quidproquo-webserver 0.0.263 → 0.1.1

package/lib/commonjs/actionProcessor/api/getHttpApiEventAutoRespondActionProcessor.js

@@ -13,9 +13,8 @@ exports.getHttpApiEventAutoRespondActionProcessor = void 0;
 const quidproquo_core_1 = require("quidproquo-core");
 const askValidateRouteAuth_1 = require("../../stories/askValidateRouteAuth");
 const headerUtils_1 = require("../../utils/headerUtils");
-const uuidUtils_1 = require("../../utils/uuidUtils");
 const getProcessAutoRespond = (qpqConfig) => {
-    const validateAuth = (0, quidproquo_core_1.getProcessCustomImplementation)(qpqConfig, askValidateRouteAuth_1.askValidateRouteAuth, 'API Auth Validation', null, () => new Date().toISOString(), uuidUtils_1.generateUUID);
+    const validateAuth = (0, quidproquo_core_1.getProcessCustomImplementation)(qpqConfig, askValidateRouteAuth_1.askValidateRouteAuth, 'API Auth Validation', null, () => new Date().toISOString(), quidproquo_core_1.generateUuid);
     return (_a, session_1, actionProcessorList_1, logger_1, updateSession_1, dynamicModuleLoader_1) => __awaiter(void 0, [_a, session_1, actionProcessorList_1, logger_1, updateSession_1, dynamicModuleLoader_1], void 0, function* ({ qpqEventRecord, matchResult }, session, actionProcessorList, logger, updateSession, dynamicModuleLoader) {
         var _b;
         // Just auto respond for options requests

package/lib/commonjs/actionProcessor/api/getHttpApiEventGetStorySessionActionProcessor.js

@@ -12,9 +12,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.getHttpApiEventGetStorySessionActionProcessor = void 0;
 const quidproquo_core_1 = require("quidproquo-core");
 const askGetHttpApiEventStorySession_1 = require("../../stories/askGetHttpApiEventStorySession");
-const uuidUtils_1 = require("../../utils/uuidUtils");
 const getProcessGetStorySession = (qpqConfig) => {
-    const getSession = (0, quidproquo_core_1.getProcessCustomImplementation)(qpqConfig, askGetHttpApiEventStorySession_1.askGetHttpApiEventStorySession, 'API Get Story Session', null, () => new Date().toISOString(), uuidUtils_1.generateUUID);
+    const getSession = (0, quidproquo_core_1.getProcessCustomImplementation)(qpqConfig, askGetHttpApiEventStorySession_1.askGetHttpApiEventStorySession, 'API Get Story Session', null, () => new Date().toISOString(), quidproquo_core_1.generateUuid);
     return (_a, session_1, actionProcessorList_1, logger_1, updateSession_1, dynamicModuleLoader_1) => __awaiter(void 0, [_a, session_1, actionProcessorList_1, logger_1, updateSession_1, dynamicModuleLoader_1], void 0, function* ({ matchStoryResult, qpqEventRecord }, session, actionProcessorList, logger, updateSession, dynamicModuleLoader) {
         var _b;
         const payload = {

package/lib/commonjs/actionProcessor/routeAuthValidation/getRouteAuthValidationDecodeActionProcessor.js

@@ -13,9 +13,8 @@ exports.getRouteAuthValidationDecodeActionProcessor = void 0;
 const quidproquo_core_1 = require("quidproquo-core");
 const routeAuthValidation_1 = require("../../actions/routeAuthValidation");
 const askRouteAuthValidationDecodeDefault_1 = require("../../stories/askRouteAuthValidationDecodeDefault");
-const uuidUtils_1 = require("../../utils/uuidUtils");
 const getProcessRouteAuthValidationDecode = (qpqConfig) => {
-    const decodeAuth = (0, quidproquo_core_1.getProcessCustomImplementation)(qpqConfig, askRouteAuthValidationDecodeDefault_1.askRouteAuthValidationDecodeDefault, 'Route Auth Validation Decode', null, () => new Date().toISOString(), uuidUtils_1.generateUUID);
+    const decodeAuth = (0, quidproquo_core_1.getProcessCustomImplementation)(qpqConfig, askRouteAuthValidationDecodeDefault_1.askRouteAuthValidationDecodeDefault, 'Route Auth Validation Decode', null, () => new Date().toISOString(), quidproquo_core_1.generateUuid);
     return (payload, session, actionProcessorList, logger, updateSession, dynamicModuleLoader, streamRegistry) => __awaiter(void 0, void 0, void 0, function* () {
         const [result, error] = yield decodeAuth(payload, session, actionProcessorList, logger, updateSession, dynamicModuleLoader, streamRegistry);
         if (error) {

package/lib/commonjs/actions/index.d.ts

@@ -1,7 +1,6 @@
 export * from './admin';
 export * from './apiKeyValidation';
 export * from './dns';
-export * from "./extract";
 export * from './genericDataResource';
 export * from './openApiSpec';
 export * from './routeAuthValidation';

package/lib/commonjs/actions/index.js

@@ -17,7 +17,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./admin"), exports);
 __exportStar(require("./apiKeyValidation"), exports);
 __exportStar(require("./dns"), exports);
-__exportStar(require("./extract"), exports);
 __exportStar(require("./genericDataResource"), exports);
 __exportStar(require("./openApiSpec"), exports);
 __exportStar(require("./routeAuthValidation"), exports);

package/lib/commonjs/config/QPQConfig.d.ts

@@ -12,7 +12,8 @@ export declare enum QPQWebServerConfigSettingType {
     WebSocket = "@quidproquo-webserver/config/WebSocket",
     Cache = "@quidproquo-webserver/config/Cache",
     Certificate = "@quidproquo-webserver/config/Certificate",
-    DomainProxy = "@quidproquo-webserver/config/DomainProxy"
+    DomainProxy = "@quidproquo-webserver/config/DomainProxy",
+    StorageDriveCorsSettings = "@quidproquo-webserver/config/StorageDriveCorsSettings"
 }
 export interface CacheSettings {
     minTTLInSeconds: number;

package/lib/commonjs/config/QPQConfig.js

@@ -17,4 +17,5 @@ var QPQWebServerConfigSettingType;
     QPQWebServerConfigSettingType["Cache"] = "@quidproquo-webserver/config/Cache";
     QPQWebServerConfigSettingType["Certificate"] = "@quidproquo-webserver/config/Certificate";
     QPQWebServerConfigSettingType["DomainProxy"] = "@quidproquo-webserver/config/DomainProxy";
+    QPQWebServerConfigSettingType["StorageDriveCorsSettings"] = "@quidproquo-webserver/config/StorageDriveCorsSettings";
 })(QPQWebServerConfigSettingType || (exports.QPQWebServerConfigSettingType = QPQWebServerConfigSettingType = {}));

package/lib/commonjs/config/settings/{logs.d.ts → defineAdminSettings/defineAdminSettings.d.ts}

@@ -3,6 +3,6 @@ export interface QPQConfigAdvancedLogSettings extends QPQConfigAdvancedSettings
     logRetentionDays?: number;
     coldStorageAfterDays?: number;
     claudeAiApiKeySecretName?: string;
+    services?: string[];
 }
-export declare const logReportsResourceName = "qpq-log-reports";
-export declare const defineLogs: (rootDomain: string, services: string[], advancedSettings?: QPQConfigAdvancedLogSettings) => QPQConfig;
+export declare const defineAdminSettings: (logServiceName: string, rootDomain: string, advancedSettings?: QPQConfigAdvancedLogSettings) => QPQConfig;

package/lib/commonjs/config/settings/defineAdminSettings/defineAdminSettings.js

@@ -0,0 +1,127 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.defineAdminSettings = void 0;
+const quidproquo_core_1 = require("quidproquo-core");
+const getServiceEntryQpqFunctionRuntime_1 = require("../../../services/getServiceEntryQpqFunctionRuntime");
+const defineAdminServiceAuthRoute_1 = require("../../../services/log/config/defineAdminServiceAuthRoute");
+const defineAdminServiceLogLogRoute_1 = require("../../../services/log/config/defineAdminServiceLogLogRoute");
+const defineAdminServiceLogRoute_1 = require("../../../services/log/config/defineAdminServiceLogRoute");
+const WebSocketQueueQpqAdminClientMessageEventType_1 = require("../../../services/log/logic/webSocket/clientMessages/WebSocketQueueQpqAdminClientMessageEventType");
+const adminUserDirectory_1 = require("../adminUserDirectory");
+const webSocketQueue_1 = require("../webSocketQueue");
+// Retention defaults to undefined (no expiry) unless `logRetentionDays` is set.
+// If `coldStorageAfterDays` is set, retention is padded by 180 days so logs
+// outlive the cold-storage transition window.
+const calculateLogRetentionDays = (advancedSettings) => {
+    var _a;
+    if (!(advancedSettings === null || advancedSettings === void 0 ? void 0 : advancedSettings.logRetentionDays))
+        return undefined;
+    const coldStorageExtension = ((_a = advancedSettings.coldStorageAfterDays) !== null && _a !== void 0 ? _a : 0) > 0 ? advancedSettings.coldStorageAfterDays + 180 : 0;
+    return Math.max(advancedSettings.logRetentionDays, coldStorageExtension);
+};
+const defineAdminSettings = (logServiceName, rootDomain, advancedSettings) => {
+    var _a, _b, _c;
+    const routeAuthSettings = {
+        routeAuthSettings: {
+            userDirectoryName: adminUserDirectory_1.adminUserDirectoryResourceName,
+        },
+    };
+    const logRetentionDays = calculateLogRetentionDays(advancedSettings);
+    return [
+        // Owner-stamped resources — materialise as owned on the admin deploy,
+        // and as foreign refs elsewhere. Owner resolution runs at IAM-scoping time.
+        (0, quidproquo_core_1.defineEventBus)('qpq-admin-wsq', {
+            owner: { module: logServiceName },
+        }),
+        (0, quidproquo_core_1.defineQueue)('qpqadmin-wscfg', {
+            [WebSocketQueueQpqAdminClientMessageEventType_1.WebsocketAdminClientMessageEventType.ConfigSyncRequest]: {
+                basePath: __dirname,
+                functionName: 'onConfigSyncRequest',
+                relativePath: 'entry/queue/webSocket',
+            },
+        }, {
+            eventBusSubscriptions: ['qpq-admin-wsq'],
+        }),
+        (0, webSocketQueue_1.defineWebSocketQueue)('qpq-admin-wsq', 'qpqadmin', rootDomain, {
+            userDirectoryName: adminUserDirectory_1.adminUserDirectoryResourceName,
+            owner: { module: logServiceName },
+        }),
+        (0, quidproquo_core_1.defineStorageDrive)(quidproquo_core_1.QPQ_LOGS_STORAGE_DRIVE_NAME, {
+            owner: { module: logServiceName },
+            onEvent: {
+                create: (0, getServiceEntryQpqFunctionRuntime_1.getServiceEntryQpqFunctionRuntime)('log', 'storageDrive', 'onCreate::onCreate'),
+            },
+            deprecated: advancedSettings === null || advancedSettings === void 0 ? void 0 : advancedSettings.deprecated,
+            lifecycleRules: [
+                {
+                    transitions: ((_a = advancedSettings === null || advancedSettings === void 0 ? void 0 : advancedSettings.coldStorageAfterDays) !== null && _a !== void 0 ? _a : 0) > 0
+                        ? [
+                            {
+                                storageDriveTier: quidproquo_core_1.StorageDriveTier.DEEP_COLD_STORAGE,
+                                transitionAfterDays: advancedSettings.coldStorageAfterDays,
+                            },
+                        ]
+                        : undefined,
+                    deleteAfterDays: logRetentionDays,
+                },
+            ],
+        }),
+        // Admin-only resources — only flatten out when the deploying service is the log service.
+        (0, quidproquo_core_1.defineServiceSettings)({
+            [logServiceName]: [
+                (0, quidproquo_core_1.defineStorageDrive)(quidproquo_core_1.QPQ_LOG_REPORTS_STORAGE_DRIVE_NAME, {
+                    deprecated: advancedSettings === null || advancedSettings === void 0 ? void 0 : advancedSettings.deprecated,
+                    lifecycleRules: [{ deleteAfterDays: 30 }],
+                }),
+                (0, quidproquo_core_1.defineKeyValueStore)(quidproquo_core_1.QPQ_LOGS_STORAGE_DRIVE_NAME, 'correlation', [], {
+                    indexes: [
+                        { partitionKey: 'runtimeType', sortKey: 'startedAt' },
+                        { partitionKey: 'fromCorrelation', sortKey: 'startedAt' },
+                    ],
+                    ttlAttribute: 'ttl',
+                    deprecated: advancedSettings === null || advancedSettings === void 0 ? void 0 : advancedSettings.deprecated,
+                }),
+                (0, quidproquo_core_1.defineKeyValueStore)('qpq-log-messages', 'correlationId', ['timestamp']),
+                (0, quidproquo_core_1.defineKeyValueStore)(`${quidproquo_core_1.QPQ_LOGS_STORAGE_DRIVE_NAME}-list`, { key: 'type', type: 'number' }, ['timestamp'], {
+                    deprecated: advancedSettings === null || advancedSettings === void 0 ? void 0 : advancedSettings.deprecated,
+                }),
+                (0, defineAdminServiceAuthRoute_1.defineAdminServiceAuthRoute)('POST', '/login', 'login'),
+                (0, defineAdminServiceAuthRoute_1.defineAdminServiceAuthRoute)('POST', '/refreshToken', 'refreshToken'),
+                (0, defineAdminServiceAuthRoute_1.defineAdminServiceAuthRoute)('POST', '/challenge', 'respondToAuthChallenge'),
+                (0, defineAdminServiceLogLogRoute_1.defineAdminServiceLogLogRoute)('POST', '/loglog/list', 'getLogLogs', routeAuthSettings),
+                (0, defineAdminServiceLogRoute_1.defineAdminServiceLogRoute)('GET', '/admin/services', 'getServiceNames'),
+                (0, defineAdminServiceLogRoute_1.defineAdminServiceLogRoute)('POST', '/log/list', 'getLogs', routeAuthSettings),
+                (0, defineAdminServiceLogRoute_1.defineAdminServiceLogRoute)('GET', '/log/{correlationId}', 'getLog', routeAuthSettings),
+                (0, defineAdminServiceLogRoute_1.defineAdminServiceLogRoute)('GET', '/log/{correlationId}/toggle', 'toggleLogCheck', routeAuthSettings),
+                (0, defineAdminServiceLogRoute_1.defineAdminServiceLogRoute)('GET', '/log/children/{fromCorrelation}', 'getChildren', routeAuthSettings),
+                (0, defineAdminServiceLogRoute_1.defineAdminServiceLogRoute)('GET', '/log/{correlationId}/hierarchies', 'getHierarchies', routeAuthSettings),
+                (0, defineAdminServiceLogRoute_1.defineAdminServiceLogRoute)('GET', '/log/downloadurl/{correlationId}', 'downloadUrl', routeAuthSettings),
+                (0, defineAdminServiceLogRoute_1.defineAdminServiceLogRoute)('POST', '/log/chat/message', 'sendChatMessage', routeAuthSettings),
+                (0, defineAdminServiceLogRoute_1.defineAdminServiceLogRoute)('POST', '/log/chat', 'getChatMessages', routeAuthSettings),
+                (0, quidproquo_core_1.defineQueue)('qpq-admin-websockets', {
+                    [WebSocketQueueQpqAdminClientMessageEventType_1.WebsocketAdminClientMessageEventType.MarkLogChecked]: (0, getServiceEntryQpqFunctionRuntime_1.getServiceEntryQpqFunctionRuntime)('log', 'queueEvent', 'webSocket::onMarkLogChecked'),
+                    [WebSocketQueueQpqAdminClientMessageEventType_1.WebsocketAdminClientMessageEventType.RefreshLogMetadata]: (0, getServiceEntryQpqFunctionRuntime_1.getServiceEntryQpqFunctionRuntime)('log', 'queueEvent', 'webSocket::onRefreshLogMetadata'),
+                }, {
+                    eventBusSubscriptions: ['qpq-admin-wsq'],
+                }),
+                (0, quidproquo_core_1.defineEventBus)('admin-notifier'),
+                (0, quidproquo_core_1.defineNotifyError)('admin-notifier', {
+                    onAlarm: {
+                        publishToEventBus: ['admin-notifier'],
+                    },
+                }),
+                (0, quidproquo_core_1.defineQueue)('admin-alarms', {
+                    [quidproquo_core_1.NotifyErrorQueueEvents.Error]: (0, getServiceEntryQpqFunctionRuntime_1.getServiceEntryQpqFunctionRuntime)('log', 'queueEvent', 'alarm::onError'),
+                    [quidproquo_core_1.NotifyErrorQueueEvents.Timeout]: (0, getServiceEntryQpqFunctionRuntime_1.getServiceEntryQpqFunctionRuntime)('log', 'queueEvent', 'alarm::onTimeout'),
+                    [quidproquo_core_1.NotifyErrorQueueEvents.Throttle]: (0, getServiceEntryQpqFunctionRuntime_1.getServiceEntryQpqFunctionRuntime)('log', 'queueEvent', 'alarm::onThrottle'),
+                }, {
+                    eventBusSubscriptions: ['admin-notifier'],
+                }),
+                (0, quidproquo_core_1.defineGlobal)('qpq-serviceNames', (_b = advancedSettings === null || advancedSettings === void 0 ? void 0 : advancedSettings.services) !== null && _b !== void 0 ? _b : []),
+                (0, quidproquo_core_1.defineGlobal)('qpq-log-retention-days', logRetentionDays),
+                (0, quidproquo_core_1.defineGlobal)('claudeAi-api-key', (_c = advancedSettings === null || advancedSettings === void 0 ? void 0 : advancedSettings.claudeAiApiKeySecretName) !== null && _c !== void 0 ? _c : ''),
+            ],
+        }),
+    ];
+};
+exports.defineAdminSettings = defineAdminSettings;

package/lib/commonjs/config/settings/defineAdminSettings/index.d.ts

@@ -0,0 +1 @@
+export * from './defineAdminSettings';

package/lib/commonjs/config/settings/{defineExposeAdminAdvancedSettings → defineAdminSettings}/index.js

@@ -14,4 +14,4 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-__exportStar(require("./defineExposeAdminAdvancedSettings"), exports);
+__exportStar(require("./defineAdminSettings"), exports);

package/lib/commonjs/config/settings/defineAuthSystem/defineAuthSystem.d.ts

@@ -0,0 +1,10 @@
+import { EmailTemplates, QPQConfig, UserDirectoryMfaSettings } from 'quidproquo-core';
+export interface AuthSystemOptions {
+    phoneRequired?: boolean;
+    selfSignUpEnabled?: boolean;
+    emailTemplates?: EmailTemplates;
+    mfa?: UserDirectoryMfaSettings;
+    basePath?: string;
+    allowedOrigins?: string[];
+}
+export declare const defineAuthSystem: (service: string, directoryName: string, options?: AuthSystemOptions) => QPQConfig;

package/lib/commonjs/config/settings/defineAuthSystem/defineAuthSystem.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.defineAuthSystem = void 0;
+const quidproquo_core_1 = require("quidproquo-core");
+const config_1 = require("../../../services/auth/config");
+const defineAuthServiceRoute_1 = require("../../../services/auth/config/defineAuthServiceRoute");
+// Bundles a complete username/password login flow: a user directory plus the
+// endpoints needed to log in, refresh tokens, respond to challenges, recover a
+// forgotten password, and change a password. The handler stories ship inside
+// quidproquo-webserver (services/auth) and resolve `directoryName` at runtime
+// from the global emitted below.
+const defineAuthSystem = (service, directoryName, options) => {
+    var _a;
+    const basePath = (_a = options === null || options === void 0 ? void 0 : options.basePath) !== null && _a !== void 0 ? _a : '';
+    const routeOptions = {
+        allowedOrigins: options === null || options === void 0 ? void 0 : options.allowedOrigins,
+    };
+    return [
+        // The user directory is declared at the top level (ungated) so other
+        // services in the application can reference it to validate access tokens.
+        (0, quidproquo_core_1.defineUserDirectory)(directoryName, {
+            phoneRequired: options === null || options === void 0 ? void 0 : options.phoneRequired,
+            selfSignUpEnabled: options === null || options === void 0 ? void 0 : options.selfSignUpEnabled,
+            emailTemplates: options === null || options === void 0 ? void 0 : options.emailTemplates,
+            mfa: options === null || options === void 0 ? void 0 : options.mfa,
+            owner: { module: service },
+        }),
+        // The login endpoints and their handlers only deploy with the owning service.
+        (0, quidproquo_core_1.defineServiceSettings)({
+            [service]: [
+                (0, quidproquo_core_1.defineGlobal)(config_1.AUTH_USER_DIRECTORY_GLOBAL_KEY, directoryName),
+                (0, defineAuthServiceRoute_1.defineAuthServiceRoute)('POST', `${basePath}/login`, 'login', routeOptions),
+                (0, defineAuthServiceRoute_1.defineAuthServiceRoute)('POST', `${basePath}/refreshToken`, 'refreshToken', routeOptions),
+                (0, defineAuthServiceRoute_1.defineAuthServiceRoute)('POST', `${basePath}/challenge`, 'respondToAuthChallenge', routeOptions),
+                (0, defineAuthServiceRoute_1.defineAuthServiceRoute)('POST', `${basePath}/associateSoftwareToken`, 'associateSoftwareToken', routeOptions),
+                (0, defineAuthServiceRoute_1.defineAuthServiceRoute)('POST', `${basePath}/forgotPassword`, 'forgotPassword', routeOptions),
+                (0, defineAuthServiceRoute_1.defineAuthServiceRoute)('POST', `${basePath}/forgotPassword/confirm`, 'confirmForgotPassword', routeOptions),
+                // Authenticated: the caller must present a valid access token.
+                (0, defineAuthServiceRoute_1.defineAuthServiceRoute)('POST', `${basePath}/changePassword`, 'changePassword', Object.assign(Object.assign({}, routeOptions), { routeAuthSettings: {
+                        userDirectoryName: directoryName,
+                    } })),
+            ],
+        }),
+    ];
+};
+exports.defineAuthSystem = defineAuthSystem;

package/lib/commonjs/config/settings/defineAuthSystem/index.d.ts

@@ -0,0 +1 @@
+export * from './defineAuthSystem';

package/lib/commonjs/{actions/extract → config/settings/defineAuthSystem}/index.js

@@ -14,6 +14,4 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-__exportStar(require("./ExtractActionType"), exports);
-__exportStar(require("./ExtractExpenseActionRequester"), exports);
-__exportStar(require("./ExtractExpenseActionTypes"), exports);
+__exportStar(require("./defineAuthSystem"), exports);

package/lib/commonjs/config/settings/index.d.ts

@@ -4,10 +4,10 @@ export * from './apiKey';
 export * from './cache';
 export * from './certificate';
 export * from './defaultRouteOptions';
-export * from './defineExposeAdminAdvancedSettings';
+export * from './defineAdminSettings';
+export * from './defineAuthSystem';
 export * from './dns';
 export * from './domainProxy';
-export * from './logs';
 export * from './migration';
 export * from './openApi';
 export * from './route';
@@ -15,6 +15,7 @@ export * from './seed';
 export * from './seo';
 export * from './serviceFunction';
 export * from './stateDispatchOverWebsockets';
+export * from './storageDriveCorsSettings';
 export * from './subdomainRedirect';
 export * from './webEntry';
 export * from './websocket';

package/lib/commonjs/config/settings/index.js

@@ -20,10 +20,10 @@ __exportStar(require("./apiKey"), exports);
 __exportStar(require("./cache"), exports);
 __exportStar(require("./certificate"), exports);
 __exportStar(require("./defaultRouteOptions"), exports);
-__exportStar(require("./defineExposeAdminAdvancedSettings"), exports);
+__exportStar(require("./defineAdminSettings"), exports);
+__exportStar(require("./defineAuthSystem"), exports);
 __exportStar(require("./dns"), exports);
 __exportStar(require("./domainProxy"), exports);
-__exportStar(require("./logs"), exports);
 __exportStar(require("./migration"), exports);
 __exportStar(require("./openApi"), exports);
 __exportStar(require("./route"), exports);
@@ -31,6 +31,7 @@ __exportStar(require("./seed"), exports);
 __exportStar(require("./seo"), exports);
 __exportStar(require("./serviceFunction"), exports);
 __exportStar(require("./stateDispatchOverWebsockets"), exports);
+__exportStar(require("./storageDriveCorsSettings"), exports);
 __exportStar(require("./subdomainRedirect"), exports);
 __exportStar(require("./webEntry"), exports);
 __exportStar(require("./websocket"), exports);

package/lib/commonjs/config/settings/migration.js

@@ -11,7 +11,7 @@ function removeLeadingSlashs(text) {
     return text;
 }
 function getQpqMigrationQueueTypeFromQpqFunctionRuntime(qpqFunctionRuntime) {
-    if ((0, quidproquo_core_1.isQpqFunctionRuntimeAbsolutePath)(qpqFunctionRuntime)) {
+    if ((0, quidproquo_core_1.isQpqFunctionRuntimeAdvanced)(qpqFunctionRuntime)) {
         return `${qpqFunctionRuntime.basePath}/${removeLeadingSlashs(qpqFunctionRuntime.relativePath)}`;
     }
     const [srcPath] = qpqFunctionRuntime.split('::');

package/lib/commonjs/config/settings/storageDriveCorsSettings.d.ts

@@ -0,0 +1,19 @@
+import { QPQConfigAdvancedSettings, QPQConfigSetting } from 'quidproquo-core';
+export interface QPQConfigAdvancedStorageDriveCorsSettings extends QPQConfigAdvancedSettings {
+}
+export interface StorageDriveCorsSettingsQPQWebServerConfigSetting extends QPQConfigSetting {
+    storageDriveName: string;
+    /**
+     * Browser origins allowed to read/write this drive's objects via cross-origin
+     * `fetch`/`XHR` (e.g. presigned uploads/downloads). Pass `['*']` to allow any
+     * origin, or an explicit list for cross-domain frontends. When no CORS setting
+     * is declared for a drive, its CORS defaults to this service's own domain.
+     */
+    allowedOrigins: string[];
+}
+/**
+ * Web-layer CORS policy for a (core) storage drive, keyed by the drive's name.
+ * CORS only matters when a browser talks to the bucket, so it lives here in the
+ * webserver config rather than on the core `defineStorageDrive`.
+ */
+export declare const defineStorageDriveCorsSettings: (storageDriveName: string, allowedOrigins: string[], options?: QPQConfigAdvancedStorageDriveCorsSettings) => StorageDriveCorsSettingsQPQWebServerConfigSetting;

package/lib/commonjs/config/settings/storageDriveCorsSettings.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.defineStorageDriveCorsSettings = void 0;
+const QPQConfig_1 = require("../QPQConfig");
+/**
+ * Web-layer CORS policy for a (core) storage drive, keyed by the drive's name.
+ * CORS only matters when a browser talks to the bucket, so it lives here in the
+ * webserver config rather than on the core `defineStorageDrive`.
+ */
+const defineStorageDriveCorsSettings = (storageDriveName, allowedOrigins, options) => ({
+    configSettingType: QPQConfig_1.QPQWebServerConfigSettingType.StorageDriveCorsSettings,
+    uniqueKey: storageDriveName,
+    storageDriveName,
+    allowedOrigins,
+});
+exports.defineStorageDriveCorsSettings = defineStorageDriveCorsSettings;

package/lib/commonjs/config/settings/webEntry.d.ts

@@ -19,6 +19,13 @@ export interface QPQConfigAdvancedWebEntrySettings extends QPQConfigAdvancedSett
     compressFiles?: boolean;
     cloudflareApiKeySecretName?: string;
     securityHeaders?: ResponseSecurityHeaders;
+    /**
+     * Browser origins allowed to cross-origin `fetch` this web entry's (public,
+     * static) assets. Leave undefined to scope to this service's own domain
+     * (`https://<domain>` + `https://*.<domain>`); pass `['*']` to allow any
+     * origin (e.g. serving assets as a public CDN / cross-origin fonts).
+     */
+    corsAllowedOrigins?: string[];
 }
 export interface WebEntryQPQWebServerConfigSetting extends QPQConfigSetting {
     name: string;
@@ -31,5 +38,6 @@ export interface WebEntryQPQWebServerConfigSetting extends QPQConfigSetting {
     compressFiles: boolean;
     cloudflareApiKeySecretName?: string;
     securityHeaders?: ResponseSecurityHeaders;
+    corsAllowedOrigins?: string[];
 }
 export declare const defineWebEntry: (name: string, options: QPQConfigAdvancedWebEntrySettings) => WebEntryQPQWebServerConfigSetting;

package/lib/commonjs/config/settings/webEntry.js

@@ -19,6 +19,7 @@ const defineWebEntry = (name, options) => {
         securityHeaders: options === null || options === void 0 ? void 0 : options.securityHeaders,
         cloudflareApiKeySecretName: options === null || options === void 0 ? void 0 : options.cloudflareApiKeySecretName,
         cacheSettingsName: options === null || options === void 0 ? void 0 : options.cacheSettingsName,
+        corsAllowedOrigins: options === null || options === void 0 ? void 0 : options.corsAllowedOrigins,
     });
 };
 exports.defineWebEntry = defineWebEntry;

package/lib/commonjs/services/auth/config/constants.d.ts

@@ -0,0 +1 @@
+export declare const AUTH_USER_DIRECTORY_GLOBAL_KEY = "qpq-auth-user-directory";

package/lib/commonjs/services/auth/config/constants.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AUTH_USER_DIRECTORY_GLOBAL_KEY = void 0;
+// The auth system stores its user directory name as a global so the bundled
+// handler stories can resolve it at runtime (mirrors the `qpq-serviceNames`
+// pattern). One auth directory per service deployment.
+exports.AUTH_USER_DIRECTORY_GLOBAL_KEY = 'qpq-auth-user-directory';

package/lib/commonjs/services/auth/config/defineAuthServiceRoute.d.ts

@@ -0,0 +1,4 @@
+import { HTTPMethod } from 'quidproquo-core';
+import { ApiKeyReference } from '../../../config/settings/apiKey';
+import { GenericRouteOptions } from '../../../config/settings/route';
+export declare const defineAuthServiceRoute: (method: HTTPMethod, urlPath: string, methodName: string, options?: GenericRouteOptions<ApiKeyReference | string>) => import("../../../config/settings/route").RouteQPQWebServerConfigSetting;

package/lib/commonjs/services/auth/config/defineAuthServiceRoute.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.defineAuthServiceRoute = void 0;
+const route_1 = require("../../../config/settings/route");
+const getServiceEntryQpqFunctionRuntime_1 = require("../../getServiceEntryQpqFunctionRuntime");
+const defineAuthServiceRoute = (method, urlPath, methodName, options = {}) => {
+    const qpqRuntime = (0, getServiceEntryQpqFunctionRuntime_1.getServiceEntryQpqFunctionRuntime)('auth', 'controller', `authController::${methodName}`);
+    return (0, route_1.defineRoute)(method, urlPath, qpqRuntime, options);
+};
+exports.defineAuthServiceRoute = defineAuthServiceRoute;

package/lib/commonjs/services/auth/config/index.d.ts

@@ -0,0 +1,2 @@
+export * from './constants';
+export * from './defineAuthServiceRoute';

package/lib/commonjs/services/auth/config/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./constants"), exports);
+__exportStar(require("./defineAuthServiceRoute"), exports);

package/lib/commonjs/services/auth/entry/controller/authController.d.ts

@@ -0,0 +1,9 @@
+import { AskResponse } from 'quidproquo-core';
+import { HTTPEvent, HTTPEventResponse } from '../../../../types';
+export declare function login(event: HTTPEvent): AskResponse<HTTPEventResponse>;
+export declare function refreshToken(event: HTTPEvent): AskResponse<HTTPEventResponse>;
+export declare function respondToAuthChallenge(event: HTTPEvent): AskResponse<HTTPEventResponse>;
+export declare function associateSoftwareToken(event: HTTPEvent): AskResponse<HTTPEventResponse>;
+export declare function forgotPassword(event: HTTPEvent): AskResponse<HTTPEventResponse>;
+export declare function confirmForgotPassword(event: HTTPEvent): AskResponse<HTTPEventResponse>;
+export declare function changePassword(event: HTTPEvent): AskResponse<HTTPEventResponse>;

package/lib/commonjs/services/auth/entry/controller/authController.js

@@ -0,0 +1,81 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.login = login;
+exports.refreshToken = refreshToken;
+exports.respondToAuthChallenge = respondToAuthChallenge;
+exports.associateSoftwareToken = associateSoftwareToken;
+exports.forgotPassword = forgotPassword;
+exports.confirmForgotPassword = confirmForgotPassword;
+exports.changePassword = changePassword;
+const quidproquo_core_1 = require("quidproquo-core");
+// TODO: Fix this import (name it up the chain)
+const index_1 = require("../../../../index");
+const logic_1 = require("../../logic");
+const types_1 = require("../../types");
+// Maps the wire payload (discriminated by `challenge`) onto the core auth
+// challenge shape. The type guards narrow `payload`, so no manual casts are
+// needed. Add a branch here as new challenge types are supported.
+const challengePayloadToAuthChallenge = (payload) => {
+    if ((0, types_1.isNewPasswordChallengePayload)(payload)) {
+        return {
+            challenge: quidproquo_core_1.AuthenticateUserChallenge.NEW_PASSWORD_REQUIRED,
+            username: payload.email,
+            session: payload.session,
+            newPassword: payload.newPassword,
+        };
+    }
+    if ((0, types_1.isMfaChallengePayload)(payload)) {
+        return {
+            challenge: quidproquo_core_1.AuthenticateUserChallenge.SOFTWARE_TOKEN_MFA,
+            username: payload.email,
+            session: payload.session,
+            mfaCode: payload.mfaCode,
+        };
+    }
+    if ((0, types_1.isMfaSetupChallengePayload)(payload)) {
+        return {
+            challenge: quidproquo_core_1.AuthenticateUserChallenge.MFA_SETUP,
+            username: payload.email,
+            session: payload.session,
+            mfaCode: payload.mfaCode,
+        };
+    }
+    throw new Error(`Unsupported auth challenge: ${payload.challenge}`);
+};
+function* login(event) {
+    const { username, password } = yield* index_1.qpqWebServerUtils.askFromJsonEventRequest(event);
+    const authResponse = yield* logic_1.authLogic.askLogin(username, password);
+    return index_1.qpqWebServerUtils.toJsonEventResponse(authResponse);
+}
+function* refreshToken(event) {
+    const { refreshToken } = yield* index_1.qpqWebServerUtils.askFromJsonEventRequest(event);
+    const refreshResponse = yield* logic_1.authLogic.askRefreshToken(refreshToken);
+    return index_1.qpqWebServerUtils.toJsonEventResponse(refreshResponse);
+}
+function* respondToAuthChallenge(event) {
+    const payload = yield* index_1.qpqWebServerUtils.askFromJsonEventRequest(event);
+    const response = yield* logic_1.authLogic.askRespondToAuthChallenge(challengePayloadToAuthChallenge(payload));
+    return index_1.qpqWebServerUtils.toJsonEventResponse(response);
+}
+function* associateSoftwareToken(event) {
+    const { session } = yield* index_1.qpqWebServerUtils.askFromJsonEventRequest(event);
+    const response = yield* logic_1.authLogic.askAssociateSoftwareToken(session);
+    return index_1.qpqWebServerUtils.toJsonEventResponse(response);
+}
+function* forgotPassword(event) {
+    const { username } = yield* index_1.qpqWebServerUtils.askFromJsonEventRequest(event);
+    const deliveryDetails = yield* logic_1.authLogic.askForgotPassword(username);
+    return index_1.qpqWebServerUtils.toJsonEventResponse(deliveryDetails);
+}
+function* confirmForgotPassword(event) {
+    const { username, code, password } = yield* index_1.qpqWebServerUtils.askFromJsonEventRequest(event);
+    const response = yield* logic_1.authLogic.askConfirmForgotPassword(username, code, password);
+    return index_1.qpqWebServerUtils.toJsonEventResponse(response);
+}
+function* changePassword(event) {
+    const { oldPassword, newPassword } = yield* index_1.qpqWebServerUtils.askFromJsonEventRequest(event);
+    // The route is authenticated, so the access token is present on the request.
+    const accessToken = index_1.qpqWebServerUtils.getAccessTokenFromHeaders(event.headers) || '';
+    yield* logic_1.authLogic.askChangePassword(oldPassword, newPassword, accessToken);
+    return index_1.qpqWebServerUtils.toJsonEventResponse({ success: true });
+}

package/lib/commonjs/services/auth/index.d.ts

@@ -0,0 +1,2 @@
+export * from './config';
+export * from './types';

package/lib/commonjs/services/auth/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./config"), exports);
+__exportStar(require("./types"), exports);

package/lib/commonjs/services/auth/logic/auth/askAssociateSoftwareToken.d.ts

@@ -0,0 +1,2 @@
+import { AskResponse, AssociateSoftwareTokenResult } from 'quidproquo-core';
+export declare function askAssociateSoftwareToken(session: string): AskResponse<AssociateSoftwareTokenResult>;

package/lib/commonjs/services/auth/logic/auth/askAssociateSoftwareToken.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.askAssociateSoftwareToken = askAssociateSoftwareToken;
+const quidproquo_core_1 = require("quidproquo-core");
+const askGetAuthUserDirectoryName_1 = require("./askGetAuthUserDirectoryName");
+function* askAssociateSoftwareToken(session) {
+    const userDirectoryName = yield* (0, askGetAuthUserDirectoryName_1.askGetAuthUserDirectoryName)();
+    return yield* (0, quidproquo_core_1.askUserDirectoryAssociateSoftwareToken)(userDirectoryName, session);
+}

package/lib/commonjs/services/auth/logic/auth/askChangePassword.d.ts

@@ -0,0 +1,2 @@
+import { AskResponse } from 'quidproquo-core';
+export declare function askChangePassword(oldPassword: string, newPassword: string, accessToken: string): AskResponse<void>;

package/lib/commonjs/services/auth/logic/auth/askChangePassword.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.askChangePassword = askChangePassword;
+const quidproquo_core_1 = require("quidproquo-core");
+// The underlying action authenticates the caller via their access token, so no
+// user directory name is required here.
+function* askChangePassword(oldPassword, newPassword, accessToken) {
+    yield* (0, quidproquo_core_1.askUserDirectoryChangePassword)(oldPassword, newPassword, accessToken);
+}