@boopkit/cap-users 0.6.0 → 0.8.0

package/scaffold/src/scripts/migrate-credentials.ts

@@ -0,0 +1,69 @@
+// @boopkit/cap-users template — Rehash cleartext credentials stored in property
+// tables (boop-j8xc credential-hashing epic).
+//
+// Some property payloads once stored a raw, redeemable bearer credential beside
+// its correctly-hashed twin: session tokens and API keys in the `authorization`
+// user-property (and, once cap-users ships it, invitation tokens in the
+// `team_invitations` account-property). The upgraded services store the hash and
+// read tolerantly, but existing rows keep the raw value until they are rewritten.
+// This script rehashes them IN PLACE, so no user is logged out and no pending
+// invitation is voided.
+//
+// Usage:
+//   npm run credentials:migrate            # REPORT ONLY — counts what would change, writes nothing
+//   npm run credentials:migrate -- --run   # apply the rehash
+//
+// ⚠️  ONE-WAY, NO ROLLBACK. Hashing is irreversible — once a row is rewritten the
+//     raw value is gone for good. TAKE A DATABASE BACKUP before running --run.
+//
+// Safe to re-run: idempotency is decided by value shape (a SHA-256 digest is left
+// untouched), so a value is never double-hashed. Provider access/refresh tokens
+// in the `authentication` property are never touched — they are replayed to
+// Google/Microsoft and must stay raw.
+
+import { migrateCredentialStore, authorizationStore, teamInvitationsStore, type CredentialStore, type MigrationDelegate } from '@boopkit/cap-users';
+import db from '../db';
+
+const run = process.argv.includes('--run');
+
+// The stores this deployment migrates — the same runner drives every one:
+//   - `authorization` user-property: raw session tokens and API keys (boop-j8xc.2)
+//   - `team_invitations` account-property: raw invitation tokens (boop-j8xc.3)
+const targets: { model: MigrationDelegate; store: CredentialStore }[] = [
+  { model: db.userProperty as unknown as MigrationDelegate, store: authorizationStore },
+  { model: db.accountProperty as unknown as MigrationDelegate, store: teamInvitationsStore },
+];
+
+async function main() {
+  if (!run) {
+    console.log('=== REPORT ONLY (no writes) — pass --run to apply ===\n');
+  } else {
+    console.log('=== APPLYING migration (--run) ===\n');
+  }
+
+  let totalPending = 0;
+  for (const { model, store } of targets) {
+    const report = await migrateCredentialStore(model, store, { run });
+    totalPending += report.needsMigration;
+    const action = run ? `rehashed ${report.migrated}` : `${report.needsMigration} would be rehashed`;
+    console.log(
+      `${store.label}: scanned ${report.scanned}, ${action} ` +
+        `(${report.scanned - report.needsMigration} already migrated)`,
+    );
+  }
+
+  if (!run && totalPending > 0) {
+    console.log(`\n${totalPending} row(s) hold a raw credential. Back up your database, then re-run with --run.`);
+  } else if (run) {
+    console.log('\nDone. All targeted rows are hashed and tagged.');
+  } else {
+    console.log('\nNothing to migrate — every targeted row is already hashed.');
+  }
+}
+
+main()
+  .catch((err) => {
+    console.error('Migration failed:', err);
+    process.exitCode = 1;
+  })
+  .finally(() => db.$disconnect());

package/scaffold/src/types/express.ts

@@ -60,8 +60,18 @@ declare global {
        * the session cookie via resolveVisitor. A gate that must accept only one
        * kind of credential (requireApiKey) reads this — req.user alone cannot
        * tell a key principal from a cookie one.
+       *
+       * `string`, not the `'api-key'` literal, because the label is chosen by
+       * whoever built the bearer middleware: `createBearerMiddleware` writes
+       * whatever `options.strategy` it was given, so a capability that issues
+       * its own tokens labels them its own way (oauth-server uses `'oauth'`).
+       * cap-users' own `resolveBearer` still writes `'api-key'`, and
+       * `requireApiKey` still compares against that literal — which is what
+       * makes another capability's token fail a key-only gate rather than pass
+       * it. Widening the label and widening the gate are NOT the same change;
+       * only the label widens.
        */
-      authStrategy?: 'api-key';
+      authStrategy?: string;
     }
   }
 }