@commonpub/layer 0.16.0 → 0.16.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@commonpub/layer",
-  "version": "0.16.0",
+  "version": "0.16.2",
   "type": "module",
   "main": "./nuxt.config.ts",
   "files": [
@@ -29,8 +29,8 @@
   "dependencies": {
     "@aws-sdk/client-s3": "^3.1010.0",
     "@commonpub/explainer": "^0.7.12",
-    "@commonpub/schema": "^0.14.0",
-    "@commonpub/server": "^2.44.1",
+    "@commonpub/schema": "^0.14.1",
+    "@commonpub/server": "^2.44.2",
     "@tiptap/core": "^2.11.0",
     "@tiptap/extension-bold": "^2.11.0",
     "@tiptap/extension-bullet-list": "^2.11.0",
@@ -54,12 +54,12 @@
     "vue-router": "^4.3.0",
     "zod": "^4.3.6",
     "@commonpub/config": "0.11.0",
-    "@commonpub/auth": "0.5.1",
     "@commonpub/docs": "0.6.2",
-    "@commonpub/learning": "0.5.0",
+    "@commonpub/auth": "0.5.1",
     "@commonpub/editor": "0.7.9",
-    "@commonpub/ui": "0.8.5",
-    "@commonpub/protocol": "0.9.9"
+    "@commonpub/learning": "0.5.0",
+    "@commonpub/protocol": "0.9.9",
+    "@commonpub/ui": "0.8.5"
   },
   "devDependencies": {
     "@testing-library/jest-dom": "^6.9.1",

package/server/api/admin/api-keys/[id].delete.ts

@@ -1,4 +1,4 @@
-import { revokeApiKey } from '@commonpub/server';
+import { revokeApiKey, createAuditEntry } from '@commonpub/server';
 
 export default defineEventHandler(async (event) => {
   const user = requireAdmin(event);
@@ -7,5 +7,14 @@ export default defineEventHandler(async (event) => {
   const db = useDB();
   const result = await revokeApiKey(db, id, user.id);
   if (!result) throw createError({ statusCode: 404, statusMessage: 'Key not found or already revoked' });
+
+  await createAuditEntry(db, {
+    userId: user.id,
+    action: 'api_key.revoke',
+    targetType: 'api_key',
+    targetId: result.id,
+    metadata: { name: result.name, scopes: result.scopes },
+  }).catch(() => { /* audit best-effort */ });
+
   return result;
 });

package/server/api/admin/api-keys/index.post.ts

@@ -1,4 +1,4 @@
-import { createApiKey } from '@commonpub/server';
+import { createApiKey, createAuditEntry } from '@commonpub/server';
 import { createApiKeySchema } from '@commonpub/schema';
 
 /**
@@ -7,6 +7,11 @@ import { createApiKeySchema } from '@commonpub/schema';
  * Creates a new public API key. The full token is returned ONCE in the
  * response body — the UI displays it with a "copy now, you won't see it
  * again" warning. Server-side we only keep the SHA-256 hash.
+ *
+ * Audit: issuance of an API key is a sensitive change to the instance's
+ * external access surface, so we always write an auditLogs row. The token
+ * itself is NEVER logged — only the id, name, scopes, and (optional) expiry
+ * land in the metadata column.
  */
 export default defineEventHandler(async (event) => {
   const user = requireAdmin(event);
@@ -18,5 +23,19 @@ export default defineEventHandler(async (event) => {
 
   const db = useDB();
   const result = await createApiKey(db, user.id, parsed.data);
+
+  await createAuditEntry(db, {
+    userId: user.id,
+    action: 'api_key.create',
+    targetType: 'api_key',
+    targetId: result.key.id,
+    metadata: {
+      name: result.key.name,
+      scopes: result.key.scopes,
+      expiresAt: result.key.expiresAt,
+      rateLimitPerMinute: result.key.rateLimitPerMinute,
+    },
+  }).catch(() => { /* audit is best-effort; never fail the create */ });
+
   return result;
 });

package/server/middleware/public-api-auth.ts

@@ -33,6 +33,28 @@ export default defineEventHandler(async (event) => {
     throw createError({ statusCode: 404, statusMessage: 'Not Found' });
   }
 
+  // CORS preflight. Browsers send OPTIONS with `Origin` and either
+  // `Access-Control-Request-Method` or `-Headers`. We reflect the origin
+  // only if the admin key allow-list has opted in — but to do that we
+  // need to auth first, which preflight doesn't carry. The pragmatic
+  // compromise: for preflight, short-circuit with permissive headers for
+  // the standard set and let the real request's auth check gate access.
+  // No data flows here; the body is empty.
+  if (event.method === 'OPTIONS') {
+    setResponseHeader(event, 'Access-Control-Allow-Methods', 'GET, OPTIONS');
+    setResponseHeader(event, 'Access-Control-Allow-Headers', 'Authorization, Content-Type');
+    setResponseHeader(event, 'Access-Control-Max-Age', 600);
+    const origin = getRequestHeader(event, 'origin');
+    if (origin) {
+      // Echo origin only on preflight — real requests get the per-key
+      // allow-list check below. Browsers that don't trust this echo because
+      // credentials aren't involved will simply fall back to the no-CORS path.
+      setResponseHeader(event, 'Access-Control-Allow-Origin', origin);
+      appendResponseHeader(event, 'Vary', 'Origin');
+    }
+    return sendNoContent(event);
+  }
+
   const authHeader = getRequestHeader(event, 'authorization');
   const token = authHeader?.startsWith('Bearer ')
     ? authHeader.slice(7).trim()