@bajustone/fortress 1.0.0-rc.1

package/dist/plugins/api-key.d.cts

@@ -0,0 +1,121 @@
+import { f as PluginRouteContext, F as FortressPlugin } from '../config-GtlVt6ZD.cjs';
+import { a as SubjectType, S as Subject } from '../types-et0R8tsC.cjs';
+import '../index-CxEkfCA0.cjs';
+import '../jwt.cjs';
+import '../auth-service-BcyQ2PuZ.cjs';
+
+/**
+ * Pure key operations for the api-key plugin.
+ *
+ * Extracted so both the api-key plugin (self-service) and the admin plugin
+ * (admin-over-users) can share one implementation without cross-plugin
+ * runtime coupling. Functions take a {@link DatabaseAdapter} plus args and
+ * throw {@link FortressError} via the existing `Errors` factory on failure.
+ *
+ * Keys are owned by a {@link Subject} — either a USER or a SERVICE_ACCOUNT
+ * (and extensible to future subject types). The storage schema uses a
+ * polymorphic `(subject_type, subject_id)` pair instead of a hard FK to
+ * `users.id`, mirroring `role_binding` / `direct_permission_binding`.
+ *
+ * @module
+ */
+
+interface ApiKeyInfo {
+    id: string;
+    name: string;
+    keyPrefix: string;
+    scopes: string[] | null;
+    expiresAt: Date | null;
+    lastUsedAt: Date | null;
+    createdAt: Date;
+}
+interface ApiKeyRecord {
+    id: string;
+    subjectType: SubjectType;
+    subjectId: string;
+    name: string;
+    keyHash: string;
+    keyPrefix: string;
+    scopes: string | null;
+    expiresAt: Date | null;
+    lastUsedAt: Date | null;
+    isRevoked: boolean;
+    createdAt: Date;
+}
+
+/**
+ * API key plugin for fortress.
+ *
+ * Issues scoped, hashed API keys for users and service accounts, with
+ * optional expiry, revocation, and per-key permission scopes. Authenticates
+ * incoming requests via `Authorization: ApiKey <key>` or `X-API-Key: <key>`
+ * headers and exposes management methods on the fortress instance.
+ *
+ * HTTP endpoints are opt-in: pass `apiKey({ routes: true })` to mount the
+ * self-service routes under `/api-key/keys/*`. The programmatic methods on
+ * `fortress.plugins['api-key']` are always available regardless of the flag.
+ *
+ * Keys are owned by a {@link Subject} — either a USER or a SERVICE_ACCOUNT.
+ * When a service account is deleted via core IAM, this plugin's IAM
+ * observer hard-deletes every key it owns.
+ *
+ * @module
+ */
+
+interface ApiKeyConfig {
+    /** Prefix for generated keys (default: 'fortress') */
+    prefix?: string;
+    /** Default expiry in seconds. null = never expires (default: null) */
+    defaultExpirySeconds?: number | null;
+    /** Maximum active (non-revoked) keys per subject (default: 10) */
+    maxKeysPerSubject?: number;
+    /**
+     * Mount self-service HTTP routes under `/api-key/keys/*`. Default `false`.
+     * The programmatic methods on `fortress.plugins['api-key']` are always
+     * available; this flag only controls HTTP mounting.
+     */
+    routes?: boolean;
+}
+interface ApiKeyMethods {
+    createKey: (input: {
+        subject?: Subject;
+        name: string;
+        scopes?: string[];
+        expiresAt?: Date | string;
+    }, routeCtx?: PluginRouteContext) => Promise<{
+        key: string;
+        id: string;
+    }>;
+    listKeys: (input: {
+        subject?: Subject;
+    }, routeCtx?: PluginRouteContext) => Promise<ApiKeyInfo[]>;
+    revokeKey: (input: {
+        subject?: Subject;
+        id: string;
+    }, routeCtx?: PluginRouteContext) => Promise<{
+        ok: true;
+    }>;
+    rotateKey: (input: {
+        subject?: Subject;
+        id: string;
+    }, routeCtx?: PluginRouteContext) => Promise<{
+        key: string;
+        id: string;
+    }>;
+    resolveKey: (rawKey: string) => Promise<{
+        subject: Subject;
+        scopes: string[] | null;
+    } | null>;
+}
+/**
+ * API key plugin factory. Returns a {@link FortressPlugin} that issues
+ * scoped, hashed API keys, resolves them into request principals via the
+ * `Authorization: ApiKey`/`X-API-Key` headers, and exposes management
+ * methods on the fortress instance. Pass `{ routes: true }` to mount the
+ * self-service HTTP routes under `/api-key/keys/*`.
+ */
+declare function apiKey(config?: ApiKeyConfig): FortressPlugin & {
+    readonly name: 'api-key';
+};
+
+export { type ApiKeyConfig, type ApiKeyInfo, type ApiKeyMethods, type ApiKeyRecord, apiKey };

package/dist/plugins/api-key.d.ts

@@ -0,0 +1,121 @@
+import { f as PluginRouteContext, F as FortressPlugin } from '../config-B2366s_G.js';
+import { a as SubjectType, S as Subject } from '../types-et0R8tsC.js';
+import '../index-CxEkfCA0.js';
+import '../jwt.js';
+import '../auth-service-BkzZkWfH.js';
+
+/**
+ * Pure key operations for the api-key plugin.
+ *
+ * Extracted so both the api-key plugin (self-service) and the admin plugin
+ * (admin-over-users) can share one implementation without cross-plugin
+ * runtime coupling. Functions take a {@link DatabaseAdapter} plus args and
+ * throw {@link FortressError} via the existing `Errors` factory on failure.
+ *
+ * Keys are owned by a {@link Subject} — either a USER or a SERVICE_ACCOUNT
+ * (and extensible to future subject types). The storage schema uses a
+ * polymorphic `(subject_type, subject_id)` pair instead of a hard FK to
+ * `users.id`, mirroring `role_binding` / `direct_permission_binding`.
+ *
+ * @module
+ */
+
+interface ApiKeyInfo {
+    id: string;
+    name: string;
+    keyPrefix: string;
+    scopes: string[] | null;
+    expiresAt: Date | null;
+    lastUsedAt: Date | null;
+    createdAt: Date;
+}
+interface ApiKeyRecord {
+    id: string;
+    subjectType: SubjectType;
+    subjectId: string;
+    name: string;
+    keyHash: string;
+    keyPrefix: string;
+    scopes: string | null;
+    expiresAt: Date | null;
+    lastUsedAt: Date | null;
+    isRevoked: boolean;
+    createdAt: Date;
+}
+
+/**
+ * API key plugin for fortress.
+ *
+ * Issues scoped, hashed API keys for users and service accounts, with
+ * optional expiry, revocation, and per-key permission scopes. Authenticates
+ * incoming requests via `Authorization: ApiKey <key>` or `X-API-Key: <key>`
+ * headers and exposes management methods on the fortress instance.
+ *
+ * HTTP endpoints are opt-in: pass `apiKey({ routes: true })` to mount the
+ * self-service routes under `/api-key/keys/*`. The programmatic methods on
+ * `fortress.plugins['api-key']` are always available regardless of the flag.
+ *
+ * Keys are owned by a {@link Subject} — either a USER or a SERVICE_ACCOUNT.
+ * When a service account is deleted via core IAM, this plugin's IAM
+ * observer hard-deletes every key it owns.
+ *
+ * @module
+ */
+
+interface ApiKeyConfig {
+    /** Prefix for generated keys (default: 'fortress') */
+    prefix?: string;
+    /** Default expiry in seconds. null = never expires (default: null) */
+    defaultExpirySeconds?: number | null;
+    /** Maximum active (non-revoked) keys per subject (default: 10) */
+    maxKeysPerSubject?: number;
+    /**
+     * Mount self-service HTTP routes under `/api-key/keys/*`. Default `false`.
+     * The programmatic methods on `fortress.plugins['api-key']` are always
+     * available; this flag only controls HTTP mounting.
+     */
+    routes?: boolean;
+}
+interface ApiKeyMethods {
+    createKey: (input: {
+        subject?: Subject;
+        name: string;
+        scopes?: string[];
+        expiresAt?: Date | string;
+    }, routeCtx?: PluginRouteContext) => Promise<{
+        key: string;
+        id: string;
+    }>;
+    listKeys: (input: {
+        subject?: Subject;
+    }, routeCtx?: PluginRouteContext) => Promise<ApiKeyInfo[]>;
+    revokeKey: (input: {
+        subject?: Subject;
+        id: string;
+    }, routeCtx?: PluginRouteContext) => Promise<{
+        ok: true;
+    }>;
+    rotateKey: (input: {
+        subject?: Subject;
+        id: string;
+    }, routeCtx?: PluginRouteContext) => Promise<{
+        key: string;
+        id: string;
+    }>;
+    resolveKey: (rawKey: string) => Promise<{
+        subject: Subject;
+        scopes: string[] | null;
+    } | null>;
+}
+/**
+ * API key plugin factory. Returns a {@link FortressPlugin} that issues
+ * scoped, hashed API keys, resolves them into request principals via the
+ * `Authorization: ApiKey`/`X-API-Key` headers, and exposes management
+ * methods on the fortress instance. Pass `{ routes: true }` to mount the
+ * self-service HTTP routes under `/api-key/keys/*`.
+ */
+declare function apiKey(config?: ApiKeyConfig): FortressPlugin & {
+    readonly name: 'api-key';
+};
+
+export { type ApiKeyConfig, type ApiKeyInfo, type ApiKeyMethods, type ApiKeyRecord, apiKey };