whale-code 6.5.6 → 6.5.7

package/dist/server/server-routes-approvals.js

@@ -0,0 +1,238 @@
+// server/server-routes-approvals.ts — Approval route handlers
+// Guest approval GET and authenticated approval respond POST
+// Extracted from index.ts for domain-based modularity.
+
+import { createLogger } from "./lib/logger.js";
+import { getServiceClient } from "./lib/supabase-client.js";
+import { verifyGuestApprovalSignature, executeInlineChain } from "./handlers/workflows.js";
+import { jsonResponse, readBody, safeCompare } from "./server-helpers.js";
+import { sendIpRateLimit } from "./server-rate-limit.js";
+const log = createLogger("server-routes-approvals");
+const SUPABASE_SERVICE_ROLE_KEY = process.env.SUPABASE_SERVICE_ROLE_KEY;
+const SERVICE_ROLE_JWT = process.env.SERVICE_ROLE_JWT || "";
+const FLY_INTERNAL_SECRET = process.env.FLY_INTERNAL_SECRET || "";
+
+// ============================================================================
+// HELPERS
+// ============================================================================
+
+function getToken(req) {
+  const authHeader = req.headers.authorization;
+  return authHeader?.startsWith("Bearer ") ? authHeader.substring(7) : "";
+}
+function isInternalAuth(token) {
+  return safeCompare(token, FLY_INTERNAL_SECRET) || safeCompare(token, SUPABASE_SERVICE_ROLE_KEY) || safeCompare(token, SERVICE_ROLE_JWT);
+}
+
+// ============================================================================
+// GET /approvals/guest/:id — Guest approval via signed URL (no auth required)
+// GET /approvals/guest/:id?action=approve&expires=...&sig=...
+// ============================================================================
+
+export async function handleGuestApproval(req, res, ctx) {
+  const {
+    pathname,
+    corsHeaders
+  } = ctx;
+  const guestApprovalMatch = pathname.match(/^\/approvals\/guest\/([a-f0-9-]+)$/);
+  if (!(guestApprovalMatch && req.method === "GET")) return false;
+  const clientIp = req.headers["x-forwarded-for"]?.toString().split(",")[0]?.trim() || req.socket.remoteAddress || "unknown";
+  if (sendIpRateLimit(res, clientIp, corsHeaders)) return true;
+  const stepRunId = guestApprovalMatch[1];
+  const urlParams = new URL(req.url || "", `http://${req.headers.host}`).searchParams;
+  const action = urlParams.get("action") || "";
+  const expires = urlParams.get("expires") || "";
+  const sig = urlParams.get("sig") || "";
+  if (!action || !expires || !sig) {
+    jsonResponse(res, 400, {
+      error: "Missing action, expires, or sig parameter"
+    }, corsHeaders);
+    return true;
+  }
+  if (new Date(expires) < new Date()) {
+    jsonResponse(res, 410, {
+      error: "This approval link has expired"
+    }, corsHeaders);
+    return true;
+  }
+  if (!verifyGuestApprovalSignature(stepRunId, action, expires, sig)) {
+    jsonResponse(res, 403, {
+      error: "Invalid signature"
+    }, corsHeaders);
+    return true;
+  }
+  const guestSupabase = getServiceClient();
+  const {
+    data: approval
+  } = await guestSupabase.from("workflow_approval_requests").select("id, store_id, run_id, status").eq("step_run_id", stepRunId).limit(1);
+  if (!approval?.length) {
+    jsonResponse(res, 404, {
+      error: "Approval not found"
+    }, corsHeaders);
+    return true;
+  }
+  if (approval[0].status !== "pending") {
+    jsonResponse(res, 409, {
+      error: `Approval already ${approval[0].status}`
+    }, corsHeaders);
+    return true;
+  }
+  const isApprove = action === "approve" || action === "approved";
+  const {
+    data: guestResult,
+    error: guestErr
+  } = await guestSupabase.rpc("respond_to_approval", {
+    p_approval_id: approval[0].id,
+    p_store_id: approval[0].store_id,
+    p_response: isApprove ? "approved" : "rejected",
+    p_response_data: {
+      guest: true,
+      action
+    },
+    p_responded_by: null
+  });
+  if (guestErr) {
+    jsonResponse(res, 500, {
+      success: false,
+      error: guestErr.message
+    }, corsHeaders);
+    return true;
+  }
+  if (guestResult?.success && approval[0].run_id) {
+    try {
+      await executeInlineChain(guestSupabase, approval[0].run_id);
+    } catch (err) {
+      log.error({
+        err: err.message,
+        runId: approval[0].run_id
+      }, "inline chain failed after guest approval");
+    }
+  }
+  res.writeHead(200, {
+    "Content-Type": "text/html",
+    ...corsHeaders
+  });
+  res.end(`<!DOCTYPE html><html><body style="font-family:system-ui;text-align:center;padding:40px">
+    <h2>${isApprove ? "Approved" : "Rejected"}</h2>
+    <p>Your response has been recorded. You can close this window.</p>
+  </body></html>`);
+  return true;
+}
+
+// ============================================================================
+// POST /approvals/:id/respond — Authenticated approval response
+// ============================================================================
+
+export async function handleApprovalRespond(req, res, ctx) {
+  const {
+    pathname,
+    corsHeaders
+  } = ctx;
+  const approvalMatch = pathname.match(/^\/approvals\/([a-f0-9-]+)\/respond$/);
+  if (!approvalMatch || req.method !== "POST") return false;
+  const approvalId = approvalMatch[1];
+  const token = getToken(req);
+  const isInternal = isInternalAuth(token);
+  if (!isInternal && !token) {
+    jsonResponse(res, 401, {
+      error: "Missing authorization"
+    }, corsHeaders);
+    return true;
+  }
+  const supabase = getServiceClient();
+  let userId = null;
+  if (!isInternal) {
+    const {
+      data: {
+        user: authUser
+      },
+      error: authError
+    } = await supabase.auth.getUser(token);
+    if (authError || !authUser) {
+      jsonResponse(res, 401, {
+        error: "Invalid or expired token"
+      }, corsHeaders);
+      return true;
+    }
+    userId = authUser.id;
+  }
+  let rawBody;
+  try {
+    rawBody = await readBody(req);
+  } catch {
+    jsonResponse(res, 413, {
+      error: "Request body too large"
+    }, corsHeaders);
+    return true;
+  }
+  let body;
+  try {
+    body = JSON.parse(rawBody);
+  } catch {
+    jsonResponse(res, 400, {
+      error: "Invalid JSON"
+    }, corsHeaders);
+    return true;
+  }
+  if (!body.status) {
+    jsonResponse(res, 400, {
+      error: "status required (approved/rejected)"
+    }, corsHeaders);
+    return true;
+  }
+
+  // Get store_id from approval
+  const {
+    data: approval
+  } = await supabase.from("workflow_approval_requests").select("store_id, run_id").eq("id", approvalId).single();
+  if (!approval) {
+    jsonResponse(res, 404, {
+      error: "Approval not found"
+    }, corsHeaders);
+    return true;
+  }
+
+  // P1 FIX: Verify user has access to the approval's store
+  if (!isInternal && userId) {
+    const {
+      data: approvalMembership
+    } = await supabase.from("store_members").select("id").eq("store_id", approval.store_id).eq("user_id", userId).single();
+    if (!approvalMembership) {
+      jsonResponse(res, 403, {
+        error: "Not authorized to respond to this approval"
+      }, corsHeaders);
+      return true;
+    }
+  }
+  const {
+    data: result,
+    error
+  } = await supabase.rpc("respond_to_approval", {
+    p_approval_id: approvalId,
+    p_store_id: approval.store_id,
+    p_response: body.status,
+    p_response_data: body.response_data || {},
+    p_responded_by: userId || body.responded_by || null
+  });
+  if (error) {
+    jsonResponse(res, 500, {
+      success: false,
+      error: error.message
+    }, corsHeaders);
+    return true;
+  }
+
+  // Inline resume — execute next step immediately
+  if (result?.success && approval.run_id) {
+    try {
+      await executeInlineChain(supabase, approval.run_id);
+    } catch (err) {
+      log.error({
+        err: err.message
+      }, "inline chain failed after approval");
+    }
+  }
+  jsonResponse(res, result?.success ? 200 : 422, result, corsHeaders);
+  return true;
+}
+//# sourceMappingURL=server-routes-approvals.js.map

package/dist/server/server-routes-approvals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-routes-approvals.js","names":["createLogger","getServiceClient","verifyGuestApprovalSignature","executeInlineChain","jsonResponse","readBody","safeCompare","sendIpRateLimit","log","SUPABASE_SERVICE_ROLE_KEY","process","env","SERVICE_ROLE_JWT","FLY_INTERNAL_SECRET","getToken","req","authHeader","headers","authorization","startsWith","substring","isInternalAuth","token","handleGuestApproval","res","ctx","pathname","corsHeaders","guestApprovalMatch","match","method","clientIp","toString","split","trim","socket","remoteAddress","stepRunId","urlParams","URL","url","host","searchParams","action","get","expires","sig","error","Date","guestSupabase","data","approval","from","select","eq","limit","length","status","isApprove","guestResult","guestErr","rpc","p_approval_id","id","p_store_id","store_id","p_response","p_response_data","guest","p_responded_by","success","message","run_id","err","runId","writeHead","end","handleApprovalRespond","approvalMatch","approvalId","isInternal","supabase","userId","user","authUser","authError","auth","getUser","rawBody","body","JSON","parse","single","approvalMembership","result","response_data","responded_by"],"sources":["../../src/server/server-routes-approvals.ts"],"sourcesContent":["// server/server-routes-approvals.ts — Approval route handlers\n// Guest approval GET and authenticated approval respond POST\n// Extracted from index.ts for domain-based modularity.\n\nimport http from \"node:http\";\nimport { createLogger } from \"./lib/logger.js\";\nimport { getServiceClient } from \"./lib/supabase-client.js\";\nimport { verifyGuestApprovalSignature, executeInlineChain } from \"./handlers/workflows.js\";\nimport { jsonResponse, readBody, safeCompare, type ServerContext } from \"./server-helpers.js\";\nimport { sendIpRateLimit } from \"./server-rate-limit.js\";\n\nconst log = createLogger(\"server-routes-approvals\");\n\nconst SUPABASE_SERVICE_ROLE_KEY = process.env.SUPABASE_SERVICE_ROLE_KEY!;\nconst SERVICE_ROLE_JWT = process.env.SERVICE_ROLE_JWT || \"\";\nconst FLY_INTERNAL_SECRET = process.env.FLY_INTERNAL_SECRET || \"\";\n\n// ============================================================================\n// HELPERS\n// ============================================================================\n\nfunction getToken(req: http.IncomingMessage): string {\n  const authHeader = req.headers.authorization;\n  return authHeader?.startsWith(\"Bearer \") ? authHeader.substring(7) : \"\";\n}\n\nfunction isInternalAuth(token: string): boolean {\n  return safeCompare(token, FLY_INTERNAL_SECRET) || safeCompare(token, SUPABASE_SERVICE_ROLE_KEY) || safeCompare(token, SERVICE_ROLE_JWT);\n}\n\n// ============================================================================\n// GET /approvals/guest/:id — Guest approval via signed URL (no auth required)\n// GET /approvals/guest/:id?action=approve&expires=...&sig=...\n// ============================================================================\n\nexport async function handleGuestApproval(\n  req: http.IncomingMessage,\n  res: http.ServerResponse,\n  ctx: ServerContext,\n): Promise<boolean> {\n  const { pathname, corsHeaders } = ctx;\n\n  const guestApprovalMatch = pathname.match(/^\\/approvals\\/guest\\/([a-f0-9-]+)$/);\n  if (!(guestApprovalMatch && req.method === \"GET\")) return false;\n\n  const clientIp = req.headers[\"x-forwarded-for\"]?.toString().split(\",\")[0]?.trim() || req.socket.remoteAddress || \"unknown\";\n  if (sendIpRateLimit(res, clientIp, corsHeaders)) return true;\n\n  const stepRunId = guestApprovalMatch[1];\n  const urlParams = new URL(req.url || \"\", `http://${req.headers.host}`).searchParams;\n  const action = urlParams.get(\"action\") || \"\";\n  const expires = urlParams.get(\"expires\") || \"\";\n  const sig = urlParams.get(\"sig\") || \"\";\n\n  if (!action || !expires || !sig) {\n    jsonResponse(res, 400, { error: \"Missing action, expires, or sig parameter\" }, corsHeaders);\n    return true;\n  }\n  if (new Date(expires) < new Date()) {\n    jsonResponse(res, 410, { error: \"This approval link has expired\" }, corsHeaders);\n    return true;\n  }\n  if (!verifyGuestApprovalSignature(stepRunId, action, expires, sig)) {\n    jsonResponse(res, 403, { error: \"Invalid signature\" }, corsHeaders);\n    return true;\n  }\n\n  const guestSupabase = getServiceClient();\n\n  const { data: approval } = await guestSupabase.from(\"workflow_approval_requests\")\n    .select(\"id, store_id, run_id, status\").eq(\"step_run_id\", stepRunId).limit(1);\n  if (!approval?.length) {\n    jsonResponse(res, 404, { error: \"Approval not found\" }, corsHeaders);\n    return true;\n  }\n  if (approval[0].status !== \"pending\") {\n    jsonResponse(res, 409, { error: `Approval already ${approval[0].status}` }, corsHeaders);\n    return true;\n  }\n\n  const isApprove = action === \"approve\" || action === \"approved\";\n  const { data: guestResult, error: guestErr } = await guestSupabase.rpc(\"respond_to_approval\", {\n    p_approval_id: approval[0].id,\n    p_store_id: approval[0].store_id,\n    p_response: isApprove ? \"approved\" : \"rejected\",\n    p_response_data: { guest: true, action },\n    p_responded_by: null,\n  });\n\n  if (guestErr) {\n    jsonResponse(res, 500, { success: false, error: guestErr.message }, corsHeaders);\n    return true;\n  }\n\n  if (guestResult?.success && approval[0].run_id) {\n    try {\n      await executeInlineChain(guestSupabase, approval[0].run_id);\n    } catch (err) {\n      log.error({ err: (err as Error).message, runId: approval[0].run_id }, \"inline chain failed after guest approval\");\n    }\n  }\n\n  res.writeHead(200, { \"Content-Type\": \"text/html\", ...corsHeaders });\n  res.end(`<!DOCTYPE html><html><body style=\"font-family:system-ui;text-align:center;padding:40px\">\n    <h2>${isApprove ? \"Approved\" : \"Rejected\"}</h2>\n    <p>Your response has been recorded. You can close this window.</p>\n  </body></html>`);\n  return true;\n}\n\n// ============================================================================\n// POST /approvals/:id/respond — Authenticated approval response\n// ============================================================================\n\nexport async function handleApprovalRespond(\n  req: http.IncomingMessage,\n  res: http.ServerResponse,\n  ctx: ServerContext,\n): Promise<boolean> {\n  const { pathname, corsHeaders } = ctx;\n\n  const approvalMatch = pathname.match(/^\\/approvals\\/([a-f0-9-]+)\\/respond$/);\n  if (!approvalMatch || req.method !== \"POST\") return false;\n\n  const approvalId = approvalMatch[1];\n  const token = getToken(req);\n  const isInternal = isInternalAuth(token);\n\n  if (!isInternal && !token) {\n    jsonResponse(res, 401, { error: \"Missing authorization\" }, corsHeaders);\n    return true;\n  }\n\n  const supabase = getServiceClient();\n  let userId: string | null = null;\n\n  if (!isInternal) {\n    const { data: { user: authUser }, error: authError } = await supabase.auth.getUser(token);\n    if (authError || !authUser) {\n      jsonResponse(res, 401, { error: \"Invalid or expired token\" }, corsHeaders);\n      return true;\n    }\n    userId = authUser.id;\n  }\n\n  let rawBody: string;\n  try { rawBody = await readBody(req); } catch {\n    jsonResponse(res, 413, { error: \"Request body too large\" }, corsHeaders);\n    return true;\n  }\n\n  let body: any;\n  try { body = JSON.parse(rawBody); } catch {\n    jsonResponse(res, 400, { error: \"Invalid JSON\" }, corsHeaders);\n    return true;\n  }\n  if (!body.status) {\n    jsonResponse(res, 400, { error: \"status required (approved/rejected)\" }, corsHeaders);\n    return true;\n  }\n\n  // Get store_id from approval\n  const { data: approval } = await supabase.from(\"workflow_approval_requests\")\n    .select(\"store_id, run_id\").eq(\"id\", approvalId).single();\n  if (!approval) {\n    jsonResponse(res, 404, { error: \"Approval not found\" }, corsHeaders);\n    return true;\n  }\n\n  // P1 FIX: Verify user has access to the approval's store\n  if (!isInternal && userId) {\n    const { data: approvalMembership } = await supabase.from(\"store_members\")\n      .select(\"id\").eq(\"store_id\", approval.store_id).eq(\"user_id\", userId).single();\n    if (!approvalMembership) {\n      jsonResponse(res, 403, { error: \"Not authorized to respond to this approval\" }, corsHeaders);\n      return true;\n    }\n  }\n\n  const { data: result, error } = await supabase.rpc(\"respond_to_approval\", {\n    p_approval_id: approvalId,\n    p_store_id: approval.store_id,\n    p_response: body.status,\n    p_response_data: body.response_data || {},\n    p_responded_by: userId || body.responded_by || null,\n  });\n\n  if (error) {\n    jsonResponse(res, 500, { success: false, error: error.message }, corsHeaders);\n    return true;\n  }\n\n  // Inline resume — execute next step immediately\n  if (result?.success && approval.run_id) {\n    try {\n      await executeInlineChain(supabase, approval.run_id);\n    } catch (err) {\n      log.error({ err: (err as Error).message }, \"inline chain failed after approval\");\n    }\n  }\n\n  jsonResponse(res, result?.success ? 200 : 422, result, corsHeaders);\n  return true;\n}\n"],"mappings":"AAAA;AACA;AACA;;AAGA,SAASA,YAAY,QAAQ,iBAAiB;AAC9C,SAASC,gBAAgB,QAAQ,0BAA0B;AAC3D,SAASC,4BAA4B,EAAEC,kBAAkB,QAAQ,yBAAyB;AAC1F,SAASC,YAAY,EAAEC,QAAQ,EAAEC,WAAW,QAA4B,qBAAqB;AAC7F,SAASC,eAAe,QAAQ,wBAAwB;AAExD,MAAMC,GAAG,GAAGR,YAAY,CAAC,yBAAyB,CAAC;AAEnD,MAAMS,yBAAyB,GAAGC,OAAO,CAACC,GAAG,CAACF,yBAA0B;AACxE,MAAMG,gBAAgB,GAAGF,OAAO,CAACC,GAAG,CAACC,gBAAgB,IAAI,EAAE;AAC3D,MAAMC,mBAAmB,GAAGH,OAAO,CAACC,GAAG,CAACE,mBAAmB,IAAI,EAAE;;AAEjE;AACA;AACA;;AAEA,SAASC,QAAQA,CAACC,GAAyB,EAAU;EACnD,MAAMC,UAAU,GAAGD,GAAG,CAACE,OAAO,CAACC,aAAa;EAC5C,OAAOF,UAAU,EAAEG,UAAU,CAAC,SAAS,CAAC,GAAGH,UAAU,CAACI,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE;AACzE;AAEA,SAASC,cAAcA,CAACC,KAAa,EAAW;EAC9C,OAAOhB,WAAW,CAACgB,KAAK,EAAET,mBAAmB,CAAC,IAAIP,WAAW,CAACgB,KAAK,EAAEb,yBAAyB,CAAC,IAAIH,WAAW,CAACgB,KAAK,EAAEV,gBAAgB,CAAC;AACzI;;AAEA;AACA;AACA;AACA;;AAEA,OAAO,eAAeW,mBAAmBA,CACvCR,GAAyB,EACzBS,GAAwB,EACxBC,GAAkB,EACA;EAClB,MAAM;IAAEC,QAAQ;IAAEC;EAAY,CAAC,GAAGF,GAAG;EAErC,MAAMG,kBAAkB,GAAGF,QAAQ,CAACG,KAAK,CAAC,oCAAoC,CAAC;EAC/E,IAAI,EAAED,kBAAkB,IAAIb,GAAG,CAACe,MAAM,KAAK,KAAK,CAAC,EAAE,OAAO,KAAK;EAE/D,MAAMC,QAAQ,GAAGhB,GAAG,CAACE,OAAO,CAAC,iBAAiB,CAAC,EAAEe,QAAQ,CAAC,CAAC,CAACC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAEC,IAAI,CAAC,CAAC,IAAInB,GAAG,CAACoB,MAAM,CAACC,aAAa,IAAI,SAAS;EAC1H,IAAI7B,eAAe,CAACiB,GAAG,EAAEO,QAAQ,EAAEJ,WAAW,CAAC,EAAE,OAAO,IAAI;EAE5D,MAAMU,SAAS,GAAGT,kBAAkB,CAAC,CAAC,CAAC;EACvC,MAAMU,SAAS,GAAG,IAAIC,GAAG,CAACxB,GAAG,CAACyB,GAAG,IAAI,EAAE,EAAE,UAAUzB,GAAG,CAACE,OAAO,CAACwB,IAAI,EAAE,CAAC,CAACC,YAAY;EACnF,MAAMC,MAAM,GAAGL,SAAS,CAACM,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE;EAC5C,MAAMC,OAAO,GAAGP,SAAS,CAACM,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE;EAC9C,MAAME,GAAG,GAAGR,SAAS,CAACM,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE;EAEtC,IAAI,CAACD,MAAM,IAAI,CAACE,OAAO,IAAI,CAACC,GAAG,EAAE;IAC/B1C,YAAY,CAACoB,GAAG,EAAE,GAAG,EAAE;MAAEuB,KAAK,EAAE;IAA4C,CAAC,EAAEpB,WAAW,CAAC;IAC3F,OAAO,IAAI;EACb;EACA,IAAI,IAAIqB,IAAI,CAACH,OAAO,CAAC,GAAG,IAAIG,IAAI,CAAC,CAAC,EAAE;IAClC5C,YAAY,CAACoB,GAAG,EAAE,GAAG,EAAE;MAAEuB,KAAK,EAAE;IAAiC,CAAC,EAAEpB,WAAW,CAAC;IAChF,OAAO,IAAI;EACb;EACA,IAAI,CAACzB,4BAA4B,CAACmC,SAAS,EAAEM,MAAM,EAAEE,OAAO,EAAEC,GAAG,CAAC,EAAE;IAClE1C,YAAY,CAACoB,GAAG,EAAE,GAAG,EAAE;MAAEuB,KAAK,EAAE;IAAoB,CAAC,EAAEpB,WAAW,CAAC;IACnE,OAAO,IAAI;EACb;EAEA,MAAMsB,aAAa,GAAGhD,gBAAgB,CAAC,CAAC;EAExC,MAAM;IAAEiD,IAAI,EAAEC;EAAS,CAAC,GAAG,MAAMF,aAAa,CAACG,IAAI,CAAC,4BAA4B,CAAC,CAC9EC,MAAM,CAAC,8BAA8B,CAAC,CAACC,EAAE,CAAC,aAAa,EAAEjB,SAAS,CAAC,CAACkB,KAAK,CAAC,CAAC,CAAC;EAC/E,IAAI,CAACJ,QAAQ,EAAEK,MAAM,EAAE;IACrBpD,YAAY,CAACoB,GAAG,EAAE,GAAG,EAAE;MAAEuB,KAAK,EAAE;IAAqB,CAAC,EAAEpB,WAAW,CAAC;IACpE,OAAO,IAAI;EACb;EACA,IAAIwB,QAAQ,CAAC,CAAC,CAAC,CAACM,MAAM,KAAK,SAAS,EAAE;IACpCrD,YAAY,CAACoB,GAAG,EAAE,GAAG,EAAE;MAAEuB,KAAK,EAAE,oBAAoBI,QAAQ,CAAC,CAAC,CAAC,CAACM,MAAM;IAAG,CAAC,EAAE9B,WAAW,CAAC;IACxF,OAAO,IAAI;EACb;EAEA,MAAM+B,SAAS,GAAGf,MAAM,KAAK,SAAS,IAAIA,MAAM,KAAK,UAAU;EAC/D,MAAM;IAAEO,IAAI,EAAES,WAAW;IAAEZ,KAAK,EAAEa;EAAS,CAAC,GAAG,MAAMX,aAAa,CAACY,GAAG,CAAC,qBAAqB,EAAE;IAC5FC,aAAa,EAAEX,QAAQ,CAAC,CAAC,CAAC,CAACY,EAAE;IAC7BC,UAAU,EAAEb,QAAQ,CAAC,CAAC,CAAC,CAACc,QAAQ;IAChCC,UAAU,EAAER,SAAS,GAAG,UAAU,GAAG,UAAU;IAC/CS,eAAe,EAAE;MAAEC,KAAK,EAAE,IAAI;MAAEzB;IAAO,CAAC;IACxC0B,cAAc,EAAE;EAClB,CAAC,CAAC;EAEF,IAAIT,QAAQ,EAAE;IACZxD,YAAY,CAACoB,GAAG,EAAE,GAAG,EAAE;MAAE8C,OAAO,EAAE,KAAK;MAAEvB,KAAK,EAAEa,QAAQ,CAACW;IAAQ,CAAC,EAAE5C,WAAW,CAAC;IAChF,OAAO,IAAI;EACb;EAEA,IAAIgC,WAAW,EAAEW,OAAO,IAAInB,QAAQ,CAAC,CAAC,CAAC,CAACqB,MAAM,EAAE;IAC9C,IAAI;MACF,MAAMrE,kBAAkB,CAAC8C,aAAa,EAAEE,QAAQ,CAAC,CAAC,CAAC,CAACqB,MAAM,CAAC;IAC7D,CAAC,CAAC,OAAOC,GAAG,EAAE;MACZjE,GAAG,CAACuC,KAAK,CAAC;QAAE0B,GAAG,EAAGA,GAAG,CAAWF,OAAO;QAAEG,KAAK,EAAEvB,QAAQ,CAAC,CAAC,CAAC,CAACqB;MAAO,CAAC,EAAE,0CAA0C,CAAC;IACnH;EACF;EAEAhD,GAAG,CAACmD,SAAS,CAAC,GAAG,EAAE;IAAE,cAAc,EAAE,WAAW;IAAE,GAAGhD;EAAY,CAAC,CAAC;EACnEH,GAAG,CAACoD,GAAG,CAAC;AACV,UAAUlB,SAAS,GAAG,UAAU,GAAG,UAAU;AAC7C;AACA,iBAAiB,CAAC;EAChB,OAAO,IAAI;AACb;;AAEA;AACA;AACA;;AAEA,OAAO,eAAemB,qBAAqBA,CACzC9D,GAAyB,EACzBS,GAAwB,EACxBC,GAAkB,EACA;EAClB,MAAM;IAAEC,QAAQ;IAAEC;EAAY,CAAC,GAAGF,GAAG;EAErC,MAAMqD,aAAa,GAAGpD,QAAQ,CAACG,KAAK,CAAC,sCAAsC,CAAC;EAC5E,IAAI,CAACiD,aAAa,IAAI/D,GAAG,CAACe,MAAM,KAAK,MAAM,EAAE,OAAO,KAAK;EAEzD,MAAMiD,UAAU,GAAGD,aAAa,CAAC,CAAC,CAAC;EACnC,MAAMxD,KAAK,GAAGR,QAAQ,CAACC,GAAG,CAAC;EAC3B,MAAMiE,UAAU,GAAG3D,cAAc,CAACC,KAAK,CAAC;EAExC,IAAI,CAAC0D,UAAU,IAAI,CAAC1D,KAAK,EAAE;IACzBlB,YAAY,CAACoB,GAAG,EAAE,GAAG,EAAE;MAAEuB,KAAK,EAAE;IAAwB,CAAC,EAAEpB,WAAW,CAAC;IACvE,OAAO,IAAI;EACb;EAEA,MAAMsD,QAAQ,GAAGhF,gBAAgB,CAAC,CAAC;EACnC,IAAIiF,MAAqB,GAAG,IAAI;EAEhC,IAAI,CAACF,UAAU,EAAE;IACf,MAAM;MAAE9B,IAAI,EAAE;QAAEiC,IAAI,EAAEC;MAAS,CAAC;MAAErC,KAAK,EAAEsC;IAAU,CAAC,GAAG,MAAMJ,QAAQ,CAACK,IAAI,CAACC,OAAO,CAACjE,KAAK,CAAC;IACzF,IAAI+D,SAAS,IAAI,CAACD,QAAQ,EAAE;MAC1BhF,YAAY,CAACoB,GAAG,EAAE,GAAG,EAAE;QAAEuB,KAAK,EAAE;MAA2B,CAAC,EAAEpB,WAAW,CAAC;MAC1E,OAAO,IAAI;IACb;IACAuD,MAAM,GAAGE,QAAQ,CAACrB,EAAE;EACtB;EAEA,IAAIyB,OAAe;EACnB,IAAI;IAAEA,OAAO,GAAG,MAAMnF,QAAQ,CAACU,GAAG,CAAC;EAAE,CAAC,CAAC,MAAM;IAC3CX,YAAY,CAACoB,GAAG,EAAE,GAAG,EAAE;MAAEuB,KAAK,EAAE;IAAyB,CAAC,EAAEpB,WAAW,CAAC;IACxE,OAAO,IAAI;EACb;EAEA,IAAI8D,IAAS;EACb,IAAI;IAAEA,IAAI,GAAGC,IAAI,CAACC,KAAK,CAACH,OAAO,CAAC;EAAE,CAAC,CAAC,MAAM;IACxCpF,YAAY,CAACoB,GAAG,EAAE,GAAG,EAAE;MAAEuB,KAAK,EAAE;IAAe,CAAC,EAAEpB,WAAW,CAAC;IAC9D,OAAO,IAAI;EACb;EACA,IAAI,CAAC8D,IAAI,CAAChC,MAAM,EAAE;IAChBrD,YAAY,CAACoB,GAAG,EAAE,GAAG,EAAE;MAAEuB,KAAK,EAAE;IAAsC,CAAC,EAAEpB,WAAW,CAAC;IACrF,OAAO,IAAI;EACb;;EAEA;EACA,MAAM;IAAEuB,IAAI,EAAEC;EAAS,CAAC,GAAG,MAAM8B,QAAQ,CAAC7B,IAAI,CAAC,4BAA4B,CAAC,CACzEC,MAAM,CAAC,kBAAkB,CAAC,CAACC,EAAE,CAAC,IAAI,EAAEyB,UAAU,CAAC,CAACa,MAAM,CAAC,CAAC;EAC3D,IAAI,CAACzC,QAAQ,EAAE;IACb/C,YAAY,CAACoB,GAAG,EAAE,GAAG,EAAE;MAAEuB,KAAK,EAAE;IAAqB,CAAC,EAAEpB,WAAW,CAAC;IACpE,OAAO,IAAI;EACb;;EAEA;EACA,IAAI,CAACqD,UAAU,IAAIE,MAAM,EAAE;IACzB,MAAM;MAAEhC,IAAI,EAAE2C;IAAmB,CAAC,GAAG,MAAMZ,QAAQ,CAAC7B,IAAI,CAAC,eAAe,CAAC,CACtEC,MAAM,CAAC,IAAI,CAAC,CAACC,EAAE,CAAC,UAAU,EAAEH,QAAQ,CAACc,QAAQ,CAAC,CAACX,EAAE,CAAC,SAAS,EAAE4B,MAAM,CAAC,CAACU,MAAM,CAAC,CAAC;IAChF,IAAI,CAACC,kBAAkB,EAAE;MACvBzF,YAAY,CAACoB,GAAG,EAAE,GAAG,EAAE;QAAEuB,KAAK,EAAE;MAA6C,CAAC,EAAEpB,WAAW,CAAC;MAC5F,OAAO,IAAI;IACb;EACF;EAEA,MAAM;IAAEuB,IAAI,EAAE4C,MAAM;IAAE/C;EAAM,CAAC,GAAG,MAAMkC,QAAQ,CAACpB,GAAG,CAAC,qBAAqB,EAAE;IACxEC,aAAa,EAAEiB,UAAU;IACzBf,UAAU,EAAEb,QAAQ,CAACc,QAAQ;IAC7BC,UAAU,EAAEuB,IAAI,CAAChC,MAAM;IACvBU,eAAe,EAAEsB,IAAI,CAACM,aAAa,IAAI,CAAC,CAAC;IACzC1B,cAAc,EAAEa,MAAM,IAAIO,IAAI,CAACO,YAAY,IAAI;EACjD,CAAC,CAAC;EAEF,IAAIjD,KAAK,EAAE;IACT3C,YAAY,CAACoB,GAAG,EAAE,GAAG,EAAE;MAAE8C,OAAO,EAAE,KAAK;MAAEvB,KAAK,EAAEA,KAAK,CAACwB;IAAQ,CAAC,EAAE5C,WAAW,CAAC;IAC7E,OAAO,IAAI;EACb;;EAEA;EACA,IAAImE,MAAM,EAAExB,OAAO,IAAInB,QAAQ,CAACqB,MAAM,EAAE;IACtC,IAAI;MACF,MAAMrE,kBAAkB,CAAC8E,QAAQ,EAAE9B,QAAQ,CAACqB,MAAM,CAAC;IACrD,CAAC,CAAC,OAAOC,GAAG,EAAE;MACZjE,GAAG,CAACuC,KAAK,CAAC;QAAE0B,GAAG,EAAGA,GAAG,CAAWF;MAAQ,CAAC,EAAE,oCAAoC,CAAC;IAClF;EACF;EAEAnE,YAAY,CAACoB,GAAG,EAAEsE,MAAM,EAAExB,OAAO,GAAG,GAAG,GAAG,GAAG,EAAEwB,MAAM,EAAEnE,WAAW,CAAC;EACnE,OAAO,IAAI;AACb","ignoreList":[]}

package/dist/server/server-routes-auth.d.ts

@@ -0,0 +1,7 @@
+import http from "node:http";
+/**
+ * Handle all authenticated POST/PUT/DELETE routes.
+ * Called after public routes have been checked.
+ * Returns true if route was handled, false otherwise.
+ */
+export declare function handleAuthenticatedRoutes(req: http.IncomingMessage, res: http.ServerResponse, pathname: string, url: URL, corsHeaders: Record<string, string>): Promise<boolean>;