@adtrackify/at-service-common 3.17.2 → 3.17.4

package/dist/cjs/__tests__/helpers/api-key-auth-helper.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/cjs/__tests__/helpers/api-key-auth-helper.spec.js

@@ -0,0 +1,75 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+jest.mock('../../helpers/logging-helper', () => ({
+    Logger: { info: jest.fn(), warn: jest.fn(), error: jest.fn(), debug: jest.fn() },
+}));
+jest.mock('../../libs/http-error', () => ({
+    HttpError: {
+        unauthorized: () => Object.assign(new Error('Unauthorized'), { statusCode: 401 }),
+        forbidden: (msg) => Object.assign(new Error(msg), { statusCode: 403 }),
+    },
+}));
+const at_tracking_event_types_1 = require("@adtrackify/at-tracking-event-types");
+const api_key_auth_helper_1 = require("../../helpers/api-key-auth-helper");
+const makeEvent = (authorizer) => ({ requestContext: { authorizer } });
+describe('extractApiKeyAuth', () => {
+    it('returns pixelId, accountId, scopes, and apiKeyPk from authorizer context', () => {
+        const event = makeEvent({
+            pixelId: 'px_1',
+            accountId: 'acc_1',
+            apiKeyPk: 'px_1_abc',
+            scopes: 'analytics:read,dashboards:write',
+        });
+        expect((0, api_key_auth_helper_1.extractApiKeyAuth)(event)).toEqual({
+            pixelId: 'px_1',
+            accountId: 'acc_1',
+            apiKeyPk: 'px_1_abc',
+            scopes: ['analytics:read', 'dashboards:write'],
+        });
+    });
+    it('expands legacy db_query scope to analytics:read', () => {
+        const event = makeEvent({
+            pixelId: 'px_1', accountId: 'acc_1', apiKeyPk: 'px_1_abc', scopes: 'db_query',
+        });
+        expect((0, api_key_auth_helper_1.extractApiKeyAuth)(event).scopes).toEqual([at_tracking_event_types_1.API_KEY_SCOPE.ANALYTICS_READ]);
+    });
+    it('expands legacy attribution_query scope to analytics:read', () => {
+        const event = makeEvent({
+            pixelId: 'px_1', accountId: 'acc_1', apiKeyPk: 'px_1_abc', scopes: 'attribution_query',
+        });
+        expect((0, api_key_auth_helper_1.extractApiKeyAuth)(event).scopes).toEqual([at_tracking_event_types_1.API_KEY_SCOPE.ANALYTICS_READ]);
+    });
+    it('deduplicates when both legacy values are present', () => {
+        const event = makeEvent({
+            pixelId: 'px_1', accountId: 'acc_1', apiKeyPk: 'px_1_abc',
+            scopes: 'db_query,attribution_query',
+        });
+        expect((0, api_key_auth_helper_1.extractApiKeyAuth)(event).scopes).toEqual([at_tracking_event_types_1.API_KEY_SCOPE.ANALYTICS_READ]);
+    });
+    it('passes modern scopes through unchanged', () => {
+        const event = makeEvent({
+            pixelId: 'px_1', accountId: 'acc_1', apiKeyPk: 'px_1_abc',
+            scopes: 'analytics:read,dashboards:read,dashboards:write',
+        });
+        expect((0, api_key_auth_helper_1.extractApiKeyAuth)(event).scopes).toEqual([
+            'analytics:read', 'dashboards:read', 'dashboards:write',
+        ]);
+    });
+    it('returns empty scopes array when scopes header is missing', () => {
+        const event = makeEvent({ pixelId: 'px_1', accountId: 'acc_1', apiKeyPk: 'px_1_abc' });
+        expect((0, api_key_auth_helper_1.extractApiKeyAuth)(event).scopes).toEqual([]);
+    });
+    it('throws Unauthorized when pixelId is missing from authorizer context', () => {
+        const event = makeEvent({ accountId: 'acc_1' });
+        expect(() => (0, api_key_auth_helper_1.extractApiKeyAuth)(event)).toThrow('Unauthorized');
+    });
+});
+describe('requireScope', () => {
+    it('allows when the required scope is present', () => {
+        expect(() => (0, api_key_auth_helper_1.requireScope)(['analytics:read', 'dashboards:read'], at_tracking_event_types_1.API_KEY_SCOPE.ANALYTICS_READ)).not.toThrow();
+    });
+    it('throws Forbidden when the required scope is missing', () => {
+        expect(() => (0, api_key_auth_helper_1.requireScope)(['analytics:read'], at_tracking_event_types_1.API_KEY_SCOPE.DASHBOARDS_WRITE)).toThrow('API key does not have the dashboards:write scope');
+    });
+});
+//# sourceMappingURL=api-key-auth-helper.spec.js.map

package/dist/cjs/__tests__/helpers/api-key-auth-helper.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key-auth-helper.spec.js","sourceRoot":"","sources":["../../../../src/__tests__/helpers/api-key-auth-helper.spec.ts"],"names":[],"mappings":";;AAKA,IAAI,CAAC,IAAI,CAAC,8BAA8B,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/C,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE;CACjF,CAAC,CAAC,CAAC;AAEJ,IAAI,CAAC,IAAI,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,CAAC;IACxC,SAAS,EAAE;QACT,YAAY,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;QACjF,SAAS,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;KAC/E;CACF,CAAC,CAAC,CAAC;AAGJ,iFAAoE;AACpE,2EAAoF;AAEpF,MAAM,SAAS,GAAG,CAAC,UAA0C,EAAmB,EAAE,CAChF,CAAC,EAAE,cAAc,EAAE,EAAE,UAAU,EAAE,EAAiC,CAAA,CAAC;AAErE,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,MAAM,KAAK,GAAG,SAAS,CAAC;YACtB,OAAO,EAAE,MAAM;YACf,SAAS,EAAE,OAAO;YAClB,QAAQ,EAAE,UAAU;YACpB,MAAM,EAAE,iCAAiC;SAC1C,CAAC,CAAC;QAEH,MAAM,CAAC,IAAA,uCAAiB,EAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC;YACvC,OAAO,EAAE,MAAM;YACf,SAAS,EAAE,OAAO;YAClB,QAAQ,EAAE,UAAU;YACpB,MAAM,EAAE,CAAC,gBAAgB,EAAE,kBAAkB,CAAC;SAC/C,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,KAAK,GAAG,SAAS,CAAC;YACtB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU;SAC9E,CAAC,CAAC;QACH,MAAM,CAAC,IAAA,uCAAiB,EAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,uCAAa,CAAC,cAAc,CAAC,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,KAAK,GAAG,SAAS,CAAC;YACtB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,mBAAmB;SACvF,CAAC,CAAC;QACH,MAAM,CAAC,IAAA,uCAAiB,EAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,uCAAa,CAAC,cAAc,CAAC,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,KAAK,GAAG,SAAS,CAAC;YACtB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU;YACzD,MAAM,EAAE,4BAA4B;SACrC,CAAC,CAAC;QACH,MAAM,CAAC,IAAA,uCAAiB,EAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,uCAAa,CAAC,cAAc,CAAC,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,KAAK,GAAG,SAAS,CAAC;YACtB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU;YACzD,MAAM,EAAE,iDAAiD;SAC1D,CAAC,CAAC;QACH,MAAM,CAAC,IAAA,uCAAiB,EAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;YAC9C,gBAAgB,EAAE,iBAAiB,EAAE,kBAAkB;SACxD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;QACvF,MAAM,CAAC,IAAA,uCAAiB,EAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;QAChD,MAAM,CAAC,GAAG,EAAE,CAAC,IAAA,uCAAiB,EAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,CAAC,GAAG,EAAE,CACV,IAAA,kCAAY,EAAC,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,EAAE,uCAAa,CAAC,cAAc,CAAC,CAClF,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,CAAC,GAAG,EAAE,CACV,IAAA,kCAAY,EAAC,CAAC,gBAAgB,CAAC,EAAE,uCAAa,CAAC,gBAAgB,CAAC,CACjE,CAAC,OAAO,CAAC,kDAAkD,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/cjs/helpers/api-key-auth-helper.d.ts

@@ -0,0 +1,9 @@
+import { API_KEY_SCOPE } from '@adtrackify/at-tracking-event-types';
+export interface ApiKeyAuthContext {
+    pixelId: string;
+    accountId: string;
+    scopes: string[];
+    apiKeyPk: string;
+}
+export declare const extractApiKeyAuth: (event: import("aws-lambda").APIGatewayProxyEvent) => ApiKeyAuthContext;
+export declare const requireScope: (scopes: string[], required: API_KEY_SCOPE) => void;

package/dist/cjs/helpers/api-key-auth-helper.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.requireScope = exports.extractApiKeyAuth = void 0;
+const at_tracking_event_types_1 = require("@adtrackify/at-tracking-event-types");
+const logging_helper_js_1 = require("./logging-helper.js");
+const http_error_js_1 = require("../libs/http-error.js");
+const expandLegacyScopes = (rawScopes) => {
+    const expanded = new Set();
+    for (const scope of rawScopes) {
+        const replacement = at_tracking_event_types_1.LEGACY_API_KEY_SCOPE_EXPANSION[scope];
+        if (replacement) {
+            for (const modern of replacement)
+                expanded.add(modern);
+        }
+        else {
+            expanded.add(scope);
+        }
+    }
+    return [...expanded];
+};
+const extractApiKeyAuth = (event) => {
+    const authorizer = event.requestContext.authorizer;
+    const pixelId = authorizer?.pixelId;
+    const accountId = authorizer?.accountId;
+    const apiKeyPk = authorizer?.apiKeyPk;
+    const rawScopes = (authorizer?.scopes || '').split(',').filter(Boolean);
+    const scopes = expandLegacyScopes(rawScopes);
+    if (!pixelId) {
+        throw http_error_js_1.HttpError.unauthorized();
+    }
+    return { pixelId, accountId, scopes, apiKeyPk };
+};
+exports.extractApiKeyAuth = extractApiKeyAuth;
+const requireScope = (scopes, required) => {
+    if (!scopes.includes(required)) {
+        logging_helper_js_1.Logger.info('requireScope: missing required scope', { scopes, required });
+        throw http_error_js_1.HttpError.forbidden(`API key does not have the ${required} scope`);
+    }
+};
+exports.requireScope = requireScope;
+//# sourceMappingURL=api-key-auth-helper.js.map

package/dist/cjs/helpers/api-key-auth-helper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key-auth-helper.js","sourceRoot":"","sources":["../../../src/helpers/api-key-auth-helper.ts"],"names":[],"mappings":";;;AAUA,iFAAoG;AACpG,2DAA6C;AAC7C,yDAAkD;AAOlD,MAAM,kBAAkB,GAAG,CAAC,SAAmB,EAAY,EAAE;IAC3D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE;QAC7B,MAAM,WAAW,GAAG,wDAA8B,CAAC,KAAK,CAAC,CAAC;QAC1D,IAAI,WAAW,EAAE;YACf,KAAK,MAAM,MAAM,IAAI,WAAW;gBAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;SACxD;aAAM;YACL,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;SACrB;KACF;IACD,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC;AACvB,CAAC,CAAC;AAcK,MAAM,iBAAiB,GAAG,CAAC,KAAsB,EAAqB,EAAE;IAC7E,MAAM,UAAU,GAAG,KAAK,CAAC,cAAc,CAAC,UAAU,CAAC;IACnD,MAAM,OAAO,GAAG,UAAU,EAAE,OAAiB,CAAC;IAC9C,MAAM,SAAS,GAAG,UAAU,EAAE,SAAmB,CAAC;IAClD,MAAM,QAAQ,GAAG,UAAU,EAAE,QAAkB,CAAC;IAChD,MAAM,SAAS,GAAG,CAAE,UAAU,EAAE,MAAiB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACpF,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAE7C,IAAI,CAAC,OAAO,EAAE;QACZ,MAAM,yBAAS,CAAC,YAAY,EAAE,CAAC;KAChC;IAED,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAClD,CAAC,CAAC;AAbW,QAAA,iBAAiB,qBAa5B;AAGK,MAAM,YAAY,GAAG,CAAC,MAAgB,EAAE,QAAuB,EAAQ,EAAE;IAC9E,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAC9B,0BAAM,CAAC,IAAI,CAAC,sCAAsC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC1E,MAAM,yBAAS,CAAC,SAAS,CAAC,6BAA6B,QAAQ,QAAQ,CAAC,CAAC;KAC1E;AACH,CAAC,CAAC;AALW,QAAA,YAAY,gBAKvB"}

package/dist/cjs/helpers/api-key-authorizer-helper.d.ts

@@ -0,0 +1,36 @@
+import { Context } from 'aws-lambda';
+import { type ApiKeyRecord, type Pixel } from '@adtrackify/at-tracking-event-types';
+export interface ApiKeyAuthorizerDeps {
+    getApiKeyByPk: (pk: string) => Promise<ApiKeyRecord | null>;
+    getPixelById: (pixelId: string) => Promise<Pixel | null | undefined>;
+}
+interface AllowPolicy {
+    principalId: string;
+    policyDocument: {
+        Version: string;
+        Statement: {
+            Action: string;
+            Effect: 'Allow';
+            Resource: string;
+        }[];
+    };
+    context: {
+        pixelId: string;
+        accountId: string;
+        scopes: string;
+        apiKeyPk: string;
+    };
+}
+interface DenyPolicy {
+    principalId: string;
+    policyDocument: {
+        Version: string;
+        Statement: {
+            Action: string;
+            Effect: 'Deny';
+            Resource: string;
+        }[];
+    };
+}
+export declare const createApiKeyAuthorizerHandler: (deps: ApiKeyAuthorizerDeps) => (event: any, context: Context) => Promise<AllowPolicy | DenyPolicy>;
+export {};

package/dist/cjs/helpers/api-key-authorizer-helper.js

@@ -0,0 +1,78 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createApiKeyAuthorizerHandler = void 0;
+const at_tracking_event_types_1 = require("@adtrackify/at-tracking-event-types");
+const logging_helper_js_1 = require("./logging-helper.js");
+const crypto_js_1 = require("../libs/crypto.js");
+const toWildcardArn = (methodArn) => {
+    const parts = methodArn.split('/');
+    return `${parts[0]}/${parts[1]}/*`;
+};
+const generateDenyPolicy = (methodArn) => ({
+    principalId: 'anonymous',
+    policyDocument: {
+        Version: '2012-10-17',
+        Statement: [{ Action: 'execute-api:Invoke', Effect: 'Deny', Resource: methodArn }],
+    },
+});
+const createApiKeyAuthorizerHandler = (deps) => {
+    return async function handler(event, context) {
+        const methodArn = event.methodArn;
+        try {
+            (0, logging_helper_js_1.configureLogger)(event, context);
+            const apiKey = event.headers?.['x-api-key'] || event.headers?.['X-Api-Key'];
+            const pixelId = event.headers?.['x-pixel-id'] || event.headers?.['X-Pixel-Id'];
+            if (!apiKey || !pixelId) {
+                logging_helper_js_1.Logger.info('ApiKeyAuthorizer: missing x-api-key or x-pixel-id header');
+                return generateDenyPolicy(methodArn);
+            }
+            const keyHash = (0, crypto_js_1.generateSha256Hash)(apiKey);
+            const pk = `${pixelId}_${keyHash}`;
+            const apiKeyRecord = await deps.getApiKeyByPk(pk);
+            if (!apiKeyRecord) {
+                logging_helper_js_1.Logger.info('ApiKeyAuthorizer: no matching key found');
+                return generateDenyPolicy(methodArn);
+            }
+            if (apiKeyRecord.status !== at_tracking_event_types_1.API_KEY_STATUS.ACTIVE) {
+                logging_helper_js_1.Logger.info('ApiKeyAuthorizer: key is not active', { status: apiKeyRecord.status });
+                return generateDenyPolicy(methodArn);
+            }
+            if (apiKeyRecord.expiresAt && new Date(apiKeyRecord.expiresAt) < new Date()) {
+                logging_helper_js_1.Logger.info('ApiKeyAuthorizer: key has expired', { expiresAt: apiKeyRecord.expiresAt });
+                return generateDenyPolicy(methodArn);
+            }
+            const pixel = await deps.getPixelById(pixelId);
+            if (!pixel || pixel.status !== at_tracking_event_types_1.PIXEL_STATUS.ACTIVE) {
+                logging_helper_js_1.Logger.info('ApiKeyAuthorizer: pixel is not active', { pixelId, status: pixel?.status });
+                return generateDenyPolicy(methodArn);
+            }
+            logging_helper_js_1.Logger.info('ApiKeyAuthorizer: key authorized', {
+                pixelId: apiKeyRecord.pixelId,
+                apiKeyPk: apiKeyRecord.pk,
+            });
+            return {
+                principalId: apiKeyRecord.pixelId,
+                policyDocument: {
+                    Version: '2012-10-17',
+                    Statement: [{
+                            Action: 'execute-api:Invoke',
+                            Effect: 'Allow',
+                            Resource: toWildcardArn(methodArn),
+                        }],
+                },
+                context: {
+                    pixelId: apiKeyRecord.pixelId,
+                    accountId: apiKeyRecord.accountId,
+                    scopes: apiKeyRecord.scopes.join(','),
+                    apiKeyPk: apiKeyRecord.pk,
+                },
+            };
+        }
+        catch (error) {
+            logging_helper_js_1.Logger.error('ApiKeyAuthorizer: error', { error });
+            return generateDenyPolicy(methodArn);
+        }
+    };
+};
+exports.createApiKeyAuthorizerHandler = createApiKeyAuthorizerHandler;
+//# sourceMappingURL=api-key-authorizer-helper.js.map

package/dist/cjs/helpers/api-key-authorizer-helper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key-authorizer-helper.js","sourceRoot":"","sources":["../../../src/helpers/api-key-authorizer-helper.ts"],"names":[],"mappings":";;;AAyBA,iFAAkH;AAClH,2DAA8D;AAC9D,iDAAuD;AA+BvD,MAAM,aAAa,GAAG,CAAC,SAAiB,EAAU,EAAE;IAElD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnC,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACrC,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,CAAC,SAAiB,EAAc,EAAE,CAAC,CAAC;IAC7D,WAAW,EAAE,WAAW;IACxB,cAAc,EAAE;QACd,OAAO,EAAE,YAAY;QACrB,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;KACnF;CACF,CAAC,CAAC;AAEI,MAAM,6BAA6B,GAAG,CAAC,IAA0B,EAAE,EAAE;IAC1E,OAAO,KAAK,UAAU,OAAO,CAAC,KAAU,EAAE,OAAgB;QACxD,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;QAElC,IAAI;YACF,IAAA,mCAAe,EAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAChC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,CAAC;YAC5E,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,YAAY,CAAC,CAAC;YAE/E,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE;gBACvB,0BAAM,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;gBACxE,OAAO,kBAAkB,CAAC,SAAS,CAAC,CAAC;aACtC;YAED,MAAM,OAAO,GAAG,IAAA,8BAAkB,EAAC,MAAM,CAAC,CAAC;YAC3C,MAAM,EAAE,GAAG,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC;YACnC,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;YAElD,IAAI,CAAC,YAAY,EAAE;gBACjB,0BAAM,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;gBACvD,OAAO,kBAAkB,CAAC,SAAS,CAAC,CAAC;aACtC;YAED,IAAI,YAAY,CAAC,MAAM,KAAK,wCAAc,CAAC,MAAM,EAAE;gBACjD,0BAAM,CAAC,IAAI,CAAC,qCAAqC,EAAE,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;gBACpF,OAAO,kBAAkB,CAAC,SAAS,CAAC,CAAC;aACtC;YAED,IAAI,YAAY,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE;gBAC3E,0BAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE,EAAE,SAAS,EAAE,YAAY,CAAC,SAAS,EAAE,CAAC,CAAC;gBACxF,OAAO,kBAAkB,CAAC,SAAS,CAAC,CAAC;aACtC;YAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;YAC/C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,sCAAY,CAAC,MAAM,EAAE;gBAClD,0BAAM,CAAC,IAAI,CAAC,uCAAuC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;gBACzF,OAAO,kBAAkB,CAAC,SAAS,CAAC,CAAC;aACtC;YAED,0BAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE;gBAC9C,OAAO,EAAE,YAAY,CAAC,OAAO;gBAC7B,QAAQ,EAAE,YAAY,CAAC,EAAE;aAC1B,CAAC,CAAC;YAEH,OAAO;gBACL,WAAW,EAAE,YAAY,CAAC,OAAO;gBACjC,cAAc,EAAE;oBACd,OAAO,EAAE,YAAY;oBACrB,SAAS,EAAE,CAAC;4BACV,MAAM,EAAE,oBAAoB;4BAC5B,MAAM,EAAE,OAAO;4BACf,QAAQ,EAAE,aAAa,CAAC,SAAS,CAAC;yBACnC,CAAC;iBACH;gBACD,OAAO,EAAE;oBACP,OAAO,EAAE,YAAY,CAAC,OAAO;oBAC7B,SAAS,EAAE,YAAY,CAAC,SAAS;oBACjC,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;oBACrC,QAAQ,EAAE,YAAY,CAAC,EAAE;iBAC1B;aACF,CAAC;SACH;QAAC,OAAO,KAAK,EAAE;YACd,0BAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACnD,OAAO,kBAAkB,CAAC,SAAS,CAAC,CAAC;SACtC;IACH,CAAC,CAAC;AACJ,CAAC,CAAC;AAlEW,QAAA,6BAA6B,iCAkExC"}

package/dist/cjs/helpers/index.d.ts

@@ -5,3 +5,5 @@ export * from './shopify-helper.js';
 export * from './identity-cache-helper.js';
 export * from './account-users-helper.js';
 export * from './sqs-utils.js';
+export * from './api-key-auth-helper.js';
+export * from './api-key-authorizer-helper.js';

package/dist/cjs/helpers/index.js

@@ -21,4 +21,6 @@ __exportStar(require("./shopify-helper.js"), exports);
 __exportStar(require("./identity-cache-helper.js"), exports);
 __exportStar(require("./account-users-helper.js"), exports);
 __exportStar(require("./sqs-utils.js"), exports);
+__exportStar(require("./api-key-auth-helper.js"), exports);
+__exportStar(require("./api-key-authorizer-helper.js"), exports);
 //# sourceMappingURL=index.js.map

package/dist/cjs/helpers/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/helpers/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,+DAA6C;AAC7C,sDAAoC;AACpC,uDAAqC;AACrC,sDAAoC;AACpC,6DAA2C;AAC3C,4DAA0C;AAC1C,iDAA+B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/helpers/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,+DAA6C;AAC7C,sDAAoC;AACpC,uDAAqC;AACrC,sDAAoC;AACpC,6DAA2C;AAC3C,4DAA0C;AAC1C,iDAA+B;AAC/B,2DAAyC;AACzC,iEAA+C"}

package/dist/esm/__tests__/helpers/api-key-auth-helper.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/esm/__tests__/helpers/api-key-auth-helper.spec.js

@@ -0,0 +1,73 @@
+jest.mock('../../helpers/logging-helper', () => ({
+    Logger: { info: jest.fn(), warn: jest.fn(), error: jest.fn(), debug: jest.fn() },
+}));
+jest.mock('../../libs/http-error', () => ({
+    HttpError: {
+        unauthorized: () => Object.assign(new Error('Unauthorized'), { statusCode: 401 }),
+        forbidden: (msg) => Object.assign(new Error(msg), { statusCode: 403 }),
+    },
+}));
+import { API_KEY_SCOPE } from '@adtrackify/at-tracking-event-types';
+import { extractApiKeyAuth, requireScope } from '../../helpers/api-key-auth-helper';
+const makeEvent = (authorizer) => ({ requestContext: { authorizer } });
+describe('extractApiKeyAuth', () => {
+    it('returns pixelId, accountId, scopes, and apiKeyPk from authorizer context', () => {
+        const event = makeEvent({
+            pixelId: 'px_1',
+            accountId: 'acc_1',
+            apiKeyPk: 'px_1_abc',
+            scopes: 'analytics:read,dashboards:write',
+        });
+        expect(extractApiKeyAuth(event)).toEqual({
+            pixelId: 'px_1',
+            accountId: 'acc_1',
+            apiKeyPk: 'px_1_abc',
+            scopes: ['analytics:read', 'dashboards:write'],
+        });
+    });
+    it('expands legacy db_query scope to analytics:read', () => {
+        const event = makeEvent({
+            pixelId: 'px_1', accountId: 'acc_1', apiKeyPk: 'px_1_abc', scopes: 'db_query',
+        });
+        expect(extractApiKeyAuth(event).scopes).toEqual([API_KEY_SCOPE.ANALYTICS_READ]);
+    });
+    it('expands legacy attribution_query scope to analytics:read', () => {
+        const event = makeEvent({
+            pixelId: 'px_1', accountId: 'acc_1', apiKeyPk: 'px_1_abc', scopes: 'attribution_query',
+        });
+        expect(extractApiKeyAuth(event).scopes).toEqual([API_KEY_SCOPE.ANALYTICS_READ]);
+    });
+    it('deduplicates when both legacy values are present', () => {
+        const event = makeEvent({
+            pixelId: 'px_1', accountId: 'acc_1', apiKeyPk: 'px_1_abc',
+            scopes: 'db_query,attribution_query',
+        });
+        expect(extractApiKeyAuth(event).scopes).toEqual([API_KEY_SCOPE.ANALYTICS_READ]);
+    });
+    it('passes modern scopes through unchanged', () => {
+        const event = makeEvent({
+            pixelId: 'px_1', accountId: 'acc_1', apiKeyPk: 'px_1_abc',
+            scopes: 'analytics:read,dashboards:read,dashboards:write',
+        });
+        expect(extractApiKeyAuth(event).scopes).toEqual([
+            'analytics:read', 'dashboards:read', 'dashboards:write',
+        ]);
+    });
+    it('returns empty scopes array when scopes header is missing', () => {
+        const event = makeEvent({ pixelId: 'px_1', accountId: 'acc_1', apiKeyPk: 'px_1_abc' });
+        expect(extractApiKeyAuth(event).scopes).toEqual([]);
+    });
+    it('throws Unauthorized when pixelId is missing from authorizer context', () => {
+        const event = makeEvent({ accountId: 'acc_1' });
+        expect(() => extractApiKeyAuth(event)).toThrow('Unauthorized');
+    });
+});
+describe('requireScope', () => {
+    it('allows when the required scope is present', () => {
+        expect(() => requireScope(['analytics:read', 'dashboards:read'], API_KEY_SCOPE.ANALYTICS_READ)).not.toThrow();
+    });
+    it('throws Forbidden when the required scope is missing', () => {
+        expect(() => requireScope(['analytics:read'], API_KEY_SCOPE.DASHBOARDS_WRITE)).toThrow('API key does not have the dashboards:write scope');
+    });
+});
+//# sourceMappingURL=api-key-auth-helper.spec.js.map

package/dist/esm/__tests__/helpers/api-key-auth-helper.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key-auth-helper.spec.js","sourceRoot":"","sources":["../../../../src/__tests__/helpers/api-key-auth-helper.spec.ts"],"names":[],"mappings":"AAKA,IAAI,CAAC,IAAI,CAAC,8BAA8B,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/C,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE;CACjF,CAAC,CAAC,CAAC;AAEJ,IAAI,CAAC,IAAI,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,CAAC;IACxC,SAAS,EAAE;QACT,YAAY,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;QACjF,SAAS,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;KAC/E;CACF,CAAC,CAAC,CAAC;AAGJ,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AAEpF,MAAM,SAAS,GAAG,CAAC,UAA0C,EAAmB,EAAE,CAChF,CAAC,EAAE,cAAc,EAAE,EAAE,UAAU,EAAE,EAAiC,CAAA,CAAC;AAErE,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,MAAM,KAAK,GAAG,SAAS,CAAC;YACtB,OAAO,EAAE,MAAM;YACf,SAAS,EAAE,OAAO;YAClB,QAAQ,EAAE,UAAU;YACpB,MAAM,EAAE,iCAAiC;SAC1C,CAAC,CAAC;QAEH,MAAM,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC;YACvC,OAAO,EAAE,MAAM;YACf,SAAS,EAAE,OAAO;YAClB,QAAQ,EAAE,UAAU;YACpB,MAAM,EAAE,CAAC,gBAAgB,EAAE,kBAAkB,CAAC;SAC/C,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,KAAK,GAAG,SAAS,CAAC;YACtB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU;SAC9E,CAAC,CAAC;QACH,MAAM,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,KAAK,GAAG,SAAS,CAAC;YACtB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,mBAAmB;SACvF,CAAC,CAAC;QACH,MAAM,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,KAAK,GAAG,SAAS,CAAC;YACtB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU;YACzD,MAAM,EAAE,4BAA4B;SACrC,CAAC,CAAC;QACH,MAAM,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,KAAK,GAAG,SAAS,CAAC;YACtB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU;YACzD,MAAM,EAAE,iDAAiD;SAC1D,CAAC,CAAC;QACH,MAAM,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;YAC9C,gBAAgB,EAAE,iBAAiB,EAAE,kBAAkB;SACxD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;QACvF,MAAM,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;QAChD,MAAM,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,CAAC,GAAG,EAAE,CACV,YAAY,CAAC,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,EAAE,aAAa,CAAC,cAAc,CAAC,CAClF,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,CAAC,GAAG,EAAE,CACV,YAAY,CAAC,CAAC,gBAAgB,CAAC,EAAE,aAAa,CAAC,gBAAgB,CAAC,CACjE,CAAC,OAAO,CAAC,kDAAkD,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/esm/helpers/api-key-auth-helper.d.ts

@@ -0,0 +1,9 @@
+import { API_KEY_SCOPE } from '@adtrackify/at-tracking-event-types';
+export interface ApiKeyAuthContext {
+    pixelId: string;
+    accountId: string;
+    scopes: string[];
+    apiKeyPk: string;
+}
+export declare const extractApiKeyAuth: (event: import("aws-lambda").APIGatewayProxyEvent) => ApiKeyAuthContext;
+export declare const requireScope: (scopes: string[], required: API_KEY_SCOPE) => void;

package/dist/esm/helpers/api-key-auth-helper.js

@@ -0,0 +1,36 @@
+import { LEGACY_API_KEY_SCOPE_EXPANSION } from '@adtrackify/at-tracking-event-types';
+import { Logger } from './logging-helper.js';
+import { HttpError } from '../libs/http-error.js';
+const expandLegacyScopes = (rawScopes) => {
+    const expanded = new Set();
+    for (const scope of rawScopes) {
+        const replacement = LEGACY_API_KEY_SCOPE_EXPANSION[scope];
+        if (replacement) {
+            for (const modern of replacement)
+                expanded.add(modern);
+        }
+        else {
+            expanded.add(scope);
+        }
+    }
+    return [...expanded];
+};
+export const extractApiKeyAuth = (event) => {
+    const authorizer = event.requestContext.authorizer;
+    const pixelId = authorizer?.pixelId;
+    const accountId = authorizer?.accountId;
+    const apiKeyPk = authorizer?.apiKeyPk;
+    const rawScopes = (authorizer?.scopes || '').split(',').filter(Boolean);
+    const scopes = expandLegacyScopes(rawScopes);
+    if (!pixelId) {
+        throw HttpError.unauthorized();
+    }
+    return { pixelId, accountId, scopes, apiKeyPk };
+};
+export const requireScope = (scopes, required) => {
+    if (!scopes.includes(required)) {
+        Logger.info('requireScope: missing required scope', { scopes, required });
+        throw HttpError.forbidden(`API key does not have the ${required} scope`);
+    }
+};
+//# sourceMappingURL=api-key-auth-helper.js.map

package/dist/esm/helpers/api-key-auth-helper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key-auth-helper.js","sourceRoot":"","sources":["../../../src/helpers/api-key-auth-helper.ts"],"names":[],"mappings":"AAUA,OAAO,EAAiB,8BAA8B,EAAE,MAAM,qCAAqC,CAAC;AACpG,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAOlD,MAAM,kBAAkB,GAAG,CAAC,SAAmB,EAAY,EAAE;IAC3D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE;QAC7B,MAAM,WAAW,GAAG,8BAA8B,CAAC,KAAK,CAAC,CAAC;QAC1D,IAAI,WAAW,EAAE;YACf,KAAK,MAAM,MAAM,IAAI,WAAW;gBAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;SACxD;aAAM;YACL,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;SACrB;KACF;IACD,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC;AACvB,CAAC,CAAC;AAcF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,KAAsB,EAAqB,EAAE;IAC7E,MAAM,UAAU,GAAG,KAAK,CAAC,cAAc,CAAC,UAAU,CAAC;IACnD,MAAM,OAAO,GAAG,UAAU,EAAE,OAAiB,CAAC;IAC9C,MAAM,SAAS,GAAG,UAAU,EAAE,SAAmB,CAAC;IAClD,MAAM,QAAQ,GAAG,UAAU,EAAE,QAAkB,CAAC;IAChD,MAAM,SAAS,GAAG,CAAE,UAAU,EAAE,MAAiB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACpF,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAE7C,IAAI,CAAC,OAAO,EAAE;QACZ,MAAM,SAAS,CAAC,YAAY,EAAE,CAAC;KAChC;IAED,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAClD,CAAC,CAAC;AAGF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAgB,EAAE,QAAuB,EAAQ,EAAE;IAC9E,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAC9B,MAAM,CAAC,IAAI,CAAC,sCAAsC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC1E,MAAM,SAAS,CAAC,SAAS,CAAC,6BAA6B,QAAQ,QAAQ,CAAC,CAAC;KAC1E;AACH,CAAC,CAAC"}

package/dist/esm/helpers/api-key-authorizer-helper.d.ts

@@ -0,0 +1,36 @@
+import { Context } from 'aws-lambda';
+import { type ApiKeyRecord, type Pixel } from '@adtrackify/at-tracking-event-types';
+export interface ApiKeyAuthorizerDeps {
+    getApiKeyByPk: (pk: string) => Promise<ApiKeyRecord | null>;
+    getPixelById: (pixelId: string) => Promise<Pixel | null | undefined>;
+}
+interface AllowPolicy {
+    principalId: string;
+    policyDocument: {
+        Version: string;
+        Statement: {
+            Action: string;
+            Effect: 'Allow';
+            Resource: string;
+        }[];
+    };
+    context: {
+        pixelId: string;
+        accountId: string;
+        scopes: string;
+        apiKeyPk: string;
+    };
+}
+interface DenyPolicy {
+    principalId: string;
+    policyDocument: {
+        Version: string;
+        Statement: {
+            Action: string;
+            Effect: 'Deny';
+            Resource: string;
+        }[];
+    };
+}
+export declare const createApiKeyAuthorizerHandler: (deps: ApiKeyAuthorizerDeps) => (event: any, context: Context) => Promise<AllowPolicy | DenyPolicy>;
+export {};

package/dist/esm/helpers/api-key-authorizer-helper.js

@@ -0,0 +1,74 @@
+import { API_KEY_STATUS, PIXEL_STATUS } from '@adtrackify/at-tracking-event-types';
+import { Logger, configureLogger } from './logging-helper.js';
+import { generateSha256Hash } from '../libs/crypto.js';
+const toWildcardArn = (methodArn) => {
+    const parts = methodArn.split('/');
+    return `${parts[0]}/${parts[1]}/*`;
+};
+const generateDenyPolicy = (methodArn) => ({
+    principalId: 'anonymous',
+    policyDocument: {
+        Version: '2012-10-17',
+        Statement: [{ Action: 'execute-api:Invoke', Effect: 'Deny', Resource: methodArn }],
+    },
+});
+export const createApiKeyAuthorizerHandler = (deps) => {
+    return async function handler(event, context) {
+        const methodArn = event.methodArn;
+        try {
+            configureLogger(event, context);
+            const apiKey = event.headers?.['x-api-key'] || event.headers?.['X-Api-Key'];
+            const pixelId = event.headers?.['x-pixel-id'] || event.headers?.['X-Pixel-Id'];
+            if (!apiKey || !pixelId) {
+                Logger.info('ApiKeyAuthorizer: missing x-api-key or x-pixel-id header');
+                return generateDenyPolicy(methodArn);
+            }
+            const keyHash = generateSha256Hash(apiKey);
+            const pk = `${pixelId}_${keyHash}`;
+            const apiKeyRecord = await deps.getApiKeyByPk(pk);
+            if (!apiKeyRecord) {
+                Logger.info('ApiKeyAuthorizer: no matching key found');
+                return generateDenyPolicy(methodArn);
+            }
+            if (apiKeyRecord.status !== API_KEY_STATUS.ACTIVE) {
+                Logger.info('ApiKeyAuthorizer: key is not active', { status: apiKeyRecord.status });
+                return generateDenyPolicy(methodArn);
+            }
+            if (apiKeyRecord.expiresAt && new Date(apiKeyRecord.expiresAt) < new Date()) {
+                Logger.info('ApiKeyAuthorizer: key has expired', { expiresAt: apiKeyRecord.expiresAt });
+                return generateDenyPolicy(methodArn);
+            }
+            const pixel = await deps.getPixelById(pixelId);
+            if (!pixel || pixel.status !== PIXEL_STATUS.ACTIVE) {
+                Logger.info('ApiKeyAuthorizer: pixel is not active', { pixelId, status: pixel?.status });
+                return generateDenyPolicy(methodArn);
+            }
+            Logger.info('ApiKeyAuthorizer: key authorized', {
+                pixelId: apiKeyRecord.pixelId,
+                apiKeyPk: apiKeyRecord.pk,
+            });
+            return {
+                principalId: apiKeyRecord.pixelId,
+                policyDocument: {
+                    Version: '2012-10-17',
+                    Statement: [{
+                            Action: 'execute-api:Invoke',
+                            Effect: 'Allow',
+                            Resource: toWildcardArn(methodArn),
+                        }],
+                },
+                context: {
+                    pixelId: apiKeyRecord.pixelId,
+                    accountId: apiKeyRecord.accountId,
+                    scopes: apiKeyRecord.scopes.join(','),
+                    apiKeyPk: apiKeyRecord.pk,
+                },
+            };
+        }
+        catch (error) {
+            Logger.error('ApiKeyAuthorizer: error', { error });
+            return generateDenyPolicy(methodArn);
+        }
+    };
+};
+//# sourceMappingURL=api-key-authorizer-helper.js.map

package/dist/esm/helpers/api-key-authorizer-helper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key-authorizer-helper.js","sourceRoot":"","sources":["../../../src/helpers/api-key-authorizer-helper.ts"],"names":[],"mappings":"AAyBA,OAAO,EAAE,cAAc,EAAiC,YAAY,EAAE,MAAM,qCAAqC,CAAC;AAClH,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AA+BvD,MAAM,aAAa,GAAG,CAAC,SAAiB,EAAU,EAAE;IAElD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnC,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACrC,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,CAAC,SAAiB,EAAc,EAAE,CAAC,CAAC;IAC7D,WAAW,EAAE,WAAW;IACxB,cAAc,EAAE;QACd,OAAO,EAAE,YAAY;QACrB,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;KACnF;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,IAA0B,EAAE,EAAE;IAC1E,OAAO,KAAK,UAAU,OAAO,CAAC,KAAU,EAAE,OAAgB;QACxD,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;QAElC,IAAI;YACF,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAChC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,CAAC;YAC5E,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,YAAY,CAAC,CAAC;YAE/E,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE;gBACvB,MAAM,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;gBACxE,OAAO,kBAAkB,CAAC,SAAS,CAAC,CAAC;aACtC;YAED,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;YAC3C,MAAM,EAAE,GAAG,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC;YACnC,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;YAElD,IAAI,CAAC,YAAY,EAAE;gBACjB,MAAM,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;gBACvD,OAAO,kBAAkB,CAAC,SAAS,CAAC,CAAC;aACtC;YAED,IAAI,YAAY,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM,EAAE;gBACjD,MAAM,CAAC,IAAI,CAAC,qCAAqC,EAAE,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;gBACpF,OAAO,kBAAkB,CAAC,SAAS,CAAC,CAAC;aACtC;YAED,IAAI,YAAY,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE;gBAC3E,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE,EAAE,SAAS,EAAE,YAAY,CAAC,SAAS,EAAE,CAAC,CAAC;gBACxF,OAAO,kBAAkB,CAAC,SAAS,CAAC,CAAC;aACtC;YAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;YAC/C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,EAAE;gBAClD,MAAM,CAAC,IAAI,CAAC,uCAAuC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;gBACzF,OAAO,kBAAkB,CAAC,SAAS,CAAC,CAAC;aACtC;YAED,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE;gBAC9C,OAAO,EAAE,YAAY,CAAC,OAAO;gBAC7B,QAAQ,EAAE,YAAY,CAAC,EAAE;aAC1B,CAAC,CAAC;YAEH,OAAO;gBACL,WAAW,EAAE,YAAY,CAAC,OAAO;gBACjC,cAAc,EAAE;oBACd,OAAO,EAAE,YAAY;oBACrB,SAAS,EAAE,CAAC;4BACV,MAAM,EAAE,oBAAoB;4BAC5B,MAAM,EAAE,OAAO;4BACf,QAAQ,EAAE,aAAa,CAAC,SAAS,CAAC;yBACnC,CAAC;iBACH;gBACD,OAAO,EAAE;oBACP,OAAO,EAAE,YAAY,CAAC,OAAO;oBAC7B,SAAS,EAAE,YAAY,CAAC,SAAS;oBACjC,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;oBACrC,QAAQ,EAAE,YAAY,CAAC,EAAE;iBAC1B;aACF,CAAC;SACH;QAAC,OAAO,KAAK,EAAE;YACd,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACnD,OAAO,kBAAkB,CAAC,SAAS,CAAC,CAAC;SACtC;IACH,CAAC,CAAC;AACJ,CAAC,CAAC"}

package/dist/esm/helpers/index.d.ts

@@ -5,3 +5,5 @@ export * from './shopify-helper.js';
 export * from './identity-cache-helper.js';
 export * from './account-users-helper.js';
 export * from './sqs-utils.js';
+export * from './api-key-auth-helper.js';
+export * from './api-key-authorizer-helper.js';

package/dist/esm/helpers/index.js

@@ -5,4 +5,6 @@ export * from './shopify-helper.js';
 export * from './identity-cache-helper.js';
 export * from './account-users-helper.js';
 export * from './sqs-utils.js';
+export * from './api-key-auth-helper.js';
+export * from './api-key-authorizer-helper.js';
 //# sourceMappingURL=index.js.map

package/dist/esm/helpers/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/helpers/index.ts"],"names":[],"mappings":"AAAA,cAAc,8BAA8B,CAAC;AAC7C,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC;AACpC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,gBAAgB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/helpers/index.ts"],"names":[],"mappings":"AAAA,cAAc,8BAA8B,CAAC;AAC7C,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC;AACpC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,gBAAgB,CAAC;AAC/B,cAAc,0BAA0B,CAAC;AACzC,cAAc,gCAAgC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adtrackify/at-service-common",
-  "version": "3.17.2",
+  "version": "3.17.4",
   "description": "",
   "files": [
     "dist/*"
@@ -37,7 +37,7 @@
   },
   "dependencies": {
     "@adtrackify/at-shared-utils": "^3.2.23",
-    "@adtrackify/at-tracking-event-types": "^4.68.1",
+    "@adtrackify/at-tracking-event-types": "^4.68.3",
     "@aws-sdk/util-utf8": "^3.374.0",
     "@shopify/admin-api-client": "^1.0.4",
     "@shopify/shopify-api": "^11.6.1",