAAI,CAAC,SAAS,CAAC,MAAqB,EACpC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;QAEF,MAAM,UAAU,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CACzC,GAAG,SAAS,IAAI,UAAU,EAAE,CAC7B,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,IAAI,CACjC,MAAM,EACN,UAAU,EACV,UAAU,CAAC,MAAqB,CACjC,CAAC;QAEF,MAAM,YAAY,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;QAC3E,OAAO,GAAG,SAAS,IAAI,UAAU,IAAI,YAAY,EAAE,CAAC;IACtD,CAAC;IAEO,wBAAwB;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACxC,IAAI,EAAE,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;gBACvB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,sBAAsB;QAC5B,IAAI,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,sBAAsB,CAAC,cAAc,CAAC;QAC5E,IAAI,QAAQ,IAAI,CAAC;YAAE,OAAO;QAC1B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;YACzC,IAAI,QAAQ,EAAE,IAAI,CAAC;gBAAE,MAAM;YAC3B,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,mBAAmB;IAEX,eAAe,CAAC,GAAW;QACjC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QACzB,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC1E,CAAC;IAEO,eAAe,CAAC,GAAW;QACjC,IAAI,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACvD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,IAAI,GAAG,CAAC;QACxC,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;IAEO,qBAAqB,CAAC,KAAiB;QAC7C,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1C,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5B,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC1E,CAAC;IAEO,qBAAqB,CAAC,GAAW;QACvC,IAAI,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACvD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,IAAI,GAAG,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,kBAAkB,CAAC,MAAc;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;;AAjUH,wDAkUC;AAhUC;;;GAGG;AACqB,qCAAc,GAAG,KAAM,AAAT,CAAU"}

package/dist/server/TenantManager.d.ts

@@ -0,0 +1,366 @@
+/**
+ * TenantManager handles loading, caching, and registration of tenants.
+ *
+ * Uses a global server identity (one per server, not per tenant) for
+ * authenticating with remote servers and opening tenant directories.
+ *
+ * When a tenant has a $publicinfos key (sent during publishToServer), the
+ * manager creates a real BaseMindooTenant for directory reading. User
+ * authentication is then validated against the admin-signed directory DB
+ * rather than a static JSON config.
+ *
+ * When no $publicinfos key is available, a SimpleMindooDirectory backed
+ * by config.json users[] is used as a fallback (useful for tests).
+ *
+ * A CompositeMindooDirectory wraps whichever directory source is used and
+ * also checks the global trusted-servers list, enabling server-to-server
+ * auth without servers being in each tenant's user directory.
+ */
+import { AuthenticationService } from "../core/appendonlystores/network/AuthenticationService";
+import { ServerNetworkContentAddressedStore } from "../appendonlystores/network/ServerNetworkContentAddressedStore";
+import type { ServerPeerTokenResolver, ServerTrustedWitnessResolver } from "../appendonlystores/network/ServerNetworkContentAddressedStore";
+import type { WitnessSigner } from "../core/crypto/WitnessReceipt";
+import type { TimestampProvider } from "../core/accesscontrol/timestamp/TimestampProvider";
+import type { MindooTenant, MindooTenantDirectory, ContentAddressedStore, DirectoryUserLookup } from "../core/types";
+import { StoreKind } from "../core/types";
+import type { PrivateUserId } from "../core/userid";
+import type { CryptoAdapter } from "../core/crypto/CryptoAdapter";
+import type { ServerDataStore, ServerStoreProvider, TenantStoreFactory } from "./ServerDataStore";
+import type { TenantConfig, TenantContext, RegisterTenantRequest, TrustedServer } from "./types";
+export interface LoadedTenant {
+    context: TenantContext;
+    storeFactory: TenantStoreFactory;
+    authService: AuthenticationService;
+    directory: MindooTenantDirectory;
+    mindooTenant?: MindooTenant;
+    serverStores: Map<string, ServerNetworkContentAddressedStore>;
+}
+export interface RegisterTenantResult {
+    context: TenantContext;
+    created: boolean;
+}
+export declare class SimpleMindooDirectory implements Pick<MindooTenantDirectory, "getUserPublicKeys" | "isUserRevoked" | "validatePublicSigningKey" | "getUserBySigningPublicKey"> {
+    /** Canonical index: entries are identified by their signing public key. */
+    private usersByKey;
+    /**
+     * Backward-compat index by documentation-only username, populated only for
+     * config entries that carry a `username`. Lets legacy username-based
+     * challenges keep resolving; `username` is never required.
+     */
+    private usersByUsername;
+    private revokedUsers;
+    private adminSigningPublicKey;
+    constructor(config: TenantConfig);
+    getUserPublicKeys(username: string): Promise<{
+        signingPublicKey: string;
+        encryptionPublicKey: string;
+    } | null>;
+    getUserBySigningPublicKey(publicKey: string): Promise<DirectoryUserLookup | null>;
+    private toLookup;
+    isUserRevoked(username: string): Promise<boolean>;
+    validatePublicSigningKey(publicKey: string, _opts?: {
+        forceRefresh?: boolean;
+    }): Promise<boolean>;
+}
+export interface TenantManagerOptions {
+    /** Server identity, trusted servers, key bag and tenant configs. */
+    dataStore: ServerDataStore;
+    /** Content-addressed stores of every tenant database. */
+    storeProvider: ServerStoreProvider;
+    cryptoAdapter: CryptoAdapter;
+    /** Unlocks the server identity's private keys and the server key bag. */
+    serverPassword?: string;
+    /**
+     * HMAC secret for a tenant's sync tokens. Without it every loaded tenant
+     * gets a random secret, so tokens die with the process — fine for one
+     * server process, wrong for a host that spreads one tenant over several
+     * instances which must accept each other's tokens.
+     */
+    jwtSecretForTenant?: (tenantId: string) => Promise<Uint8Array>;
+    /**
+     * Source of a tenant's `$publicinfos` keys when they are not kept in this
+     * manager's own `server.keybag` (e.g. a host instance that serves one
+     * tenant database and gets the keys from a central registry).
+     */
+    publicInfosKeysResolver?: (tenantId: string) => Promise<Uint8Array[]>;
+}
+export interface ExecutePendingPurgesOptions {
+    /**
+     * Only purge in these databases; requests for other databases stay
+     * unprocessed in this manager's registry. For hosts that serve a subset of
+     * a tenant's databases per instance.
+     */
+    dbIds?: ReadonlySet<string>;
+}
+/**
+ * TenantManager is responsible for:
+ * - Loading the global server identity and trusted servers
+ * - Loading tenant configurations from disk
+ * - Caching loaded tenants
+ * - Registering new tenants
+ * - Managing tenant stores and authentication services
+ * - Creating a real MindooDB tenant for directory reading (when keys available)
+ * - Runtime management of trusted servers
+ */
+export declare class TenantManager {
+    private readonly dataStore;
+    private readonly storeProvider;
+    private serverPassword;
+    private cryptoAdapter;
+    private readonly jwtSecretForTenant;
+    private readonly publicInfosKeysResolver;
+    private loadedTenants;
+    private serverIdentity;
+    private trustedServers;
+    /** Lazily-built, cached witness signer (server's Ed25519 signing identity). */
+    private witnessSigner;
+    /** Lazily-imported RSA private key for peer replication (see getServerEncryptionPrivateKey). */
+    private serverEncryptionPrivateKey;
+    /** Peer wiring handed down to every server store; see setPeerAccessControl. */
+    private peerAccessControl;
+    /** Per-tenant persistent registry of executed purges (docs/accesscontrol.md §13). */
+    private purgedDocRegistries;
+    /** In-flight purge executions, keyed by normalized tenant id (serializes runs). */
+    private purgeInFlight;
+    constructor(options: TenantManagerOptions);
+    getServerIdentity(): PrivateUserId | null;
+    getServerPublicInfo(): TrustedServer | null;
+    /**
+     * Teach every server store how to recognise a trusted peer.
+     *
+     * `MindooDBServer` calls this once at startup. Two hooks, both required for
+     * peer replication to be correct:
+     *
+     * - `peerTokenResolver` lets a peer's cluster-level JWT through the tenant
+     *   sync routes. A peer holds no per-tenant grant, so without it the mirror
+     *   would need a second replication protocol; with it the peer reuses the
+     *   client one and the store skips the per-user gates that do not apply to a
+     *   full replica.
+     * - `trustedWitnessResolver` decides whose witness receipts may be preserved
+     *   instead of re-stamped (convergence invariant 3). Without it a replicated
+     *   entry would get a fresh `receivedAt` on every hop and "trusted time"
+     *   would mean "time it reached the last server".
+     *
+     * Must be called before the first {@link getServerStore}, since stores are
+     * cached per tenant and database.
+     */
+    setPeerAccessControl(options: {
+        peerTokenResolver?: ServerPeerTokenResolver;
+        trustedWitnessResolver?: ServerTrustedWitnessResolver;
+    }): void;
+    /**
+     * Database ids this server holds for a tenant (on Node, the directories in
+     * `{dataDir}/{tenantId}/stores`). Used by peer replication to mirror every
+     * database rather than a configured subset.
+     */
+    listDatabases(tenantId: string): string[];
+    /**
+     * The server's own RSA private key, imported for decryption.
+     *
+     * Peer replication needs it because the remote wraps transported entries to
+     * this server's `encryptionPublicKey` (the one in its `trusted-servers.json`),
+     * exactly as it would wrap them for a client.
+     */
+    getServerEncryptionPrivateKey(): Promise<CryptoKey | undefined>;
+    /**
+     * Build (and cache) the server's witness identity used to stamp receipts on
+     * accepted entries (docs/accesscontrol.md §5.3). Returns undefined when the
+     * server identity or its unlock password is unavailable, in which case the
+     * server runs in pre-access-control mode (no stamping, no Tier 1 advertised).
+     */
+    getWitnessSigner(): Promise<WitnessSigner | undefined>;
+    /**
+     * Build the trusted-time provider that stamps receipts on accepted entries
+     * (docs/accesscontrol.md §5.3, §13). v1 wraps the server's Ed25519 witness
+     * identity; returns undefined when no witness signer is available, leaving the
+     * server in pre-access-control mode.
+     */
+    getTimestampProvider(): Promise<TimestampProvider | undefined>;
+    listTrustedServers(): TrustedServer[];
+    addTrustedServer(server: TrustedServer): void;
+    /**
+     * Add or replace a trusted server by name.
+     *
+     * Peer CRUD needs an upsert: `addTrustedServer` throws on an existing name,
+     * which is right for `add-to-network` (a silent overwrite of a peer's keys
+     * would be a trust change disguised as a config edit) but wrong for the admin
+     * API, where changing a peer's url or role is the common case.
+     */
+    saveTrustedServer(server: TrustedServer): void;
+    removeTrustedServer(name: string): boolean;
+    private persistTrustedServers;
+    private loadServerKeyBag;
+    private createServerKeyBag;
+    private saveServerKeyBag;
+    private bytesToBase64;
+    private mergeUniqueKeys;
+    private computePublicInfosFingerprint;
+    /**
+     * The data-store key of a tenant's directory. Tenant ids reach this from
+     * request paths, so anything that could address another key is refused.
+     */
+    private tenantKey;
+    private tenantConfigKey;
+    private readTenantConfig;
+    private writeTenantConfig;
+    private decryptEncryptedPublicInfosKey;
+    private resolveIncomingPublicInfosKey;
+    private getStoredPublicInfosKeys;
+    private persistTenantPublicInfosKey;
+    /**
+     * All stored `$publicinfos` AES key versions for a tenant from `server.keybag`.
+     * Empty when the tenant was never published or the server keybag is locked.
+     */
+    getPublicInfosKeysForTenant(tenantId: string): Promise<Uint8Array[]>;
+    listTenantPublicInfosFingerprints(tenantId: string): Promise<string[]>;
+    registerTenant(request: RegisterTenantRequest): Promise<RegisterTenantResult>;
+    getTenant(tenantId: string): Promise<LoadedTenant>;
+    tenantExists(tenantId: string): boolean;
+    /**
+     * Read the tenant's registered admin signing key without fully loading the
+     * tenant. Returns `null` if the tenant is missing or the config is unreadable.
+     */
+    getTenantAdminSigningPublicKey(tenantId: string): string | null;
+    /**
+     * True when `publicsignkey` is the registered tenant-admin signing key for
+     * `tenantId` (PEM whitespace-insensitive).
+     */
+    isTenantAdminSigningKeyFor(tenantId: string, publicsignkey: string): boolean;
+    /**
+     * True when `publicsignkey` is the registered admin signing key of any
+     * tenant on this server. Used to issue a system JWT so that admin can
+     * DELETE their own tenant; other `/system/*` routes stay capability-gated.
+     */
+    isRegisteredTenantAdminSigningKey(publicsignkey: string): boolean;
+    listTenants(): string[];
+    /**
+     * Update operator-owned fields of an existing tenant configuration.
+     * Only the fields present in `updates` are overwritten.
+     */
+    updateTenantConfig(tenantId: string, updates: Partial<Pick<TenantConfig, "defaultStoreType">>): void;
+    removeTenant(tenantId: string): Promise<void>;
+    getServerStore(tenantId: string, dbId: string, storeKind: StoreKind): Promise<ServerNetworkContentAddressedStore>;
+    /**
+     * Build a Tier 1 evaluator closure for a server store, or undefined when the
+     * directory cannot evaluate access (e.g. config-based directory without the
+     * access-control state chain). The closure resolves `$author` for non-create
+     * ops by reading the document's `doc_create` entry creator key from the local
+     * store (metadata only, no decryption) and comparing it to the change author.
+     */
+    /**
+     * The witness's Tier 1 gate. The evaluation itself is shared with the peer
+     * listener, which has to run it for entries that never reach a witness at
+     * all — see `core/accesscontrol/tier1Evaluator.ts`.
+     */
+    private buildTier1Evaluator;
+    /**
+     * Builtin `userdirectory` write invariant: admin may create/delete, only the
+     * owning person may change. `username_hash` is read from the decrypted
+     * `doc_create` payload (`$publicinfos`). Personal documents are sealed to
+     * their owner and therefore undecryptable here, so they are owned by whoever
+     * signed their `doc_create` — `resolveCreatorSigningKey` answers that from
+     * the entry chain alone.
+     */
+    private buildUserdirectoryWriteContext;
+    /**
+     * Read-scope resolver (§6.12): `null` (reads everything) unless the
+     * database's `docReadScope` is `"own"` for this principal; then the principal
+     * sees documents whose creator is the same person (grant level).
+     */
+    private buildReadScopeResolver;
+    /** Finds a document's `doc_create` creator in the given (docs) store. */
+    private buildDocCreatorResolver;
+    private findCreateEntry;
+    /**
+     * Build a database-open evaluator closure for a server store, or undefined
+     * when the directory cannot evaluate the database-open policy (e.g. a
+     * config-based directory without the access-control state chain). When the
+     * tenant policy is `"directory-restricted"`, this rejects sync for any
+     * database id that is not in the allowlist; `"directory"` is always allowed
+     * and the tenant admin is exempt (resolved from the principal signing key).
+     */
+    private buildDbAccessEvaluator;
+    /**
+     * Like {@link buildDbAccessEvaluator}, but reports read / deposit / none
+     * (docs/accesscontrol.md §6.10). Undefined when the directory predates it,
+     * in which case the boolean evaluator stays in charge.
+     */
+    private buildDbAccessModeEvaluator;
+    /**
+     * Build a remote-wipe resolver closure for a server store, or undefined when
+     * the directory does not support wipe directives (docs/accesscontrol.md §6.5).
+     * Maps a wipe-targeted signing key to the admin-signed grant document id so
+     * the server can serve only that document to the targeted device.
+     */
+    private buildWipeGrantDocIdResolver;
+    /**
+     * Build a per-user revoked-key blacklist resolver for a server store, or
+     * undefined when the directory cannot resolve revoked keys (e.g. a
+     * config-based directory). Maps the authenticated principal's signing key to
+     * the set of decryption key ids revoked for them at the directory head
+     * (docs/accesscontrol.md §13).
+     */
+    private buildRevokedKeyResolver;
+    getStore(tenantId: string, dbId: string, storeKind: StoreKind): Promise<ContentAddressedStore>;
+    /**
+     * Documents purged from `dbId` on this server (the persistent purge
+     * registry). Peer pull replication refuses their entries.
+     */
+    getPurgedDocIds(tenantId: string, dbId: string): ReadonlySet<string>;
+    /** The (lazily-loaded, cached) purge registry for a tenant. */
+    private getPurgedDocRegistry;
+    /**
+     * Execute any not-yet-processed document-history purge requests for a tenant
+     * (docs/accesscontrol.md §13). Reads the admin-signed purge requests from the
+     * tenant directory (server-readable `$publicinfos` envelope), physically
+     * purges each requested document's history from the tenant's `docs` and
+     * `attachments` stores, and records the purge in the persistent registry so
+     * (a) it is never executed twice and (b) re-pushes of the purged docs are
+     * rejected at sync time.
+     *
+     * No-op when the server cannot read the directory (config-based fallback, or
+     * the directory does not expose the purge reader). Runs are serialized per
+     * tenant; concurrent callers share the in-flight promise.
+     */
+    executePendingPurges(tenantId: string, options?: ExecutePendingPurgesOptions): Promise<void>;
+    private executePendingPurgesInternal;
+    /**
+     * The push check for purge requests in a personal database (§6.11): a
+     * `$publicinfos` create, signed by someone with read access to the database
+     * (a device of the owner, a service with a matching `accessPrefixes` grant,
+     * the tenant admin), naming only documents that are deleted (last
+     * delete/undelete is a delete, on the server or in the same push). Purge
+     * requests themselves cannot be purged, changed or deleted.
+     */
+    private buildPurgeRequestValidator;
+    /**
+     * Executes the purge requests of one personal database (§6.11): every
+     * document a request names is put on the denylist and removed from the docs
+     * and attachment stores. Called after accepted writes to the database;
+     * requests already executed are skipped. Serialized per database.
+     */
+    executePersonalPurges(tenantId: string, dbId: string): Promise<void>;
+    private executePersonalPurgesInternal;
+    /**
+     * Purge one document from a database's docs and attachment stores. Attachment
+     * chunks still referenced by another document are kept (see
+     * `purgeDocumentHistory.ts`). Failures are logged, never thrown.
+     */
+    private purgeDocumentFromDatabase;
+    getAuthService(tenantId: string): Promise<AuthenticationService>;
+    getCryptoAdapter(): CryptoAdapter;
+    reloadTenant(tenantId: string): Promise<LoadedTenant>;
+    clearCache(): void;
+    private loadTenant;
+    /**
+     * Create a real BaseMindooTenant for directory reading using the global
+     * server identity.
+     */
+    private createDirectoryTenant;
+}
+/**
+ * A store that is only created when something other than its identity
+ * (`getId`, `getStoreKind`) is used. See {@link TenantManager.getServerStore}.
+ */
+export declare function lazyContentAddressedStore(dbId: string, storeKind: StoreKind, create: () => ContentAddressedStore): ContentAddressedStore;
+//# sourceMappingURL=TenantManager.d.ts.map

package/dist/server/TenantManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantManager.d.ts","sourceRoot":"","sources":["../../src/server/TenantManager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAC/F,OAAO,EAAE,kCAAkC,EAAE,MAAM,gEAAgE,CAAC;AACpH,OAAO,KAAK,EAUV,uBAAuB,EACvB,4BAA4B,EAC7B,MAAM,gEAAgE,CAAC;AAGxE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAEnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mDAAmD,CAAC;AAO3F,OAAO,KAAK,EACV,YAAY,EACZ,qBAAqB,EACrB,qBAAqB,EAMrB,mBAAmB,EAGpB,MAAM,eAAe,CAAC;AACvB,OAAO,EAEL,SAAS,EAEV,MAAM,eAAe,CAAC;AAYvB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAGlE,OAAO,KAAK,EACV,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EACV,YAAY,EACZ,aAAa,EACb,qBAAqB,EAErB,aAAa,EACd,MAAM,SAAS,CAAC;AAMjB,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,aAAa,CAAC;IACvB,YAAY,EAAE,kBAAkB,CAAC;IACjC,WAAW,EAAE,qBAAqB,CAAC;IACnC,SAAS,EAAE,qBAAqB,CAAC;IACjC,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,kCAAkC,CAAC,CAAC;CAC/D;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,aAAa,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC;CAClB;AAuBD,qBAAa,qBAAsB,YAAW,IAAI,CAChD,qBAAqB,EACnB,mBAAmB,GACnB,eAAe,GACf,0BAA0B,GAC1B,2BAA2B,CAC9B;IACC,2EAA2E;IAC3E,OAAO,CAAC,UAAU,CAAsC;IACxD;;;;OAIG;IACH,OAAO,CAAC,eAAe,CAAsC;IAC7D,OAAO,CAAC,YAAY,CAA0B;IAC9C,OAAO,CAAC,qBAAqB,CAAS;gBAE1B,MAAM,EAAE,YAAY;IAe1B,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QACjD,gBAAgB,EAAE,MAAM,CAAC;QACzB,mBAAmB,EAAE,MAAM,CAAC;KAC7B,GAAG,IAAI,CAAC;IAeH,yBAAyB,CAC7B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAetC,OAAO,CAAC,QAAQ;IAeV,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIjD,wBAAwB,CAC5B,SAAS,EAAE,MAAM,EACjB,KAAK,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAA;KAAE,GACjC,OAAO,CAAC,OAAO,CAAC;CAgBpB;AAyUD,MAAM,WAAW,oBAAoB;IACnC,oEAAoE;IACpE,SAAS,EAAE,eAAe,CAAC;IAC3B,yDAAyD;IACzD,aAAa,EAAE,mBAAmB,CAAC;IACnC,aAAa,EAAE,aAAa,CAAC;IAC7B,yEAAyE;IACzE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/D;;;;OAIG;IACH,uBAAuB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;CACvE;AAED,MAAM,WAAW,2BAA2B;IAC1C;;;;OAIG;IACH,KAAK,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC7B;AAED;;;;;;;;;GASG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkB;IAC5C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAsB;IACpD,OAAO,CAAC,cAAc,CAAqB;IAC3C,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA6C;IAChF,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAkD;IAC1F,OAAO,CAAC,aAAa,CAAwC;IAE7D,OAAO,CAAC,cAAc,CAA8B;IACpD,OAAO,CAAC,cAAc,CAAuB;IAC7C,+EAA+E;IAC/E,OAAO,CAAC,aAAa,CAA4B;IACjD,gGAAgG;IAChG,OAAO,CAAC,0BAA0B,CAAwB;IAC1D,+EAA+E;IAC/E,OAAO,CAAC,iBAAiB,CAGlB;IACP,qFAAqF;IACrF,OAAO,CAAC,mBAAmB,CAA6C;IACxE,mFAAmF;IACnF,OAAO,CAAC,aAAa,CAAyC;gBAElD,OAAO,EAAE,oBAAoB;IAmCzC,iBAAiB,IAAI,aAAa,GAAG,IAAI;IAIzC,mBAAmB,IAAI,aAAa,GAAG,IAAI;IAW3C;;;;;;;;;;;;;;;;;;OAkBG;IACH,oBAAoB,CAAC,OAAO,EAAE;QAC5B,iBAAiB,CAAC,EAAE,uBAAuB,CAAC;QAC5C,sBAAsB,CAAC,EAAE,4BAA4B,CAAC;KACvD,GAAG,IAAI;IAIR;;;;OAIG;IACH,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE;IAIzC;;;;;;OAMG;IACG,6BAA6B,IAAI,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC;IAsBrE;;;;;OAKG;IACG,gBAAgB,IAAI,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;IA0B5D;;;;;OAKG;IACG,oBAAoB,IAAI,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC;IAUpE,kBAAkB,IAAI,aAAa,EAAE;IAIrC,gBAAgB,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI;IAY7C;;;;;;;OAOG;IACH,iBAAiB,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI;IAa9C,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAW1C,OAAO,CAAC,qBAAqB;YAOf,gBAAgB;YAiBhB,kBAAkB;YAgBlB,gBAAgB;IAI9B,OAAO,CAAC,aAAa;IAIrB,OAAO,CAAC,eAAe;YAcT,6BAA6B;IAW3C;;;OAGG;IACH,OAAO,CAAC,SAAS;IAejB,OAAO,CAAC,eAAe;IAIvB,OAAO,CAAC,gBAAgB;IAKxB,OAAO,CAAC,iBAAiB;YAOX,8BAA8B;YAqC9B,6BAA6B;YAgB7B,wBAAwB;YAoBxB,2BAA2B;IAoBzC;;;OAGG;IACG,2BAA2B,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAIpE,iCAAiC,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAiBtE,cAAc,CAClB,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,oBAAoB,CAAC;IAwD1B,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAcxD,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAKvC;;;OAGG;IACH,8BAA8B,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAoB/D;;;OAGG;IACH,0BAA0B,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO;IAK5E;;;;OAIG;IACH,iCAAiC,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO;IASjE,WAAW,IAAI,MAAM,EAAE;IAOvB;;;OAGG;IACH,kBAAkB,CAChB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC,GACvD,IAAI;IAgBD,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA4B7C,cAAc,CAClB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,SAAS,GACnB,OAAO,CAAC,kCAAkC,CAAC;IA6G9C;;;;;;OAMG;IACH;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IAU3B;;;;;;;OAOG;IACH,OAAO,CAAC,8BAA8B;IA8BtC;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAoC9B,yEAAyE;IACzE,OAAO,CAAC,uBAAuB;YAUjB,eAAe;IAkB7B;;;;;;;OAOG;IACH,OAAO,CAAC,sBAAsB;IAkB9B;;;;OAIG;IACH,OAAO,CAAC,0BAA0B;IAalC;;;;;OAKG;IACH,OAAO,CAAC,2BAA2B;IASnC;;;;;;OAMG;IACH,OAAO,CAAC,uBAAuB;IAgBzB,QAAQ,CACZ,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,SAAS,GACnB,OAAO,CAAC,qBAAqB,CAAC;IAKjC;;;OAGG;IACH,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC;IAIpE,+DAA+D;IAC/D,OAAO,CAAC,oBAAoB;IAa5B;;;;;;;;;;;;OAYG;IACG,oBAAoB,CACxB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,2BAA2B,GACpC,OAAO,CAAC,IAAI,CAAC;YAWF,4BAA4B;IAwF1C;;;;;;;OAOG;IACH,OAAO,CAAC,0BAA0B;IAgDlC;;;;;OAKG;IACG,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAW5D,6BAA6B;IAgC3C;;;;OAIG;YACW,yBAAyB;IAqBjC,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAKtE,gBAAgB,IAAI,aAAa;IAI3B,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAM3D,UAAU,IAAI,IAAI;YASJ,UAAU;IAyFxB;;;OAGG;YACW,qBAAqB;CA6CpC;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,qBAAqB,GAClC,qBAAqB,CAevB"}