@better-auth/api-key 1.7.0-beta.1 → 1.7.0-beta.3

package/dist/client.mjs

@@ -1,4 +1,4 @@
-import { n as API_KEY_ERROR_CODES, t as PACKAGE_VERSION } from "./version-Cgx_4P2P.mjs";
+import { n as API_KEY_ERROR_CODES, t as PACKAGE_VERSION } from "./version-CmDM8fr2.mjs";
 //#region src/client.ts
 const apiKeyClient = () => {
 	return {

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { n as API_KEY_ERROR_CODES, t as PACKAGE_VERSION } from "./version-Cgx_4P2P.mjs";
+import { n as API_KEY_ERROR_CODES, t as PACKAGE_VERSION } from "./version-CmDM8fr2.mjs";
 import { createAuthEndpoint, createAuthMiddleware } from "@better-auth/core/api";
 import { base64Url } from "@better-auth/utils/base64";
 import { createHash } from "@better-auth/utils/hash";
@@ -10,11 +10,13 @@ import { APIError as APIError$1 } from "@better-auth/core/error";
 import { generateId } from "@better-auth/core/utils/id";
 import { safeJSONParse } from "@better-auth/core/utils/json";
 import * as z from "zod";
+import { mapConcurrent } from "@better-auth/core/utils/async";
 import { isDevelopment, isTest } from "@better-auth/core/env";
 import { isValidIP, normalizeIP } from "@better-auth/core/utils/ip";
 import { role } from "better-auth/plugins/access";
 import { parseJSON } from "better-auth/client";
 //#region src/adapter.ts
+const STORAGE_CONCURRENCY = 10;
 /**
 * Parses double-stringified metadata synchronously without updating the database.
 * Use this for reading metadata, then call migrateLegacyMetadataInBackground for DB updates.
@@ -165,15 +167,10 @@ async function getApiKeyByIdFromStorage(ctx, id, storage) {
 	return deserializeApiKey(await storage.get(key));
 }
 /**
-* Store API key in secondary storage
+* Read-modify-write the ref list:
+* used only when the list is the source of truth.
 */
-async function setApiKeyInStorage(ctx, apiKey, storage, ttl) {
-	const serialized = serializeApiKey(apiKey);
-	const hashedKey = apiKey.key;
-	const id = apiKey.id;
-	await storage.set(getStorageKeyByHashedKey(hashedKey), serialized, ttl);
-	await storage.set(getStorageKeyById(id), serialized, ttl);
-	const refKey = getStorageKeyByReferenceId(apiKey.referenceId);
+async function modifyRefList(storage, refKey, modify) {
 	const refListData = await storage.get(refKey);
 	let keyIds = [];
 	if (refListData && typeof refListData === "string") try {
@@ -182,32 +179,42 @@ async function setApiKeyInStorage(ctx, apiKey, storage, ttl) {
 		keyIds = [];
 	}
 	else if (Array.isArray(refListData)) keyIds = refListData;
-	if (!keyIds.includes(id)) {
-		keyIds.push(id);
-		await storage.set(refKey, JSON.stringify(keyIds));
+	const next = modify(keyIds);
+	if (next.length === 0) await storage.delete(refKey);
+	else await storage.set(refKey, JSON.stringify(next));
+}
+async function setApiKeyInStorage(_ctx, apiKey, storage, ttl, opts) {
+	const serialized = serializeApiKey(apiKey);
+	const refKey = getStorageKeyByReferenceId(apiKey.referenceId);
+	if (opts.fallbackToDatabase) {
+		await Promise.all([
+			storage.set(getStorageKeyByHashedKey(apiKey.key), serialized, ttl),
+			storage.set(getStorageKeyById(apiKey.id), serialized, ttl),
+			storage.delete(refKey)
+		]);
+		return;
 	}
+	await Promise.all([storage.set(getStorageKeyByHashedKey(apiKey.key), serialized, ttl), storage.set(getStorageKeyById(apiKey.id), serialized, ttl)]);
+	await modifyRefList(storage, refKey, (ids) => ids.includes(apiKey.id) ? ids : [...ids, apiKey.id]);
 }
 /**
 * Delete API key from secondary storage
 */
-async function deleteApiKeyFromStorage(ctx, apiKey, storage) {
-	const hashedKey = apiKey.key;
-	const id = apiKey.id;
-	const referenceId = apiKey.referenceId;
-	await storage.delete(getStorageKeyByHashedKey(hashedKey));
-	await storage.delete(getStorageKeyById(id));
-	const refKey = getStorageKeyByReferenceId(referenceId);
-	const refListData = await storage.get(refKey);
-	let keyIds = [];
-	if (refListData && typeof refListData === "string") try {
-		keyIds = JSON.parse(refListData);
-	} catch {
-		keyIds = [];
+async function deleteApiKeyFromStorage(ctx, apiKey, storage, opts) {
+	const refKey = getStorageKeyByReferenceId(apiKey.referenceId);
+	if (opts.fallbackToDatabase) {
+		await Promise.all([
+			storage.delete(getStorageKeyByHashedKey(apiKey.key)),
+			storage.delete(getStorageKeyById(apiKey.id)),
+			storage.delete(refKey)
+		]);
+		return;
 	}
-	else if (Array.isArray(refListData)) keyIds = refListData;
-	const filteredIds = keyIds.filter((keyId) => keyId !== id);
-	if (filteredIds.length === 0) await storage.delete(refKey);
-	else await storage.set(refKey, JSON.stringify(filteredIds));
+	await Promise.all([
+		storage.delete(getStorageKeyByHashedKey(apiKey.key)),
+		storage.delete(getStorageKeyById(apiKey.id)),
+		modifyRefList(storage, refKey, (ids) => ids.filter((keyId) => keyId !== apiKey.id))
+	]);
 }
 /**
 * Unified getter for API keys with support for all storage modes
@@ -233,7 +240,7 @@ async function getApiKey$1(ctx, hashedKey, opts) {
 				value: hashedKey
 			}]
 		});
-		if (dbKey && storage) await setApiKeyInStorage(ctx, dbKey, storage, calculateTTL(dbKey));
+		if (dbKey && storage) await setApiKeyInStorage(ctx, dbKey, storage, calculateTTL(dbKey), opts);
 		return dbKey;
 	}
 	if (opts.storage === "secondary-storage") {
@@ -272,7 +279,7 @@ async function getApiKeyById(ctx, id, opts) {
 				value: id
 			}]
 		});
-		if (dbKey && storage) await setApiKeyInStorage(ctx, dbKey, storage, calculateTTL(dbKey));
+		if (dbKey && storage) await setApiKeyInStorage(ctx, dbKey, storage, calculateTTL(dbKey), opts);
 		return dbKey;
 	}
 	if (opts.storage === "secondary-storage") {
@@ -296,7 +303,7 @@ async function setApiKey(ctx, apiKey, opts) {
 	if (opts.storage === "database") return;
 	if (opts.storage === "secondary-storage") {
 		if (!storage) throw new Error("Secondary storage is required when storage mode is 'secondary-storage'");
-		await setApiKeyInStorage(ctx, apiKey, storage, ttl);
+		await setApiKeyInStorage(ctx, apiKey, storage, ttl, opts);
 		return;
 	}
 }
@@ -308,7 +315,7 @@ async function deleteApiKey$1(ctx, apiKey, opts) {
 	if (opts.storage === "database") return;
 	if (opts.storage === "secondary-storage") {
 		if (!storage) throw new Error("Secondary storage is required when storage mode is 'secondary-storage'");
-		await deleteApiKeyFromStorage(ctx, apiKey, storage);
+		await deleteApiKeyFromStorage(ctx, apiKey, storage, opts);
 		return;
 	}
 }
@@ -378,11 +385,7 @@ async function listApiKeys$1(ctx, referenceId, opts, paginationOpts) {
 			}
 			else if (Array.isArray(refListData)) keyIds = refListData;
 			if (keyIds.length > 0) {
-				const apiKeys = [];
-				for (const id of keyIds) {
-					const apiKey = await getApiKeyByIdFromStorage(ctx, id, storage);
-					if (apiKey) apiKeys.push(apiKey);
-				}
+				const apiKeys = (await mapConcurrent(keyIds, (id) => getApiKeyByIdFromStorage(ctx, id, storage), { concurrency: STORAGE_CONCURRENCY })).filter((key) => key !== null && key !== void 0);
 				return {
 					apiKeys: applySortingAndPagination(apiKeys, sortBy, sortDirection, limit, offset),
 					total: apiKeys.length
@@ -409,11 +412,8 @@ async function listApiKeys$1(ctx, referenceId, opts, paginationOpts) {
 			}]
 		})]);
 		if (storage && dbKeys.length > 0) {
-			const keyIds = [];
-			for (const apiKey of dbKeys) {
-				await setApiKeyInStorage(ctx, apiKey, storage, calculateTTL(apiKey));
-				keyIds.push(apiKey.id);
-			}
+			await mapConcurrent(dbKeys, (apiKey) => setApiKeyInStorage(ctx, apiKey, storage, calculateTTL(apiKey), opts), { concurrency: STORAGE_CONCURRENCY });
+			const keyIds = dbKeys.map((apiKey) => apiKey.id);
 			await storage.set(refKey, JSON.stringify(keyIds));
 		}
 		return {
@@ -442,11 +442,7 @@ async function listApiKeys$1(ctx, referenceId, opts, paginationOpts) {
 			apiKeys: [],
 			total: 0
 		};
-		const apiKeys = [];
-		for (const id of keyIds) {
-			const apiKey = await getApiKeyByIdFromStorage(ctx, id, storage);
-			if (apiKey) apiKeys.push(apiKey);
-		}
+		const apiKeys = (await mapConcurrent(keyIds, (id) => getApiKeyByIdFromStorage(ctx, id, storage), { concurrency: STORAGE_CONCURRENCY })).filter((key) => key !== null && key !== void 0);
 		return {
 			apiKeys: applySortingAndPagination(apiKeys, sortBy, sortDirection, limit, offset),
 			total: apiKeys.length
@@ -1285,18 +1281,16 @@ function listApiKeys({ configurations, schema, deleteAllExpiredApiKeys }) {
 				const storageKey = getStorageIdentifier(config);
 				if (!storageGroups.has(storageKey)) storageGroups.set(storageKey, config);
 			}
+			const groupResults = await Promise.all([...storageGroups.values()].map((opts) => listApiKeys$1(ctx, referenceId, opts, {
+				limit: void 0,
+				offset: void 0,
+				sortBy: ctx.query?.sortBy,
+				sortDirection: ctx.query?.sortDirection
+			})));
 			const seenIds = /* @__PURE__ */ new Set();
-			for (const opts of storageGroups.values()) {
-				const { apiKeys } = await listApiKeys$1(ctx, referenceId, opts, {
-					limit: void 0,
-					offset: void 0,
-					sortBy: ctx.query?.sortBy,
-					sortDirection: ctx.query?.sortDirection
-				});
-				for (const key of apiKeys) if (!seenIds.has(key.id)) {
-					seenIds.add(key.id);
-					allApiKeys.push(key);
-				}
+			for (const { apiKeys } of groupResults) for (const key of apiKeys) if (!seenIds.has(key.id)) {
+				seenIds.add(key.id);
+				allApiKeys.push(key);
 			}
 		}
 		let filteredApiKeys = allApiKeys.filter((key) => {
@@ -1641,6 +1635,7 @@ function isRateLimited(apiKey, opts) {
 async function validateApiKey({ hashedKey, ctx, opts, schema, permissions }) {
 	const apiKey = await getApiKey$1(ctx, hashedKey, opts);
 	if (!apiKey) throw APIError$1.from("UNAUTHORIZED", API_KEY_ERROR_CODES.INVALID_API_KEY);
+	if (apiKey.configId !== (opts.configId ?? "default")) throw APIError$1.from("UNAUTHORIZED", API_KEY_ERROR_CODES.INVALID_API_KEY);
 	if (apiKey.enabled === false) throw APIError$1.from("UNAUTHORIZED", API_KEY_ERROR_CODES.KEY_DISABLED);
 	if (apiKey.expiresAt) {
 		if (Date.now() > new Date(apiKey.expiresAt).getTime()) {

package/dist/{version-Cgx_4P2P.mjs → version-CmDM8fr2.mjs}

@@ -35,6 +35,6 @@ const API_KEY_ERROR_CODES = defineErrorCodes({
 });
 //#endregion
 //#region src/version.ts
-const PACKAGE_VERSION = "1.7.0-beta.1";
+const PACKAGE_VERSION = "1.7.0-beta.3";
 //#endregion
 export { API_KEY_ERROR_CODES as n, PACKAGE_VERSION as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/api-key",
-  "version": "1.7.0-beta.1",
+  "version": "1.7.0-beta.3",
   "description": "API Key plugin for Better Auth.",
   "type": "module",
   "license": "MIT",
@@ -61,13 +61,13 @@
   },
   "devDependencies": {
     "tsdown": "0.21.1",
-    "@better-auth/core": "1.7.0-beta.1",
-    "better-auth": "1.7.0-beta.1"
+    "@better-auth/core": "1.7.0-beta.3",
+    "better-auth": "1.7.0-beta.3"
   },
   "peerDependencies": {
     "@better-auth/utils": "0.4.0",
-    "@better-auth/core": "^1.7.0-beta.1",
-    "better-auth": "^1.7.0-beta.1"
+    "@better-auth/core": "^1.7.0-beta.3",
+    "better-auth": "^1.7.0-beta.3"
   },
   "scripts": {
     "build": "tsdown",