pipework 0.7.12 → 0.7.17

package/dist/auth/auth/sessions.js

@@ -0,0 +1,231 @@
+import { SignJWT, jwtVerify, importPKCS8, importSPKI } from 'jose';
+import { sql } from '../../data/db/sql.js';
+import { UnauthorizedError } from '../../core/errors/index.js';
+import { resolveCookieConfig, buildSetCookieHeader, buildClearCookieHeader, parseCookieHeader } from './cookie.js';
+/** Creates a Sessions manager with JWT access/refresh tokens, rotation, reuse detection, and cookie helpers. */
+export function createSessions(config) {
+    const environment = config.environment ?? 'production';
+    if (environment === 'production') {
+        validateSigningKeys(config);
+    }
+    let privateKey = null;
+    let publicKey = null;
+    const versionCache = new Map();
+    const cacheTtl = config.versionCacheTtlMs ?? 60_000;
+    async function getPrivateKey() {
+        if (!privateKey)
+            privateKey = await importPKCS8(config.signing.privateKey, config.signing.algorithm);
+        return privateKey;
+    }
+    async function getPublicKey() {
+        if (!publicKey)
+            publicKey = await importSPKI(config.signing.publicKey, config.signing.algorithm);
+        return publicKey;
+    }
+    function parseExpiry(exp) {
+        const match = exp.match(/^(\d+)([smhd])$/);
+        if (!match)
+            throw new Error(`Invalid expiry format: ${exp}`);
+        const value = parseInt(match[1], 10);
+        const unit = match[2];
+        switch (unit) {
+            case 's': return value;
+            case 'm': return value * 60;
+            case 'h': return value * 3600;
+            case 'd': return value * 86400;
+            default: return value;
+        }
+    }
+    async function getOrCreateVersion(db, userId) {
+        const rows = await db.execute(sql `INSERT INTO pipework_auth_versions (user_id, version) VALUES (${userId}, 1)
+          ON CONFLICT (user_id) DO NOTHING
+          RETURNING version`);
+        if (rows.length > 0)
+            return rows[0]['version'];
+        const existing = await db.execute(sql `SELECT version FROM pipework_auth_versions WHERE user_id = ${userId}`);
+        const row = existing[0];
+        if (row === undefined)
+            return 1;
+        return row['version'];
+    }
+    async function issueTokens(db, user) {
+        const key = await getPrivateKey();
+        const version = config.versionCheck ? await getOrCreateVersion(db, user.id) : 1;
+        const expiresInSeconds = parseExpiry(config.accessToken.expiresIn);
+        const accessToken = await new SignJWT({ tid: user.tenantId, av: version, roles: user.roles })
+            .setProtectedHeader({ alg: config.signing.algorithm })
+            .setSubject(user.id)
+            .setIssuer(config.issuer)
+            .setAudience(config.audience)
+            .setIssuedAt()
+            .setExpirationTime(`${expiresInSeconds}s`)
+            .sign(key);
+        const familyId = crypto.randomUUID();
+        const refreshTokenValue = crypto.randomUUID();
+        const refreshHash = await hashToken(refreshTokenValue);
+        const refreshExpiresIn = parseExpiry(config.refreshToken.expiresIn);
+        const expiresAt = new Date(Date.now() + refreshExpiresIn * 1000);
+        await db.execute(sql `INSERT INTO pipework_refresh_tokens (user_id, tenant_id, token_hash, family_id, expires_at)
+          VALUES (${user.id}, ${user.tenantId}, ${refreshHash}, ${familyId}::uuid, ${expiresAt.toISOString()}::timestamptz)`);
+        return { accessToken, refreshToken: refreshTokenValue, expiresIn: expiresInSeconds };
+    }
+    async function refresh(db, refreshToken) {
+        const tokenHash = await hashToken(refreshToken);
+        return db.transaction(async (tx) => {
+            const rows = await tx.execute(sql `SELECT id, user_id, tenant_id, family_id, revoked_at, expires_at
+            FROM pipework_refresh_tokens
+            WHERE token_hash = ${tokenHash}
+            FOR UPDATE`);
+            if (rows.length === 0) {
+                throw new UnauthorizedError('Invalid refresh token');
+            }
+            const row = rows[0];
+            const userId = row['user_id'];
+            const tenantId = row['tenant_id'];
+            const familyId = row['family_id'];
+            const revokedAt = row['revoked_at'];
+            const expiresAt = new Date(row['expires_at']);
+            if (expiresAt < new Date()) {
+                throw new UnauthorizedError('Refresh token expired');
+            }
+            if (revokedAt !== null) {
+                if (config.refreshToken.reuseDetection) {
+                    await tx.execute(sql `UPDATE pipework_refresh_tokens SET revoked_at = now()
+                WHERE family_id = ${familyId}::uuid AND revoked_at IS NULL`);
+                }
+                throw new UnauthorizedError('Refresh token reuse detected — all sessions revoked');
+            }
+            if (config.refreshToken.rotateOnUse) {
+                await tx.execute(sql `UPDATE pipework_refresh_tokens SET revoked_at = now() WHERE token_hash = ${tokenHash}`);
+            }
+            const roles = config.resolveRoles
+                ? await config.resolveRoles(tx, userId, tenantId)
+                : undefined;
+            return issueTokens(tx, roles ? { id: userId, tenantId, roles } : { id: userId, tenantId });
+        });
+    }
+    async function revokeAll(db, userId) {
+        await db.execute(sql `UPDATE pipework_refresh_tokens SET revoked_at = now()
+          WHERE user_id = ${userId} AND revoked_at IS NULL`);
+    }
+    async function bumpVersion(db, userId) {
+        await db.execute(sql `INSERT INTO pipework_auth_versions (user_id, version, updated_at)
+          VALUES (${userId}, 2, now())
+          ON CONFLICT (user_id)
+          DO UPDATE SET version = pipework_auth_versions.version + 1, updated_at = now()`);
+        versionCache.delete(userId);
+    }
+    async function verifyAccessToken(token) {
+        const key = await getPublicKey();
+        try {
+            const { payload } = await jwtVerify(token, key, {
+                algorithms: [config.signing.algorithm],
+                issuer: config.issuer,
+                audience: config.audience,
+            });
+            return {
+                sub: payload.sub,
+                tid: payload['tid'],
+                av: payload['av'],
+                roles: payload['roles'],
+            };
+        }
+        catch {
+            throw new UnauthorizedError('Invalid access token');
+        }
+    }
+    async function checkVersion(db, userId, tokenVersion) {
+        const cached = versionCache.get(userId);
+        if (cached && cached.expiresAt > Date.now()) {
+            return cached.version === tokenVersion;
+        }
+        const rows = await db.execute(sql `SELECT version FROM pipework_auth_versions WHERE user_id = ${userId}`);
+        const currentVersion = rows.length > 0 ? rows[0]['version'] : 1;
+        versionCache.set(userId, { version: currentVersion, expiresAt: Date.now() + cacheTtl });
+        return currentVersion === tokenVersion;
+    }
+    async function cleanExpiredTokens(db) {
+        const rows = await db.execute(sql `DELETE FROM pipework_refresh_tokens WHERE expires_at < now() RETURNING id`);
+        return rows.length;
+    }
+    function getCookieConfig() {
+        const cookie = config.refreshToken.cookie;
+        if (cookie === undefined) {
+            throw new Error('Cookie-based session methods require refreshToken.cookie configuration');
+        }
+        return resolveCookieConfig(cookie, config.environment ?? 'production');
+    }
+    function getRefreshMaxAge() {
+        return parseExpiry(config.refreshToken.expiresIn);
+    }
+    async function issueTokensHttp(response, db, user) {
+        const resolved = getCookieConfig();
+        const pair = await issueTokens(db, user);
+        response.header('Set-Cookie', buildSetCookieHeader(resolved, pair.refreshToken, getRefreshMaxAge()));
+        return { accessToken: pair.accessToken, expiresIn: pair.expiresIn };
+    }
+    async function refreshHttp(response, db, request) {
+        const resolved = getCookieConfig();
+        const token = parseCookieHeader(request.headers['cookie'], resolved.name);
+        if (token === undefined) {
+            throw new UnauthorizedError('Missing refresh token cookie');
+        }
+        const pair = await refresh(db, token);
+        response.header('Set-Cookie', buildSetCookieHeader(resolved, pair.refreshToken, getRefreshMaxAge()));
+        return { accessToken: pair.accessToken, expiresIn: pair.expiresIn };
+    }
+    async function revokeHttp(response, db, request) {
+        const resolved = getCookieConfig();
+        const token = parseCookieHeader(request.headers['cookie'], resolved.name);
+        if (token === undefined) {
+            throw new UnauthorizedError('Missing refresh token cookie');
+        }
+        const tokenHash = await hashToken(token);
+        await db.execute(sql `UPDATE pipework_refresh_tokens SET revoked_at = now()
+          WHERE token_hash = ${tokenHash} AND revoked_at IS NULL`);
+        response.header('Set-Cookie', buildClearCookieHeader(resolved));
+    }
+    async function revokeAllHttp(response, db, userId) {
+        const resolved = getCookieConfig();
+        await revokeAll(db, userId);
+        response.header('Set-Cookie', buildClearCookieHeader(resolved));
+    }
+    return {
+        issueTokens, refresh, revokeAll, bumpVersion, verifyAccessToken, checkVersion, cleanExpiredTokens,
+        issueTokensHttp, refreshHttp, revokeHttp, revokeAllHttp,
+    };
+}
+const TEST_KEY_PATTERNS = [
+    'test', 'example', 'dummy', 'placeholder', 'changeme', 'insecure', 'dev-only',
+];
+function validateSigningKeys(config) {
+    const problems = [];
+    const { privateKey, publicKey } = config.signing;
+    if (privateKey.length < 100) {
+        problems.push('Private key appears too short for ES256. Ensure you are using a real PKCS#8 key.');
+    }
+    if (publicKey.length < 80) {
+        problems.push('Public key appears too short for ES256. Ensure you are using a real SPKI key.');
+    }
+    const combined = (privateKey + publicKey).toLowerCase();
+    for (const pattern of TEST_KEY_PATTERNS) {
+        if (combined.includes(pattern)) {
+            problems.push(`Signing key material contains "${pattern}" — this looks like a test key.`);
+            break;
+        }
+    }
+    if (!privateKey.includes('BEGIN') || !publicKey.includes('BEGIN')) {
+        problems.push('Keys should be PEM-encoded (BEGIN PRIVATE KEY / BEGIN PUBLIC KEY).');
+    }
+    if (problems.length > 0) {
+        throw new Error(`[pipework] Session signing keys are not suitable for production:\n\n${problems.map(p => `  - ${p}`).join('\n')}\n\n` +
+            '  Generate production keys with: openssl ecparam -genkey -name prime256v1 -noout | openssl pkcs8 -topk8 -nocrypt\n');
+    }
+}
+async function hashToken(token) {
+    const encoder = new TextEncoder();
+    const data = encoder.encode(token);
+    const hash = await crypto.subtle.digest('SHA-256', data);
+    return Buffer.from(hash).toString('hex');
+}
+//# sourceMappingURL=sessions.js.map

package/dist/auth/auth/sessions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../../src/auth/auth/sessions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,MAAM,CAAA;AAClE,OAAO,EAAE,GAAG,EAAE,MAAM,sBAAsB,CAAA;AAE1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA;AAE9D,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAuDlH,gHAAgH;AAChH,MAAM,UAAU,cAAc,CAAC,MAAqB;IAClD,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,YAAY,CAAA;IACtD,IAAI,WAAW,KAAK,YAAY,EAAE,CAAC;QACjC,mBAAmB,CAAC,MAAM,CAAC,CAAA;IAC7B,CAAC;IAED,IAAI,UAAU,GAAqB,IAAI,CAAA;IACvC,IAAI,SAAS,GAAqB,IAAI,CAAA;IACtC,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkD,CAAA;IAC9E,MAAM,QAAQ,GAAG,MAAM,CAAC,iBAAiB,IAAI,MAAM,CAAA;IAEnD,KAAK,UAAU,aAAa;QAC1B,IAAI,CAAC,UAAU;YAAE,UAAU,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QACpG,OAAO,UAAU,CAAA;IACnB,CAAC;IAED,KAAK,UAAU,YAAY;QACzB,IAAI,CAAC,SAAS;YAAE,SAAS,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QAChG,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,SAAS,WAAW,CAAC,GAAW;QAC9B,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAA;QAC1C,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,EAAE,CAAC,CAAA;QAC5D,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAA;QACrC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACrB,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,GAAG,CAAC,CAAC,OAAO,KAAK,CAAA;YACtB,KAAK,GAAG,CAAC,CAAC,OAAO,KAAK,GAAG,EAAE,CAAA;YAC3B,KAAK,GAAG,CAAC,CAAC,OAAO,KAAK,GAAG,IAAI,CAAA;YAC7B,KAAK,GAAG,CAAC,CAAC,OAAO,KAAK,GAAG,KAAK,CAAA;YAC9B,OAAO,CAAC,CAAC,OAAO,KAAK,CAAA;QACvB,CAAC;IACH,CAAC;IAED,KAAK,UAAU,kBAAkB,CAAC,EAAM,EAAE,MAAc;QACtD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAC3B,GAAG,CAAA,iEAAiE,MAAM;;4BAEpD,CACvB,CAAA;QACD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,CAAE,CAAC,SAAS,CAAW,CAAA;QAEzD,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,OAAO,CAC/B,GAAG,CAAA,8DAA8D,MAAM,EAAE,CAC1E,CAAA;QACD,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAA;QACvB,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,CAAC,CAAA;QAC/B,OAAO,GAAG,CAAC,SAAS,CAAW,CAAA;IACjC,CAAC;IAED,KAAK,UAAU,WAAW,CACxB,EAAM,EACN,IAAwD;QAExD,MAAM,GAAG,GAAG,MAAM,aAAa,EAAE,CAAA;QACjC,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,kBAAkB,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAC/E,MAAM,gBAAgB,GAAG,WAAW,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAA;QAElE,MAAM,WAAW,GAAG,MAAM,IAAI,OAAO,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;aAC1F,kBAAkB,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;aACrD,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;aACnB,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC;aACxB,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC;aAC5B,WAAW,EAAE;aACb,iBAAiB,CAAC,GAAG,gBAAgB,GAAG,CAAC;aACzC,IAAI,CAAC,GAAG,CAAC,CAAA;QAEZ,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;QACpC,MAAM,iBAAiB,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;QAC7C,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,iBAAiB,CAAC,CAAA;QACtD,MAAM,gBAAgB,GAAG,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAA;QACnE,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,GAAG,IAAI,CAAC,CAAA;QAEhE,MAAM,EAAE,CAAC,OAAO,CACd,GAAG,CAAA;oBACW,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,QAAQ,KAAK,WAAW,KAAK,QAAQ,WAAW,SAAS,CAAC,WAAW,EAAE,gBAAgB,CACvH,CAAA;QAED,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,iBAAiB,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAA;IACtF,CAAC;IAED,KAAK,UAAU,OAAO,CAAC,EAAM,EAAE,YAAoB;QACjD,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,CAAA;QAE/C,OAAO,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACjC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAC3B,GAAG,CAAA;;iCAEsB,SAAS;uBACnB,CAChB,CAAA;YAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,iBAAiB,CAAC,uBAAuB,CAAC,CAAA;YACtD,CAAC;YAED,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAE,CAAA;YACpB,MAAM,MAAM,GAAG,GAAG,CAAC,SAAS,CAAW,CAAA;YACvC,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,CAAW,CAAA;YAC3C,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,CAAW,CAAA;YAC3C,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAkB,CAAA;YACpD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,YAAY,CAAW,CAAC,CAAA;YAEvD,IAAI,SAAS,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;gBAC3B,MAAM,IAAI,iBAAiB,CAAC,uBAAuB,CAAC,CAAA;YACtD,CAAC;YAED,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACvB,IAAI,MAAM,CAAC,YAAY,CAAC,cAAc,EAAE,CAAC;oBACvC,MAAM,EAAE,CAAC,OAAO,CACd,GAAG,CAAA;oCACqB,QAAQ,+BAA+B,CAChE,CAAA;gBACH,CAAC;gBACD,MAAM,IAAI,iBAAiB,CAAC,qDAAqD,CAAC,CAAA;YACpF,CAAC;YAED,IAAI,MAAM,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC;gBACpC,MAAM,EAAE,CAAC,OAAO,CACd,GAAG,CAAA,4EAA4E,SAAS,EAAE,CAC3F,CAAA;YACH,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY;gBAC/B,CAAC,CAAC,MAAM,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC;gBACjD,CAAC,CAAC,SAAS,CAAA;YAEb,OAAO,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAA;QAC5F,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,UAAU,SAAS,CAAC,EAAM,EAAE,MAAc;QAC7C,MAAM,EAAE,CAAC,OAAO,CACd,GAAG,CAAA;4BACmB,MAAM,yBAAyB,CACtD,CAAA;IACH,CAAC;IAED,KAAK,UAAU,WAAW,CAAC,EAAM,EAAE,MAAc;QAC/C,MAAM,EAAE,CAAC,OAAO,CACd,GAAG,CAAA;oBACW,MAAM;;yFAE+D,CACpF,CAAA;QACD,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC7B,CAAC;IAED,KAAK,UAAU,iBAAiB,CAAC,KAAa;QAC5C,MAAM,GAAG,GAAG,MAAM,YAAY,EAAE,CAAA;QAChC,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE;gBAC9C,UAAU,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;gBACtC,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B,CAAC,CAAA;YACF,OAAO;gBACL,GAAG,EAAE,OAAO,CAAC,GAAI;gBACjB,GAAG,EAAE,OAAO,CAAC,KAAK,CAAW;gBAC7B,EAAE,EAAE,OAAO,CAAC,IAAI,CAAW;gBAC3B,KAAK,EAAE,OAAO,CAAC,OAAO,CAAyB;aAChD,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,iBAAiB,CAAC,sBAAsB,CAAC,CAAA;QACrD,CAAC;IACH,CAAC;IAED,KAAK,UAAU,YAAY,CAAC,EAAM,EAAE,MAAc,EAAE,YAAoB;QACtE,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QACvC,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC5C,OAAO,MAAM,CAAC,OAAO,KAAK,YAAY,CAAA;QACxC,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAC3B,GAAG,CAAA,8DAA8D,MAAM,EAAE,CAC1E,CAAA;QACD,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,CAAE,CAAC,SAAS,CAAY,CAAC,CAAC,CAAC,CAAC,CAAA;QAC5E,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAA;QACvF,OAAO,cAAc,KAAK,YAAY,CAAA;IACxC,CAAC;IAED,KAAK,UAAU,kBAAkB,CAAC,EAAM;QACtC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAC3B,GAAG,CAAA,2EAA2E,CAC/E,CAAA;QACD,OAAO,IAAI,CAAC,MAAM,CAAA;IACpB,CAAC;IAED,SAAS,eAAe;QACtB,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAAA;QACzC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAA;QAC3F,CAAC;QACD,OAAO,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,WAAW,IAAI,YAAY,CAAC,CAAA;IACxE,CAAC;IAED,SAAS,gBAAgB;QACvB,OAAO,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAA;IACnD,CAAC;IAED,KAAK,UAAU,eAAe,CAC5B,QAAsB,EACtB,EAAM,EACN,IAAwD;QAExD,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAA;QAClC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;QACxC,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,oBAAoB,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAA;QACpG,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAA;IACrE,CAAC;IAED,KAAK,UAAU,WAAW,CACxB,QAAsB,EACtB,EAAM,EACN,OAAoB;QAEpB,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAA;QAClC,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAA;QACzE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,iBAAiB,CAAC,8BAA8B,CAAC,CAAA;QAC7D,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;QACrC,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,oBAAoB,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAA;QACpG,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAA;IACrE,CAAC;IAED,KAAK,UAAU,UAAU,CACvB,QAAsB,EACtB,EAAM,EACN,OAAoB;QAEpB,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAA;QAClC,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAA;QACzE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,iBAAiB,CAAC,8BAA8B,CAAC,CAAA;QAC7D,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAA;QACxC,MAAM,EAAE,CAAC,OAAO,CACd,GAAG,CAAA;+BACsB,SAAS,yBAAyB,CAC5D,CAAA;QACD,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,sBAAsB,CAAC,QAAQ,CAAC,CAAC,CAAA;IACjE,CAAC;IAED,KAAK,UAAU,aAAa,CAC1B,QAAsB,EACtB,EAAM,EACN,MAAc;QAEd,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAA;QAClC,MAAM,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QAC3B,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,sBAAsB,CAAC,QAAQ,CAAC,CAAC,CAAA;IACjE,CAAC;IAED,OAAO;QACL,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,iBAAiB,EAAE,YAAY,EAAE,kBAAkB;QACjG,eAAe,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa;KACxD,CAAA;AACH,CAAC;AAED,MAAM,iBAAiB,GAAG;IACxB,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;CAC9E,CAAA;AAED,SAAS,mBAAmB,CAAC,MAAqB;IAChD,MAAM,QAAQ,GAAa,EAAE,CAAA;IAC7B,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC,OAAO,CAAA;IAEhD,IAAI,UAAU,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAC5B,QAAQ,CAAC,IAAI,CAAC,kFAAkF,CAAC,CAAA;IACnG,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC1B,QAAQ,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAA;IAChG,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC,WAAW,EAAE,CAAA;IACvD,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,CAAC;QACxC,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CAAC,kCAAkC,OAAO,iCAAiC,CAAC,CAAA;YACzF,MAAK;QACP,CAAC;IACH,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAClE,QAAQ,CAAC,IAAI,CAAC,oEAAoE,CAAC,CAAA;IACrF,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,uEAAuE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM;YACrH,oHAAoH,CACrH,CAAA;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,KAAa;IACpC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;IACjC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAClC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;IACxD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;AAC1C,CAAC"}

package/dist/auth/auth/types.d.ts

@@ -0,0 +1,22 @@
+import type { DB } from '../../data/db/types.js';
+/** Runtime auth context passed to strategies — carries the resolved DB and request metadata. */
+export interface AuthContext {
+    readonly db: (name?: string) => DB;
+}
+/** Pluggable auth strategy — implement authenticate() to extract auth from a request. */
+export interface AuthStrategy<TAuth> {
+    readonly name: string;
+    extract(request: AuthRequest, context: AuthContext): Promise<TAuth | null>;
+    verify(extracted: TAuth, context: AuthContext): Promise<TAuth>;
+}
+/** Normalized request shape passed to auth strategies — headers, cookies, method, url. */
+export interface AuthRequest {
+    readonly headers: Readonly<Record<string, string | undefined>>;
+    readonly cookies: Readonly<Record<string, string | undefined>>;
+}
+/** Minimum auth shape — userId and tenantId. Extend for app-specific auth fields. */
+export interface BaseAuth {
+    readonly userId: string;
+    readonly tenantId: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/auth/auth/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/auth/auth/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,wBAAwB,CAAA;AAEhD,gGAAgG;AAChG,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,KAAK,EAAE,CAAA;CACnC;AAED,yFAAyF;AACzF,MAAM,WAAW,YAAY,CAAC,KAAK;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,OAAO,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAAA;IAC1E,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,CAAA;CAC/D;AAED,0FAA0F;AAC1F,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAA;IAC9D,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAA;CAC/D;AAED,qFAAqF;AACrF,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAC1B"}

package/dist/auth/auth/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/auth/auth/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/auth/auth/types.ts"],"names":[],"mappings":""}

package/dist/auth/rbac/cache.d.ts

@@ -0,0 +1,13 @@
+import type { PermissionSet } from './types.js';
+export declare class PermissionCache {
+    private readonly store;
+    private readonly ttlMs;
+    constructor(ttlMs: number);
+    get(userId: string, tenantId: string, authVersion: number): PermissionSet | null;
+    set(permissionSet: PermissionSet): void;
+    invalidate(userId: string, tenantId: string): void;
+    clear(): void;
+    get size(): number;
+    private key;
+}
+//# sourceMappingURL=cache.d.ts.map

package/dist/auth/rbac/cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../../src/auth/rbac/cache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAO/C,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAgC;IACtD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;gBAElB,KAAK,EAAE,MAAM;IAIzB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI;IAWhF,GAAG,CAAC,aAAa,EAAE,aAAa,GAAG,IAAI;IAQvC,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI;IASlD,KAAK,IAAI,IAAI;IAIb,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,OAAO,CAAC,GAAG;CAGZ"}

package/dist/auth/rbac/cache.js

@@ -0,0 +1,43 @@
+export class PermissionCache {
+    store = new Map();
+    ttlMs;
+    constructor(ttlMs) {
+        this.ttlMs = ttlMs;
+    }
+    get(userId, tenantId, authVersion) {
+        const key = this.key(userId, tenantId, authVersion);
+        const entry = this.store.get(key);
+        if (!entry)
+            return null;
+        if (Date.now() > entry.expiresAt) {
+            this.store.delete(key);
+            return null;
+        }
+        return entry.set;
+    }
+    set(permissionSet) {
+        const key = this.key(permissionSet.userId, permissionSet.tenantId, permissionSet.authVersion);
+        this.store.set(key, {
+            set: permissionSet,
+            expiresAt: Date.now() + this.ttlMs,
+        });
+    }
+    invalidate(userId, tenantId) {
+        const prefix = `${userId}:${tenantId}:`;
+        for (const key of this.store.keys()) {
+            if (key.startsWith(prefix)) {
+                this.store.delete(key);
+            }
+        }
+    }
+    clear() {
+        this.store.clear();
+    }
+    get size() {
+        return this.store.size;
+    }
+    key(userId, tenantId, authVersion) {
+        return `${userId}:${tenantId}:${authVersion}`;
+    }
+}
+//# sourceMappingURL=cache.js.map

package/dist/auth/rbac/cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.js","sourceRoot":"","sources":["../../../src/auth/rbac/cache.ts"],"names":[],"mappings":"AAOA,MAAM,OAAO,eAAe;IACT,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAA;IACrC,KAAK,CAAQ;IAE9B,YAAY,KAAa;QACvB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;IACpB,CAAC;IAED,GAAG,CAAC,MAAc,EAAE,QAAgB,EAAE,WAAmB;QACvD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAA;QACnD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACjC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QACvB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YACtB,OAAO,IAAI,CAAA;QACb,CAAC;QACD,OAAO,KAAK,CAAC,GAAG,CAAA;IAClB,CAAC;IAED,GAAG,CAAC,aAA4B;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,EAAE,aAAa,CAAC,QAAQ,EAAE,aAAa,CAAC,WAAW,CAAC,CAAA;QAC7F,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE;YAClB,GAAG,EAAE,aAAa;YAClB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK;SACnC,CAAC,CAAA;IACJ,CAAC;IAED,UAAU,CAAC,MAAc,EAAE,QAAgB;QACzC,MAAM,MAAM,GAAG,GAAG,MAAM,IAAI,QAAQ,GAAG,CAAA;QACvC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YACpC,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YACxB,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK;QACH,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAA;IACpB,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAA;IACxB,CAAC;IAEO,GAAG,CAAC,MAAc,EAAE,QAAgB,EAAE,WAAmB;QAC/D,OAAO,GAAG,MAAM,IAAI,QAAQ,IAAI,WAAW,EAAE,CAAA;IAC/C,CAAC;CACF"}

package/dist/auth/rbac/check.d.ts

@@ -0,0 +1,4 @@
+import type { ResolvedPermission } from './types.js';
+export declare function scopeSatisfies(granted: string, required: string, hierarchy?: readonly string[]): boolean;
+export declare function hasPermission(permissions: readonly ResolvedPermission[], resource: string, action: string, requiredScope?: string, hierarchy?: readonly string[]): boolean;
+//# sourceMappingURL=check.d.ts.map

package/dist/auth/rbac/check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../../src/auth/rbac/check.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAIpD,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,SAAS,GAAE,SAAS,MAAM,EAAsB,GAC/C,OAAO,CAKT;AAED,wBAAgB,aAAa,CAC3B,WAAW,EAAE,SAAS,kBAAkB,EAAE,EAC1C,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,MAAM,EACtB,SAAS,GAAE,SAAS,MAAM,EAAsB,GAC/C,OAAO,CAQT"}

package/dist/auth/rbac/check.js

@@ -0,0 +1,20 @@
+const DEFAULT_HIERARCHY = ['own', 'team', 'territory', 'tenant'];
+export function scopeSatisfies(granted, required, hierarchy = DEFAULT_HIERARCHY) {
+    const grantedIdx = hierarchy.indexOf(granted);
+    const requiredIdx = hierarchy.indexOf(required);
+    if (grantedIdx === -1 || requiredIdx === -1)
+        return false;
+    return grantedIdx >= requiredIdx;
+}
+export function hasPermission(permissions, resource, action, requiredScope, hierarchy = DEFAULT_HIERARCHY) {
+    for (const perm of permissions) {
+        if (perm.resource === resource && perm.action === action) {
+            if (requiredScope === undefined)
+                return true;
+            if (scopeSatisfies(perm.scope, requiredScope, hierarchy))
+                return true;
+        }
+    }
+    return false;
+}
+//# sourceMappingURL=check.js.map

package/dist/auth/rbac/check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.js","sourceRoot":"","sources":["../../../src/auth/rbac/check.ts"],"names":[],"mappings":"AAEA,MAAM,iBAAiB,GAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAA;AAEnF,MAAM,UAAU,cAAc,CAC5B,OAAe,EACf,QAAgB,EAChB,YAA+B,iBAAiB;IAEhD,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IAC7C,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC/C,IAAI,UAAU,KAAK,CAAC,CAAC,IAAI,WAAW,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAA;IACzD,OAAO,UAAU,IAAI,WAAW,CAAA;AAClC,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,WAA0C,EAC1C,QAAgB,EAChB,MAAc,EACd,aAAsB,EACtB,YAA+B,iBAAiB;IAEhD,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACzD,IAAI,aAAa,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAA;YAC5C,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,aAAa,EAAE,SAAS,CAAC;gBAAE,OAAO,IAAI,CAAA;QACvE,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/auth/rbac/index.d.ts

@@ -0,0 +1,8 @@
+import type { RbacConfig, Rbac } from './types.js';
+export type { RbacConfig, Rbac, PermissionSet, ResolvedPermission, Scope, SeedData, SeedPermission, SeedRole, SeedRolePermission, SeedUserRole } from './types.js';
+export { hasPermission, scopeSatisfies } from './check.js';
+export { PermissionCache } from './cache.js';
+export { enforcePermission } from './middleware.js';
+/** Creates an Rbac instance from role/permission config — provides check, enforce, and seed operations. */
+export declare function createRbac(config: RbacConfig): Rbac;
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/rbac/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/rbac/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,IAAI,EAA2B,MAAM,YAAY,CAAA;AAM3E,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,EAAE,kBAAkB,EAAE,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,QAAQ,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAClK,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AAEnD,2GAA2G;AAC3G,wBAAgB,UAAU,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CA0BnD"}

package/dist/auth/rbac/index.js

@@ -0,0 +1,32 @@
+import { PermissionCache } from './cache.js';
+import { resolveUserPermissions } from './resolve.js';
+import { hasPermission } from './check.js';
+import { seedRbac } from './seed.js';
+export { hasPermission, scopeSatisfies } from './check.js';
+export { PermissionCache } from './cache.js';
+export { enforcePermission } from './middleware.js';
+/** Creates an Rbac instance from role/permission config — provides check, enforce, and seed operations. */
+export function createRbac(config) {
+    const cache = new PermissionCache(config.cacheTtlMs ?? 60_000);
+    const scopes = config.scopes ?? ['own', 'team', 'territory', 'tenant'];
+    return {
+        async resolve(db, userId, tenantId, authVersion) {
+            const cached = cache.get(userId, tenantId, authVersion);
+            if (cached)
+                return cached;
+            const resolved = await resolveUserPermissions(db, userId, tenantId, authVersion, config);
+            cache.set(resolved);
+            return resolved;
+        },
+        check(permissions, resource, action, requiredScope) {
+            return hasPermission(permissions.permissions, resource, action, requiredScope, scopes);
+        },
+        invalidate(userId, tenantId) {
+            cache.invalidate(userId, tenantId);
+        },
+        async seed(db, data) {
+            await seedRbac(db, data, config);
+        },
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/auth/rbac/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/rbac/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAA;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AAGpC,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AAEnD,2GAA2G;AAC3G,MAAM,UAAU,UAAU,CAAC,MAAkB;IAC3C,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,CAAA;IAC9D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAA;IAEtE,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,EAAM,EAAE,MAAc,EAAE,QAAgB,EAAE,WAAmB;YACzE,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAA;YACvD,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAA;YAEzB,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,CAAC,CAAA;YACxF,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YACnB,OAAO,QAAQ,CAAA;QACjB,CAAC;QAED,KAAK,CAAC,WAA0B,EAAE,QAAgB,EAAE,MAAc,EAAE,aAAsB;YACxF,OAAO,aAAa,CAAC,WAAW,CAAC,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC,CAAA;QACxF,CAAC;QAED,UAAU,CAAC,MAAc,EAAE,QAAgB;YACzC,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QACpC,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,EAAM,EAAE,IAAc;YAC/B,MAAM,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;QAClC,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/auth/rbac/middleware.d.ts

@@ -0,0 +1,4 @@
+import type { DB } from '../../data/db/index.js';
+import type { Rbac } from './types.js';
+export declare function enforcePermission(rbac: Rbac, db: DB, userId: string, tenantId: string, authVersion: number, resource: string, action: string, requiredScope?: string): Promise<void>;
+//# sourceMappingURL=middleware.d.ts.map

package/dist/auth/rbac/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../../src/auth/rbac/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,wBAAwB,CAAA;AAChD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AAGtC,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,IAAI,EACV,EAAE,EAAE,EAAE,EACN,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,IAAI,CAAC,CAMf"}

package/dist/auth/rbac/middleware.js

@@ -0,0 +1,9 @@
+import { ForbiddenError } from '../../core/errors/index.js';
+export async function enforcePermission(rbac, db, userId, tenantId, authVersion, resource, action, requiredScope) {
+    const permissions = await rbac.resolve(db, userId, tenantId, authVersion);
+    const granted = rbac.check(permissions, resource, action, requiredScope);
+    if (!granted) {
+        throw new ForbiddenError(`Missing permission: ${resource}:${action}`);
+    }
+}
+//# sourceMappingURL=middleware.js.map

package/dist/auth/rbac/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../../src/auth/rbac/middleware.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAE3D,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAU,EACV,EAAM,EACN,MAAc,EACd,QAAgB,EAChB,WAAmB,EACnB,QAAgB,EAChB,MAAc,EACd,aAAsB;IAEtB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAA;IACzE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,CAAC,CAAA;IACxE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,cAAc,CAAC,uBAAuB,QAAQ,IAAI,MAAM,EAAE,CAAC,CAAA;IACvE,CAAC;AACH,CAAC"}

package/dist/auth/rbac/namespace.d.ts

@@ -0,0 +1,15 @@
+import { createRbac, hasPermission, enforcePermission, scopeSatisfies, PermissionCache } from './index.js';
+/** Role-based access control namespace — permission checking, enforcement, scope hierarchy. */
+export declare const rbac: {
+    /** Creates an Rbac instance from config (roles, permissions, hierarchy). */
+    create: typeof createRbac;
+    /** Checks if a permission set includes the required resource/action/scope. Pure function, no DB. */
+    check: typeof hasPermission;
+    /** Checks permission and throws ForbiddenError if denied. Loads permissions from DB with caching. */
+    enforce: typeof enforcePermission;
+    /** Checks if a granted scope satisfies a required scope given a hierarchy (e.g. org > team > self). */
+    satisfies: typeof scopeSatisfies;
+    /** LRU cache for resolved permissions — avoids repeated DB lookups within a request. */
+    PermissionCache: typeof PermissionCache;
+};
+//# sourceMappingURL=namespace.d.ts.map

package/dist/auth/rbac/namespace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"namespace.d.ts","sourceRoot":"","sources":["../../../src/auth/rbac/namespace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,iBAAiB,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAE1G,+FAA+F;AAC/F,eAAO,MAAM,IAAI;IACf,4EAA4E;;IAE5E,oGAAoG;;IAEpG,qGAAqG;;IAErG,uGAAuG;;IAEvG,wFAAwF;;CAEzF,CAAA"}

package/dist/auth/rbac/namespace.js

@@ -0,0 +1,15 @@
+import { createRbac, hasPermission, enforcePermission, scopeSatisfies, PermissionCache } from './index.js';
+/** Role-based access control namespace — permission checking, enforcement, scope hierarchy. */
+export const rbac = {
+    /** Creates an Rbac instance from config (roles, permissions, hierarchy). */
+    create: createRbac,
+    /** Checks if a permission set includes the required resource/action/scope. Pure function, no DB. */
+    check: hasPermission,
+    /** Checks permission and throws ForbiddenError if denied. Loads permissions from DB with caching. */
+    enforce: enforcePermission,
+    /** Checks if a granted scope satisfies a required scope given a hierarchy (e.g. org > team > self). */
+    satisfies: scopeSatisfies,
+    /** LRU cache for resolved permissions — avoids repeated DB lookups within a request. */
+    PermissionCache,
+};
+//# sourceMappingURL=namespace.js.map

package/dist/auth/rbac/namespace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"namespace.js","sourceRoot":"","sources":["../../../src/auth/rbac/namespace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,iBAAiB,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAE1G,+FAA+F;AAC/F,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,4EAA4E;IAC5E,MAAM,EAAE,UAAU;IAClB,oGAAoG;IACpG,KAAK,EAAE,aAAa;IACpB,qGAAqG;IACrG,OAAO,EAAE,iBAAiB;IAC1B,uGAAuG;IACvG,SAAS,EAAE,cAAc;IACzB,wFAAwF;IACxF,eAAe;CAChB,CAAA"}

package/dist/auth/rbac/resolve.d.ts

@@ -0,0 +1,4 @@
+import type { DB } from '../../data/db/index.js';
+import type { RbacConfig, PermissionSet } from './types.js';
+export declare function resolveUserPermissions(db: DB, userId: string, tenantId: string, authVersion: number, config: RbacConfig): Promise<PermissionSet>;
+//# sourceMappingURL=resolve.d.ts.map

package/dist/auth/rbac/resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../../src/auth/rbac/resolve.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,wBAAwB,CAAA;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAsB,MAAM,YAAY,CAAA;AAG/E,wBAAsB,sBAAsB,CAC1C,EAAE,EAAE,EAAE,EACN,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,aAAa,CAAC,CAwBxB"}

package/dist/auth/rbac/resolve.js

@@ -0,0 +1,24 @@
+import { sql } from '../../data/db/sql.js';
+import { assertValidIdentifier, quoteIdentifier } from '../../data/db/identifiers.js';
+export async function resolveUserPermissions(db, userId, tenantId, authVersion, config) {
+    const userRolesTable = config.table?.userRoles ?? 'pipework_user_roles';
+    const rolePermissionsTable = config.table?.rolePermissions ?? 'pipework_role_permissions';
+    const permissionsTable = config.table?.permissions ?? 'pipework_permissions';
+    assertValidIdentifier(userRolesTable, 'userRoles table');
+    assertValidIdentifier(rolePermissionsTable, 'rolePermissions table');
+    assertValidIdentifier(permissionsTable, 'permissions table');
+    const rows = await db.execute(sql `
+    SELECT p.resource, p.action, rp.scope
+    FROM ${sql.raw(quoteIdentifier(userRolesTable, 'userRoles table'))} ur
+    JOIN ${sql.raw(quoteIdentifier(rolePermissionsTable, 'rolePermissions table'))} rp ON rp.role_id = ur.role_id
+    JOIN ${sql.raw(quoteIdentifier(permissionsTable, 'permissions table'))} p ON p.id = rp.permission_id
+    WHERE ur.user_id = ${userId} AND ur.tenant_id = ${tenantId}
+  `);
+    const permissions = rows.map((row) => ({
+        resource: row['resource'],
+        action: row['action'],
+        scope: row['scope'],
+    }));
+    return { userId, tenantId, authVersion, permissions };
+}
+//# sourceMappingURL=resolve.js.map

package/dist/auth/rbac/resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../../src/auth/rbac/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,sBAAsB,CAAA;AAG1C,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AAErF,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,EAAM,EACN,MAAc,EACd,QAAgB,EAChB,WAAmB,EACnB,MAAkB;IAElB,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,EAAE,SAAS,IAAI,qBAAqB,CAAA;IACvE,MAAM,oBAAoB,GAAG,MAAM,CAAC,KAAK,EAAE,eAAe,IAAI,2BAA2B,CAAA;IACzF,MAAM,gBAAgB,GAAG,MAAM,CAAC,KAAK,EAAE,WAAW,IAAI,sBAAsB,CAAA;IAE5E,qBAAqB,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAA;IACxD,qBAAqB,CAAC,oBAAoB,EAAE,uBAAuB,CAAC,CAAA;IACpE,qBAAqB,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,CAAA;IAE5D,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;;WAExB,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC;WAC3D,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,oBAAoB,EAAE,uBAAuB,CAAC,CAAC;WACvE,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,CAAC;yBACjD,MAAM,uBAAuB,QAAQ;GAC3D,CAAC,CAAA;IAEF,MAAM,WAAW,GAAyB,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC3D,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAW;QACnC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAW;QAC/B,KAAK,EAAE,GAAG,CAAC,OAAO,CAAW;KAC9B,CAAC,CAAC,CAAA;IAEH,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,CAAA;AACvD,CAAC"}

package/dist/auth/rbac/seed.d.ts

@@ -0,0 +1,4 @@
+import type { DB } from '../../data/db/index.js';
+import type { RbacConfig, SeedData } from './types.js';
+export declare function seedRbac(db: DB, data: SeedData, config: RbacConfig): Promise<void>;
+//# sourceMappingURL=seed.d.ts.map

package/dist/auth/rbac/seed.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seed.d.ts","sourceRoot":"","sources":["../../../src/auth/rbac/seed.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,wBAAwB,CAAA;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAGtD,wBAAsB,QAAQ,CAC5B,EAAE,EAAE,EAAE,EACN,IAAI,EAAE,QAAQ,EACd,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,IAAI,CAAC,CAgEf"}

package/dist/auth/rbac/seed.js

@@ -0,0 +1,63 @@
+import { sql } from '../../data/db/sql.js';
+import { assertValidIdentifier, quoteIdentifier } from '../../data/db/identifiers.js';
+export async function seedRbac(db, data, config) {
+    const permissionsTable = config.table?.permissions ?? 'pipework_permissions';
+    const rolesTable = config.table?.roles ?? 'pipework_roles';
+    const rolePermissionsTable = config.table?.rolePermissions ?? 'pipework_role_permissions';
+    const userRolesTable = config.table?.userRoles ?? 'pipework_user_roles';
+    assertValidIdentifier(permissionsTable, 'permissions table');
+    assertValidIdentifier(rolesTable, 'roles table');
+    assertValidIdentifier(rolePermissionsTable, 'rolePermissions table');
+    assertValidIdentifier(userRolesTable, 'userRoles table');
+    const permQ = quoteIdentifier(permissionsTable, 'permissions table');
+    const rolesQ = quoteIdentifier(rolesTable, 'roles table');
+    const rolePermQ = quoteIdentifier(rolePermissionsTable, 'rolePermissions table');
+    const userRolesQ = quoteIdentifier(userRolesTable, 'userRoles table');
+    for (const perm of data.permissions) {
+        await db.execute(sql `
+      INSERT INTO ${sql.raw(permQ)} (resource, action)
+      VALUES (${perm.resource}, ${perm.action})
+      ON CONFLICT (resource, action) DO NOTHING
+    `);
+    }
+    for (const role of data.roles) {
+        if (role.description !== undefined) {
+            await db.execute(sql `
+        INSERT INTO ${sql.raw(rolesQ)} (name, tenant_id, description)
+        VALUES (${role.name}, ${role.tenantId}, ${role.description})
+        ON CONFLICT (tenant_id, name) DO UPDATE SET
+          description = EXCLUDED.description
+      `);
+        }
+        else {
+            await db.execute(sql `
+        INSERT INTO ${sql.raw(rolesQ)} (name, tenant_id)
+        VALUES (${role.name}, ${role.tenantId})
+        ON CONFLICT (tenant_id, name) DO UPDATE SET
+          description = EXCLUDED.description
+      `);
+        }
+        for (const rp of role.permissions) {
+            await db.execute(sql `
+        INSERT INTO ${sql.raw(rolePermQ)} (role_id, permission_id, scope)
+        SELECT r.id, p.id, ${rp.scope}
+        FROM ${sql.raw(rolesQ)} r, ${sql.raw(permQ)} p
+        WHERE r.name = ${role.name} AND r.tenant_id = ${role.tenantId}
+          AND p.resource = ${rp.resource} AND p.action = ${rp.action}
+        ON CONFLICT (role_id, permission_id) DO UPDATE SET scope = EXCLUDED.scope
+      `);
+        }
+    }
+    if (data.userRoles) {
+        for (const ur of data.userRoles) {
+            await db.execute(sql `
+        INSERT INTO ${sql.raw(userRolesQ)} (user_id, role_id, tenant_id)
+        SELECT ${ur.userId}, r.id, ${ur.tenantId}
+        FROM ${sql.raw(rolesQ)} r
+        WHERE r.name = ${ur.roleName} AND r.tenant_id = ${ur.tenantId}
+        ON CONFLICT (user_id, role_id, tenant_id) DO NOTHING
+      `);
+        }
+    }
+}
+//# sourceMappingURL=seed.js.map