mindoodb 0.0.85 → 0.0.88

package/dist/server/rateLimits.js

@@ -0,0 +1,159 @@
+"use strict";
+/**
+ * Rate-limit resolution shared by the server's limiter tiers.
+ *
+ * Kept out of {@link MindooDBServer} so the interaction between the global net
+ * and the per-route tiers is testable on its own: it is the part that is easy
+ * to get wrong, and getting it wrong is silent — a global cap below a tier cap
+ * simply replaces that tier, and the tier's configuration stops meaning
+ * anything.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PEER_RATE_LIMIT = exports.DEVICE_DISCOVERY_RATE_LIMIT = exports.DEFAULT_SYSTEM_RATE_LIMIT_MAX = exports.DEFAULT_SYSTEM_RATE_LIMIT_WINDOW_MS = exports.TIMESTAMP_DAILY_WINDOW_MS = exports.DEFAULT_TIMESTAMP_DAILY_LIMIT_MAX = exports.DEFAULT_TIMESTAMP_RATE_LIMIT_MAX = exports.DEFAULT_TIMESTAMP_RATE_LIMIT_WINDOW_MS = exports.GLOBAL_RATE_LIMIT_TIER_HEADROOM = exports.DEFAULT_GLOBAL_RATE_LIMIT_WINDOW_MS = exports.DEFAULT_SYNC_RATE_LIMIT_MAX = exports.DEFAULT_SYNC_RATE_LIMIT_WINDOW_MS = exports.DEFAULT_AUTH_RATE_LIMIT_MAX = exports.DEFAULT_AUTH_RATE_LIMIT_WINDOW_MS = void 0;
+exports.resolveGlobalRateLimit = resolveGlobalRateLimit;
+exports.buildSyncRateLimitKey = buildSyncRateLimitKey;
+exports.resolveServerRateLimits = resolveServerRateLimits;
+exports.buildAuthRateLimitKey = buildAuthRateLimitKey;
+exports.buildTimestampRateLimitKey = buildTimestampRateLimitKey;
+/**
+ * Resolve the global limiter against the tiers it is supposed to back up.
+ *
+ * Without an explicit `rateLimits.global`, the ceiling is derived from the
+ * tiers so the net catches only traffic no tier claims. An explicit value is
+ * honoured — an operator may want a hard cap — but reported as shadowing so
+ * the caller can say so at startup instead of leaving it to be discovered as
+ * mysterious 429s.
+ */
+function resolveGlobalRateLimit(configured, tiers) {
+    const windowMs = configured?.windowMs ?? tiers.defaultWindowMs;
+    // Tier windows need not match the global one; compare rates, not raw maxima.
+    const perWindow = (tier) => Math.ceil((tier.max / tier.windowMs) * windowMs);
+    const tierFloor = perWindow(tiers.sync) + perWindow(tiers.auth) + tiers.headroom;
+    if (configured?.max === undefined) {
+        return { windowMs, max: tierFloor, tierFloor, shadowsTiers: false };
+    }
+    return {
+        windowMs,
+        max: configured.max,
+        tierFloor,
+        shadowsTiers: configured.max < tierFloor,
+    };
+}
+/**
+ * Bucket key for the sync tier.
+ *
+ * The principal is what makes this usable behind a NAT or a CDN: keyed on the
+ * address alone, one client opening several databases spends everyone else's
+ * budget. The address stays in the key so that callers we could not
+ * authenticate still get separated per source rather than sharing one
+ * "anonymous" bucket.
+ */
+function buildSyncRateLimitKey(tenantId, principal, ip) {
+    return `sync:${tenantId ?? "unknown"}:${principal ?? "anonymous"}:${ip ?? "unknown"}`;
+}
+/**
+ * Rate-limit defaults. Auth and sync have separate tiers because a single
+ * challenge/authenticate handshake is two requests; with multiple tenants,
+ * store kinds, and token renewals the auth budget exhausts quickly if set
+ * too low. These can be overridden in config.json under `rateLimits.auth`
+ * and `rateLimits.sync`.
+ */
+exports.DEFAULT_AUTH_RATE_LIMIT_WINDOW_MS = 60000;
+exports.DEFAULT_AUTH_RATE_LIMIT_MAX = 120;
+exports.DEFAULT_SYNC_RATE_LIMIT_WINDOW_MS = 60000;
+/**
+ * Sync is keyed per authenticated principal, and a client legitimately opens
+ * several databases at once: a host like Teacher's Desk reads six, and a cold
+ * pass over one of them costs a few hundred batched requests. A budget sized
+ * for a single database turns that normal open into a throttled one.
+ */
+exports.DEFAULT_SYNC_RATE_LIMIT_MAX = 3000;
+/**
+ * The global limiter is a coarse net for unauthenticated floods and unknown
+ * routes; the per-tier limiters are the real budgets. It runs first, so a
+ * global max below a tier max silently replaces that tier — the sync budget
+ * was unreachable while this was a hardcoded 500. The default is therefore
+ * derived from the tiers, and an override that would shadow one is honoured
+ * but flagged at startup rather than quietly applied.
+ */
+exports.DEFAULT_GLOBAL_RATE_LIMIT_WINDOW_MS = 60000;
+exports.GLOBAL_RATE_LIMIT_TIER_HEADROOM = 500;
+/**
+ * Timestamping gets its own budget rather than sharing the sync one. Sync is
+ * chatty and high-volume; sealing a document is a deliberate, rare user action.
+ * Sharing a bucket would let ordinary sync traffic starve the seal endpoint, and
+ * a runaway seal loop degrade sync.
+ *
+ * The daily cap matters more than the burst cap: proxying collapses every user
+ * onto the server's IP, so one tenant can exhaust an upstream's per-IP allowance
+ * (open-tsa.eu publishes 60/minute) and lock out everyone else on this server.
+ */
+exports.DEFAULT_TIMESTAMP_RATE_LIMIT_WINDOW_MS = 60000;
+exports.DEFAULT_TIMESTAMP_RATE_LIMIT_MAX = 10;
+exports.DEFAULT_TIMESTAMP_DAILY_LIMIT_MAX = 500;
+exports.TIMESTAMP_DAILY_WINDOW_MS = 24 * 60 * 60 * 1000;
+/** `/system/*` admin routes: aggressive per-IP throttle. */
+exports.DEFAULT_SYSTEM_RATE_LIMIT_WINDOW_MS = 60000;
+exports.DEFAULT_SYSTEM_RATE_LIMIT_MAX = 30;
+/** Device discovery scans every local tenant per request. */
+exports.DEVICE_DISCOVERY_RATE_LIMIT = { windowMs: 60000, max: 10 };
+/** Server-to-server peer routes; replication must not crawl. */
+exports.PEER_RATE_LIMIT = { windowMs: 60000, max: 600 };
+function resolveServerRateLimits(rateLimits) {
+    const auth = {
+        windowMs: rateLimits?.auth?.windowMs ?? exports.DEFAULT_AUTH_RATE_LIMIT_WINDOW_MS,
+        max: rateLimits?.auth?.max ?? exports.DEFAULT_AUTH_RATE_LIMIT_MAX,
+    };
+    const sync = {
+        windowMs: rateLimits?.sync?.windowMs ?? exports.DEFAULT_SYNC_RATE_LIMIT_WINDOW_MS,
+        max: rateLimits?.sync?.max ?? exports.DEFAULT_SYNC_RATE_LIMIT_MAX,
+    };
+    const timestamps = rateLimits?.timestamps;
+    return {
+        global: resolveGlobalRateLimit(rateLimits?.global, {
+            sync,
+            auth,
+            defaultWindowMs: exports.DEFAULT_GLOBAL_RATE_LIMIT_WINDOW_MS,
+            headroom: exports.GLOBAL_RATE_LIMIT_TIER_HEADROOM,
+        }),
+        auth,
+        sync,
+        timestamp: {
+            windowMs: timestamps?.windowMs ?? exports.DEFAULT_TIMESTAMP_RATE_LIMIT_WINDOW_MS,
+            max: timestamps?.max ?? exports.DEFAULT_TIMESTAMP_RATE_LIMIT_MAX,
+            dailyMax: timestamps?.dailyMax ?? exports.DEFAULT_TIMESTAMP_DAILY_LIMIT_MAX,
+        },
+        system: {
+            windowMs: rateLimits?.system?.windowMs ?? exports.DEFAULT_SYSTEM_RATE_LIMIT_WINDOW_MS,
+            max: rateLimits?.system?.max ?? exports.DEFAULT_SYSTEM_RATE_LIMIT_MAX,
+        },
+        device: exports.DEVICE_DISCOVERY_RATE_LIMIT,
+        peer: exports.PEER_RATE_LIMIT,
+    };
+}
+/**
+ * Composite key for the auth tier. Challenge requests include the username so
+ * that brute-forcing one account doesn't block legitimate users on the same
+ * IP. Authenticate requests omit username because the challenge token is
+ * already scoped to a single principal.
+ */
+function buildAuthRateLimitKey(scope, phase, tenantId, clientIp, body) {
+    const tenant = scope === "tenant" ? tenantId ?? "-" : "system";
+    if (phase === "challenge") {
+        // Bucket by username when supplied, otherwise by the signing public key a
+        // key-based client identifies with, so key-based clients still get a
+        // stable per-principal bucket instead of all sharing "-".
+        const principal = typeof body?.username === "string" && body.username.trim()
+            ? body.username.trim().toLowerCase()
+            : typeof body?.signingPublicKey === "string" && body.signingPublicKey.trim()
+                ? body.signingPublicKey.trim()
+                : "-";
+        return `${scope}:${tenant}:${phase}:${clientIp}:${principal}`;
+    }
+    return `${scope}:${tenant}:${phase}:${clientIp}`;
+}
+/** Bucket key of the timestamp tiers: tenant + principal + IP. */
+function buildTimestampRateLimitKey(tier, tenantId, principal, clientIp) {
+    return `timestamp:${tier}:${tenantId ?? "unknown"}:${principal ?? "anonymous"}:${clientIp}`;
+}
+//# sourceMappingURL=rateLimits.js.map

package/dist/server/rateLimits.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rateLimits.js","sourceRoot":"","sources":["../../src/server/rateLimits.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;;AAyBH,wDAyBC;AAWD,sDAMC;AAmED,0DAiCC;AAQD,sDAsBC;AAGD,gEAOC;AA/LD;;;;;;;;GAQG;AACH,SAAgB,sBAAsB,CACpC,UAA4C,EAC5C,KAKC;IAED,MAAM,QAAQ,GAAG,UAAU,EAAE,QAAQ,IAAI,KAAK,CAAC,eAAe,CAAC;IAE/D,6EAA6E;IAC7E,MAAM,SAAS,GAAG,CAAC,IAAuB,EAAU,EAAE,CACpD,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC;IAEjF,IAAI,UAAU,EAAE,GAAG,KAAK,SAAS,EAAE,CAAC;QAClC,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;IACtE,CAAC;IACD,OAAO;QACL,QAAQ;QACR,GAAG,EAAE,UAAU,CAAC,GAAG;QACnB,SAAS;QACT,YAAY,EAAE,UAAU,CAAC,GAAG,GAAG,SAAS;KACzC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,qBAAqB,CACnC,QAA4B,EAC5B,SAA6B,EAC7B,EAAsB;IAEtB,OAAO,QAAQ,QAAQ,IAAI,SAAS,IAAI,SAAS,IAAI,WAAW,IAAI,EAAE,IAAI,SAAS,EAAE,CAAC;AACxF,CAAC;AAED;;;;;;GAMG;AACU,QAAA,iCAAiC,GAAG,KAAM,CAAC;AAC3C,QAAA,2BAA2B,GAAG,GAAG,CAAC;AAClC,QAAA,iCAAiC,GAAG,KAAM,CAAC;AACxD;;;;;GAKG;AACU,QAAA,2BAA2B,GAAG,IAAK,CAAC;AAEjD;;;;;;;GAOG;AACU,QAAA,mCAAmC,GAAG,KAAM,CAAC;AAC7C,QAAA,+BAA+B,GAAG,GAAG,CAAC;AAEnD;;;;;;;;;GASG;AACU,QAAA,sCAAsC,GAAG,KAAM,CAAC;AAChD,QAAA,gCAAgC,GAAG,EAAE,CAAC;AACtC,QAAA,iCAAiC,GAAG,GAAG,CAAC;AACxC,QAAA,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE7D,4DAA4D;AAC/C,QAAA,mCAAmC,GAAG,KAAM,CAAC;AAC7C,QAAA,6BAA6B,GAAG,EAAE,CAAC;AAEhD,6DAA6D;AAChD,QAAA,2BAA2B,GAAsB,EAAE,QAAQ,EAAE,KAAM,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;AAE5F,gEAAgE;AACnD,QAAA,eAAe,GAAsB,EAAE,QAAQ,EAAE,KAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAajF,SAAgB,uBAAuB,CACrC,UAA8C;IAE9C,MAAM,IAAI,GAAsB;QAC9B,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,IAAI,yCAAiC;QACzE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,IAAI,mCAA2B;KAC1D,CAAC;IACF,MAAM,IAAI,GAAsB;QAC9B,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,IAAI,yCAAiC;QACzE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,IAAI,mCAA2B;KAC1D,CAAC;IACF,MAAM,UAAU,GAAG,UAAU,EAAE,UAAU,CAAC;IAC1C,OAAO;QACL,MAAM,EAAE,sBAAsB,CAAC,UAAU,EAAE,MAAM,EAAE;YACjD,IAAI;YACJ,IAAI;YACJ,eAAe,EAAE,2CAAmC;YACpD,QAAQ,EAAE,uCAA+B;SAC1C,CAAC;QACF,IAAI;QACJ,IAAI;QACJ,SAAS,EAAE;YACT,QAAQ,EAAE,UAAU,EAAE,QAAQ,IAAI,8CAAsC;YACxE,GAAG,EAAE,UAAU,EAAE,GAAG,IAAI,wCAAgC;YACxD,QAAQ,EAAE,UAAU,EAAE,QAAQ,IAAI,yCAAiC;SACpE;QACD,MAAM,EAAE;YACN,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,IAAI,2CAAmC;YAC7E,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,IAAI,qCAA6B;SAC9D;QACD,MAAM,EAAE,mCAA2B;QACnC,IAAI,EAAE,uBAAe;KACtB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,qBAAqB,CACnC,KAA0B,EAC1B,KAAmC,EACnC,QAA4B,EAC5B,QAAgB,EAChB,IAAoE;IAEpE,MAAM,MAAM,GAAG,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;IAE/D,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;QAC1B,0EAA0E;QAC1E,qEAAqE;QACrE,0DAA0D;QAC1D,MAAM,SAAS,GAAG,OAAO,IAAI,EAAE,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE;YAC1E,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE;YACpC,CAAC,CAAC,OAAO,IAAI,EAAE,gBAAgB,KAAK,QAAQ,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE;gBAC1E,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE;gBAC9B,CAAC,CAAC,GAAG,CAAC;QACV,OAAO,GAAG,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,QAAQ,IAAI,SAAS,EAAE,CAAC;IAChE,CAAC;IAED,OAAO,GAAG,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,QAAQ,EAAE,CAAC;AACnD,CAAC;AAED,kEAAkE;AAClE,SAAgB,0BAA0B,CACxC,IAAuB,EACvB,QAA4B,EAC5B,SAA6B,EAC7B,QAAgB;IAEhB,OAAO,aAAa,IAAI,IAAI,QAAQ,IAAI,SAAS,IAAI,SAAS,IAAI,WAAW,IAAI,QAAQ,EAAE,CAAC;AAC9F,CAAC"}

package/dist/server/serverConfig.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Platform-neutral part of the server config: the `config.json` schema
+ * validator and the capability helpers. File access lives in the host
+ * (`node/server/config.ts` for Node).
+ */
+import type { ServerConfig, SystemAdminPrincipal } from "./types";
+export interface ConfigBackupInfo {
+    file: string;
+    createdAt: string;
+}
+export declare function isTenantCreationCapabilityRule(ruleKey: string): boolean;
+export declare function isWildcardSystemAdminPrincipal(principal: SystemAdminPrincipal): boolean;
+export declare function hasTenantCreationWildcardPrincipal(config: ServerConfig): boolean;
+export declare function validateServerConfig(raw: unknown, filePath: string): ServerConfig;
+export declare function isConfigBackupFilename(fileName: string): boolean;
+export declare function parseConfigBackupTimestamp(fileName: string): string | null;
+/**
+ * Where a host keeps `config.json` and its backups. `PUT /system/config`
+ * goes through this so the handler does not care whether the config is a
+ * file (Node) or a stored document (serverless hosts).
+ */
+export interface ServerConfigRepository {
+    listBackups(): ConfigBackupInfo[];
+    /** Throws `Config backup not found: <file>` / `Invalid config backup filename: <file>`. */
+    loadBackup(backupFile: string): ServerConfig;
+    /**
+     * Back up the current config (when there is one) and persist `config`.
+     * Returns the backup file name, or null when there was nothing to back up.
+     */
+    replace(config: ServerConfig): string | null;
+}
+/**
+ * Extract all unique system admin principals from the capabilities config.
+ * Each principal is identified by (username, publicsignkey).
+ */
+export declare function extractAllPrincipals(config: ServerConfig): SystemAdminPrincipal[];
+//# sourceMappingURL=serverConfig.d.ts.map

package/dist/server/serverConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serverConfig.d.ts","sourceRoot":"","sources":["../../src/server/serverConfig.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAGV,YAAY,EAGZ,oBAAoB,EAErB,MAAM,SAAS,CAAC;AAGjB,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB;AAKD,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAcvE;AAED,wBAAgB,8BAA8B,CAC5C,SAAS,EAAE,oBAAoB,GAC9B,OAAO,CAET;AAED,wBAAgB,kCAAkC,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAKhF;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,YAAY,CAqDjF;AAyOD,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEhE;AAED,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAU1E;AAED;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,WAAW,IAAI,gBAAgB,EAAE,CAAC;IAClC,2FAA2F;IAC3F,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,YAAY,CAAC;IAC7C;;;OAGG;IACH,OAAO,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,GAAG,IAAI,CAAC;CAC9C;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,YAAY,GACnB,oBAAoB,EAAE,CAexB"}

package/dist/server/serverConfig.js

@@ -0,0 +1,251 @@
+"use strict";
+/**
+ * Platform-neutral part of the server config: the `config.json` schema
+ * validator and the capability helpers. File access lives in the host
+ * (`node/server/config.ts` for Node).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isTenantCreationCapabilityRule = isTenantCreationCapabilityRule;
+exports.isWildcardSystemAdminPrincipal = isWildcardSystemAdminPrincipal;
+exports.hasTenantCreationWildcardPrincipal = hasTenantCreationWildcardPrincipal;
+exports.validateServerConfig = validateServerConfig;
+exports.isConfigBackupFilename = isConfigBackupFilename;
+exports.parseConfigBackupTimestamp = parseConfigBackupTimestamp;
+exports.extractAllPrincipals = extractAllPrincipals;
+const types_1 = require("./peer/types");
+const CONFIG_BACKUP_FILENAME_RE = /^config\.(\d{4}-\d{2}-\d{2}T\d{2}-\d{2}-\d{2}(?:\.\d{3})?Z)\.json$/;
+function isTenantCreationCapabilityRule(ruleKey) {
+    const colonIdx = ruleKey.indexOf(":");
+    if (colonIdx === -1) {
+        return false;
+    }
+    const method = ruleKey.substring(0, colonIdx).toUpperCase();
+    const pathPattern = ruleKey.substring(colonIdx + 1);
+    // Segment-exact: tenant creation targets exactly one segment under
+    // `/system/tenants/` (the tenant id, which may itself be a `*` pattern). A
+    // prefix test would let a wildcard `*` principal be configured on an existing
+    // tenant's sub-resource, an over-grant (audit #6).
+    return method === "POST" && /^\/system\/tenants\/[^/]+\/?$/.test(pathPattern);
+}
+function isWildcardSystemAdminPrincipal(principal) {
+    return principal.username === "*" && principal.publicsignkey === "*";
+}
+function hasTenantCreationWildcardPrincipal(config) {
+    return Object.entries(config.capabilities).some(([ruleKey, principals]) => isTenantCreationCapabilityRule(ruleKey) &&
+        principals.some((principal) => isWildcardSystemAdminPrincipal(principal)));
+}
+function validateServerConfig(raw, filePath) {
+    if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+        throw new Error(`config.json at ${filePath} must be a JSON object`);
+    }
+    const obj = raw;
+    if (!obj.capabilities || typeof obj.capabilities !== "object" || Array.isArray(obj.capabilities)) {
+        throw new Error(`config.json at ${filePath} must have a "capabilities" object`);
+    }
+    const capabilities = {};
+    for (const [ruleKey, principals] of Object.entries(obj.capabilities)) {
+        validateCapabilityRule(ruleKey, filePath);
+        if (!Array.isArray(principals)) {
+            throw new Error(`config.json: capability rule "${ruleKey}" must map to an array of principals`);
+        }
+        capabilities[ruleKey] = principals.map((p, i) => validatePrincipal(p, ruleKey, i, filePath));
+    }
+    const rateLimits = validateRateLimits(obj.rateLimits, filePath);
+    const config = rateLimits ? { capabilities, rateLimits } : { capabilities };
+    const cluster = validateCluster(obj.cluster, filePath);
+    if (cluster) {
+        config.cluster = cluster;
+    }
+    const iroh = validateIroh(obj.iroh, filePath);
+    if (iroh) {
+        config.iroh = iroh;
+    }
+    const principalCount = Object.values(capabilities).reduce((sum, arr) => sum + arr.length, 0);
+    console.log(`[Config] Loaded config.json from ${filePath}: ${Object.keys(capabilities).length} capability rule(s), ${principalCount} principal entry/entries`);
+    return config;
+}
+function validateCluster(raw, filePath) {
+    if (raw === undefined) {
+        return undefined;
+    }
+    if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+        throw new Error(`config.json at ${filePath}: "cluster" must be an object`);
+    }
+    const obj = raw;
+    const cluster = {};
+    if (obj.autoSync !== undefined) {
+        if (typeof obj.autoSync !== "boolean") {
+            throw new Error(`config.json at ${filePath}: "cluster.autoSync" must be a boolean`);
+        }
+        cluster.autoSync = obj.autoSync;
+    }
+    if (obj.role !== undefined) {
+        if (!(0, types_1.isPeerRole)(obj.role)) {
+            throw new Error(`config.json at ${filePath}: "cluster.role" must be "peer", "hub" or "spoke"`);
+        }
+        cluster.role = obj.role;
+    }
+    return Object.keys(cluster).length > 0 ? cluster : undefined;
+}
+function validateIroh(raw, filePath) {
+    if (raw === undefined) {
+        return undefined;
+    }
+    if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+        throw new Error(`config.json at ${filePath}: "iroh" must be an object`);
+    }
+    const obj = raw;
+    if (obj.enabled !== undefined && typeof obj.enabled !== "boolean") {
+        throw new Error(`config.json at ${filePath}: "iroh.enabled" must be a boolean`);
+    }
+    if (obj.secretKeyPath !== undefined) {
+        if (typeof obj.secretKeyPath !== "string" || !obj.secretKeyPath.trim()) {
+            throw new Error(`config.json at ${filePath}: "iroh.secretKeyPath" must be a non-empty string`);
+        }
+    }
+    const iroh = {
+        enabled: obj.enabled === true,
+    };
+    if (typeof obj.secretKeyPath === "string") {
+        iroh.secretKeyPath = obj.secretKeyPath.trim();
+    }
+    return iroh;
+}
+function validateRateLimits(raw, filePath) {
+    if (raw === undefined) {
+        return undefined;
+    }
+    if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+        throw new Error(`config.json at ${filePath}: "rateLimits" must be an object`);
+    }
+    const obj = raw;
+    const auth = validateRateLimitConfig(obj.auth, "auth", filePath);
+    const sync = validateRateLimitConfig(obj.sync, "sync", filePath);
+    const timestamps = validateTimestampRateLimitConfig(obj.timestamps, filePath);
+    const global = validateRateLimitConfig(obj.global, "global", filePath);
+    const system = validateRateLimitConfig(obj.system, "system", filePath);
+    const rateLimits = {};
+    if (system) {
+        rateLimits.system = system;
+    }
+    if (auth) {
+        rateLimits.auth = auth;
+    }
+    if (sync) {
+        rateLimits.sync = sync;
+    }
+    if (timestamps) {
+        rateLimits.timestamps = timestamps;
+    }
+    if (global) {
+        rateLimits.global = global;
+    }
+    return Object.keys(rateLimits).length > 0 ? rateLimits : {};
+}
+function validateRateLimitConfig(raw, name, filePath) {
+    if (raw === undefined) {
+        return undefined;
+    }
+    if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+        throw new Error(`config.json at ${filePath}: "rateLimits.${name}" must be an object`);
+    }
+    const obj = raw;
+    const config = {};
+    if (obj.windowMs !== undefined) {
+        config.windowMs = validatePositiveInteger(obj.windowMs, `rateLimits.${name}.windowMs`, filePath);
+    }
+    if (obj.max !== undefined) {
+        config.max = validatePositiveInteger(obj.max, `rateLimits.${name}.max`, filePath);
+    }
+    return Object.keys(config).length > 0 ? config : {};
+}
+function validateTimestampRateLimitConfig(raw, filePath) {
+    const base = validateRateLimitConfig(raw, "timestamps", filePath);
+    if (!base) {
+        return undefined;
+    }
+    const obj = raw;
+    const config = { ...base };
+    if (obj.dailyMax !== undefined) {
+        config.dailyMax = validatePositiveInteger(obj.dailyMax, "rateLimits.timestamps.dailyMax", filePath);
+    }
+    return config;
+}
+function validatePositiveInteger(raw, fieldName, filePath) {
+    if (!Number.isInteger(raw) || raw <= 0) {
+        throw new Error(`config.json at ${filePath}: "${fieldName}" must be a positive integer`);
+    }
+    return raw;
+}
+/**
+ * Validate a capability rule key has the format `METHOD:PATH`.
+ */
+function validateCapabilityRule(rule, filePath) {
+    const colonIdx = rule.indexOf(":");
+    if (colonIdx === -1) {
+        throw new Error(`config.json at ${filePath}: invalid capability rule "${rule}" — expected "METHOD:PATH" format`);
+    }
+    const method = rule.substring(0, colonIdx).toUpperCase();
+    const pathPattern = rule.substring(colonIdx + 1);
+    const validMethods = ["ALL", "GET", "POST", "PUT", "DELETE", "PATCH"];
+    if (!validMethods.includes(method)) {
+        throw new Error(`config.json at ${filePath}: invalid method "${method}" in rule "${rule}" — expected one of ${validMethods.join(", ")}`);
+    }
+    if (!pathPattern.startsWith("/")) {
+        throw new Error(`config.json at ${filePath}: path pattern in rule "${rule}" must start with "/"`);
+    }
+}
+function validatePrincipal(raw, ruleKey, index, filePath) {
+    if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+        throw new Error(`config.json at ${filePath}: principal #${index} in rule "${ruleKey}" must be an object`);
+    }
+    const obj = raw;
+    if (typeof obj.username !== "string" || obj.username.length === 0) {
+        throw new Error(`config.json at ${filePath}: principal #${index} in rule "${ruleKey}" must have a non-empty "username" string`);
+    }
+    if (typeof obj.publicsignkey !== "string" || obj.publicsignkey.length === 0) {
+        throw new Error(`config.json at ${filePath}: principal #${index} in rule "${ruleKey}" must have a non-empty "publicsignkey" string`);
+    }
+    const hasWildcardField = obj.username === "*" || obj.publicsignkey === "*";
+    if (hasWildcardField) {
+        if (obj.username !== "*" || obj.publicsignkey !== "*") {
+            throw new Error(`config.json at ${filePath}: principal #${index} in rule "${ruleKey}" must use "*" for both "username" and "publicsignkey"`);
+        }
+        if (!isTenantCreationCapabilityRule(ruleKey)) {
+            throw new Error(`config.json at ${filePath}: wildcard principal "*" is only allowed for POST:/system/tenants/... rules`);
+        }
+    }
+    return {
+        username: obj.username,
+        publicsignkey: obj.publicsignkey,
+    };
+}
+function isConfigBackupFilename(fileName) {
+    return CONFIG_BACKUP_FILENAME_RE.test(fileName);
+}
+function parseConfigBackupTimestamp(fileName) {
+    const match = CONFIG_BACKUP_FILENAME_RE.exec(fileName);
+    if (!match) {
+        return null;
+    }
+    return match[1].replace(/^(\d{4}-\d{2}-\d{2}T\d{2})-(\d{2})-(\d{2}(?:\.\d{3})?Z)$/, "$1:$2:$3");
+}
+/**
+ * Extract all unique system admin principals from the capabilities config.
+ * Each principal is identified by (username, publicsignkey).
+ */
+function extractAllPrincipals(config) {
+    const seen = new Set();
+    const result = [];
+    for (const principals of Object.values(config.capabilities)) {
+        for (const p of principals) {
+            const key = `${p.username.toLowerCase()}\0${p.publicsignkey}`;
+            if (!seen.has(key)) {
+                seen.add(key);
+                result.push(p);
+            }
+        }
+    }
+    return result;
+}
+//# sourceMappingURL=serverConfig.js.map

package/dist/server/serverConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serverConfig.js","sourceRoot":"","sources":["../../src/server/serverConfig.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;AAqBH,wEAcC;AAED,wEAIC;AAED,gFAKC;AAED,oDAqDC;AAyOD,wDAEC;AAED,gEAUC;AAsBD,oDAiBC;AA1XD,wCAA0C;AAO1C,MAAM,yBAAyB,GAC7B,oEAAoE,CAAC;AAEvE,SAAgB,8BAA8B,CAAC,OAAe;IAC5D,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;QACpB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5D,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;IAEpD,mEAAmE;IACnE,2EAA2E;IAC3E,8EAA8E;IAC9E,mDAAmD;IACnD,OAAO,MAAM,KAAK,MAAM,IAAI,+BAA+B,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;AAChF,CAAC;AAED,SAAgB,8BAA8B,CAC5C,SAA+B;IAE/B,OAAO,SAAS,CAAC,QAAQ,KAAK,GAAG,IAAI,SAAS,CAAC,aAAa,KAAK,GAAG,CAAC;AACvE,CAAC;AAED,SAAgB,kCAAkC,CAAC,MAAoB;IACrE,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,EAAE,CACxE,8BAA8B,CAAC,OAAO,CAAC;QACvC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,8BAA8B,CAAC,SAAS,CAAC,CAAC,CAC1E,CAAC;AACJ,CAAC;AAED,SAAgB,oBAAoB,CAAC,GAAY,EAAE,QAAgB;IACjE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,wBAAwB,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,GAAG,GAAG,GAA8B,CAAC;IAE3C,IAAI,CAAC,GAAG,CAAC,YAAY,IAAI,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;QACjG,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,oCAAoC,CAC/D,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAA2C,EAAE,CAAC;IAEhE,KAAK,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAChD,GAAG,CAAC,YAAuC,CAC5C,EAAE,CAAC;QACF,sBAAsB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAE1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,iCAAiC,OAAO,sCAAsC,CAC/E,CAAC;QACJ,CAAC;QAED,YAAY,CAAC,OAAO,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAC9C,iBAAiB,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,CAAC,CAC3C,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAChE,MAAM,MAAM,GAAiB,UAAU,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC;IAE1F,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACvD,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;IAC3B,CAAC;IAED,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC9C,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC;IACrB,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CACvD,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,EAC9B,CAAC,CACF,CAAC;IACF,OAAO,CAAC,GAAG,CACT,oCAAoC,QAAQ,KAAK,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,wBAAwB,cAAc,0BAA0B,CAClJ,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,GAAY,EAAE,QAAgB;IACrD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,+BAA+B,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,GAAG,GAAG,GAA8B,CAAC;IAC3C,MAAM,OAAO,GAAwB,EAAE,CAAC;IAExC,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,wCAAwC,CAAC,CAAC;QACtF,CAAC;QACD,OAAO,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;IAClC,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC,IAAA,kBAAU,EAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,mDAAmD,CAC9E,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IAC1B,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/D,CAAC;AAED,SAAS,YAAY,CAAC,GAAY,EAAE,QAAgB;IAClD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,4BAA4B,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,GAAG,GAAG,GAA8B,CAAC;IAC3C,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,oCAAoC,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,GAAG,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACpC,IAAI,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC;YACvE,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,mDAAmD,CAAC,CAAC;QACjG,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAqB;QAC7B,OAAO,EAAE,GAAG,CAAC,OAAO,KAAK,IAAI;KAC9B,CAAC;IACF,IAAI,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;QAC1C,IAAI,CAAC,aAAa,GAAG,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;IAChD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CACzB,GAAY,EACZ,QAAgB;IAEhB,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,kCAAkC,CAAC,CAAC;IAChF,CAAC;IAED,MAAM,GAAG,GAAG,GAA8B,CAAC;IAC3C,MAAM,IAAI,GAAG,uBAAuB,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACjE,MAAM,IAAI,GAAG,uBAAuB,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACjE,MAAM,UAAU,GAAG,gCAAgC,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC9E,MAAM,MAAM,GAAG,uBAAuB,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,uBAAuB,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAEvE,MAAM,UAAU,GAA2B,EAAE,CAAC;IAC9C,IAAI,MAAM,EAAE,CAAC;QACX,UAAU,CAAC,MAAM,GAAG,MAAM,CAAC;IAC7B,CAAC;IACD,IAAI,IAAI,EAAE,CAAC;QACT,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC;IACzB,CAAC;IACD,IAAI,IAAI,EAAE,CAAC;QACT,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC;IACzB,CAAC;IACD,IAAI,UAAU,EAAE,CAAC;QACf,UAAU,CAAC,UAAU,GAAG,UAAU,CAAC;IACrC,CAAC;IACD,IAAI,MAAM,EAAE,CAAC;QACX,UAAU,CAAC,MAAM,GAAG,MAAM,CAAC;IAC7B,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED,SAAS,uBAAuB,CAC9B,GAAY,EACZ,IAAY,EACZ,QAAgB;IAEhB,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,iBAAiB,IAAI,qBAAqB,CAAC,CAAC;IACxF,CAAC;IAED,MAAM,GAAG,GAAG,GAA8B,CAAC;IAC3C,MAAM,MAAM,GAAoB,EAAE,CAAC;IAEnC,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,CAAC,QAAQ,GAAG,uBAAuB,CACvC,GAAG,CAAC,QAAQ,EACZ,cAAc,IAAI,WAAW,EAC7B,QAAQ,CACT,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,GAAG,uBAAuB,CAClC,GAAG,CAAC,GAAG,EACP,cAAc,IAAI,MAAM,EACxB,QAAQ,CACT,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;AACtD,CAAC;AAED,SAAS,gCAAgC,CACvC,GAAY,EACZ,QAAgB;IAEhB,MAAM,IAAI,GAAG,uBAAuB,CAAC,GAAG,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;IAClE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,GAAG,GAAG,GAA8B,CAAC;IAC3C,MAAM,MAAM,GAA6B,EAAE,GAAG,IAAI,EAAE,CAAC;IACrD,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,CAAC,QAAQ,GAAG,uBAAuB,CACvC,GAAG,CAAC,QAAQ,EACZ,gCAAgC,EAChC,QAAQ,CACT,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,uBAAuB,CAC9B,GAAY,EACZ,SAAiB,EACjB,QAAgB;IAEhB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAK,GAAc,IAAI,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,MAAM,SAAS,8BAA8B,CACxE,CAAC;IACJ,CAAC;IACD,OAAO,GAAa,CAAC;AACvB,CAAC;AAED;;GAEG;AACH,SAAS,sBAAsB,CAAC,IAAY,EAAE,QAAgB;IAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,8BAA8B,IAAI,mCAAmC,CAChG,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IACzD,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;IAEjD,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACtE,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,qBAAqB,MAAM,cAAc,IAAI,uBAAuB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACxH,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,2BAA2B,IAAI,uBAAuB,CACjF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CACxB,GAAY,EACZ,OAAe,EACf,KAAa,EACb,QAAgB;IAEhB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,gBAAgB,KAAK,aAAa,OAAO,qBAAqB,CACzF,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,GAA8B,CAAC;IAE3C,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,gBAAgB,KAAK,aAAa,OAAO,2CAA2C,CAC/G,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ,IAAI,GAAG,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,gBAAgB,KAAK,aAAa,OAAO,gDAAgD,CACpH,CAAC;IACJ,CAAC;IAED,MAAM,gBAAgB,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,aAAa,KAAK,GAAG,CAAC;IAC3E,IAAI,gBAAgB,EAAE,CAAC;QACrB,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,aAAa,KAAK,GAAG,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,gBAAgB,KAAK,aAAa,OAAO,wDAAwD,CAC5H,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,8BAA8B,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,6EAA6E,CACxG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,aAAa,EAAE,GAAG,CAAC,aAAa;KACjC,CAAC;AACJ,CAAC;AAED,SAAgB,sBAAsB,CAAC,QAAgB;IACrD,OAAO,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAClD,CAAC;AAED,SAAgB,0BAA0B,CAAC,QAAgB;IACzD,MAAM,KAAK,GAAG,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CACrB,0DAA0D,EAC1D,UAAU,CACX,CAAC;AACJ,CAAC;AAkBD;;;GAGG;AACH,SAAgB,oBAAoB,CAClC,MAAoB;IAEpB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,MAAM,GAA2B,EAAE,CAAC;IAE1C,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;QAC5D,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,aAAa,EAAE,CAAC;YAC9D,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACd,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/server/timestampProxy.d.ts

@@ -0,0 +1,129 @@
+/**
+ * RFC 3161 timestamp proxy.
+ *
+ * Sealing a document (see the TeamSketchbook seal feature) needs a third-party
+ * attested time: the client hashes its own signature and asks a Time-Stamping
+ * Authority to sign that hash together with the TSA's clock reading.
+ *
+ * Most public TSAs cannot be called from a browser — they are http-only or send
+ * no CORS headers — so the server offers an authenticated proxy. It forwards
+ * opaque DER bytes and never parses them; the *client* verifies the returned
+ * token (messageImprint equality and chain to a trusted root), which is what
+ * makes a hostile or buggy proxy a denial-of-service risk rather than a forgery
+ * risk.
+ *
+ * SSRF is the hazard a forwarding endpoint always carries, so target URLs come
+ * only from server-side env config. A client may name a provider `id`; it can
+ * never supply a URL.
+ */
+/** Content type mandated by RFC 3161 §3.4 for a request. */
+export declare const TIMESTAMP_QUERY_CONTENT_TYPE = "application/timestamp-query";
+/** Content type mandated by RFC 3161 §3.4 for a response. */
+export declare const TIMESTAMP_REPLY_CONTENT_TYPE = "application/timestamp-reply";
+/**
+ * A TimeStampReq is a hash plus a little ASN.1 framing — a few hundred bytes at
+ * most. Anything larger is either a bug or an attempt to use us as an upload
+ * relay.
+ */
+export declare const MAX_TIMESTAMP_REQUEST_BYTES: number;
+/**
+ * A TimeStampResp carries the token and the TSA certificate chain. Real tokens
+ * run 2–8 KB; the cap bounds memory when an upstream misbehaves.
+ */
+export declare const MAX_TIMESTAMP_RESPONSE_BYTES: number;
+/** Per-provider timeout. Failover to the next provider is preferable to waiting. */
+export declare const DEFAULT_TIMESTAMP_TIMEOUT_MS = 10000;
+/** A configured upstream TSA, including the URL that never leaves the server. */
+export interface TsaProviderConfig {
+    id: string;
+    name: string;
+    url: string;
+    /** TSA policy OID to request, when the provider publishes one. */
+    policyOid?: string;
+    /** eIDAS-qualified (or equivalent national-scheme) trust service. */
+    qualified: boolean;
+    /**
+     * Whether the token chains to a root that ships in common trust stores. When
+     * false the verifier must be handed the chain explicitly — the evidence
+     * bundle does that anyway, but it changes what third-party tooling can check
+     * unaided.
+     */
+    rootInPublicTrustStores: boolean;
+}
+/** The provider description advertised to clients — deliberately without `url`. */
+export type PublicTsaProvider = Omit<TsaProviderConfig, "url">;
+/**
+ * Providers a client can name by id without the operator writing a URL.
+ *
+ * Terms of use differ and are the operator's call, which is why nothing here is
+ * enabled by default:
+ * - `aimoda` and `opentsa` state that general production use is fine;
+ * - `freetsa` is a community service with no usage restriction;
+ * - the DigiCert/Sectigo endpoints are provided for their own certificate
+ *   customers' code signing, so using them as general infrastructure is not
+ *   clearly permitted — they are listed for completeness, not recommended.
+ */
+export declare const BUILT_IN_TSA_PROVIDERS: Readonly<Record<string, TsaProviderConfig>>;
+export interface ParseTsaProvidersOptions {
+    /** Permit http and loopback/private targets (local development, self-hosted TSA on the same box). */
+    allowInsecureUrls?: boolean;
+    /** Sink for configuration warnings; defaults to `console.warn`. */
+    warn?: (message: string) => void;
+}
+/**
+ * Parse `MINDOODB_TSA_PROVIDERS`.
+ *
+ * Comma-separated entries, each either a built-in id (`aimoda`) or a custom
+ * `id=url` pair (`inhouse=https://tsa.corp.example/tsr`). A trailing `!` on an
+ * entry marks it qualified, and `+` marks its root as publicly trusted:
+ *
+ *   MINDOODB_TSA_PROVIDERS="aimoda,opentsa,belgium=http://tsa.belgium.be/connect!+"
+ *
+ * Unset or empty disables the proxy entirely. That is the safe default: a
+ * forwarding endpoint is outbound network access the operator should opt into,
+ * and Haven can still reach the browser-callable TSA directly without it.
+ */
+export declare function parseTsaProviders(raw: string | undefined, options?: ParseTsaProvidersOptions): TsaProviderConfig[];
+/** Drop the URL before a provider list is handed to a client. */
+export declare function toPublicTsaProviders(providers: TsaProviderConfig[]): PublicTsaProvider[];
+export declare class TimestampProxyError extends Error {
+    readonly status: number;
+    /** Per-provider failures, for logging and for a client that wants to retry elsewhere. */
+    readonly attempts: TimestampAttempt[];
+    constructor(message: string, status: number, 
+    /** Per-provider failures, for logging and for a client that wants to retry elsewhere. */
+    attempts?: TimestampAttempt[]);
+}
+export interface TimestampAttempt {
+    providerId: string;
+    ok: boolean;
+    error?: string;
+    httpStatus?: number;
+    durationMs: number;
+}
+export interface TimestampProxyResult {
+    providerId: string;
+    providerName: string;
+    /** Raw DER TimeStampResp. The caller does not interpret it. */
+    response: Uint8Array;
+    attempts: TimestampAttempt[];
+}
+export interface RequestTimestampOptions {
+    providers: TsaProviderConfig[];
+    /** DER-encoded TimeStampReq. */
+    request: Uint8Array;
+    /** Try this provider first; others remain as failover. */
+    preferredProviderId?: string;
+    timeoutMs?: number;
+    maxResponseBytes?: number;
+    fetchImpl?: typeof fetch;
+}
+/**
+ * POST the request to each provider in turn, returning the first DER answer.
+ *
+ * Failover is per-provider and the reason for each failure is preserved: an
+ * operator debugging "sealing stopped working" needs to see that provider A
+ * timed out and provider B answered 403, not a single opaque 502.
+ */
+export declare function requestTimestampToken(options: RequestTimestampOptions): Promise<TimestampProxyResult>;
+//# sourceMappingURL=timestampProxy.d.ts.map

package/dist/server/timestampProxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"timestampProxy.d.ts","sourceRoot":"","sources":["../../src/server/timestampProxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,4DAA4D;AAC5D,eAAO,MAAM,4BAA4B,gCAAgC,CAAC;AAC1E,6DAA6D;AAC7D,eAAO,MAAM,4BAA4B,gCAAgC,CAAC;AAE1E;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,QAAW,CAAC;AACpD;;;GAGG;AACH,eAAO,MAAM,4BAA4B,QAAa,CAAC;AACvD,oFAAoF;AACpF,eAAO,MAAM,4BAA4B,QAAS,CAAC;AAEnD,iFAAiF;AACjF,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qEAAqE;IACrE,SAAS,EAAE,OAAO,CAAC;IACnB;;;;;OAKG;IACH,uBAAuB,EAAE,OAAO,CAAC;CAClC;AAED,mFAAmF;AACnF,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;AAE/D;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CA2C7E,CAAC;AAKH,MAAM,WAAW,wBAAwB;IACvC,qGAAqG;IACrG,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,mEAAmE;IACnE,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAClC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,OAAO,GAAE,wBAA6B,GACrC,iBAAiB,EAAE,CA8ErB;AAED,iEAAiE;AACjE,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,iBAAiB,EAAE,GAAG,iBAAiB,EAAE,CAExF;AAED,qBAAa,mBAAoB,SAAQ,KAAK;IAG1C,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,yFAAyF;IACzF,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,EAAE;gBAHrC,OAAO,EAAE,MAAM,EACN,MAAM,EAAE,MAAM;IACvB,yFAAyF;IAChF,QAAQ,GAAE,gBAAgB,EAAO;CAK7C;AAED,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,+DAA+D;IAC/D,QAAQ,EAAE,UAAU,CAAC;IACrB,QAAQ,EAAE,gBAAgB,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAC/B,gCAAgC;IAChC,OAAO,EAAE,UAAU,CAAC;IACpB,0DAA0D;IAC1D,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AA4ED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,oBAAoB,CAAC,CAgG/B"}