@automagik/omni 2.260718.4 → 2.260718.6

package/dist/index.js

@@ -73282,6 +73282,38 @@ class ApiKeyService {
     if (options.name !== undefined && await this.isPrimaryKey(id)) {
       throw new Error("Cannot rename primary API key");
     }
+    const updates = this.buildUpdateValues(options);
+    const [updated] = await this.db.update(apiKeys).set(updates).where(eq2(apiKeys.id, id)).returning();
+    if (updated) {
+      await apiKeyCache.delete(CacheKeys.apiKey(updated.keyHash));
+      log20.info("API key updated", { id, fields: Object.keys(options) });
+    }
+    return updated ?? null;
+  }
+  async updateWithAuthorityGuard(id, options, guard) {
+    const result = await this.db.transaction(async (tx2) => {
+      const [current] = await tx2.select().from(apiKeys).where(eq2(apiKeys.id, id)).limit(1).for("update");
+      if (!current)
+        return { status: "not_found" };
+      if (options.name !== undefined && current.name === PRIMARY_KEY_NAME) {
+        throw new Error("Cannot rename primary API key");
+      }
+      const updates = this.buildUpdateValues(options);
+      const next = { ...current, ...updates };
+      if (!await guard(current, next))
+        return { status: "denied" };
+      const [updated] = await tx2.update(apiKeys).set(updates).where(eq2(apiKeys.id, id)).returning();
+      if (!updated)
+        return { status: "not_found" };
+      return { status: "updated", key: updated };
+    });
+    if (result.status === "updated") {
+      await apiKeyCache.delete(CacheKeys.apiKey(result.key.keyHash));
+      log20.info("API key updated", { id, fields: Object.keys(options) });
+    }
+    return result;
+  }
+  buildUpdateValues(options) {
     const updates = { updatedAt: new Date };
     if (options.name !== undefined)
       updates.name = options.name;
@@ -73304,12 +73336,7 @@ class ApiKeyService {
     if (options.contextInstanceId !== undefined || options.contextChatId !== undefined || options.contextMessageId !== undefined) {
       updates.contextUpdatedAt = new Date;
     }
-    const [updated] = await this.db.update(apiKeys).set(updates).where(eq2(apiKeys.id, id)).returning();
-    if (updated) {
-      await apiKeyCache.delete(CacheKeys.apiKey(updated.keyHash));
-      log20.info("API key updated", { id, fields: Object.keys(options) });
-    }
-    return updated ?? null;
+    return updates;
   }
   async list() {
     return this.db.select().from(apiKeys).orderBy(apiKeys.createdAt);
@@ -125164,7 +125191,7 @@ import { fileURLToPath } from "url";
 // package.json
 var package_default = {
   name: "@automagik/omni",
-  version: "2.260718.4",
+  version: "2.260718.6",
   description: "LLM-optimized CLI for Omni",
   type: "module",
   bin: {

package/dist/server/index.js

@@ -227026,7 +227026,7 @@ var init_sentry_scrub = __esm(() => {
 var require_package7 = __commonJS((exports, module) => {
   module.exports = {
     name: "@omni/api",
-    version: "2.260718.4",
+    version: "2.260718.6",
     type: "module",
     exports: {
       ".": {
@@ -285713,6 +285713,38 @@ class ApiKeyService {
     if (options.name !== undefined && await this.isPrimaryKey(id)) {
       throw new Error("Cannot rename primary API key");
     }
+    const updates = this.buildUpdateValues(options);
+    const [updated] = await this.db.update(apiKeys).set(updates).where(eq(apiKeys.id, id)).returning();
+    if (updated) {
+      await apiKeyCache.delete(CacheKeys.apiKey(updated.keyHash));
+      log58.info("API key updated", { id, fields: Object.keys(options) });
+    }
+    return updated ?? null;
+  }
+  async updateWithAuthorityGuard(id, options, guard) {
+    const result = await this.db.transaction(async (tx) => {
+      const [current] = await tx.select().from(apiKeys).where(eq(apiKeys.id, id)).limit(1).for("update");
+      if (!current)
+        return { status: "not_found" };
+      if (options.name !== undefined && current.name === PRIMARY_KEY_NAME) {
+        throw new Error("Cannot rename primary API key");
+      }
+      const updates = this.buildUpdateValues(options);
+      const next = { ...current, ...updates };
+      if (!await guard(current, next))
+        return { status: "denied" };
+      const [updated] = await tx.update(apiKeys).set(updates).where(eq(apiKeys.id, id)).returning();
+      if (!updated)
+        return { status: "not_found" };
+      return { status: "updated", key: updated };
+    });
+    if (result.status === "updated") {
+      await apiKeyCache.delete(CacheKeys.apiKey(result.key.keyHash));
+      log58.info("API key updated", { id, fields: Object.keys(options) });
+    }
+    return result;
+  }
+  buildUpdateValues(options) {
     const updates = { updatedAt: new Date };
     if (options.name !== undefined)
       updates.name = options.name;
@@ -285735,12 +285767,7 @@ class ApiKeyService {
     if (options.contextInstanceId !== undefined || options.contextChatId !== undefined || options.contextMessageId !== undefined) {
       updates.contextUpdatedAt = new Date;
     }
-    const [updated] = await this.db.update(apiKeys).set(updates).where(eq(apiKeys.id, id)).returning();
-    if (updated) {
-      await apiKeyCache.delete(CacheKeys.apiKey(updated.keyHash));
-      log58.info("API key updated", { id, fields: Object.keys(options) });
-    }
-    return updated ?? null;
+    return updates;
   }
   async list() {
     return this.db.select().from(apiKeys).orderBy(apiKeys.createdAt);
@@ -357988,11 +358015,62 @@ function enforceScopeCeiling(c, requestedScopes) {
     }
   }, 403);
 }
-function enforceInstanceCeiling(c, requestedInstanceIds) {
-  const apiKey = c.get("apiKey");
-  if (apiKey?.instanceIds === null)
+function isStringArray(value) {
+  return Array.isArray(value) && value.every((item) => typeof item === "string");
+}
+function normalizeInstanceIds(values2) {
+  return new Set(values2.map((value) => value.toLowerCase()));
+}
+function intersectAuthorities(left, right) {
+  if (left === null)
+    return right;
+  if (right === null)
+    return left;
+  return new Set([...left].filter((instanceId) => right.has(instanceId)));
+}
+function deriveInstanceAuthorities(input) {
+  if (input.instanceIds !== null && !isStringArray(input.instanceIds))
+    return null;
+  if (input.instanceAllowlist !== undefined && !isStringArray(input.instanceAllowlist))
+    return null;
+  if (input.profile !== undefined && input.profile !== null && (typeof input.profile !== "string" || !KNOWN_API_KEY_PROFILES.has(input.profile))) {
     return null;
-  const exceedsCaller = !apiKey || !Array.isArray(apiKey.instanceIds) || requestedInstanceIds === null || requestedInstanceIds.some((instanceId) => !apiKey.instanceIds?.includes(instanceId));
+  }
+  const legacy = input.instanceIds === null ? null : normalizeInstanceIds(input.instanceIds);
+  const legacyEmptyInactive = input.instanceIds === null || input.instanceIds.length === 0 ? null : legacy;
+  const instanceAllowlist = input.instanceAllowlist ?? [];
+  const profileAware = isLockActive(input.profile, "instanceAllowlist", instanceAllowlist) ? normalizeInstanceIds(instanceAllowlist) : null;
+  return {
+    legacy,
+    legacyEmptyInactive,
+    effective: intersectAuthorities(legacy, profileAware),
+    profileAware
+  };
+}
+function isAuthoritySubset(requested, allowed) {
+  if (allowed === null)
+    return true;
+  if (requested === null)
+    return false;
+  return [...requested].every((instanceId) => allowed.has(instanceId));
+}
+function enforceInstanceCeiling(c, requestedAuthority) {
+  const apiKey = c.get("apiKey");
+  if (!apiKey) {
+    return c.json({
+      error: {
+        code: "FORBIDDEN",
+        message: "Cannot grant instance access that exceeds the caller's own."
+      }
+    }, 403);
+  }
+  const callerAuthorities = deriveInstanceAuthorities({
+    instanceIds: apiKey.instanceIds,
+    profile: apiKey.profile,
+    instanceAllowlist: apiKey.instanceAllowlist
+  });
+  const childAuthorities = deriveInstanceAuthorities(requestedAuthority);
+  const exceedsCaller = callerAuthorities === null || childAuthorities === null || !isAuthoritySubset(childAuthorities.legacy, callerAuthorities.legacy) || !isAuthoritySubset(childAuthorities.legacyEmptyInactive, callerAuthorities.legacyEmptyInactive) || !isAuthoritySubset(childAuthorities.profileAware, callerAuthorities.profileAware) || !isAuthoritySubset(childAuthorities.effective, callerAuthorities.effective);
   if (!exceedsCaller)
     return null;
   return c.json({
@@ -358016,7 +358094,11 @@ async function handleProfileCreate(c, data, services) {
     const ceilingDenied = enforceScopeCeiling(c, resolved.scopes);
     if (ceilingDenied)
       return ceilingDenied;
-    const instanceCeilingDenied = enforceInstanceCeiling(c, data.instanceIds ?? null);
+    const instanceCeilingDenied = enforceInstanceCeiling(c, {
+      instanceIds: data.instanceIds ?? null,
+      profile: resolved.profile,
+      instanceAllowlist: resolved.instanceAllowlist
+    });
     if (instanceCeilingDenied)
       return instanceCeilingDenied;
     const result = await services.apiKeys.create({
@@ -358054,7 +358136,11 @@ async function handleLegacyCreate(c, data, services) {
   const ceilingDenied = enforceScopeCeiling(c, data.scopes);
   if (ceilingDenied)
     return ceilingDenied;
-  const instanceCeilingDenied = enforceInstanceCeiling(c, data.instanceIds ?? null);
+  const instanceCeilingDenied = enforceInstanceCeiling(c, {
+    instanceIds: data.instanceIds ?? null,
+    profile: null,
+    instanceAllowlist: []
+  });
   if (instanceCeilingDenied)
     return instanceCeilingDenied;
   const result = await services.apiKeys.create({
@@ -358068,13 +358154,14 @@ async function handleLegacyCreate(c, data, services) {
   });
   return c.json({ data: { ...result.key, plainTextKey: result.plainTextKey } }, 201);
 }
-var keysRoutes, NON_ADMIN_PROFILES, profileOverridesSchema, createKeySchema, updateKeySchema, revokeKeySchema, listQuerySchema13, auditQuerySchema;
+var keysRoutes, NON_ADMIN_PROFILES, KNOWN_API_KEY_PROFILES, profileOverridesSchema, createKeySchema, updateKeySchema, revokeKeySchema, listQuerySchema13, auditQuerySchema;
 var init_keys = __esm(() => {
   init_dist6();
   init_dist2();
   init_zod();
   init_resolve_profile();
   init_signed_host_scope_context();
+  init_scope_enforcer();
   init_date_query();
   init_api_keys();
   keysRoutes = new Hono2;
@@ -358087,6 +358174,7 @@ var init_keys = __esm(() => {
     "console-operator",
     "console-admin"
   ];
+  KNOWN_API_KEY_PROFILES = new Set(["admin", ...NON_ADMIN_PROFILES]);
   profileOverridesSchema = exports_external.object({
     add: exports_external.array(exports_external.string()).optional(),
     remove: exports_external.array(exports_external.string()).optional(),
@@ -358179,21 +358267,33 @@ var init_keys = __esm(() => {
     const id = c.req.param("id");
     const data = c.req.valid("json");
     const services = c.get("services");
-    if (data.scopes) {
-      const ceilingDenied = enforceScopeCeiling(c, data.scopes);
-      if (ceilingDenied)
-        return ceilingDenied;
-    }
-    if (data.instanceIds !== undefined) {
-      const instanceCeilingDenied = enforceInstanceCeiling(c, data.instanceIds);
-      if (instanceCeilingDenied)
-        return instanceCeilingDenied;
-    }
+    const updateOptions = {
+      ...data,
+      expiresAt: data.expiresAt === null ? null : data.expiresAt ? new Date(data.expiresAt) : undefined
+    };
     try {
-      const updated = await services.apiKeys.update(id, {
-        ...data,
-        expiresAt: data.expiresAt === null ? null : data.expiresAt ? new Date(data.expiresAt) : undefined
-      });
+      if (data.instanceIds !== undefined || data.scopes !== undefined) {
+        let authorityDenied;
+        const result = await services.apiKeys.updateWithAuthorityGuard(id, updateOptions, (_current, next) => {
+          authorityDenied = enforceScopeCeiling(c, next.scopes);
+          if (authorityDenied)
+            return false;
+          authorityDenied = enforceInstanceCeiling(c, {
+            instanceIds: next.instanceIds,
+            profile: next.profile,
+            instanceAllowlist: next.instanceAllowlist
+          });
+          return authorityDenied == null;
+        });
+        if (result.status === "denied") {
+          return authorityDenied ?? c.json({ error: { code: "FORBIDDEN", message: "API key authority exceeds caller authority" } }, 403);
+        }
+        if (result.status === "not_found") {
+          return c.json({ error: { code: "NOT_FOUND", message: "API key not found" } }, 404);
+        }
+        return c.json({ data: result.key });
+      }
+      const updated = await services.apiKeys.update(id, updateOptions);
       if (!updated) {
         return c.json({ error: { code: "NOT_FOUND", message: "API key not found" } }, 404);
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@automagik/omni",
-  "version": "2.260718.4",
+  "version": "2.260718.6",
   "description": "LLM-optimized CLI for Omni",
   "type": "module",
   "bin": {