@archlast/server 0.0.1

package/dist/auth/better-auth-api-key-resolver.js

@@ -0,0 +1,184 @@
+"use strict";
+/**
+ * Better-Auth API Key Resolver
+ *
+ * Validates API keys from Better-Auth's apiKey plugin.
+ *
+ * Better-Auth API key format:
+ * - Prefix: arch_ (configurable, defaults to arch_)
+ * - Headers: x-api-key or Authorization: Bearer <key>
+ * - Storage: system_auth_api_key collection
+ * - Features: Rate limiting, expiration, metadata, permissions
+ *
+ * This resolver takes precedence over the legacy arc_key_* system.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BetterAuthApiKeyResolver = void 0;
+const logger_js_1 = require("../logging/logger.js");
+const interfaces_js_1 = require("./interfaces.js");
+const BETTER_AUTH_API_KEY_HEADER = "x-api-key";
+const BETTER_AUTH_API_KEY_PREFIX = "arch_";
+class BetterAuthApiKeyResolver {
+    auth;
+    constructor(options) {
+        this.auth = options.auth;
+    }
+    /**
+     * Extract API key from request headers
+     * Checks both x-api-key and Authorization: Bearer header
+     */
+    extractApiKey(input) {
+        // Check x-api-key header (primary for Better-Auth)
+        const apiKeyHeader = input.headers?.[BETTER_AUTH_API_KEY_HEADER] ||
+            input.headers?.[BETTER_AUTH_API_KEY_HEADER.toUpperCase()];
+        if (apiKeyHeader && typeof apiKeyHeader === "string") {
+            return apiKeyHeader;
+        }
+        // Check Authorization: Bearer header
+        const authHeader = input.headers?.["authorization"] || input.headers?.["Authorization"];
+        if (authHeader && typeof authHeader === "string") {
+            const parts = authHeader.split(" ");
+            if (parts.length === 2 && parts[0].toLowerCase() === "bearer") {
+                const token = parts[1];
+                // Check if it's a Better-Auth API key (arch_ prefix)
+                if (token.startsWith(BETTER_AUTH_API_KEY_PREFIX)) {
+                    return token;
+                }
+            }
+        }
+        return null;
+    }
+    /**
+     * Resolve Better-Auth API key to AuthContext
+     *
+     * Steps:
+     * 1. Extract API key from headers
+     * 2. Verify using Better-Auth's verifyApiKey API
+     * 3. Check if key is enabled and not expired
+     * 4. Use user data from response (Better-Auth includes user in verifyApiKey response)
+     * 5. Build AuthContext with user context and permissions
+     */
+    async resolve(input) {
+        const rawKey = this.extractApiKey(input);
+        if (!rawKey) {
+            return null; // No API key present
+        }
+        // Validate format (must start with arch_)
+        if (!rawKey.startsWith(BETTER_AUTH_API_KEY_PREFIX)) {
+            return null;
+        }
+        try {
+            // Verify API key using Better-Auth
+            // The verifyApiKey API should return both key and user data
+            const result = await this.auth.api.verifyApiKey({
+                body: { key: rawKey },
+            });
+            if (!result?.valid || !result?.key) {
+                logger_js_1.logger.log({
+                    timestamp: Date.now(),
+                    level: "warn",
+                    kind: "system",
+                    message: "[Better-Auth API Key] Invalid or expired key",
+                });
+                return null;
+            }
+            const apiKeyData = result.key;
+            const userData = result.user; // Better-Auth should include user data
+            if (!userData) {
+                logger_js_1.logger.log({
+                    timestamp: Date.now(),
+                    level: "warn",
+                    kind: "system",
+                    message: "[Better-Auth API Key] User not found in key response",
+                    context: { keyId: apiKeyData.id, userId: apiKeyData.userId },
+                });
+                return null;
+            }
+            // Check if enabled
+            if (apiKeyData.enabled === false) {
+                logger_js_1.logger.log({
+                    timestamp: Date.now(),
+                    level: "warn",
+                    kind: "system",
+                    message: "[Better-Auth API Key] Key is disabled",
+                    context: { keyId: apiKeyData.id },
+                });
+                return null;
+            }
+            // Check expiration (Better-Auth uses expiresAt Date)
+            if (apiKeyData.expiresAt) {
+                const expiresAt = new Date(apiKeyData.expiresAt);
+                if (expiresAt < new Date()) {
+                    logger_js_1.logger.log({
+                        timestamp: Date.now(),
+                        level: "warn",
+                        kind: "system",
+                        message: "[Better-Auth API Key] Key is expired",
+                        context: { expiresAt: apiKeyData.expiresAt },
+                    });
+                    return null;
+                }
+            }
+            // Check if user is banned
+            if (userData.banned) {
+                logger_js_1.logger.log({
+                    timestamp: Date.now(),
+                    level: "warn",
+                    kind: "system",
+                    message: "[Better-Auth API Key] User is banned",
+                    context: { userId: userData.id, banReason: userData.banReason },
+                });
+                return null;
+            }
+            // Parse permissions from metadata
+            let permissions = [];
+            if (apiKeyData.permissions && typeof apiKeyData.permissions === "object") {
+                // Better-Auth permissions are Record<string, string[]>
+                // Flatten to string array for compatibility
+                permissions = Object.entries(apiKeyData.permissions).flatMap(([resource, actions]) => actions.map(a => `${resource}:${a}`));
+            }
+            // Build AuthContext
+            const base = {
+                type: "apiKey",
+                userId: userData.id,
+                isAuthenticated: true,
+                isAdminToken: userData.role === "admin" || userData.role === "super-admin",
+                provider: "better-auth",
+                raw: apiKeyData,
+                // User context - use _id for compatibility with AuthUser type
+                user: {
+                    _id: userData.id,
+                    email: userData.email,
+                    name: userData.name,
+                    emailVerified: userData.emailVerified || false,
+                    createdAt: userData.createdAt,
+                },
+                // Session (not applicable for API keys)
+                session: null,
+                // API key auth
+                apiKeyId: apiKeyData.id,
+                apiKey: apiKeyData,
+                // Tenant context (API keys inherit user's tenant)
+                tenantId: null,
+                tenant: null,
+                membership: null,
+                // Authorization
+                role: userData.role || "user",
+                permissions,
+            };
+            return (0, interfaces_js_1.attachAuthHelpers)(base);
+        }
+        catch (error) {
+            logger_js_1.logger.log({
+                timestamp: Date.now(),
+                level: "error",
+                kind: "system",
+                message: "[Better-Auth API Key] Resolution failed",
+                context: { error: error instanceof Error ? error.message : String(error) },
+            });
+            return null;
+        }
+    }
+}
+exports.BetterAuthApiKeyResolver = BetterAuthApiKeyResolver;
+//# sourceMappingURL=better-auth-api-key-resolver.js.map

package/dist/auth/better-auth-api-key-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"better-auth-api-key-resolver.js","sourceRoot":"","sources":["../../src/auth/better-auth-api-key-resolver.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;AAGH,oDAA8C;AAC9C,mDAAoD;AAGpD,MAAM,0BAA0B,GAAG,WAAW,CAAC;AAC/C,MAAM,0BAA0B,GAAG,OAAO,CAAC;AAM3C,MAAa,wBAAwB;IACzB,IAAI,CAAqB;IAEjC,YAAY,OAAwC;QAChD,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC7B,CAAC;IAED;;;OAGG;IACK,aAAa,CAAC,KAAgB;QAClC,mDAAmD;QACnD,MAAM,YAAY,GACd,KAAK,CAAC,OAAO,EAAE,CAAC,0BAA0B,CAAC;YAC3C,KAAK,CAAC,OAAO,EAAE,CAAC,0BAA0B,CAAC,WAAW,EAAE,CAAC,CAAC;QAC9D,IAAI,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;YACnD,OAAO,YAAY,CAAC;QACxB,CAAC;QAED,qCAAqC;QACrC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,eAAe,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,eAAe,CAAC,CAAC;QACxF,IAAI,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;YAC/C,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,QAAQ,EAAE,CAAC;gBAC5D,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACvB,qDAAqD;gBACrD,IAAI,KAAK,CAAC,UAAU,CAAC,0BAA0B,CAAC,EAAE,CAAC;oBAC/C,OAAO,KAAK,CAAC;gBACjB,CAAC;YACL,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC;IAChB,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,OAAO,CAAC,KAAgB;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAEzC,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,OAAO,IAAI,CAAC,CAAC,qBAAqB;QACtC,CAAC;QAED,0CAA0C;QAC1C,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,0BAA0B,CAAC,EAAE,CAAC;YACjD,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,IAAI,CAAC;YACD,mCAAmC;YACnC,4DAA4D;YAC5D,MAAM,MAAM,GAAG,MAAO,IAAI,CAAC,IAAY,CAAC,GAAG,CAAC,YAAY,CAAC;gBACrD,IAAI,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE;aACxB,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC;gBACjC,kBAAM,CAAC,GAAG,CAAC;oBACP,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;oBACrB,KAAK,EAAE,MAAM;oBACb,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,8CAA8C;iBAC1D,CAAC,CAAC;gBACH,OAAO,IAAI,CAAC;YAChB,CAAC;YAED,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC;YAC9B,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,uCAAuC;YAErE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACZ,kBAAM,CAAC,GAAG,CAAC;oBACP,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;oBACrB,KAAK,EAAE,MAAM;oBACb,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,sDAAsD;oBAC/D,OAAO,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE;iBAC/D,CAAC,CAAC;gBACH,OAAO,IAAI,CAAC;YAChB,CAAC;YAED,mBAAmB;YACnB,IAAI,UAAU,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;gBAC/B,kBAAM,CAAC,GAAG,CAAC;oBACP,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;oBACrB,KAAK,EAAE,MAAM;oBACb,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,uCAAuC;oBAChD,OAAO,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,EAAE,EAAE;iBACpC,CAAC,CAAC;gBACH,OAAO,IAAI,CAAC;YAChB,CAAC;YAED,qDAAqD;YACrD,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;gBACvB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;gBACjD,IAAI,SAAS,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;oBACzB,kBAAM,CAAC,GAAG,CAAC;wBACP,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;wBACrB,KAAK,EAAE,MAAM;wBACb,IAAI,EAAE,QAAQ;wBACd,OAAO,EAAE,sCAAsC;wBAC/C,OAAO,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE;qBAC/C,CAAC,CAAC;oBACH,OAAO,IAAI,CAAC;gBAChB,CAAC;YACL,CAAC;YAED,0BAA0B;YAC1B,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAClB,kBAAM,CAAC,GAAG,CAAC;oBACP,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;oBACrB,KAAK,EAAE,MAAM;oBACb,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,sCAAsC;oBAC/C,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE;iBAClE,CAAC,CAAC;gBACH,OAAO,IAAI,CAAC;YAChB,CAAC;YAED,kCAAkC;YAClC,IAAI,WAAW,GAAa,EAAE,CAAC;YAC/B,IAAI,UAAU,CAAC,WAAW,IAAI,OAAO,UAAU,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;gBACvE,uDAAuD;gBACvD,4CAA4C;gBAC5C,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,OAAO,CACxD,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,EAAE,CAAE,OAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,QAAQ,IAAI,CAAC,EAAE,CAAC,CAC9E,CAAC;YACN,CAAC;YAED,oBAAoB;YACpB,MAAM,IAAI,GAAG;gBACT,IAAI,EAAE,QAAiB;gBACvB,MAAM,EAAE,QAAQ,CAAC,EAAE;gBACnB,eAAe,EAAE,IAAI;gBACrB,YAAY,EAAE,QAAQ,CAAC,IAAI,KAAK,OAAO,IAAI,QAAQ,CAAC,IAAI,KAAK,aAAa;gBAC1E,QAAQ,EAAE,aAAsB;gBAChC,GAAG,EAAE,UAAU;gBAEf,8DAA8D;gBAC9D,IAAI,EAAE;oBACF,GAAG,EAAE,QAAQ,CAAC,EAAE;oBAChB,KAAK,EAAE,QAAQ,CAAC,KAAK;oBACrB,IAAI,EAAE,QAAQ,CAAC,IAAI;oBACnB,aAAa,EAAE,QAAQ,CAAC,aAAa,IAAI,KAAK;oBAC9C,SAAS,EAAE,QAAQ,CAAC,SAAS;iBAChC;gBAED,wCAAwC;gBACxC,OAAO,EAAE,IAAI;gBAEb,eAAe;gBACf,QAAQ,EAAE,UAAU,CAAC,EAAE;gBACvB,MAAM,EAAE,UAAU;gBAElB,kDAAkD;gBAClD,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,IAAI;gBACZ,UAAU,EAAE,IAAI;gBAEhB,gBAAgB;gBAChB,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,MAAM;gBAC7B,WAAW;aACd,CAAC;YAEF,OAAO,IAAA,iCAAiB,EAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,kBAAM,CAAC,GAAG,CAAC;gBACP,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;gBACrB,KAAK,EAAE,OAAO;gBACd,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,yCAAyC;gBAClD,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;aAC7E,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QAChB,CAAC;IACL,CAAC;CACJ;AAzLD,4DAyLC"}