admin-auth

Who a CFX operator is and what they may do, for any server that accepts a Cognito access token from the cfx-admin user pool. admin-mcp imports it. Any other server that checks an operator's token imports it too, so no two disagree about who may do what.

• verifyAccessToken({ issuer, clientId }) checks an access token's RS256 signature against the pool's JWKS, its issuer, token_use=access and that client_id is one of the clients the caller accepts (clientId takes a string or a list). It resolves { ok: true, token: { sub, clientId, scopes, expiresAt } } or { ok: false } for a bad token, and throws when the JWKS cannot be reached, so the caller answers 503 rather than 401.
• createAuthorizeAdmin({ userService, roleService, passkeyRequired }) maps a verified sub to an AdminPrincipal: an ACTIVE admin.dashboard_user with a role, a passkey when one is required, and at least one permission. It only reads. A denial resolves { ok: false, reason }; a database failure throws.
• grantedPermissions applies the admin dashboard's rule (owner gets the whole ADMIN_PERMISSIONS catalog, any other role keeps only catalog keys). test/permissions.parity.test.ts pins it to admin-dashboard/src/lib/auth.ts.
• requirePermission(principal, anyOf) passes when the principal holds any of anyOf.
• passkeyRequired({ flag, stageName, baseUrl }) is the admin dashboard's passkey rule: always on prod, elsewhere unless flag is exactly false or baseUrl is localhost.
• authorizeCliRequest({ request, verify, authorize, reportFault }) resolves the operator behind a cfx CLI request, or the response refusing it: 503 not_configured, 401 token_invalid, 503 unavailable, 403 with the denial. requireCliPermission answers 403 forbidden, and cliJson writes every answer uncached.
• cliActionResponse(result, status) answers a command's result: 200 with the bare value, or the error code's status from status with { error: { code, message } }.

./cli-token exports the CLI token header, its parser and withoutCliToken, which strips the token from a Sentry event. It imports nothing, so an edge bundle can load it.

./test exports createTestKeys, which signs Cognito-shaped access tokens against a local JWKS for callers' handler tests.

It is not in dashboard-auth-services because ADMIN_PERMISSIONS lives in @cfxlabsinc/ui, which depends on dashboard-auth-services.