@camstack/system 1.2.465 → 1.2.466

package/dist/builtins/local-auth/local-auth.addon.js

@@ -3,11 +3,11 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Dwi4JA96.js");
-const require_read_all_rows$1 = require("../../read-all-rows-CVoO1ONM.js");
+const require_dist = require("../../dist-QyW9hVO2.js");
 const require_safe_buffer$1 = require("../../safe-buffer-D3aoa-7X.js");
 const require_ms$1 = require("../../ms-LB3giGoU.js");
-const require_device_ca = require("../../device-ca-B-Txwl4W.js");
+const require_device_ca = require("../../device-ca-DpvQ5wrb.js");
+const require_read_all_rows$1 = require("../../read-all-rows-CVoO1ONM.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
@@ -17,87 +17,6 @@ let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);
-//#region src/auth/parse-record.ts
-function parseRecord$2(kind, schema, data) {
-	try {
-		return schema.parse(data);
-	} catch (err) {
-		const topKeys = data && typeof data === "object" && !Array.isArray(data) ? Object.keys(data).join(", ") || "(empty)" : `(non-object: ${typeof data})`;
-		const detail = err instanceof Error ? err.message : String(err);
-		const hint = data && typeof data === "object" && !Array.isArray(data) && Object.keys(data).length === 1 && "data" in data ? " This shape is the legacy double-wrap from a stale settings-store query path. Restart the server with the latest @camstack/system build." : "";
-		throw new Error(`Failed to parse ${kind} from settings store. Top-level keys=[${topKeys}].${hint} Underlying: ${detail}`, { cause: err });
-	}
-}
-//#endregion
-//#region src/auth/api-key-manager.ts
-/**
-* Legacy API keys — LIST and REVOKE only.
-*
-* No boundary accepts one (the tRPC context has no branch for them) and
-* nothing creates them any more: what is left is the rows a hub may still
-* hold, so an operator can see and delete them. Tokens (`auth.mintToken`) are
-* the credential for scripts and integrations.
-*/
-var import_read_all_rows = require_read_all_rows$1.require_read_all_rows();
-var API_KEYS_COLLECTION$1 = "api_keys";
-function parseApiKey(data) {
-	return parseRecord$2("api-key", require_dist.ApiKeyRecordSchema, data);
-}
-function rowToApiKey(id, body) {
-	return parseApiKey({
-		id,
-		...body
-	});
-}
-var ApiKeyManager = class {
-	kind;
-	legacyStore;
-	constructor(deps) {
-		if ("apiKeysKind" in deps) {
-			this.kind = deps.apiKeysKind;
-			this.legacyStore = deps.legacyStore ?? null;
-		} else {
-			this.kind = null;
-			this.legacyStore = deps.getStore();
-		}
-	}
-	get store() {
-		if (this.legacyStore === null) throw new Error("ApiKeyManager: legacy store unavailable on records-only path");
-		return this.legacyStore;
-	}
-	async listAll() {
-		const kind = this.kind;
-		return (kind !== null ? (await (0, import_read_all_rows.readAllRows)(kind)).map((row) => rowToApiKey(row.id, row.data)) : (await this.store.query.query({ collection: API_KEYS_COLLECTION$1 })).map((r) => parseApiKey(r.data))).map((parsed) => {
-			const { tokenHash: _th, ...rest } = parsed;
-			return rest;
-		});
-	}
-	async revoke(id) {
-		const kind = this.kind;
-		if (kind !== null) {
-			await kind.delete(id);
-			return;
-		}
-		await this.store.delete.mutate({
-			collection: API_KEYS_COLLECTION$1,
-			key: id
-		});
-	}
-	async findById(id) {
-		const kind = this.kind;
-		if (kind !== null) {
-			const row = await kind.get(id);
-			return row === null ? null : rowToApiKey(row.id, row.data);
-		}
-		const results = await this.store.query.query({
-			collection: API_KEYS_COLLECTION$1,
-			filter: { where: { id } }
-		});
-		if (results.length === 0) return null;
-		return parseApiKey(results[0].data);
-	}
-};
-//#endregion
 //#region ../../node_modules/bcryptjs/index.js
 /**
 * The random implementation to use as a fallback.
@@ -6345,6 +6264,7 @@ var AuthManager = class {
 * cannot be stored is logged loudly instead, and never blocks the action
 * (a login must not fail because the audit table is busy).
 */
+var import_read_all_rows = require_read_all_rows$1.require_read_all_rows();
 /**
 * @durable class=ledger owner=local-auth
 *   write="one row per audited auth event: a second factor skipped from a trusted
@@ -6399,7 +6319,7 @@ var AUTH_AUDIT_ACTIONS = [
 ];
 var RETENTION_MS = 90 * 864e5;
 var MAX_LIST = 500;
-function parseRecord$1(data) {
+function parseRecord$2(data) {
 	const id = data["id"];
 	const rawAt = data["at"];
 	const at = typeof rawAt === "number" ? rawAt : typeof rawAt === "string" && rawAt.trim() !== "" && Number.isFinite(Number(rawAt)) ? Number(rawAt) : null;
@@ -6492,7 +6412,7 @@ var AuthAuditLog = class {
 			order: "at",
 			desc: true,
 			limit
-		})).records.map((row) => parseRecord$1({
+		})).records.map((row) => parseRecord$2({
 			id: row.id,
 			at: row.at,
 			action: row.data.action,
@@ -6503,7 +6423,7 @@ var AuthAuditLog = class {
 		return (await this.store.query.query({
 			collection: AUTH_AUDIT_COLLECTION,
 			...input.userId !== void 0 ? { filter: { where: { userId: input.userId } } } : {}
-		})).map((row) => parseRecord$1(row.data)).filter((r) => r !== null).toSorted((a, b) => b.at - a.at).slice(0, limit);
+		})).map((row) => parseRecord$2(row.data)).filter((r) => r !== null).toSorted((a, b) => b.at - a.at).slice(0, limit);
 	}
 	/** Delete rows older than 90 days. Returns how many. */
 	async reap() {
@@ -6719,7 +6639,7 @@ var PLATFORMS = [
 	"web",
 	"other"
 ];
-function parseRecord(data) {
+function parseRecord$1(data) {
 	const id = str$1(data, "id");
 	const userId = str$1(data, "userId");
 	const deviceName = str$1(data, "deviceName");
@@ -6784,7 +6704,7 @@ var DeviceCredentialManager = class {
 		const kind = this.deps.deviceCredentialsKind ?? null;
 		if (kind !== null) {
 			for (const row of await (0, import_read_all_rows.readAllRows)(kind)) {
-				const record = parseRecord({
+				const record = parseRecord$1({
 					id: row.id,
 					...row.data
 				});
@@ -6794,7 +6714,7 @@ var DeviceCredentialManager = class {
 		}
 		const rows = await this.store.query.query({ collection: DEVICE_CREDENTIALS_COLLECTION });
 		for (const row of rows) {
-			const record = parseRecord(row.data);
+			const record = parseRecord$1(row.data);
 			if (record !== null) this.records.set(record.id, record);
 		}
 	}
@@ -7215,7 +7135,6 @@ var USERS_COLLECTION$1 = "users";
 *     expiry column and no sweep, so a key lives until someone removes it (or the
 *     destructive `declareCollection` rebuild takes the table)."
 */
-var API_KEYS_COLLECTION = "api_keys";
 /**
 * @durable class=config owner=local-auth
 *   write="none since D895 — the pre-D892 scoped-token rows are kept on disk,
@@ -7304,52 +7223,6 @@ var USERS_COLUMNS = [
 		notNull: true
 	}
 ];
-var API_KEYS_COLUMNS = [
-	{
-		name: "id",
-		type: "TEXT",
-		primaryKey: true,
-		notNull: true
-	},
-	{
-		name: "label",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "isAdmin",
-		type: "BOOLEAN",
-		notNull: true
-	},
-	{
-		name: "tokenHash",
-		type: "TEXT",
-		notNull: true,
-		unique: true
-	},
-	{
-		name: "tokenPrefix",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "allowedProviders",
-		type: "JSON"
-	},
-	{
-		name: "allowedDevices",
-		type: "JSON"
-	},
-	{
-		name: "createdAt",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "lastUsedAt",
-		type: "INTEGER"
-	}
-];
 var USER_TOTP_COLUMNS = [
 	{
 		name: "userId",
@@ -7467,14 +7340,6 @@ async function declareAuthSchema(store, options) {
 		collection: USERS_COLLECTION$1,
 		columns: USERS_COLUMNS
 	});
-	if (!skip.has("api_keys")) await store.declareCollection.mutate({
-		collection: API_KEYS_COLLECTION,
-		columns: API_KEYS_COLUMNS,
-		indexes: [{
-			name: "idx_api_keys_token_prefix",
-			columns: ["tokenPrefix"]
-		}]
-	});
 	if (!skip.has("scoped_tokens")) await store.declareCollection.mutate({
 		collection: SCOPED_TOKENS_COLLECTION,
 		columns: SCOPED_TOKENS_COLUMNS,
@@ -7548,7 +7413,6 @@ async function declareAuthSchema(store, options) {
 */
 var DAY_MS = 864e5;
 var UserBodySchema = require_dist.UserRecordSchema.omit({ id: true });
-var ApiKeyBodySchema = require_dist.ApiKeyRecordSchema.omit({ id: true });
 var ScopedTokenBodySchema = require_dist.ScopedTokenSchema.omit({ id: true });
 var AdminTokenBodySchema = zod.z.object({
 	createdBy: zod.z.string(),
@@ -7636,18 +7500,6 @@ var _localAuthRecordKinds = require_dist.defineRecordKinds({
 		}],
 		retention: { none: "row goes only when an operator deletes the user; destructive declareCollection rebuild wipes all accounts" }
 	},
-	"api-keys": {
-		schema: ApiKeyBodySchema,
-		class: "config",
-		writeTrigger: "legacy list/revoke only — nothing creates new API keys",
-		device: "none",
-		at: "none",
-		indexes: [{
-			name: "prefix",
-			fields: ["tokenPrefix"]
-		}],
-		retention: { none: "explicit revoke only" }
-	},
 	"scoped-tokens": {
 		schema: ScopedTokenBodySchema,
 		class: "config",
@@ -7784,7 +7636,6 @@ var _localAuthRecordKinds = require_dist.defineRecordKinds({
 });
 var localAuthRecordKinds = _localAuthRecordKinds;
 var localAuthUsersRecordKind = _localAuthRecordKinds.users;
-var localAuthApiKeysRecordKind = _localAuthRecordKinds["api-keys"];
 _localAuthRecordKinds["scoped-tokens"];
 _localAuthRecordKinds["admin-tokens"];
 var localAuthLoginSessionsRecordKind = _localAuthRecordKinds["login-sessions"];
@@ -7797,7 +7648,6 @@ var localAuthAuthAuditRecordKind = _localAuthRecordKinds["auth-audit"];
 /** Legacy collections that must not be `declareCollection` once these kinds are live. */
 var LOCAL_AUTH_RECORDS_LEGACY_COLLECTIONS = [
 	USERS_COLLECTION$1,
-	API_KEYS_COLLECTION,
 	SCOPED_TOKENS_COLLECTION,
 	ADMIN_TOKENS_COLLECTION,
 	LOGIN_SESSIONS_COLLECTION,
@@ -7810,7 +7660,6 @@ var LOCAL_AUTH_RECORDS_LEGACY_COLLECTIONS = [
 function localAuthRecordStoresOf(records) {
 	return {
 		users: records.kind(localAuthUsersRecordKind),
-		apiKeys: records.kind(localAuthApiKeysRecordKind),
 		loginSessions: records.kind(localAuthLoginSessionsRecordKind),
 		loginSessionCutoffs: records.kind(localAuthLoginSessionCutoffsRecordKind),
 		oauthSessions: records.kind(localAuthOauthSessionsRecordKind),
@@ -8731,6 +8580,18 @@ function getUserManagementInternal(provider) {
 	return internal;
 }
 //#endregion
+//#region src/auth/parse-record.ts
+function parseRecord(kind, schema, data) {
+	try {
+		return schema.parse(data);
+	} catch (err) {
+		const topKeys = data && typeof data === "object" && !Array.isArray(data) ? Object.keys(data).join(", ") || "(empty)" : `(non-object: ${typeof data})`;
+		const detail = err instanceof Error ? err.message : String(err);
+		const hint = data && typeof data === "object" && !Array.isArray(data) && Object.keys(data).length === 1 && "data" in data ? " This shape is the legacy double-wrap from a stale settings-store query path. Restart the server with the latest @camstack/system build." : "";
+		throw new Error(`Failed to parse ${kind} from settings store. Top-level keys=[${topKeys}].${hint} Underlying: ${detail}`, { cause: err });
+	}
+}
+//#endregion
 //#region src/auth/user-manager.ts
 var USERS_COLLECTION = "users";
 /**
@@ -8742,7 +8603,7 @@ var USERS_COLLECTION = "users";
 var FIRST_BOOT_ADMIN_USERNAME = "admin";
 var FIRST_BOOT_ADMIN_PASSWORD = "changeme";
 function parseUser(data) {
-	return parseRecord$2("user", require_dist.UserRecordSchema, data);
+	return parseRecord("user", require_dist.UserRecordSchema, data);
 }
 function userToBody(user) {
 	const { id: _id, ...body } = user;
@@ -12132,7 +11993,6 @@ function toAuthResult(user) {
 var LocalAuthAddon = class extends require_dist.BaseAddon {
 	authManager = null;
 	userManager = null;
-	apiKeyManager = null;
 	oauthSessionManager = null;
 	reapTimer = null;
 	totpManager = null;
@@ -12168,10 +12028,6 @@ var LocalAuthAddon = class extends require_dist.BaseAddon {
 				usersKind: authStores.users,
 				legacyStore: store
 			}, this.authManager);
-			this.apiKeyManager = new ApiKeyManager({
-				apiKeysKind: authStores.apiKeys,
-				legacyStore: store
-			});
 			this.oauthSessionManager = new OauthSessionManager({ oauthSessionsKind: authStores.oauthSessions });
 			this.totpManager = new TotpManager({
 				userTotpKind: authStores.userTotp,
@@ -12336,15 +12192,6 @@ var LocalAuthAddon = class extends require_dist.BaseAddon {
 					totpEnabled
 				};
 			},
-			listApiKeys: async () => {
-				if (!this.apiKeyManager) return [];
-				return this.apiKeyManager.listAll();
-			},
-			revokeApiKey: async (input) => {
-				if (!this.apiKeyManager) throw new Error("API key management not available");
-				await this.apiKeyManager.revoke(input.id);
-				return { success: true };
-			},
 			oauthIssueCode: async (input) => {
 				return lazyOauthGrants().oauthIssueCode(input);
 			},
@@ -12705,7 +12552,6 @@ var LocalAuthAddon = class extends require_dist.BaseAddon {
 		}
 		this.authManager = null;
 		this.userManager = null;
-		this.apiKeyManager = null;
 		this.oauthSessionManager = null;
 		this.externalIdentities = null;
 		this.loginSessions = null;
@@ -12715,7 +12561,6 @@ var LocalAuthAddon = class extends require_dist.BaseAddon {
 	}
 };
 //#endregion
-exports.ApiKeyManager = ApiKeyManager;
 exports.AuthAuditLog = AuthAuditLog;
 exports.AuthManager = AuthManager;
 exports.DeviceCaStore = DeviceCaStore;