@cosmicdrift/kumiko-bundled-features 0.113.1 → 1.0.0

package/src/config/handlers/reencrypt.job.ts

@@ -1,197 +0,0 @@
-// Re-encrypt job for `encrypted: true` config values. Two jobs in one,
-// because format detection makes them the same loop:
-//   - MIGRATION: legacy CONFIG_ENCRYPTION_KEY values (base64 blob, no key
-//     id) → envelope format under the current master key. After a clean
-//     run the legacy key can be dropped from the environment.
-//   - KEK-ROTATION: envelope values wrapped under an older kekVersion →
-//     re-encrypted under provider.currentVersion(). Config has no
-//     kek_version column (values live in a TEXT column), so unlike the
-//     secrets rotate job the version check parses the stored JSON.
-//
-// Idempotent: a re-run skips rows already on the current version. Every
-// write goes through the event-store executor (config values are
-// entity-backed — raw UPDATEs would be wiped by a projection rebuild),
-// so each migration appends a normal `.updated` event whose payload
-// carries the NEW envelope: after a full run even a from-scratch rebuild
-// no longer needs the legacy key for the final state.
-
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import {
-  createEventStoreExecutor,
-  createTenantDb,
-  type DbConnection,
-  type TenantDb,
-} from "@cosmicdrift/kumiko-framework/db";
-import type { JobHandlerFn, SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
-import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
-import { type EnvelopeCipher, isStoredEnvelope } from "@cosmicdrift/kumiko-framework/secrets";
-import { type ChunkedMigrationStopReason, runChunkedMigration } from "../../shared";
-import { configValueEntity, configValuesTable } from "../table";
-
-const DEFAULT_MAX_FAILURES = 10;
-const SCAN_SLICE_SIZE = 100;
-const SYSTEM_ROLES = ["system"] as const;
-
-const executor = createEventStoreExecutor(configValuesTable, configValueEntity, {
-  entityName: "config-value",
-});
-
-export type ReencryptJobPayload = {
-  readonly maxDurationMs?: number;
-  readonly maxFailures?: number;
-};
-
-export type ReencryptJobResult = {
-  readonly migrated: number;
-  readonly failed: number;
-  readonly alreadyCurrent: number;
-  readonly stoppedReason: ChunkedMigrationStopReason;
-};
-
-function needsReencrypt(value: string, targetVersion: number): boolean {
-  // legacy single-key format (base64 — can never start with "{")
-  if (!value.startsWith("{")) return true;
-  try {
-    const parsed: unknown = JSON.parse(value);
-    if (!isStoredEnvelope(parsed)) return true;
-    return parsed.kekVersion !== targetVersion;
-  } catch {
-    // malformed JSON — let the decrypt attempt surface the real error
-    return true;
-  }
-}
-
-export const reencryptJob: JobHandlerFn = async (rawPayload, ctx): Promise<void> => {
-  const payload = rawPayload as ReencryptJobPayload; // @cast-boundary engine-payload
-  const maybeCipher = ctx.configEncryption;
-  if (!maybeCipher) {
-    throw new InternalError({
-      message:
-        "[config:reencrypt] ctx.configEncryption missing — provide a master key " +
-        "(KUMIKO_SECRETS_MASTER_KEY_V<n>) so the boot wires the envelope cipher.",
-    });
-  }
-  // hoisted function declarations below capture these — pin the narrowed
-  // type explicitly so TS keeps it inside the closures
-  const cipher: EnvelopeCipher = maybeCipher;
-  const provider = ctx.masterKeyProvider;
-  if (!provider) {
-    throw new InternalError({
-      message:
-        "[config:reencrypt] ctx.masterKeyProvider missing — wire it via extraContext.masterKeyProvider at boot.",
-    });
-  }
-  if (!ctx.db) {
-    throw new InternalError({
-      message: "[config:reencrypt] ctx.db missing — job context requires a database connection.",
-    });
-  }
-  if (!ctx.registry) {
-    throw new InternalError({
-      message: "[config:reencrypt] ctx.registry missing — job context requires the registry.",
-    });
-  }
-  const db = ctx.db as DbConnection; // @cast-boundary db-operator
-
-  const encryptedKeys = [...ctx.registry.getAllConfigKeys()]
-    .filter(([, def]) => def.encrypted === true)
-    .map(([key]) => key);
-
-  const maxFailures = payload.maxFailures ?? DEFAULT_MAX_FAILURES;
-  const deadline = payload.maxDurationMs
-    ? Date.now() + payload.maxDurationMs
-    : Number.POSITIVE_INFINITY;
-
-  const tdbCache = new Map<TenantId, TenantDb>();
-  function tdbFor(tenantId: TenantId): TenantDb {
-    let existing = tdbCache.get(tenantId);
-    if (!existing) {
-      existing = createTenantDb(db, tenantId, "system");
-      tdbCache.set(tenantId, existing);
-    }
-    return existing;
-  }
-
-  type ConfigRow = {
-    id: string;
-    key: string;
-    value: string | null;
-    tenantId: string;
-    version: number;
-  };
-
-  let alreadyCurrent = 0;
-  const targetVersion = provider.currentVersion();
-
-  // ponytail: one full candidate scan — config rows are operator-scale
-  // (tenants × encrypted keys), cursor pagination when that ever changes.
-  // Served to the shared loop in slices so its deadline/signal/failure
-  // checks run between chunks, not only once.
-  let pending: ConfigRow[] | undefined;
-  async function nextBatch(): Promise<readonly ConfigRow[]> {
-    if (pending === undefined) {
-      pending =
-        encryptedKeys.length === 0
-          ? []
-          : [
-              ...(await selectMany<ConfigRow>(db, configValuesTable, {
-                key: { in: encryptedKeys },
-              })),
-            ];
-    }
-    const slice = pending;
-    return slice.splice(0, SCAN_SLICE_SIZE);
-  }
-
-  async function migrateRow(row: ConfigRow): Promise<"migrated" | "skipped" | "failed"> {
-    if (row.value === null || row.value === undefined) return "skipped";
-    if (!needsReencrypt(row.value, targetVersion)) {
-      alreadyCurrent++;
-      return "skipped";
-    }
-
-    // decrypt failure (missing legacy key, unknown kekVersion, tamper)
-    // throws → counted as failed via onRowError; the row stays untouched —
-    // never write anything we couldn't read.
-    const tenantId = row.tenantId as TenantId; // @cast-boundary db-row
-    const plaintext = await cipher.decrypt(row.value, { tenantId });
-    const reencrypted = await cipher.encrypt(plaintext, { tenantId });
-
-    const actor: SessionUser = { id: "system", tenantId, roles: SYSTEM_ROLES };
-    const result = await executor.update(
-      { id: row.id, version: row.version, changes: { value: reencrypted } },
-      actor,
-      tdbFor(tenantId),
-    );
-
-    // version_conflict == a concurrent config:set beat us; the row now
-    // holds a fresh envelope written by the set handler — already fine.
-    if (!result.isSuccess) {
-      if (result.error.code === "version_conflict") return "skipped";
-      ctx.log?.warn?.(`[config:reencrypt] executor rejected row ${row.id}`, {
-        code: result.error.code,
-      });
-      return "failed";
-    }
-    return "migrated";
-  }
-
-  const outcome = await runChunkedMigration<ConfigRow>({
-    nextBatch,
-    migrateRow,
-    maxFailures,
-    deadlineAt: deadline,
-    signal: ctx.signal,
-    onRowError: (row, err) => {
-      ctx.log?.warn?.(`[config:reencrypt] failed to re-encrypt row ${row.id}`, { err });
-    },
-  });
-
-  const result: ReencryptJobResult = {
-    migrated: outcome.migrated,
-    failed: outcome.failed,
-    alreadyCurrent,
-    stoppedReason: outcome.stoppedReason,
-  };
-  ctx.log?.info?.(`[config:reencrypt] complete: ${JSON.stringify(result)}`);
-};

package/src/personal-access-tokens/__tests__/pat.integration.test.ts

@@ -1,204 +0,0 @@
-import { afterAll, beforeAll, describe, expect, test } from "bun:test";
-import { randomBytes } from "node:crypto";
-import {
-  createInMemoryLoginRateLimiter,
-  type PatResolver,
-} from "@cosmicdrift/kumiko-framework/api";
-import { updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import type { SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
-import {
-  setupTestStack,
-  type TestStack,
-  testTenantId,
-  unsafeCreateEntityTable,
-  unsafePushTables,
-} from "@cosmicdrift/kumiko-framework/stack";
-import { createTestEnvelopeCipher, deleteRows } from "@cosmicdrift/kumiko-framework/testing";
-import { Temporal } from "temporal-polyfill";
-import { AuthHandlers } from "../../auth-email-password/constants";
-import { createAuthEmailPasswordFeature } from "../../auth-email-password/feature";
-import { createConfigFeature } from "../../config";
-import { createConfigResolver } from "../../config/resolver";
-import { configValuesTable } from "../../config/table";
-import { makeSessionHelpers } from "../../sessions/__tests__/test-helpers";
-import { SessionQueries } from "../../sessions/constants";
-import { createSessionsFeature } from "../../sessions/feature";
-import { userSessionEntity } from "../../sessions/schema/user-session";
-import { createTenantFeature } from "../../tenant";
-import { tenantMembershipsTable } from "../../tenant/membership-table";
-import { tenantEntity } from "../../tenant/schema/tenant";
-import { createUserFeature } from "../../user/feature";
-import { userEntity } from "../../user/schema/user";
-import { PatHandlers, PatQueries } from "../constants";
-import { createPersonalAccessTokensFeature } from "../feature";
-import { createPatResolver } from "../resolver";
-import { apiTokenEntity, apiTokenTable } from "../schema/api-token";
-import type { PatScopeConfig } from "../scopes";
-
-// Full loop, no mocks: mint a PAT via the create handler → use it as a bearer
-// token over real HTTP. The resolver hashes it, resolves live roles, and the
-// API boundary enforces the granted scopes. Proves the security matrix:
-// allowed → 200, out-of-scope → 403 (while a JWT user could call it),
-// revoked/expired/unknown/membership-removed → 401.
-
-let stack: TestStack;
-let h: ReturnType<typeof makeSessionHelpers>;
-let patResolver: PatResolver | undefined;
-
-const encryptionKey = randomBytes(32).toString("base64");
-const TENANT: TenantId = testTenantId(1);
-
-// One domain "tokens" whose read set is exactly the two PAT queries —
-// deliberately NOT sessions:query:user-session:mine, so that QN is the
-// out-of-scope probe. Granted as "tokens:read".
-const SCOPES: PatScopeConfig = {
-  tokens: { label: "Tokens", read: [PatQueries.mine, PatQueries.availableScopes] },
-};
-
-async function mintToken(
-  actor: SessionUser,
-  opts?: { scopes?: string[]; expiresInDays?: number },
-): Promise<string> {
-  const res = await stack.http.writeOk<{ id: string; token: string }>(
-    PatHandlers.create,
-    {
-      name: "test",
-      scopes: opts?.scopes ?? ["tokens:read"],
-      ...(opts?.expiresInDays ? { expiresInDays: opts.expiresInDays } : {}),
-    },
-    actor,
-  );
-  return res.token;
-}
-
-beforeAll(async () => {
-  const encryption = createTestEnvelopeCipher(encryptionKey);
-  const resolver = createConfigResolver({ cipher: encryption });
-
-  stack = await setupTestStack({
-    features: [
-      createConfigFeature(),
-      createUserFeature(),
-      createTenantFeature(),
-      createAuthEmailPasswordFeature(),
-      createSessionsFeature(),
-      createPersonalAccessTokensFeature({ scopes: SCOPES }),
-    ],
-    extraContext: { configResolver: resolver, configEncryption: encryption },
-    authConfig: {
-      membershipQuery: "tenant:query:memberships",
-      loginHandler: AuthHandlers.login,
-      patResolver: (raw: string) => {
-        if (!patResolver) throw new Error("resolver not set");
-        return patResolver(raw);
-      },
-      // Low per-token cap so the rate-limit test can exhaust it. Other tests do
-      // ≤2 requests per (distinct) token, so this ceiling never trips them.
-      patRateLimiter: createInMemoryLoginRateLimiter(3, 60_000),
-    },
-  });
-  patResolver = createPatResolver({ db: stack.db, scopes: SCOPES });
-  h = makeSessionHelpers(stack, TENANT);
-
-  await unsafeCreateEntityTable(stack.db, userEntity);
-  await unsafeCreateEntityTable(stack.db, tenantEntity);
-  await unsafeCreateEntityTable(stack.db, userSessionEntity);
-  await unsafeCreateEntityTable(stack.db, apiTokenEntity);
-  await unsafePushTables(stack.db, { configValuesTable, tenantMembershipsTable });
-});
-
-afterAll(async () => {
-  await stack.cleanup();
-});
-
-async function actorFor(email: string): Promise<SessionUser> {
-  const { userId } = await h.seedUser(email, "pw");
-  return { id: userId, tenantId: TENANT, roles: ["User"] };
-}
-
-// Raw login → JWT (no sid: session callbacks aren't wired here, and the PAT
-// path doesn't need them). Used only to prove a non-PAT bearer skips the gate.
-async function loginToken(email: string): Promise<string> {
-  const res = await stack.http.raw("POST", "/api/auth/login", { email, password: "pw" });
-  expect(res.status).toBe(200);
-  return ((await res.json()) as { token: string }).token;
-}
-
-describe("PAT auth", () => {
-  test("granted scope → 200", async () => {
-    const actor = await actorFor("granted@example.com");
-    const token = await mintToken(actor);
-    const res = await h.authedPost("/api/query", token, { type: PatQueries.mine, payload: {} });
-    expect(res.status).toBe(200);
-  });
-
-  test("out-of-scope QN → 403 (but a JWT user may call it)", async () => {
-    const actor = await actorFor("scope@example.com");
-    const token = await mintToken(actor);
-    const denied = await h.authedPost("/api/query", token, {
-      type: SessionQueries.mine,
-      payload: {},
-    });
-    expect(denied.status).toBe(403);
-
-    const jwt = await loginToken("scope@example.com");
-    const allowed = await h.authedPost("/api/query", jwt, {
-      type: SessionQueries.mine,
-      payload: {},
-    });
-    expect(allowed.status).toBe(200);
-  });
-
-  test("unknown token → 401", async () => {
-    const res = await h.authedPost("/api/query", "kpat_deadbeef", {
-      type: PatQueries.mine,
-      payload: {},
-    });
-    expect(res.status).toBe(401);
-  });
-
-  test("revoked token → 401", async () => {
-    const actor = await actorFor("revoked@example.com");
-    const token = await mintToken(actor);
-    const rows = await stack.http.queryOk<Array<{ id: string }>>(PatQueries.mine, {}, actor);
-    const id = rows[0]?.id;
-    expect(id).toBeDefined();
-    await stack.http.writeOk(PatHandlers.revoke, { id }, actor);
-    const res = await h.authedPost("/api/query", token, { type: PatQueries.mine, payload: {} });
-    expect(res.status).toBe(401);
-  });
-
-  test("expired token → 401", async () => {
-    const actor = await actorFor("expired@example.com");
-    const token = await mintToken(actor);
-    const past = Temporal.Now.instant().subtract({ hours: 1 });
-    const rows =
-      (await stack.http.queryOk<Array<{ id: string }>>(PatQueries.mine, {}, actor)) ?? [];
-    await updateMany(stack.db, apiTokenTable, { expiresAt: past }, { id: rows[0]?.id });
-    const res = await h.authedPost("/api/query", token, { type: PatQueries.mine, payload: {} });
-    expect(res.status).toBe(401);
-  });
-
-  test("per-token rate limit → 429 once the cap is exceeded", async () => {
-    const actor = await actorFor("ratelimit@example.com");
-    const token = await mintToken(actor);
-    for (let i = 0; i < 3; i++) {
-      const ok = await h.authedPost("/api/query", token, { type: PatQueries.mine, payload: {} });
-      expect(ok.status).toBe(200);
-    }
-    const limited = await h.authedPost("/api/query", token, { type: PatQueries.mine, payload: {} });
-    expect(limited.status).toBe(429);
-  });
-
-  test("membership removed → 401 (live roles, no snapshot)", async () => {
-    const actor = await actorFor("removed@example.com");
-    const token = await mintToken(actor);
-    const ok = await h.authedPost("/api/query", token, { type: PatQueries.mine, payload: {} });
-    expect(ok.status).toBe(200);
-    // tenantMembershipsTable is ES-managed (executor-only branded); deleteRows
-    // is the test-side escape for out-of-band row removal.
-    await deleteRows(stack.db, tenantMembershipsTable, { userId: actor.id });
-    const res = await h.authedPost("/api/query", token, { type: PatQueries.mine, payload: {} });
-    expect(res.status).toBe(401);
-  });
-});

package/src/personal-access-tokens/__tests__/scopes.test.ts

@@ -1,42 +0,0 @@
-import { describe, expect, it } from "bun:test";
-import { expandScopes, type PatScopeConfig, parseGrant } from "../scopes";
-
-const CONFIG: PatScopeConfig = {
-  credit: { label: "Kredite", read: ["credit:query:*"], write: ["credit:write:*"] },
-  miete: { label: "Mieten", read: ["ledger:query:*"] }, // read-only domain
-};
-
-describe("parseGrant", () => {
-  it("splits domain:level on the last colon", () => {
-    expect(parseGrant("credit:write")).toEqual({ domain: "credit", level: "write" });
-  });
-  it("rejects a bare token", () => {
-    expect(parseGrant("credit")).toBeNull();
-  });
-});
-
-describe("expandScopes", () => {
-  it("read grants only the read QNs", () => {
-    expect(expandScopes(CONFIG, ["credit:read"])).toEqual(["credit:query:*"]);
-  });
-
-  it("write grants read + write QNs", () => {
-    expect(expandScopes(CONFIG, ["credit:write"]).sort()).toEqual(
-      ["credit:query:*", "credit:write:*"].sort(),
-    );
-  });
-
-  it("read-only domain ignores a write grant's missing write set", () => {
-    expect(expandScopes(CONFIG, ["miete:write"])).toEqual(["ledger:query:*"]);
-  });
-
-  it("unknown domain contributes nothing (fail-closed)", () => {
-    expect(expandScopes(CONFIG, ["ghost:write"])).toEqual([]);
-  });
-
-  it("unions across multiple grants without duplicates", () => {
-    expect(expandScopes(CONFIG, ["credit:read", "miete:read"]).sort()).toEqual(
-      ["credit:query:*", "ledger:query:*"].sort(),
-    );
-  });
-});

package/src/personal-access-tokens/constants.ts

@@ -1,33 +0,0 @@
-// @runtime client
-// Pure constants — client-marked so the web screen (web/) may import screen-id
-// and QN names without pulling the feature's server runtime barrel.
-export const PAT_FEATURE = "personal-access-tokens";
-
-// Snake_case reason strings (Error-Reasons guard: no colons/dashes).
-export const PatErrors = {
-  ownershipDenied: "ownership_denied",
-} as const;
-
-// Dormant custom-screen id (r.screen) — the app places it via r.nav. The client
-// maps it to the PatTokensScreen component.
-export const PAT_SCREEN_ID = "api-tokens";
-
-export const PatHandlers = {
-  create: "personal-access-tokens:write:create",
-  revoke: "personal-access-tokens:write:revoke",
-} as const;
-
-export const PatQueries = {
-  mine: "personal-access-tokens:query:mine",
-  availableScopes: "personal-access-tokens:query:available-scopes",
-} as const;
-
-// Only the first chars of a minted token are stored (alongside the hash) so the
-// UI can show "kpat_ab12…" for recognition without ever holding the secret.
-export const PAT_PREFIX_DISPLAY_LENGTH = 12;
-
-export type PatRateLimit = { readonly maxRequests: number; readonly windowMs: number };
-
-// Default per-token request rate for PAT-authenticated calls. Generous enough
-// for normal automation, low enough to blunt a leaked-token abuse spike.
-export const PAT_DEFAULT_RATE_LIMIT: PatRateLimit = { maxRequests: 120, windowMs: 60_000 };

package/src/personal-access-tokens/feature.ts

@@ -1,78 +0,0 @@
-import { buildEntityTableMeta } from "@cosmicdrift/kumiko-framework/db";
-import { defineFeature, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
-import { PAT_DEFAULT_RATE_LIMIT, PAT_FEATURE, PAT_SCREEN_ID, type PatRateLimit } from "./constants";
-import { buildAvailableScopesQuery } from "./handlers/available-scopes.query";
-import { createPatWrite } from "./handlers/create.write";
-import { listPatQuery } from "./handlers/list.query";
-import { revokePatWrite } from "./handlers/revoke.write";
-import { apiTokenEntity } from "./schema/api-token";
-import type { PatScopeConfig } from "./scopes";
-
-export type PersonalAccessTokensOptions = {
-  // The scopes this deployment offers. Each is a named bundle of QN globs a PAT
-  // may be granted (a scope can span features). Closed over by available-scopes
-  // (UI list) and exported so run-prod-app can build the resolver from the same
-  // single source.
-  readonly scopes: PatScopeConfig;
-  // Per-token request rate limit for PAT-authenticated calls. Defaults to
-  // PAT_DEFAULT_RATE_LIMIT (120/60s). run-prod-app builds the limiter from this.
-  readonly rateLimit?: PatRateLimit;
-};
-
-export type PatFeatureExports = {
-  readonly scopes: PatScopeConfig;
-  readonly rateLimit: PatRateLimit;
-};
-
-// Personal Access Tokens — long-lived, revocable bearer credentials for the
-// HTTP API. Like `sessions`, the hot-path resolver is NOT a handler: it runs on
-// every PAT-authenticated request and does a direct-DB point-read (see
-// createPatResolver / run-prod-app wiring). The dispatcher-side handlers here
-// only mint/list/revoke tokens and expose the scope catalog.
-export function createPersonalAccessTokensFeature(
-  options: PersonalAccessTokensOptions,
-): FeatureDefinition {
-  const { scopes } = options;
-  return defineFeature(PAT_FEATURE, (r) => {
-    r.describe(
-      "Long-lived, revocable Personal Access Tokens for headless HTTP-API access. Stores SHA-256 token hashes in the `read_api_tokens` direct-write table; the plaintext is returned once at creation. `create`/`revoke`/`mine` manage a user's own tokens and `available-scopes` lists the app-declared scope catalog. Bearer tokens carrying the PAT prefix are resolved before jwt.verify (roles resolved live, granted scopes enforced fail-closed at the API boundary) — the resolver is wired via run-prod-app, not the dispatcher.",
-    );
-    r.uiHints({ displayLabel: "Personal Access Tokens", category: "identity", recommended: false });
-    // Resolver reads memberships + users on every PAT request to build live
-    // roles — make both boot-time deps so a mis-wiring fails validateBoot.
-    r.requires("user", "tenant");
-    // Direct-write store like read_user_sessions: create/revoke write it, the
-    // resolver point-reads it. r.entity would make it a rebuildable projection
-    // whose replay (no token events) would wipe every live token (#498/#494).
-    r.unmanagedTable(buildEntityTableMeta("api-token", apiTokenEntity), {
-      reason: "read_side.api_tokens_direct_write",
-    });
-
-    const handlers = {
-      create: r.writeHandler(createPatWrite),
-      revoke: r.writeHandler(revokePatWrite),
-    };
-    const queries = {
-      mine: r.queryHandler(listPatQuery),
-      availableScopes: r.queryHandler(buildAvailableScopesQuery(scopes)),
-    };
-
-    // Dormant custom-screen — the client maps PAT_SCREEN_ID to PatTokensScreen;
-    // the app places it via r.nav in its logged-in settings area.
-    r.screen({
-      id: PAT_SCREEN_ID,
-      type: "custom",
-      renderer: { react: { __component: "PatTokensScreen" } },
-      access: { openToAll: true },
-    });
-
-    // scopes + rateLimit flow into feature.exports so run-prod-app builds the
-    // resolver + limiter from the same declaration — single source of truth.
-    return {
-      handlers,
-      queries,
-      scopes,
-      rateLimit: options.rateLimit ?? PAT_DEFAULT_RATE_LIMIT,
-    } satisfies { handlers: unknown; queries: unknown } & PatFeatureExports;
-  });
-}

package/src/personal-access-tokens/handlers/available-scopes.query.ts

@@ -1,21 +0,0 @@
-import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
-import type { PatScopeConfig } from "../scopes";
-
-// Returns the app-declared scope domains ({name, label, canWrite}) so the mint
-// UI can render a per-domain level picker (no access / read / read & write).
-// canWrite is false for read-only domains → the UI hides the write option.
-// Static per deployment, not per user.
-export function buildAvailableScopesQuery(scopes: PatScopeConfig) {
-  return defineQueryHandler({
-    name: "available-scopes",
-    schema: z.object({}),
-    access: { openToAll: true },
-    handler: async () =>
-      Object.entries(scopes).map(([name, def]) => ({
-        name,
-        label: def.label,
-        canWrite: (def.write?.length ?? 0) > 0,
-      })),
-  });
-}

package/src/personal-access-tokens/handlers/create.write.ts

@@ -1,41 +0,0 @@
-import { insertOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
-import { generateId } from "@cosmicdrift/kumiko-framework/utils";
-import { Temporal } from "temporal-polyfill";
-import { z } from "zod";
-import { mintPatToken } from "../hash";
-import { apiTokenTable } from "../schema/api-token";
-
-// Mint a PAT for the calling user in their active tenant. The plaintext token
-// is returned ONCE (data.token) and never again — only the hash is stored.
-// `scopes` are granted scope names; unknown names simply grant nothing at
-// resolve time (fail-closed), so no cross-check against the app config here.
-export const createPatWrite = defineWriteHandler({
-  name: "create",
-  schema: z.object({
-    name: z.string().min(1).max(120),
-    scopes: z.array(z.string().min(1)).min(1),
-    expiresInDays: z.number().int().positive().max(3650).optional(),
-  }),
-  access: { openToAll: true },
-  handler: async (event, ctx) => {
-    const { raw, hash, prefix } = mintPatToken();
-    const now = Temporal.Now.instant();
-    const id = generateId();
-    await insertOne(ctx.db, apiTokenTable, {
-      id,
-      userId: event.user.id,
-      tenantId: event.user.tenantId,
-      name: event.payload.name,
-      tokenHash: hash,
-      prefix,
-      scopes: JSON.stringify(event.payload.scopes),
-      createdAt: now,
-      expiresAt: event.payload.expiresInDays
-        ? now.add({ hours: 24 * event.payload.expiresInDays })
-        : null,
-      revokedAt: null,
-    });
-    return { isSuccess: true, data: { id, token: raw, prefix } };
-  },
-});

package/src/personal-access-tokens/handlers/list.query.ts

@@ -1,47 +0,0 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
-import { apiTokenTable } from "../schema/api-token";
-
-// The caller's own tokens — metadata only, never the hash or plaintext.
-// Includes revoked/expired rows so the UI can show history; `prefix` is the
-// only fragment of the secret ever exposed.
-export const listPatQuery = defineQueryHandler({
-  name: "mine",
-  schema: z.object({}),
-  access: { openToAll: true },
-  handler: async (query, ctx) => {
-    const rows = await selectMany<{
-      id: string;
-      name: string;
-      prefix: string;
-      scopes: string;
-      createdAt: unknown;
-      expiresAt: unknown;
-      revokedAt: unknown;
-    }>(
-      ctx.db,
-      apiTokenTable,
-      { userId: query.user.id },
-      { orderBy: { col: "createdAt", direction: "desc" } },
-    );
-    return rows.map((r) => ({
-      id: r.id,
-      name: r.name,
-      prefix: r.prefix,
-      scopes: parseScopeNames(r.scopes),
-      createdAt: r.createdAt,
-      expiresAt: r.expiresAt,
-      revokedAt: r.revokedAt,
-    }));
-  },
-});
-
-function parseScopeNames(raw: string): string[] {
-  try {
-    const parsed: unknown = JSON.parse(raw);
-    return Array.isArray(parsed) ? parsed.filter((s): s is string => typeof s === "string") : [];
-  } catch {
-    return [];
-  }
-}