ysk-omni 1.0.0

package/dist/services/abuse-guard.service.js

@@ -0,0 +1,243 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.abuseGuardService = exports.AbuseGuardService = void 0;
+const constants_1 = require("../config/constants");
+const ddos_policy_service_1 = require("./ddos-policy.service");
+const audit_service_1 = require("./audit.service");
+const ip_match_1 = require("../utils/ip-match");
+/** Lazy to avoid cycle: connection-tracker → abuse-guard → ip-blacklist → connection-tracker */
+async function getIpBlacklist() {
+    const m = await Promise.resolve().then(() => __importStar(require('./ip-blacklist.service')));
+    return m.ipBlacklistService;
+}
+const MAX_EVENTS = 50;
+const events = [];
+let autoBanTotal = 0;
+/** Sliding window of timestamps per key. */
+class SlidingWindow {
+    hits = new Map();
+    count(key, windowMs, now = Date.now()) {
+        const arr = (this.hits.get(key) || []).filter((t) => now - t < windowMs);
+        this.hits.set(key, arr);
+        return arr.length;
+    }
+    hit(key, windowMs, now = Date.now()) {
+        const arr = (this.hits.get(key) || []).filter((t) => now - t < windowMs);
+        arr.push(now);
+        this.hits.set(key, arr);
+        return arr.length;
+    }
+    clear(key) {
+        this.hits.delete(key);
+    }
+}
+const failedAuth = new SlidingWindow();
+const rateHits = new SlidingWindow();
+const velocity = new SlidingWindow();
+const concurrent = new Map();
+/** Recent auto-ban timestamps for escalation. */
+const banHistory = new Map();
+function skipPath(path) {
+    if (path === '/health' || path === '/ready')
+        return true;
+    // Admin SPA static + soft-refresh should not trip velocity/conn auto-ban
+    if (path.startsWith('/admin') && !path.startsWith('/admin/api/ddos')) {
+        // Still protect ddos endpoints themselves from flood; skip other admin noise
+        if (!path.startsWith('/admin/api'))
+            return true;
+    }
+    return false;
+}
+/** Soft-skip velocity for general admin API to avoid self-ban while operating panel. */
+function skipVelocityPath(path) {
+    if (skipPath(path))
+        return true;
+    if (path.startsWith('/admin/api'))
+        return true;
+    return false;
+}
+class AbuseGuardService {
+    getEvents(limit = 50) {
+        return events.slice(0, Math.min(limit, MAX_EVENTS));
+    }
+    getAutoBanTotal() {
+        return autoBanTotal;
+    }
+    getConcurrent(ip) {
+        return concurrent.get((0, ip_match_1.normalizeIp)(ip)) || 0;
+    }
+    /** Call when a request starts. Returns whether over concurrent limit (should reject). */
+    onRequestStart(ipRaw, path) {
+        if (skipPath(path)) {
+            return { overConcurrent: false, concurrent: 0 };
+        }
+        const ip = (0, ip_match_1.normalizeIp)(ipRaw);
+        const policy = ddos_policy_service_1.ddosPolicyService.getSync();
+        const n = (concurrent.get(ip) || 0) + 1;
+        concurrent.set(ip, n);
+        if (policy.autoBanEnabled &&
+            policy.autoConnEnabled &&
+            n > policy.maxConcurrentPerIp &&
+            !ddos_policy_service_1.ddosPolicyService.isWhitelisted(ip)) {
+            void this.maybeAutoBan(ip, `Concurrent connections ${n} > ${policy.maxConcurrentPerIp}`, constants_1.BAN_SOURCES.AUTO_CONN, policy.connBanDurationMs);
+            return { overConcurrent: true, concurrent: n };
+        }
+        return { overConcurrent: false, concurrent: n };
+    }
+    onRequestEnd(ipRaw, path, statusCode) {
+        const ip = (0, ip_match_1.normalizeIp)(ipRaw);
+        if (!skipPath(path)) {
+            const cur = concurrent.get(ip) || 0;
+            if (cur <= 1)
+                concurrent.delete(ip);
+            else
+                concurrent.set(ip, cur - 1);
+        }
+        const policy = ddos_policy_service_1.ddosPolicyService.getSync();
+        // Velocity (skip admin API soft-refresh)
+        if (!skipVelocityPath(path) &&
+            policy.autoBanEnabled &&
+            policy.autoVelocityEnabled) {
+            const n = velocity.hit(ip, policy.velocityWindowMs);
+            if (n > policy.velocityMaxRequests) {
+                void this.maybeAutoBan(ip, `Request velocity ${n} > ${policy.velocityMaxRequests} / ${policy.velocityWindowMs}ms`, constants_1.BAN_SOURCES.AUTO_VELOCITY, policy.velocityBanDurationMs);
+            }
+        }
+        // 429 abuse
+        if (statusCode === 429) {
+            this.recordRateHit(ip);
+        }
+    }
+    recordFailedAuth(ipRaw) {
+        const ip = (0, ip_match_1.normalizeIp)(ipRaw);
+        const policy = ddos_policy_service_1.ddosPolicyService.getSync();
+        if (!policy.autoBanEnabled || !policy.autoAuthEnabled)
+            return;
+        if (ddos_policy_service_1.ddosPolicyService.isWhitelisted(ip))
+            return;
+        const n = failedAuth.hit(ip, policy.failedAuthWindowMs);
+        if (n >= policy.failedAuthThreshold) {
+            failedAuth.clear(ip);
+            void this.maybeAutoBan(ip, `Repeated failed authentication (${n} in window)`, constants_1.BAN_SOURCES.AUTO_AUTH, policy.authBanDurationMs);
+        }
+    }
+    clearFailedAuth(ipRaw) {
+        failedAuth.clear((0, ip_match_1.normalizeIp)(ipRaw));
+    }
+    recordRateHit(ipRaw) {
+        const ip = (0, ip_match_1.normalizeIp)(ipRaw);
+        const policy = ddos_policy_service_1.ddosPolicyService.getSync();
+        if (!policy.autoBanEnabled || !policy.autoRateEnabled)
+            return;
+        if (ddos_policy_service_1.ddosPolicyService.isWhitelisted(ip))
+            return;
+        const n = rateHits.hit(ip, policy.rateHitWindowMs);
+        if (n >= policy.rateHitThreshold) {
+            rateHits.clear(ip);
+            void this.maybeAutoBan(ip, `Repeated rate-limit hits (${n} in window)`, constants_1.BAN_SOURCES.AUTO_RATE, policy.rateBanDurationMs);
+        }
+    }
+    async maybeAutoBan(ipRaw, reason, source, durationMs) {
+        const ip = (0, ip_match_1.normalizeIp)(ipRaw);
+        if (!ip || ip === 'unknown')
+            return false;
+        const policy = ddos_policy_service_1.ddosPolicyService.getSync();
+        if (!policy.autoBanEnabled)
+            return false;
+        if (ddos_policy_service_1.ddosPolicyService.isWhitelisted(ip))
+            return false;
+        const ipBlacklistService = await getIpBlacklist();
+        await ipBlacklistService.ensureLoaded();
+        if (ipBlacklistService.isBlocked(ip))
+            return false;
+        let finalDuration = durationMs;
+        let finalSource = source;
+        let escalated = false;
+        const now = Date.now();
+        const hist = (banHistory.get(ip) || []).filter((t) => now - t < policy.escalateDurationMs * 2);
+        if (policy.escalateEnabled &&
+            hist.length + 1 >= policy.escalateAfterBans) {
+            finalDuration = Math.max(finalDuration, policy.escalateDurationMs);
+            finalSource = constants_1.BAN_SOURCES.AUTO_ESCALATE;
+            escalated = true;
+        }
+        try {
+            await ipBlacklistService.ban({
+                ip,
+                reason: escalated ? `[escalated] ${reason}` : reason,
+                source: finalSource,
+                expiresAt: new Date(now + finalDuration),
+            });
+        }
+        catch {
+            return false;
+        }
+        hist.push(now);
+        banHistory.set(ip, hist.slice(-20));
+        autoBanTotal += 1;
+        const ev = {
+            id: `${now}-${ip}`,
+            ip,
+            reason: escalated ? `[escalated] ${reason}` : reason,
+            source: finalSource,
+            durationMs: finalDuration,
+            escalated,
+            at: now,
+        };
+        events.unshift(ev);
+        if (events.length > MAX_EVENTS)
+            events.length = MAX_EVENTS;
+        void audit_service_1.auditService
+            .log({
+            apiKeyId: null,
+            action: constants_1.AUDIT_ACTIONS.IP_BAN,
+            resource: 'ip_blacklist',
+            meta: {
+                ip,
+                reason: ev.reason,
+                source: finalSource,
+                durationMs: finalDuration,
+                auto: true,
+                escalated,
+            },
+        })
+            .catch(() => undefined);
+        return true;
+    }
+}
+exports.AbuseGuardService = AbuseGuardService;
+exports.abuseGuardService = new AbuseGuardService();
+//# sourceMappingURL=abuse-guard.service.js.map

package/dist/services/abuse-guard.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"abuse-guard.service.js","sourceRoot":"","sources":["../../src/services/abuse-guard.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,mDAI6B;AAE7B,+DAA0D;AAC1D,mDAA+C;AAC/C,gDAAgD;AAEhD,gGAAgG;AAChG,KAAK,UAAU,cAAc;IAC3B,MAAM,CAAC,GAAG,wDAAa,wBAAwB,GAAC,CAAC;IACjD,OAAO,CAAC,CAAC,kBAAkB,CAAC;AAC9B,CAAC;AAGD,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,MAAM,MAAM,GAAmB,EAAE,CAAC;AAClC,IAAI,YAAY,GAAG,CAAC,CAAC;AAErB,4CAA4C;AAC5C,MAAM,aAAa;IACT,IAAI,GAAG,IAAI,GAAG,EAAoB,CAAC;IAE3C,KAAK,CAAC,GAAW,EAAE,QAAgB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;QACnD,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC;QACzE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,OAAO,GAAG,CAAC,MAAM,CAAC;IACpB,CAAC;IAED,GAAG,CAAC,GAAW,EAAE,QAAgB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;QACjD,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC;QACzE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACd,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,OAAO,GAAG,CAAC,MAAM,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,GAAW;QACf,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;CACF;AAED,MAAM,UAAU,GAAG,IAAI,aAAa,EAAE,CAAC;AACvC,MAAM,QAAQ,GAAG,IAAI,aAAa,EAAE,CAAC;AACrC,MAAM,QAAQ,GAAG,IAAI,aAAa,EAAE,CAAC;AACrC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;AAC7C,iDAAiD;AACjD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAoB,CAAC;AAE/C,SAAS,QAAQ,CAAC,IAAY;IAC5B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzD,yEAAyE;IACzE,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACrE,6EAA6E;QAC7E,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;YAAE,OAAO,IAAI,CAAC;IAClD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,wFAAwF;AACxF,SAAS,gBAAgB,CAAC,IAAY;IACpC,IAAI,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAa,iBAAiB;IAC5B,SAAS,CAAC,KAAK,GAAG,EAAE;QAClB,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC;IACtD,CAAC;IAED,eAAe;QACb,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,aAAa,CAAC,EAAU;QACtB,OAAO,UAAU,CAAC,GAAG,CAAC,IAAA,sBAAW,EAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC9C,CAAC;IAED,yFAAyF;IACzF,cAAc,CAAC,KAAa,EAAE,IAAY;QAIxC,IAAI,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACnB,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;QAClD,CAAC;QACD,MAAM,EAAE,GAAG,IAAA,sBAAW,EAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,uCAAiB,CAAC,OAAO,EAAE,CAAC;QAC3C,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACxC,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAEtB,IACE,MAAM,CAAC,cAAc;YACrB,MAAM,CAAC,eAAe;YACtB,CAAC,GAAG,MAAM,CAAC,kBAAkB;YAC7B,CAAC,uCAAiB,CAAC,aAAa,CAAC,EAAE,CAAC,EACpC,CAAC;YACD,KAAK,IAAI,CAAC,YAAY,CACpB,EAAE,EACF,0BAA0B,CAAC,MAAM,MAAM,CAAC,kBAAkB,EAAE,EAC5D,uBAAW,CAAC,SAAS,EACrB,MAAM,CAAC,iBAAiB,CACzB,CAAC;YACF,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;QACjD,CAAC;QACD,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;IAClD,CAAC;IAED,YAAY,CAAC,KAAa,EAAE,IAAY,EAAE,UAAmB;QAC3D,MAAM,EAAE,GAAG,IAAA,sBAAW,EAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACpB,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,GAAG,IAAI,CAAC;gBAAE,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;;gBAC/B,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC;QACnC,CAAC;QAED,MAAM,MAAM,GAAG,uCAAiB,CAAC,OAAO,EAAE,CAAC;QAE3C,yCAAyC;QACzC,IACE,CAAC,gBAAgB,CAAC,IAAI,CAAC;YACvB,MAAM,CAAC,cAAc;YACrB,MAAM,CAAC,mBAAmB,EAC1B,CAAC;YACD,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACpD,IAAI,CAAC,GAAG,MAAM,CAAC,mBAAmB,EAAE,CAAC;gBACnC,KAAK,IAAI,CAAC,YAAY,CACpB,EAAE,EACF,oBAAoB,CAAC,MAAM,MAAM,CAAC,mBAAmB,MAAM,MAAM,CAAC,gBAAgB,IAAI,EACtF,uBAAW,CAAC,aAAa,EACzB,MAAM,CAAC,qBAAqB,CAC7B,CAAC;YACJ,CAAC;QACH,CAAC;QAED,YAAY;QACZ,IAAI,UAAU,KAAK,GAAG,EAAE,CAAC;YACvB,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAED,gBAAgB,CAAC,KAAa;QAC5B,MAAM,EAAE,GAAG,IAAA,sBAAW,EAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,uCAAiB,CAAC,OAAO,EAAE,CAAC;QAC3C,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,CAAC,MAAM,CAAC,eAAe;YAAE,OAAO;QAC9D,IAAI,uCAAiB,CAAC,aAAa,CAAC,EAAE,CAAC;YAAE,OAAO;QAEhD,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,kBAAkB,CAAC,CAAC;QACxD,IAAI,CAAC,IAAI,MAAM,CAAC,mBAAmB,EAAE,CAAC;YACpC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACrB,KAAK,IAAI,CAAC,YAAY,CACpB,EAAE,EACF,mCAAmC,CAAC,aAAa,EACjD,uBAAW,CAAC,SAAS,EACrB,MAAM,CAAC,iBAAiB,CACzB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,eAAe,CAAC,KAAa;QAC3B,UAAU,CAAC,KAAK,CAAC,IAAA,sBAAW,EAAC,KAAK,CAAC,CAAC,CAAC;IACvC,CAAC;IAED,aAAa,CAAC,KAAa;QACzB,MAAM,EAAE,GAAG,IAAA,sBAAW,EAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,uCAAiB,CAAC,OAAO,EAAE,CAAC;QAC3C,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,CAAC,MAAM,CAAC,eAAe;YAAE,OAAO;QAC9D,IAAI,uCAAiB,CAAC,aAAa,CAAC,EAAE,CAAC;YAAE,OAAO;QAEhD,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;YACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACnB,KAAK,IAAI,CAAC,YAAY,CACpB,EAAE,EACF,6BAA6B,CAAC,aAAa,EAC3C,uBAAW,CAAC,SAAS,EACrB,MAAM,CAAC,iBAAiB,CACzB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,KAAa,EACb,MAAc,EACd,MAAiB,EACjB,UAAkB;QAElB,MAAM,EAAE,GAAG,IAAA,sBAAW,EAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAE1C,MAAM,MAAM,GAAG,uCAAiB,CAAC,OAAO,EAAE,CAAC;QAC3C,IAAI,CAAC,MAAM,CAAC,cAAc;YAAE,OAAO,KAAK,CAAC;QACzC,IAAI,uCAAiB,CAAC,aAAa,CAAC,EAAE,CAAC;YAAE,OAAO,KAAK,CAAC;QAEtD,MAAM,kBAAkB,GAAG,MAAM,cAAc,EAAE,CAAC;QAClD,MAAM,kBAAkB,CAAC,YAAY,EAAE,CAAC;QACxC,IAAI,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;YAAE,OAAO,KAAK,CAAC;QAEnD,IAAI,aAAa,GAAG,UAAU,CAAC;QAC/B,IAAI,WAAW,GAAG,MAAM,CAAC;QACzB,IAAI,SAAS,GAAG,KAAK,CAAC;QAEtB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAC5C,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,GAAG,MAAM,CAAC,kBAAkB,GAAG,CAAC,CAC/C,CAAC;QACF,IACE,MAAM,CAAC,eAAe;YACtB,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,iBAAiB,EAC3C,CAAC;YACD,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,kBAAkB,CAAC,CAAC;YACnE,WAAW,GAAG,uBAAW,CAAC,aAAa,CAAC;YACxC,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;QAED,IAAI,CAAC;YACH,MAAM,kBAAkB,CAAC,GAAG,CAAC;gBAC3B,EAAE;gBACF,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,eAAe,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM;gBACpD,MAAM,EAAE,WAAW;gBACnB,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,aAAa,CAAC;aACzC,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACf,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACpC,YAAY,IAAI,CAAC,CAAC;QAElB,MAAM,EAAE,GAAiB;YACvB,EAAE,EAAE,GAAG,GAAG,IAAI,EAAE,EAAE;YAClB,EAAE;YACF,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,eAAe,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM;YACpD,MAAM,EAAE,WAAW;YACnB,UAAU,EAAE,aAAa;YACzB,SAAS;YACT,EAAE,EAAE,GAAG;SACR,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACnB,IAAI,MAAM,CAAC,MAAM,GAAG,UAAU;YAAE,MAAM,CAAC,MAAM,GAAG,UAAU,CAAC;QAE3D,KAAK,4BAAY;aACd,GAAG,CAAC;YACH,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,yBAAa,CAAC,MAAM;YAC5B,QAAQ,EAAE,cAAc;YACxB,IAAI,EAAE;gBACJ,EAAE;gBACF,MAAM,EAAE,EAAE,CAAC,MAAM;gBACjB,MAAM,EAAE,WAAW;gBACnB,UAAU,EAAE,aAAa;gBACzB,IAAI,EAAE,IAAI;gBACV,SAAS;aACV;SACF,CAAC;aACD,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAE1B,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAnMD,8CAmMC;AAEY,QAAA,iBAAiB,GAAG,IAAI,iBAAiB,EAAE,CAAC"}

package/dist/services/admin-auth.service.d.ts

@@ -0,0 +1,32 @@
+import type { AuthenticatedApiKey } from '../interfaces';
+export declare function isSessionToken(token: string): boolean;
+/** Synthetic admin identity for session-authenticated Admin SPA requests. */
+export declare function sessionActor(sessionId: string): AuthenticatedApiKey;
+export declare class AdminAuthService {
+    /**
+     * CLI: create a one-time login code (plaintext returned once).
+     */
+    createOtp(meta?: {
+        ip?: string;
+    }): Promise<{
+        code: string;
+        expiresAt: Date;
+        id: string;
+    }>;
+    /**
+     * Exchange a valid unused OTP for a session bearer token.
+     */
+    loginWithOtp(rawCode: string, meta?: {
+        ip?: string;
+        userAgent?: string;
+    }): Promise<{
+        token: string;
+        expiresAt: Date;
+    }>;
+    resolveSessionToken(token: string): Promise<AuthenticatedApiKey | null>;
+    logout(token: string, ip?: string): Promise<void>;
+    /** Housekeeping */
+    purgeExpired(): Promise<void>;
+}
+export declare const adminAuthService: AdminAuthService;
+//# sourceMappingURL=admin-auth.service.d.ts.map

package/dist/services/admin-auth.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-auth.service.d.ts","sourceRoot":"","sources":["../../src/services/admin-auth.service.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AA6CzD,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAErD;AAED,6EAA6E;AAC7E,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,mBAAmB,CAcnE;AAED,qBAAa,gBAAgB;IAC3B;;OAEG;IACG,SAAS,CAAC,IAAI,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAC/C,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,EAAE,IAAI,CAAC;QAChB,EAAE,EAAE,MAAM,CAAC;KACZ,CAAC;IA2BF;;OAEG;IACG,YAAY,CAChB,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GACzC,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,CAAA;KAAE,CAAC;IA6DxC,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAqBvE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAevD,mBAAmB;IACb,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;CASpC;AAED,eAAO,MAAM,gBAAgB,kBAAyB,CAAC"}

package/dist/services/admin-auth.service.js

@@ -0,0 +1,202 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.adminAuthService = exports.AdminAuthService = void 0;
+exports.isSessionToken = isSessionToken;
+exports.sessionActor = sessionActor;
+const node_crypto_1 = require("node:crypto");
+const database_1 = require("../config/database");
+const constants_1 = require("../config/constants");
+const exception_factory_1 = require("../exceptions/exception.factory");
+const id_1 = require("../utils/id");
+const audit_service_1 = require("./audit.service");
+const OTP_TTL_MS = 5 * 60 * 1000;
+const SESSION_TTL_MS = 12 * 60 * 60 * 1000;
+const SESSION_PREFIX = 'gog_sess_';
+const SCRYPT_KEYLEN = 32;
+function scryptHash(plaintext, salt) {
+    const s = salt ?? (0, node_crypto_1.randomBytes)(16);
+    const hash = (0, node_crypto_1.scryptSync)(plaintext, s, SCRYPT_KEYLEN);
+    return `scrypt$${s.toString('hex')}$${hash.toString('hex')}`;
+}
+function scryptVerify(plaintext, stored) {
+    try {
+        const parts = stored.split('$');
+        if (parts[0] !== 'scrypt' || parts.length !== 3)
+            return false;
+        const salt = Buffer.from(parts[1], 'hex');
+        const expected = Buffer.from(parts[2], 'hex');
+        const actual = (0, node_crypto_1.scryptSync)(plaintext, salt, expected.length);
+        return (0, node_crypto_1.timingSafeEqual)(actual, expected);
+    }
+    catch {
+        return false;
+    }
+}
+function sha256Hex(s) {
+    return (0, node_crypto_1.createHash)('sha256').update(s, 'utf8').digest('hex');
+}
+/** Human-friendly OTP: ABCD-EFGH (no ambiguous 0/O/1/I). */
+function generateOtpCode() {
+    const alphabet = 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789';
+    const bytes = (0, node_crypto_1.randomBytes)(8);
+    let out = '';
+    for (let i = 0; i < 8; i++) {
+        out += alphabet[bytes[i] % alphabet.length];
+        if (i === 3)
+            out += '-';
+    }
+    return out;
+}
+function isSessionToken(token) {
+    return token.startsWith(SESSION_PREFIX);
+}
+/** Synthetic admin identity for session-authenticated Admin SPA requests. */
+function sessionActor(sessionId) {
+    return {
+        id: `admin-session:${sessionId}`,
+        name: 'Admin (OTP session)',
+        keyPrefix: 'otp_sess',
+        role: constants_1.ROLES.ADMIN,
+        mode: constants_1.KEY_MODES.AGENT,
+        rateLimit: 1000,
+        isActive: true,
+        maxTurns: null,
+        timeoutMs: null,
+        ipWhitelist: [],
+        allowedModels: [],
+    };
+}
+class AdminAuthService {
+    /**
+     * CLI: create a one-time login code (plaintext returned once).
+     */
+    async createOtp(meta) {
+        // One live code only: drop used, expired, and previous unused OTPs.
+        await database_1.prisma.adminOtp.deleteMany({
+            where: {
+                OR: [
+                    { expiresAt: { lt: new Date() } },
+                    { usedAt: { not: null } },
+                    { usedAt: null },
+                ],
+            },
+        });
+        const code = generateOtpCode();
+        const id = (0, id_1.createId)();
+        const expiresAt = new Date(Date.now() + OTP_TTL_MS);
+        await database_1.prisma.adminOtp.create({
+            data: {
+                id,
+                codeHash: scryptHash(code.toUpperCase().replace(/-/g, '')),
+                expiresAt,
+                createdIp: meta?.ip ?? null,
+            },
+        });
+        return { code, expiresAt, id };
+    }
+    /**
+     * Exchange a valid unused OTP for a session bearer token.
+     */
+    async loginWithOtp(rawCode, meta) {
+        const normalized = String(rawCode || '')
+            .toUpperCase()
+            .replace(/[^A-Z0-9]/g, '');
+        if (normalized.length < 6) {
+            throw exception_factory_1.ExceptionFactory.unauthorized('Invalid or expired login code');
+        }
+        const candidates = await database_1.prisma.adminOtp.findMany({
+            where: { usedAt: null, expiresAt: { gt: new Date() } },
+            orderBy: { createdAt: 'desc' },
+            take: 3,
+        });
+        let matched = null;
+        for (const row of candidates) {
+            if (scryptVerify(normalized, row.codeHash)) {
+                matched = row;
+                break;
+            }
+        }
+        if (!matched) {
+            throw exception_factory_1.ExceptionFactory.unauthorized('Invalid or expired login code');
+        }
+        // One-time: mark used before issuing session
+        const used = await database_1.prisma.adminOtp.updateMany({
+            where: { id: matched.id, usedAt: null },
+            data: { usedAt: new Date() },
+        });
+        if (used.count !== 1) {
+            throw exception_factory_1.ExceptionFactory.unauthorized('Invalid or expired login code');
+        }
+        const tokenRaw = SESSION_PREFIX + (0, node_crypto_1.randomBytes)(32).toString('base64url');
+        const expiresAt = new Date(Date.now() + SESSION_TTL_MS);
+        const sessionId = (0, id_1.createId)();
+        await database_1.prisma.adminSession.create({
+            data: {
+                id: sessionId,
+                tokenHash: sha256Hex(tokenRaw),
+                expiresAt,
+                ip: meta?.ip ?? null,
+                userAgent: meta?.userAgent?.slice(0, 500) ?? null,
+                lastUsedAt: new Date(),
+            },
+        });
+        await audit_service_1.auditService.log({
+            apiKeyId: null,
+            action: constants_1.AUDIT_ACTIONS.ADMIN_LOGIN,
+            resource: 'admin_session',
+            resourceId: sessionId,
+            meta: { via: 'otp' },
+            ip: meta?.ip,
+        });
+        return { token: tokenRaw, expiresAt };
+    }
+    async resolveSessionToken(token) {
+        if (!isSessionToken(token))
+            return null;
+        const tokenHash = sha256Hex(token);
+        const row = await database_1.prisma.adminSession.findUnique({ where: { tokenHash } });
+        if (!row)
+            return null;
+        if (row.expiresAt.getTime() <= Date.now()) {
+            await database_1.prisma.adminSession.delete({ where: { id: row.id } }).catch(() => undefined);
+            return null;
+        }
+        // Touch lastUsed (best-effort)
+        void database_1.prisma.adminSession
+            .update({
+            where: { id: row.id },
+            data: { lastUsedAt: new Date() },
+        })
+            .catch(() => undefined);
+        return sessionActor(row.id);
+    }
+    async logout(token, ip) {
+        if (!isSessionToken(token))
+            return;
+        const tokenHash = sha256Hex(token);
+        const row = await database_1.prisma.adminSession.findUnique({ where: { tokenHash } });
+        if (!row)
+            return;
+        await database_1.prisma.adminSession.delete({ where: { id: row.id } }).catch(() => undefined);
+        await audit_service_1.auditService.log({
+            apiKeyId: null,
+            action: constants_1.AUDIT_ACTIONS.ADMIN_LOGOUT,
+            resource: 'admin_session',
+            resourceId: row.id,
+            ip,
+        });
+    }
+    /** Housekeeping */
+    async purgeExpired() {
+        const now = new Date();
+        await database_1.prisma.adminOtp.deleteMany({
+            where: {
+                OR: [{ expiresAt: { lt: now } }, { usedAt: { not: null } }],
+            },
+        });
+        await database_1.prisma.adminSession.deleteMany({ where: { expiresAt: { lt: now } } });
+    }
+}
+exports.AdminAuthService = AdminAuthService;
+exports.adminAuthService = new AdminAuthService();
+//# sourceMappingURL=admin-auth.service.js.map

package/dist/services/admin-auth.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-auth.service.js","sourceRoot":"","sources":["../../src/services/admin-auth.service.ts"],"names":[],"mappings":";;;AAgDA,wCAEC;AAGD,oCAcC;AAnED,6CAAmF;AACnF,iDAA4C;AAC5C,mDAAsE;AAEtE,uEAAmE;AACnE,oCAAuC;AACvC,mDAA+C;AAE/C,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AACjC,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC3C,MAAM,cAAc,GAAG,WAAW,CAAC;AACnC,MAAM,aAAa,GAAG,EAAE,CAAC;AAEzB,SAAS,UAAU,CAAC,SAAiB,EAAE,IAAa;IAClD,MAAM,CAAC,GAAG,IAAI,IAAI,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,IAAA,wBAAU,EAAC,SAAS,EAAE,CAAC,EAAE,aAAa,CAAC,CAAC;IACrD,OAAO,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,YAAY,CAAC,SAAiB,EAAE,MAAc;IACrD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,KAAK,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,KAAK,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,IAAA,wBAAU,EAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC5D,OAAO,IAAA,6BAAe,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,CAAS;IAC1B,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9D,CAAC;AAED,4DAA4D;AAC5D,SAAS,eAAe;IACtB,MAAM,QAAQ,GAAG,kCAAkC,CAAC;IACpD,MAAM,KAAK,GAAG,IAAA,yBAAW,EAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK,CAAC;YAAE,GAAG,IAAI,GAAG,CAAC;IAC1B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAgB,cAAc,CAAC,KAAa;IAC1C,OAAO,KAAK,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;AAC1C,CAAC;AAED,6EAA6E;AAC7E,SAAgB,YAAY,CAAC,SAAiB;IAC5C,OAAO;QACL,EAAE,EAAE,iBAAiB,SAAS,EAAE;QAChC,IAAI,EAAE,qBAAqB;QAC3B,SAAS,EAAE,UAAU;QACrB,IAAI,EAAE,iBAAK,CAAC,KAAK;QACjB,IAAI,EAAE,qBAAS,CAAC,KAAK;QACrB,SAAS,EAAE,IAAI;QACf,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,IAAI;QACf,WAAW,EAAE,EAAE;QACf,aAAa,EAAE,EAAE;KAClB,CAAC;AACJ,CAAC;AAED,MAAa,gBAAgB;IAC3B;;OAEG;IACH,KAAK,CAAC,SAAS,CAAC,IAAsB;QAKpC,oEAAoE;QACpE,MAAM,iBAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;YAC/B,KAAK,EAAE;gBACL,EAAE,EAAE;oBACF,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,EAAE,EAAE;oBACjC,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;oBACzB,EAAE,MAAM,EAAE,IAAI,EAAE;iBACjB;aACF;SACF,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;QAC/B,MAAM,EAAE,GAAG,IAAA,aAAQ,GAAE,CAAC;QACtB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,CAAC;QACpD,MAAM,iBAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC3B,IAAI,EAAE;gBACJ,EAAE;gBACF,QAAQ,EAAE,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBAC1D,SAAS;gBACT,SAAS,EAAE,IAAI,EAAE,EAAE,IAAI,IAAI;aAC5B;SACF,CAAC,CAAC;QAEH,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAChB,OAAe,EACf,IAA0C;QAE1C,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;aACrC,WAAW,EAAE;aACb,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QAC7B,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,oCAAgB,CAAC,YAAY,CAAC,+BAA+B,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,iBAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAChD,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,EAAE,EAAE;YACtD,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE;YAC9B,IAAI,EAAE,CAAC;SACR,CAAC,CAAC;QAEH,IAAI,OAAO,GAAkC,IAAI,CAAC;QAClD,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;YAC7B,IAAI,YAAY,CAAC,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC3C,OAAO,GAAG,GAAG,CAAC;gBACd,MAAM;YACR,CAAC;QACH,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,oCAAgB,CAAC,YAAY,CAAC,+BAA+B,CAAC,CAAC;QACvE,CAAC;QAED,6CAA6C;QAC7C,MAAM,IAAI,GAAG,MAAM,iBAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;YAC5C,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;YACvC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,IAAI,EAAE,EAAE;SAC7B,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;YACrB,MAAM,oCAAgB,CAAC,YAAY,CAAC,+BAA+B,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,QAAQ,GAAG,cAAc,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACxE,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,CAAC,CAAC;QACxD,MAAM,SAAS,GAAG,IAAA,aAAQ,GAAE,CAAC;QAC7B,MAAM,iBAAM,CAAC,YAAY,CAAC,MAAM,CAAC;YAC/B,IAAI,EAAE;gBACJ,EAAE,EAAE,SAAS;gBACb,SAAS,EAAE,SAAS,CAAC,QAAQ,CAAC;gBAC9B,SAAS;gBACT,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,IAAI;gBACpB,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,IAAI;gBACjD,UAAU,EAAE,IAAI,IAAI,EAAE;aACvB;SACF,CAAC,CAAC;QAEH,MAAM,4BAAY,CAAC,GAAG,CAAC;YACrB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,yBAAa,CAAC,WAAW;YACjC,QAAQ,EAAE,eAAe;YACzB,UAAU,EAAE,SAAS;YACrB,IAAI,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE;YACpB,EAAE,EAAE,IAAI,EAAE,EAAE;SACb,CAAC,CAAC;QAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,KAAa;QACrC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACxC,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,GAAG,GAAG,MAAM,iBAAM,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QAC3E,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC1C,MAAM,iBAAM,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACnF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,+BAA+B;QAC/B,KAAK,iBAAM,CAAC,YAAY;aACrB,MAAM,CAAC;YACN,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE;YACrB,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE;SACjC,CAAC;aACD,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAE1B,OAAO,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,EAAW;QACrC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC;YAAE,OAAO;QACnC,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,GAAG,GAAG,MAAM,iBAAM,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QAC3E,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,MAAM,iBAAM,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACnF,MAAM,4BAAY,CAAC,GAAG,CAAC;YACrB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,yBAAa,CAAC,YAAY;YAClC,QAAQ,EAAE,eAAe;YACzB,UAAU,EAAE,GAAG,CAAC,EAAE;YAClB,EAAE;SACH,CAAC,CAAC;IACL,CAAC;IAED,mBAAmB;IACnB,KAAK,CAAC,YAAY;QAChB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,iBAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;YAC/B,KAAK,EAAE;gBACL,EAAE,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC;aAC5D;SACF,CAAC,CAAC;QACH,MAAM,iBAAM,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;IAC9E,CAAC;CACF;AApJD,4CAoJC;AAEY,QAAA,gBAAgB,GAAG,IAAI,gBAAgB,EAAE,CAAC"}

package/dist/services/api-features.service.d.ts

@@ -0,0 +1,15 @@
+import { type ApiFeatureKey, type ApiFeatures } from '../interfaces/api-features.type';
+export declare class ApiFeaturesService {
+    private cache;
+    private loadedAt;
+    load(): Promise<ApiFeatures>;
+    get(): Promise<ApiFeatures>;
+    getSync(): ApiFeatures;
+    update(partial: Partial<ApiFeatures>): Promise<ApiFeatures>;
+    applyPreset(name: 'open' | 'locked' | 'dev'): Promise<ApiFeatures>;
+    /** Throw 403 if protocol/capability is disabled. */
+    assertEnabled(key: ApiFeatureKey, message?: string): Promise<ApiFeatures>;
+    assertAnyProtocol(which: 'openaiChat' | 'openaiResponses' | 'anthropicMessages'): Promise<ApiFeatures>;
+}
+export declare const apiFeaturesService: ApiFeaturesService;
+//# sourceMappingURL=api-features.service.d.ts.map

package/dist/services/api-features.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-features.service.d.ts","sourceRoot":"","sources":["../../src/services/api-features.service.ts"],"names":[],"mappings":"AAGA,OAAO,EAGL,KAAK,aAAa,EAClB,KAAK,WAAW,EACjB,MAAM,iCAAiC,CAAC;AAgBzC,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,KAAK,CAA4C;IACzD,OAAO,CAAC,QAAQ,CAAK;IAEf,IAAI,IAAI,OAAO,CAAC,WAAW,CAAC;IAqB5B,GAAG,IAAI,OAAO,CAAC,WAAW,CAAC;IAOjC,OAAO,IAAI,WAAW;IAIhB,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC;IAe3D,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC;IAQxE,oDAAoD;IAC9C,aAAa,CACjB,GAAG,EAAE,aAAa,EAClB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,WAAW,CAAC;IAWjB,iBAAiB,CACrB,KAAK,EAAE,YAAY,GAAG,iBAAiB,GAAG,mBAAmB,GAC5D,OAAO,CAAC,WAAW,CAAC;CAMxB;AAED,eAAO,MAAM,kBAAkB,oBAA2B,CAAC"}

package/dist/services/api-features.service.js

@@ -0,0 +1,92 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.apiFeaturesService = exports.ApiFeaturesService = void 0;
+const database_1 = require("../config/database");
+const constants_1 = require("../config/constants");
+const exception_factory_1 = require("../exceptions/exception.factory");
+const api_features_type_1 = require("../interfaces/api-features.type");
+const TTL_MS = 2_000;
+function mergeFeatures(raw) {
+    const base = { ...api_features_type_1.DEFAULT_API_FEATURES };
+    if (!raw || typeof raw !== 'object')
+        return base;
+    const o = raw;
+    for (const key of Object.keys(base)) {
+        if (typeof o[key] === 'boolean') {
+            base[key] = o[key];
+        }
+    }
+    return base;
+}
+class ApiFeaturesService {
+    cache = { ...api_features_type_1.DEFAULT_API_FEATURES };
+    loadedAt = 0;
+    async load() {
+        try {
+            const row = await database_1.prisma.setting.findUnique({
+                where: { key: constants_1.SETTING_KEYS.API_FEATURES },
+            });
+            if (row?.value) {
+                try {
+                    this.cache = mergeFeatures(JSON.parse(row.value));
+                }
+                catch {
+                    this.cache = { ...api_features_type_1.DEFAULT_API_FEATURES };
+                }
+            }
+            else {
+                this.cache = { ...api_features_type_1.DEFAULT_API_FEATURES };
+            }
+        }
+        catch {
+            this.cache = { ...api_features_type_1.DEFAULT_API_FEATURES };
+        }
+        this.loadedAt = Date.now();
+        return this.cache;
+    }
+    async get() {
+        if (Date.now() - this.loadedAt > TTL_MS) {
+            return this.load();
+        }
+        return this.cache;
+    }
+    getSync() {
+        return this.cache;
+    }
+    async update(partial) {
+        const next = mergeFeatures({ ...(await this.get()), ...partial });
+        await database_1.prisma.setting.upsert({
+            where: { key: constants_1.SETTING_KEYS.API_FEATURES },
+            create: {
+                key: constants_1.SETTING_KEYS.API_FEATURES,
+                value: JSON.stringify(next),
+            },
+            update: { value: JSON.stringify(next) },
+        });
+        this.cache = next;
+        this.loadedAt = Date.now();
+        return next;
+    }
+    async applyPreset(name) {
+        const preset = api_features_type_1.API_FEATURE_PRESETS[name];
+        if (!preset) {
+            throw exception_factory_1.ExceptionFactory.validation(`Unknown preset: ${name}`);
+        }
+        return this.update({ ...api_features_type_1.DEFAULT_API_FEATURES, ...preset });
+    }
+    /** Throw 403 if protocol/capability is disabled. */
+    async assertEnabled(key, message) {
+        const f = await this.get();
+        if (!f[key]) {
+            throw exception_factory_1.ExceptionFactory.forbidden(message ||
+                `API feature "${key}" is disabled by admin (Admin → API features or ysk-omni api features)`);
+        }
+        return f;
+    }
+    async assertAnyProtocol(which) {
+        return this.assertEnabled(which, `${which} endpoint is disabled. Enable it in Admin → API features.`);
+    }
+}
+exports.ApiFeaturesService = ApiFeaturesService;
+exports.apiFeaturesService = new ApiFeaturesService();
+//# sourceMappingURL=api-features.service.js.map

package/dist/services/api-features.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-features.service.js","sourceRoot":"","sources":["../../src/services/api-features.service.ts"],"names":[],"mappings":";;;AAAA,iDAA4C;AAC5C,mDAAmD;AACnD,uEAAmE;AACnE,uEAKyC;AAEzC,MAAM,MAAM,GAAG,KAAK,CAAC;AAErB,SAAS,aAAa,CAAC,GAAY;IACjC,MAAM,IAAI,GAAG,EAAE,GAAG,wCAAoB,EAAE,CAAC;IACzC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAoB,EAAE,CAAC;QACvD,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;YAChC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAY,CAAC;QAChC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAa,kBAAkB;IACrB,KAAK,GAAgB,EAAE,GAAG,wCAAoB,EAAE,CAAC;IACjD,QAAQ,GAAG,CAAC,CAAC;IAErB,KAAK,CAAC,IAAI;QACR,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,iBAAM,CAAC,OAAO,CAAC,UAAU,CAAC;gBAC1C,KAAK,EAAE,EAAE,GAAG,EAAE,wBAAY,CAAC,YAAY,EAAE;aAC1C,CAAC,CAAC;YACH,IAAI,GAAG,EAAE,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC;oBACH,IAAI,CAAC,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;gBACpD,CAAC;gBAAC,MAAM,CAAC;oBACP,IAAI,CAAC,KAAK,GAAG,EAAE,GAAG,wCAAoB,EAAE,CAAC;gBAC3C,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,KAAK,GAAG,EAAE,GAAG,wCAAoB,EAAE,CAAC;YAC3C,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,KAAK,GAAG,EAAE,GAAG,wCAAoB,EAAE,CAAC;QAC3C,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,GAAG;QACP,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,GAAG,MAAM,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;QACrB,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAA6B;QACxC,MAAM,IAAI,GAAG,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;QAClE,MAAM,iBAAM,CAAC,OAAO,CAAC,MAAM,CAAC;YAC1B,KAAK,EAAE,EAAE,GAAG,EAAE,wBAAY,CAAC,YAAY,EAAE;YACzC,MAAM,EAAE;gBACN,GAAG,EAAE,wBAAY,CAAC,YAAY;gBAC9B,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;aAC5B;YACD,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;SACxC,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,IAA+B;QAC/C,MAAM,MAAM,GAAG,uCAAmB,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,oCAAgB,CAAC,UAAU,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,GAAG,wCAAoB,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,oDAAoD;IACpD,KAAK,CAAC,aAAa,CACjB,GAAkB,EAClB,OAAgB;QAEhB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;YACZ,MAAM,oCAAgB,CAAC,SAAS,CAC9B,OAAO;gBACL,gBAAgB,GAAG,wEAAwE,CAC9F,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,KAA6D;QAE7D,OAAO,IAAI,CAAC,aAAa,CACvB,KAAK,EACL,GAAG,KAAK,2DAA2D,CACpE,CAAC;IACJ,CAAC;CACF;AAlFD,gDAkFC;AAEY,QAAA,kBAAkB,GAAG,IAAI,kBAAkB,EAAE,CAAC"}