trustbase-seller-backend 0.1.5

package/api/middleware/p2p-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"p2p-auth.js","sourceRoot":"","sources":["../../../src/api/middleware/p2p-auth.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;;;AAsFH,kDAoOC;AAWD,8CA4CC;AAkED,sCAuCC;AAwDD,4CA0BC;AAcD,kCAwBC;AA9kBD,+CAA8C;AAC9C,+CAAkE;AAClE,qDAAyD;AACzD,gFAA2E;AAsB3E,MAAM,UAAU,GAA+B;IAC7C,IAAI,EAAE,CAAC;IACP,KAAK,EAAE,CAAC;IACR,KAAK,EAAE,CAAC;CACT,CAAC;AA6BF,MAAM,cAAc,GAAG,CAAC,GAAY,EAAc,EAAE;IAClD,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;IAC3C,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;IAC1C,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;IAC5C,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;IAC1C,wEAAwE;IACxE,4EAA4E;IAC5E,wDAAwD;IACxD,MAAM,QAAQ,GAAG;QACf,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,oEAAoE;QACpE,2DAA2D;QAC3D,uDAAuD;QACvD,IAAI,EAAE,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,GAAG,GAAG,CAAC,IAAI;QACpC,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,IAAI;QACtB,KAAK;QACL,SAAS,EAAE,EAAE;QACb,OAAO,EAAE,GAAG;QACZ,SAAS,EAAE,GAAG;KACf,CAAC;IACF,MAAM,IAAI,GAAG,IAAA,sBAAY,EAAC,QAAQ,CAAC,CAAC;IACpC,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC,CAAC;AAEF,SAAgB,mBAAmB,CACjC,OAAmC,EAAE;IAErC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,8BAAiB,CAAC;IACpD,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,cAAc,CAAC;IACvD,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,IAAI,KAAK,CAAC;IAEtD,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAC/D,uEAAuE;QACvE,yDAAyD;QACzD,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAC/F,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC;QACrD,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC;QAC/C,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC;QAC7B,IAAI,QAAQ,GAAkB,IAAI,CAAC;QACnC,IAAI,CAAC;YACH,iDAAiD;YACjD,IAAI,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAClF,MAAM,EAAE,GAAI,GAAG,CAAC,IAAY,CAAC,SAAS,CAAC;gBACvC,IAAI,OAAO,EAAE,KAAK,QAAQ;oBAAE,QAAQ,GAAG,EAAE,CAAC;YAC5C,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAC,8BAA8B,CAAC,CAAC;QAE1C,8DAA8D;QAC9D,oEAAoE;QACpE,iCAAiC;QACjC,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,CAAC;QACjC,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,oBAAoB,GAAQ,IAAI,CAAC;QACrC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,IAAS,EAAE,EAAE;YACxB,IAAI,CAAC;gBACH,oBAAoB,GAAG,IAAI,CAAC;gBAC5B,GAAG,CAAC,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC;YAClC,CAAC;YAAC,MAAM,CAAC,CAAC,sCAAsC,CAAC,CAAC;YAClD,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC,CAAoB,CAAC;QACtB,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,IAAS,EAAE,EAAE;YACxB,IAAI,CAAC;gBACH,IAAI,oBAAoB,KAAK,IAAI,EAAE,CAAC;oBAClC,oBAAoB,GAAG,IAAI,CAAC;oBAC5B,GAAG,CAAC,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC;gBAClC,CAAC;YACH,CAAC;YAAC,MAAM,CAAC,CAAC,aAAa,CAAC,CAAC;YACzB,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC,CAAoB,CAAC;QAEtB,MAAM,YAAY,GAAG,CAAC,CAAM,EAAiB,EAAE;YAC7C,IAAI,CAAC;gBACH,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI;oBAAE,OAAO,IAAI,CAAC;gBAC/C,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;gBAC3D,IAAI,IAAI,CAAC,MAAM,IAAI,cAAc;oBAAE,OAAO,IAAI,CAAC;gBAC/C,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC,CAAC;QACF,MAAM,kBAAkB,GAAG,GAAkB,EAAE;YAC7C,IAAI,CAAC;gBACH,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI;oBAAE,OAAO,IAAI,CAAC;gBAC7D,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;oBAAE,OAAO,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;gBACzF,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAChF,IAAI,IAAI,CAAC,MAAM,IAAI,cAAc;oBAAE,OAAO,IAAI,CAAC;gBAC/C,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC,CAAC;QAEF,MAAM,YAAY,GAAG,CAAC,MAAc,EAAE,KAAoB,EAAE,UAAyB,EAAE,EAAE;YACvF,IAAI,CAAC;gBACH,MAAM,EAAE,GAAI,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,EAAoC,IAAI,IAAI,CAAC;gBAC1E,IAAI,CAAC,EAAE;oBAAE,OAAO,CAAC,2BAA2B;gBAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC;gBACrC,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,EAAE,OAAO,IAAI,YAAY,CAAC;gBACtD,MAAM,eAAe,GAAG,UAAU,IAAI,GAAG,CAAC,IAAI,EAAE,WAAW,IAAI,IAAI,CAAC;gBACpE,iDAAiD;gBACjD,MAAM,eAAe,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,IAAI,oBAAoB,CAAC,CAAC;gBACxF,MAAM,cAAc,GAAG,kBAAkB,EAAE,CAAC;gBAC5C,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CACrB;;;0DAGgD,CACjD,CAAC,GAAG,CACH,WAAW,EACX,SAAS,EACT,WAAW,EACX,QAAQ,EACR,SAAS,EACT,OAAO,EACP,QAAQ,EACR,MAAM,EACN,KAAK,EACL,GAAG,EACH,eAAe,EACf,cAAc,EACd,eAAe,CAChB,CAAC;gBACF,6BAA6B;gBAC7B,MAAM,GAAG,GAAG;oBACV,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC;oBAChC,EAAE,EAAE,WAAW;oBACf,SAAS,EAAE,SAAkB;oBAC7B,cAAc,EAAE,WAAW;oBAC3B,SAAS,EAAE,QAAQ;oBACnB,MAAM,EAAE,SAAS;oBACjB,IAAI,EAAE,OAAO;oBACb,SAAS,EAAE,QAAQ;oBACnB,MAAM;oBACN,KAAK;oBACL,MAAM,EAAE,GAAG;oBACX,WAAW,EAAE,eAAe;oBAC5B,YAAY,EAAE,cAAc;oBAC5B,aAAa,EAAE,eAAe;iBAC/B,CAAC;gBACF,IAAI,CAAC;oBACH,iDAAsB,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;gBACxE,CAAC;gBAAC,OAAO,CAAM,EAAE,CAAC;oBAChB,eAAe;oBACf,OAAO,CAAC,KAAK,CAAC,2CAA2C,EAAE,CAAC,EAAE,OAAO,IAAI,CAAC,CAAC,CAAC;gBAC9E,CAAC;YACH,CAAC;YAAC,OAAO,CAAM,EAAE,CAAC;gBAChB,kCAAkC;gBAClC,OAAO,CAAC,KAAK,CAAC,wCAAwC,EAAE,CAAC,EAAE,OAAO,IAAI,CAAC,CAAC,CAAC;YAC3E,CAAC;QACH,CAAC,CAAC;QAEF,yCAAyC;QACzC,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;YACpB,qDAAqD;YACrD,6DAA6D;YAC7D,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YACvC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YACzC,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACpC,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YAErC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,IAAI,CAAC,EAAE,EAAE,CAAC;gBACxC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBAC1B,KAAK,EAAE,iBAAiB;oBACxB,QAAQ,EAAE,CAAC,WAAW,EAAE,aAAa,EAAE,SAAS,EAAE,aAAa,CAAC;iBACjE,CAAC,CAAC;YACL,CAAC;YAED,IAAI,QAAoB,CAAC;YACzB,IAAI,CAAC;gBACH,QAAQ,GAAG,IAAA,qBAAU,EAAC,MAAM,CAAC,CAAC;YAChC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,CAAC;YACvE,CAAC;YACD,IAAI,QAAQ,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;gBAC3B,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YACzG,CAAC;YAED,IAAI,SAAqB,CAAC;YAC1B,IAAI,eAAe,EAAE,CAAC;gBACpB,yDAAyD;gBACzD,SAAS,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;YAC3D,CAAC;iBAAM,CAAC;gBACN,8CAA8C;gBAC9C,sDAAsD;gBACtD,+CAA+C;gBAC/C,4BAA4B;gBAC5B,IAAI,UAAU,CAAC;gBACf,IAAI,CAAC;oBACH,UAAU,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;gBAChE,CAAC;gBAAC,OAAO,CAAM,EAAE,CAAC;oBAChB,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;wBAC1B,KAAK,EAAE,qBAAqB;wBAC5B,OAAO,EAAE,MAAM;wBACf,IAAI,EAAE,8FAA8F;qBACrG,CAAC,CAAC;gBACL,CAAC;gBACD,IAAI,UAAU,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACtC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;wBAC1B,KAAK,EAAE,cAAc;wBACrB,OAAO,EAAE,MAAM;wBACf,IAAI,EAAE,yDAAyD;qBAChE,CAAC,CAAC;gBACL,CAAC;gBACD,SAAS,GAAG,IAAA,qBAAU,EAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;YAC7D,CAAC;YAED,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;YAChC,MAAM,QAAQ,GAAwB;gBACpC,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,kDAAkD;gBAClD,IAAI,EAAE,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,GAAG,GAAG,CAAC,IAAI;gBACpC,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,IAAI;gBACtB,KAAK;gBACL,SAAS,EAAE,EAAE;gBACb,OAAO,EAAE,MAAM;gBACf,SAAS,EAAE,MAAM;aAClB,CAAC;YACF,MAAM,EAAE,GAAG,MAAM,IAAA,yBAAe,EAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YACtD,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBAC1B,KAAK,EAAE,+BAA+B;oBACtC,OAAO,EAAE,MAAM;oBACf,IAAI,EAAE,+CAA+C;iBACtD,CAAC,CAAC;YACL,CAAC;YAED,iDAAiD;YACjD,GAAG,CAAC,IAAI,GAAG;gBACT,OAAO,EAAE,MAAM;gBACf,UAAU,EAAE,SAAS;gBACrB,WAAW,EAAE,IAAI;aAClB,CAAC;YACF,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,uCAAuC,EAAE,GAAG,EAAE,OAAO,IAAI,GAAG,CAAC,CAAC;YAC5E,qEAAqE;YACrE,0EAA0E;YAC1E,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;YACrD,MAAM,OAAO,GAAQ,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;YAC/D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,GAAG,CAAC,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;gBACzD,OAAO,CAAC,IAAI,GAAG,SAAS,IAAI,EAAE,CAAC;YACjC,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChC,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAWD,SAAgB,iBAAiB,CAC/B,KAAiB,EACjB,OAAiC,EAAE;IAEnC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,GAAY,EAAE,EAAE,CAAE,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,EAAoC,IAAI,IAAI,CAAC,CAAC;IACtH,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,qEAAqE;YACrE,gDAAgD;YAChD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,GAAG,GAAG,EAAE;aACX,OAAO,CAAC,2DAA2D,CAAC;aACpE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAoB,CAAC;QACxC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE,uBAAuB;gBAC9B,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,GAAG,CAAC,WAAW,KAAK,MAAM,IAAI,GAAG,CAAC,WAAW,KAAK,OAAO,IAAI,GAAG,CAAC,WAAW,KAAK,OAAO,EAAE,CAAC;YAC7F,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE,qBAAqB;gBAC5B,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,GAAG,CAAC,WAAW;aACxB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,WAAW,GAAG,GAAG,CAAC,WAAW,CAAC;QACnC,IAAI,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YACrD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE,0BAA0B;gBACjC,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,IAAI,CAAC,WAAW;aACzB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAiBD,MAAM,UAAU;IAEe;IAAkC;IAD9C,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,iBAAiB;IACnE,YAA6B,OAAe,EAAmB,KAAa;QAA/C,YAAO,GAAP,OAAO,CAAQ;QAAmB,UAAK,GAAL,KAAK,CAAQ;IAAG,CAAC;IAEhF,2FAA2F;IAC3F,OAAO,CAAC,GAAW,EAAE,KAAa;QAChC,qEAAqE;QACrE,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,GAAG,KAAK,EAAE,CAAC;YAC/C,gCAAgC;YAChC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,kDAAkD;QAClD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,GAAG,CAAC,GAAW;QACb,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;IACvB,CAAC;IAED,KAAK;QACH,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;IAEO,KAAK,CAAC,KAAa;QACzB,KAAK,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YAChC,IAAI,GAAG,IAAI,KAAK;gBAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvC,CAAC;QACD,kDAAkD;QAClD,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;YAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC9B,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;gBAC5B,IAAI,CAAC,KAAK,SAAS;oBAAE,MAAM;gBAC3B,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED,SAAgB,aAAa,CAAC,OAA6B,EAAE;IAC3D,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,GAAG,CAAC;IAChD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,aAAa,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,wDAAwD;IAC9G,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAE/C,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,mDAAmD;QACnD,yCAAyC;QACzC,sDAAsD;QACtD,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC;QACvC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,aAAa,EAAE,CAAC;YACvC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE,wBAAwB;gBAC/B,GAAG;gBACH,QAAQ,EAAE,EAAE;gBACZ,cAAc,EAAE,aAAa;aAC9B,CAAC,CAAC;QACL,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK,EAAE,CAAC;QACvC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;YACjC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE,oBAAoB;gBAC3B,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED,yBAAyB;AACZ,QAAA,WAAW,GAAG,EAAE,UAAU,EAAE,CAAC;AAoB1C,MAAM,cAAc;IAGC;IACA;IACA;IAJF,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IACrD,YACmB,MAAc,EACd,QAAgB,EAChB,KAAmB;QAFnB,WAAM,GAAN,MAAM,CAAQ;QACd,aAAQ,GAAR,QAAQ,CAAQ;QAChB,UAAK,GAAL,KAAK,CAAc;IACnC,CAAC;IAEJ,2EAA2E;IAC3E,OAAO,CAAC,GAAW;QACjB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;YAC7B,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YACjD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACzB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxE,CAAC;QACD,IAAI,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAC3B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;QAC3E,CAAC;QACD,CAAC,CAAC,KAAK,EAAE,CAAC;QACV,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC;IAC9E,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;IAED,KAAK;QACH,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;CACF;AAED,SAAgB,gBAAgB,CAAC,OAAgC,EAAE;IACjE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;IACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAG,QAAQ,GAAG,IAAI,CAAC;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,IAAI,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAE5D,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9C,GAAG,CAAC,SAAS,CAAC,mBAAmB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACnD,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC,CAAC;YACrE,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC/C,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE,qBAAqB;gBAC5B,mBAAmB,EAAE,QAAQ;gBAC7B,IAAI,EAAE,IAAI,CAAC,OAAO;aACnB,CAAC,CAAC;QACL,CAAC;QACD,GAAG,CAAC,SAAS,CAAC,uBAAuB,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QAClE,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED,yBAAyB;AACZ,QAAA,YAAY,GAAG,EAAE,cAAc,EAAE,CAAC;AAW/C,SAAgB,WAAW,CAAC,OAA2B,EAAE;IACvD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC;IAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAG,QAAQ,GAAG,IAAI,CAAC;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC/C,MAAM,KAAK,GACT,IAAI,CAAC,KAAK;QACV,CAAC,CAAC,GAAY,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC;IAChG,MAAM,OAAO,GAAG,IAAI,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAE5D,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5C,GAAG,CAAC,SAAS,CAAC,mBAAmB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACnD,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC,CAAC;YACrE,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC/C,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE,wBAAwB;gBAC/B,mBAAmB,EAAE,QAAQ;aAC9B,CAAC,CAAC;QACL,CAAC;QACD,GAAG,CAAC,SAAS,CAAC,uBAAuB,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QAClE,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}

package/api/middleware/tool-policy.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Tool Policy Middleware (PRD-F Phase 2 §6.3 / §4.3)
+ *
+ * Per-tool capability whitelist + level gate.
+ *
+ * Why:
+ *   - `mcp.tools.invoke` (the remote peer's POST /api/p2p/mcp/tools/invoke) is
+ *     a *capability*, but it shouldn't expose every registered MCP tool.
+ *     A read-trusted peer must only be able to invoke read-only tools; a
+ *     write-trusted peer must additionally be allowed to invoke write tools.
+ *   - Without this gate, a peer with `read` could craft a POST body that
+ *     calls any MCP tool by name — including admin tools — and our whitelist
+ *     middleware would still say "ok". That's the bypass.
+ *
+ * Two layers of policy:
+ *
+ *   1. `ToolPolicy.allow(toolName, trustLevel)` — pure function that decides
+ *      whether a given peer trust level may invoke a given tool name.
+ *      Default policy ships with conservative defaults; callers can override.
+ *
+ *   2. `requireToolPolicy()` middleware — reads `req.peer.trust_level` (must
+ *      have been populated by requireTrustLevel) and the requested tool name
+ *      from `req.body.tool_name`, then calls `allow()`. On deny: 403.
+ *
+ * Customizing:
+ *
+ *   ```ts
+ *   requireToolPolicy({
+ *     policy: (toolName, level) => {
+ *       if (toolName.startsWith('admin__')) return level === 'admin';
+ *       if (toolName.startsWith('write__')) return level === 'write' || level === 'admin';
+ *       return true;
+ *     },
+ *   })
+ *   ```
+ */
+import type { Request, RequestHandler } from 'express';
+import type { TrustLevel } from './p2p-auth';
+export declare function defaultPolicy(toolName: string, level: TrustLevel): boolean;
+export type ToolPolicyFn = (toolName: string, level: TrustLevel) => boolean;
+export interface RequireToolPolicyOptions {
+    policy?: ToolPolicyFn;
+    /** Optional override to extract tool_name from the request body. */
+    getToolName?: (req: Request) => string | undefined;
+}
+export declare function requireToolPolicy(opts?: RequireToolPolicyOptions): RequestHandler;
+//# sourceMappingURL=tool-policy.d.ts.map

package/api/middleware/tool-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-policy.d.ts","sourceRoot":"","sources":["../../../src/api/middleware/tool-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,KAAK,EAAE,OAAO,EAA0B,cAAc,EAAE,MAAM,SAAS,CAAC;AAC/E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAgF7C,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAW1E;AAMD,MAAM,MAAM,YAAY,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC;AAE5E,MAAM,WAAW,wBAAwB;IACvC,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,oEAAoE;IACpE,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,GAAG,SAAS,CAAC;CACpD;AAED,wBAAgB,iBAAiB,CAAC,IAAI,GAAE,wBAA6B,GAAG,cAAc,CAqCrF"}

package/api/middleware/tool-policy.js

@@ -0,0 +1,156 @@
+"use strict";
+/**
+ * Tool Policy Middleware (PRD-F Phase 2 §6.3 / §4.3)
+ *
+ * Per-tool capability whitelist + level gate.
+ *
+ * Why:
+ *   - `mcp.tools.invoke` (the remote peer's POST /api/p2p/mcp/tools/invoke) is
+ *     a *capability*, but it shouldn't expose every registered MCP tool.
+ *     A read-trusted peer must only be able to invoke read-only tools; a
+ *     write-trusted peer must additionally be allowed to invoke write tools.
+ *   - Without this gate, a peer with `read` could craft a POST body that
+ *     calls any MCP tool by name — including admin tools — and our whitelist
+ *     middleware would still say "ok". That's the bypass.
+ *
+ * Two layers of policy:
+ *
+ *   1. `ToolPolicy.allow(toolName, trustLevel)` — pure function that decides
+ *      whether a given peer trust level may invoke a given tool name.
+ *      Default policy ships with conservative defaults; callers can override.
+ *
+ *   2. `requireToolPolicy()` middleware — reads `req.peer.trust_level` (must
+ *      have been populated by requireTrustLevel) and the requested tool name
+ *      from `req.body.tool_name`, then calls `allow()`. On deny: 403.
+ *
+ * Customizing:
+ *
+ *   ```ts
+ *   requireToolPolicy({
+ *     policy: (toolName, level) => {
+ *       if (toolName.startsWith('admin__')) return level === 'admin';
+ *       if (toolName.startsWith('write__')) return level === 'write' || level === 'admin';
+ *       return true;
+ *     },
+ *   })
+ *   ```
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.defaultPolicy = defaultPolicy;
+exports.requireToolPolicy = requireToolPolicy;
+// ────────────────────────────────────────────────────────────────────────────
+// Default policy
+// ────────────────────────────────────────────────────────────────────────────
+/**
+ * v2 (2026-07-19, security fix H1): explicit per-tool level map, FAIL CLOSED.
+ *
+ * The previous keyword-substring policy was exploitable in both directions:
+ *   - read-level peer could invoke `get_api_key` (contains "get") and
+ *     REGENERATE another subscriber's SaaS API key — a write op.
+ *   - write-level peer could invoke `peer__add_trusted` (explicitly in
+ *     WRITE_KEYWORDS) and grant any node `admin` trust → full escalation.
+ *
+ * Rules now:
+ *   - A tool listed in TOOL_LEVELS requires AT LEAST the mapped level.
+ *   - Any tool NOT listed defaults to 'admin' (fail closed). New tools are
+ *     therefore safe by default; the maintainer must consciously downgrade
+ *     them here. Unlisted names are logged once per process for discovery.
+ *   - Level order: read < write < admin.
+ *
+ * When editing this table, run: npx jest src/api/__tests__/tool-policy.test.ts
+ */
+const LEVEL_ORDER = { read: 1, write: 2, admin: 3 };
+const TOOL_LEVELS = {
+    // M2M messaging — read peers must be able to exchange handshakes (v0.7 design)
+    m2m_inbox_store: 'read',
+    m2m_inbox_list: 'read',
+    m2m_inbox_mark_read: 'read',
+    m2m_send: 'read',
+    // Peer discovery / identity — read
+    peer__discover: 'read',
+    peer__list_trusted: 'read',
+    peer__send_request: 'read',
+    peer__invoke_tool: 'read',
+    // Generic read-only queries — read
+    search_plugins: 'read',
+    search_products: 'read',
+    search_saas: 'read',
+    get_plugin_details: 'read',
+    get_saas_details: 'read',
+    get_seller_products: 'read',
+    get_seller_qrcode: 'read',
+    get_order_applications: 'read',
+    get_ai_usage_stats: 'read',
+    list_top_categories: 'read',
+    query_bank_balances: 'read',
+    query_business_scope: 'read',
+    query_business_scopes_by_category: 'read',
+    query_business_scopes_by_primary: 'read',
+    query_business_scopes_by_secondary: 'read',
+    query_total_supply: 'read',
+    count_business_scopes_by_category: 'read',
+    call_ai_model: 'read',
+    check_2fa_status: 'read',
+    check_account_lock: 'read',
+    verify_device_binding: 'read',
+    // Commerce / order flow — write
+    auto_apply_order: 'write',
+    auto_dispatch: 'write',
+    dispatch_order: 'write',
+    purchase_digital_product: 'write',
+    subscribe_service: 'write',
+    scan_seller_qrcode: 'write',
+    // Sensitive — admin only (H1 fix)
+    get_api_key: 'admin', // can regenerate other subscribers' keys
+    peer__add_trusted: 'admin', // grants trust levels incl. admin (escalation)
+    peer__remove_trusted: 'admin', // tears down the whitelist
+};
+// Log each unlisted tool name once per process so maintainers notice new
+// tools that need a conscious classification.
+const _warnedUnlisted = new Set();
+function defaultPolicy(toolName, level) {
+    const required = TOOL_LEVELS[toolName] ?? 'admin';
+    if (!(toolName in TOOL_LEVELS) && !_warnedUnlisted.has(toolName)) {
+        _warnedUnlisted.add(toolName);
+        // eslint-disable-next-line no-console
+        console.warn(`[tool-policy] unlisted tool "${toolName}" defaults to admin (fail closed). ` +
+            'Add it to TOOL_LEVELS in tool-policy.ts if it should be callable by read/write peers.');
+    }
+    return (LEVEL_ORDER[level] ?? 0) >= LEVEL_ORDER[required];
+}
+function requireToolPolicy(opts = {}) {
+    const policy = opts.policy ?? defaultPolicy;
+    const getToolName = opts.getToolName ??
+        ((req) => {
+            const body = req.body;
+            return typeof body?.tool_name === 'string' ? body.tool_name : undefined;
+        });
+    return (req, res, next) => {
+        const peer = req.peer;
+        if (!peer) {
+            return res.status(401).json({ error: 'no-peer-context' });
+        }
+        // If requireTrustLevel hasn't run yet, trust_level will be null; treat
+        // null as the lowest possible level (read) so the policy fails closed.
+        const level = peer.trust_level ?? 'read';
+        const toolName = getToolName(req);
+        if (!toolName || typeof toolName !== 'string') {
+            return res.status(400).json({
+                error: 'missing-tool-name',
+                hint: 'request body must include { tool_name: string }',
+            });
+        }
+        if (!policy(toolName, level)) {
+            return res.status(403).json({
+                error: 'tool-not-allowed-by-policy',
+                node_id: peer.node_id,
+                trust_level: level,
+                tool_name: toolName,
+            });
+        }
+        // Surface the tool name for the downstream handler / audit log.
+        req.resolvedToolName = toolName;
+        next();
+    };
+}
+//# sourceMappingURL=tool-policy.js.map

package/api/middleware/tool-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-policy.js","sourceRoot":"","sources":["../../../src/api/middleware/tool-policy.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;;AAmFH,sCAWC;AAcD,8CAqCC;AA5ID,+EAA+E;AAC/E,iBAAiB;AACjB,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,GAA2B,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AAE5E,MAAM,WAAW,GAA+C;IAC9D,+EAA+E;IAC/E,eAAe,EAAE,MAAM;IACvB,cAAc,EAAE,MAAM;IACtB,mBAAmB,EAAE,MAAM;IAC3B,QAAQ,EAAE,MAAM;IAEhB,mCAAmC;IACnC,cAAc,EAAE,MAAM;IACtB,kBAAkB,EAAE,MAAM;IAC1B,kBAAkB,EAAE,MAAM;IAC1B,iBAAiB,EAAE,MAAM;IAEzB,mCAAmC;IACnC,cAAc,EAAE,MAAM;IACtB,eAAe,EAAE,MAAM;IACvB,WAAW,EAAE,MAAM;IACnB,kBAAkB,EAAE,MAAM;IAC1B,gBAAgB,EAAE,MAAM;IACxB,mBAAmB,EAAE,MAAM;IAC3B,iBAAiB,EAAE,MAAM;IACzB,sBAAsB,EAAE,MAAM;IAC9B,kBAAkB,EAAE,MAAM;IAC1B,mBAAmB,EAAE,MAAM;IAC3B,mBAAmB,EAAE,MAAM;IAC3B,oBAAoB,EAAE,MAAM;IAC5B,iCAAiC,EAAE,MAAM;IACzC,gCAAgC,EAAE,MAAM;IACxC,kCAAkC,EAAE,MAAM;IAC1C,kBAAkB,EAAE,MAAM;IAC1B,iCAAiC,EAAE,MAAM;IACzC,aAAa,EAAE,MAAM;IACrB,gBAAgB,EAAE,MAAM;IACxB,kBAAkB,EAAE,MAAM;IAC1B,qBAAqB,EAAE,MAAM;IAE7B,gCAAgC;IAChC,gBAAgB,EAAE,OAAO;IACzB,aAAa,EAAE,OAAO;IACtB,cAAc,EAAE,OAAO;IACvB,wBAAwB,EAAE,OAAO;IACjC,iBAAiB,EAAE,OAAO;IAC1B,kBAAkB,EAAE,OAAO;IAE3B,kCAAkC;IAClC,WAAW,EAAE,OAAO,EAAY,yCAAyC;IACzE,iBAAiB,EAAE,OAAO,EAAM,+CAA+C;IAC/E,oBAAoB,EAAE,OAAO,EAAG,2BAA2B;CAC5D,CAAC;AAEF,yEAAyE;AACzE,8CAA8C;AAC9C,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;AAE1C,SAAgB,aAAa,CAAC,QAAgB,EAAE,KAAiB;IAC/D,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC;IAClD,IAAI,CAAC,CAAC,QAAQ,IAAI,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjE,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9B,sCAAsC;QACtC,OAAO,CAAC,IAAI,CACV,gCAAgC,QAAQ,qCAAqC;YAC3E,uFAAuF,CAC1F,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,CAAC;AAC5D,CAAC;AAcD,SAAgB,iBAAiB,CAAC,OAAiC,EAAE;IACnE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,aAAa,CAAC;IAC5C,MAAM,WAAW,GACf,IAAI,CAAC,WAAW;QAChB,CAAC,CAAC,GAAY,EAAE,EAAE;YAChB,MAAM,IAAI,GAAG,GAAG,CAAC,IAA0C,CAAC;YAC5D,OAAO,OAAO,IAAI,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1E,CAAC,CAAC,CAAC;IAEL,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC5D,CAAC;QACD,uEAAuE;QACvE,uEAAuE;QACvE,MAAM,KAAK,GAAe,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC;QAErD,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC9C,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE,mBAAmB;gBAC1B,IAAI,EAAE,iDAAiD;aACxD,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE,4BAA4B;gBACnC,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,WAAW,EAAE,KAAK;gBAClB,SAAS,EAAE,QAAQ;aACpB,CAAC,CAAC;QACL,CAAC;QACD,gEAAgE;QAC/D,GAAW,CAAC,gBAAgB,GAAG,QAAQ,CAAC;QACzC,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}

package/api/oauth-adapters.d.ts

@@ -0,0 +1,192 @@
+/**
+ * TrustChain OAuth Bridge — Platform adapters (微信 / 支付宝 / 抖音)
+ *
+ * 设计要点 (baobei #312 实战锁版, 2026-08-23):
+ * - base OAuthAdapter 接口: login / refresh / unlink / getProfile
+ * - 3 个具体 adapter: WechatAdapter / AlipayAdapter / DouyinAdapter
+ * - mock 模式默认: 不真调微信/支付宝/抖音 API, 直接用 code 派生 deterministic openid
+ * - 真 API 模式: env var 提供 appid/secret 后, 调 https API
+ *
+ * 实战锁版 (Lesson #345 写路径 4 坑):
+ * - appid/secret 全 env var (TEST_WECHAT_APPID/TEST_WECHAT_SECRET 等)
+ * - 默认 mock, 文档强制标注
+ * - fail loud: 任何环境异常直接抛错 (Lesson #266a)
+ *
+ * Adapter Pattern:
+ *   adapter.codeToOpenid(code) → 统一入口
+ *   adapter.platform → 'wechat' | 'alipay' | 'douyin'
+ *
+ * @see docs/oauth-bridge-v0.1-spec.md
+ */
+import type { OAuthPlatform } from '../utils/jwt';
+export interface AdapterProfile {
+    /** 平台 openid (user 在该平台的唯一 ID) */
+    openid: string;
+    /** 平台 unionid (微信独有, 跨 app 同主体标识, 其他平台可能为空) */
+    unionid?: string;
+    /** 平台 user_id (如 alipay 的 user_id, 不是 openid) */
+    user_id?: string;
+    /** 用户昵称 (展示用, 不参与 identity) */
+    nickname?: string;
+    /** 用户头像 (展示用) */
+    avatar?: string;
+    /** 平台 session_key (微信独有, 用于解密, 不持久化) */
+    session_key?: string;
+}
+export interface AdapterLoginResult {
+    profile: AdapterProfile;
+    /** 平台 access_token (非 TrustChain JWT) */
+    platform_access_token: string;
+    /** 平台 refresh_token (微信/抖音有, 支付宝无) */
+    platform_refresh_token?: string;
+    /** 平台 token 过期秒数 (微信 7200, 抖音 14400) */
+    expires_in: number;
+    /** 平台 scope (空格分隔) */
+    scope: string;
+}
+export interface OAuthAdapter {
+    readonly platform: OAuthPlatform;
+    readonly displayName: string;
+    /** 平台名称(英文标识) */
+    readonly name: string;
+    /**
+     * code → openid + profile
+     * @param code 平台下发的一次性 code (微信 js_code / 支付宝 auth_code / 抖音 code)
+     */
+    codeToProfile(code: string): Promise<AdapterLoginResult>;
+    /**
+     * refresh token (拉新 access_token)
+     * @param platformRefreshToken 平台 refresh_token
+     */
+    refreshPlatformToken(platformRefreshToken: string): Promise<AdapterLoginResult>;
+    /**
+     * unlink (业务侧: 撤销用户在该平台的 binding)
+     * 实战: 通常仅需业务侧改 users.wechat_openid = NULL, 此处保留接口做 audit log
+     */
+    unlink(openid: string): Promise<{
+        ok: boolean;
+    }>;
+    /**
+     * getProfile (拿平台用户信息, 用于 audit)
+     */
+    getProfile(openid: string, platformAccessToken: string): Promise<AdapterProfile>;
+    /** 是否 mock 模式 (test 友好) */
+    isMockMode(): boolean;
+}
+export interface WechatAdapterConfig {
+    /** 微信 appid, 不设走 mock */
+    appid?: string;
+    /** 微信 secret, 不设走 mock */
+    secret?: string;
+    /** jscode2session URL (生产一般固定, 测试可 mock server) */
+    apiBaseUrl?: string;
+    /** HTTP 超时 ms, 默认 5000 */
+    timeoutMs?: number;
+}
+/**
+ * 微信小程序登录 adapter
+ *
+ * 流程 (前端 wx.login → code):
+ *   POST https://api.weixin.qq.com/sns/jscode2session
+ *     ?appid=APPID&secret=SECRET&js_code=CODE&grant_type=authorization_code
+ *   → { openid, session_key, unionid? }
+ *
+ * 实战锁版:
+ * - 默认 mock: 不调真微信, 用 code 派生 openid
+ * - 真模式: 需要 WECHAT_APPID + WECHAT_SECRET env var (Lesson #345 写路径)
+ */
+export declare class WechatAdapter implements OAuthAdapter {
+    readonly platform: OAuthPlatform;
+    readonly displayName = "\u5FAE\u4FE1";
+    readonly name = "wechat";
+    private config;
+    private mockMode;
+    constructor(config?: WechatAdapterConfig);
+    isMockMode(): boolean;
+    codeToProfile(code: string): Promise<AdapterLoginResult>;
+    refreshPlatformToken(platformRefreshToken: string): Promise<AdapterLoginResult>;
+    unlink(_openid: string): Promise<{
+        ok: boolean;
+    }>;
+    getProfile(openid: string, _platformAccessToken: string): Promise<AdapterProfile>;
+}
+export interface AlipayAdapterConfig {
+    appid?: string;
+    /** 支付宝 private key (RSA), 用于签名 alipay.system.oauth.token 请求 */
+    privateKey?: string;
+    /** 支付宝 public key, 用于验签支付宝回调 */
+    publicKey?: string;
+    /** 网关 URL, 默认 openapi.alipay.com */
+    apiBaseUrl?: string;
+    timeoutMs?: number;
+}
+/**
+ * 支付宝登录 adapter
+ *
+ * 流程:
+ *   POST https://openapi.alipay.com/gateway.do
+ *     method=alipay.system.oauth.token
+ *     grant_type=authorization_code
+ *     code=<auth_code>
+ *   → { access_token, user_id, ... }
+ *
+ * 实战锁版 (Lesson #345):
+ * - 真模式需 ALIPAY_APPID + ALIPAY_PRIVATE_KEY (env var)
+ * - 签名复杂 (RSA2), mock 模式只返回 deterministic user_id
+ */
+export declare class AlipayAdapter implements OAuthAdapter {
+    readonly platform: OAuthPlatform;
+    readonly displayName = "\u652F\u4ED8\u5B9D";
+    readonly name = "alipay";
+    private config;
+    private mockMode;
+    constructor(config?: AlipayAdapterConfig);
+    isMockMode(): boolean;
+    codeToProfile(code: string): Promise<AdapterLoginResult>;
+    refreshPlatformToken(_platformRefreshToken: string): Promise<AdapterLoginResult>;
+    unlink(_userId: string): Promise<{
+        ok: boolean;
+    }>;
+    getProfile(userId: string, _accessToken: string): Promise<AdapterProfile>;
+}
+export interface DouyinAdapterConfig {
+    clientKey?: string;
+    clientSecret?: string;
+    apiBaseUrl?: string;
+    timeoutMs?: number;
+}
+/**
+ * 抖音小程序登录 adapter
+ *
+ * 流程:
+ *   POST https://open.douyin.com/oauth/token/
+ *     client_key, client_secret, code, grant_type=authorization_code
+ *   → { access_token, open_id, refresh_token, expires_in }
+ *
+ *   GET https://open.douyin.com/oauth/userinfo/
+ *     access_token, open_id
+ *   → { nickname, avatar, ... }
+ */
+export declare class DouyinAdapter implements OAuthAdapter {
+    readonly platform: OAuthPlatform;
+    readonly displayName = "\u6296\u97F3";
+    readonly name = "douyin";
+    private config;
+    private mockMode;
+    constructor(config?: DouyinAdapterConfig);
+    isMockMode(): boolean;
+    codeToProfile(code: string): Promise<AdapterLoginResult>;
+    refreshPlatformToken(rt: string): Promise<AdapterLoginResult>;
+    unlink(_openId: string): Promise<{
+        ok: boolean;
+    }>;
+    getProfile(openId: string, _accessToken: string): Promise<AdapterProfile>;
+}
+export declare class OAuthAdapterRegistry {
+    private adapters;
+    constructor();
+    register(adapter: OAuthAdapter): void;
+    get(platform: OAuthPlatform): OAuthAdapter;
+    list(): OAuthAdapter[];
+}
+//# sourceMappingURL=oauth-adapters.d.ts.map

package/api/oauth-adapters.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-adapters.d.ts","sourceRoot":"","sources":["../../src/api/oauth-adapters.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAIlD,MAAM,WAAW,cAAc;IAC7B,kCAAkC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iDAAiD;IACjD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+BAA+B;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iBAAiB;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wCAAwC;IACxC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,cAAc,CAAC;IACxB,yCAAyC;IACzC,qBAAqB,EAAE,MAAM,CAAC;IAC9B,sCAAsC;IACtC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,wCAAwC;IACxC,UAAU,EAAE,MAAM,CAAC;IACnB,sBAAsB;IACtB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,iBAAiB;IACjB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACzD;;;OAGG;IACH,oBAAoB,CAAC,oBAAoB,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAChF;;;OAGG;IACH,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACjD;;OAEG;IACH,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACjF,2BAA2B;IAC3B,UAAU,IAAI,OAAO,CAAC;CACvB;AA0BD,MAAM,WAAW,mBAAmB;IAClC,yBAAyB;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0BAA0B;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0BAA0B;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,aAAc,YAAW,YAAY;IAChD,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAY;IAC5C,QAAQ,CAAC,WAAW,kBAAQ;IAC5B,QAAQ,CAAC,IAAI,YAAY;IACzB,OAAO,CAAC,MAAM,CAAsB;IACpC,OAAO,CAAC,QAAQ,CAAU;gBAEd,MAAM,GAAE,mBAAwB;IAa5C,UAAU,IAAI,OAAO;IAIf,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAyDxD,oBAAoB,CAAC,oBAAoB,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IA0C/E,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAA;KAAE,CAAC;IAKjD,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;CAQxF;AAID,MAAM,WAAW,mBAAmB;IAClC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+DAA+D;IAC/D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gCAAgC;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oCAAoC;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,aAAc,YAAW,YAAY;IAChD,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAY;IAC5C,QAAQ,CAAC,WAAW,wBAAS;IAC7B,QAAQ,CAAC,IAAI,YAAY;IACzB,OAAO,CAAC,MAAM,CAAsB;IACpC,OAAO,CAAC,QAAQ,CAAU;gBAEd,MAAM,GAAE,mBAAwB;IAY5C,UAAU,IAAI,OAAO;IAIf,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IA2DxD,oBAAoB,CAAC,qBAAqB,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAKhF,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAA;KAAE,CAAC;IAIjD,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;CAOhF;AAID,MAAM,WAAW,mBAAmB;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,aAAc,YAAW,YAAY;IAChD,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAY;IAC5C,QAAQ,CAAC,WAAW,kBAAQ;IAC5B,QAAQ,CAAC,IAAI,YAAY;IACzB,OAAO,CAAC,MAAM,CAAsB;IACpC,OAAO,CAAC,QAAQ,CAAU;gBAEd,MAAM,GAAE,mBAAwB;IAY5C,UAAU,IAAI,OAAO;IAIf,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAoDxD,oBAAoB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IA4C7D,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAA;KAAE,CAAC;IAIjD,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;CAMhF;AAID,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAA0C;;IAQ1D,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI;IAIrC,GAAG,CAAC,QAAQ,EAAE,aAAa,GAAG,YAAY;IAM1C,IAAI,IAAI,YAAY,EAAE;CAGvB"}