@elevasis/core 0.7.1 → 0.8.2

package/src/supabase/helpers.ts

@@ -1,20 +1,20 @@
-import type { Database, Tables, TablesInsert, TablesUpdate } from './database.types'
-
-export type TableRow<T extends keyof Database['public']['Tables']> = Tables<T>
-export type TableInsert<T extends keyof Database['public']['Tables']> = TablesInsert<T>
-export type TableUpdate<T extends keyof Database['public']['Tables']> = TablesUpdate<T>
-
-export type SupabaseFunction<T extends keyof Database['public']['Functions']> = Database['public']['Functions'][T]
-
-/**
- * Strip characters that have special meaning in PostgREST filter syntax.
- * Use on user-supplied search strings before interpolating into `.or()` filter expressions.
- *
- * PostgREST uses `,` as the OR separator and `(` / `)` for logical grouping.
- * The supabase-js `.or()` method passes strings as-is with no escaping.
- */
-export function sanitizePostgrestValue(value: string): string {
-  return value.replace(/[,()]/g, '')
-}
-
-export type UpsertUserProfileResult = SupabaseFunction<'upsert_user_profile'>['Returns'][0]
+import type { Database, Tables, TablesInsert, TablesUpdate } from './database.types'
+
+export type TableRow<T extends keyof Database['public']['Tables']> = Tables<T>
+export type TableInsert<T extends keyof Database['public']['Tables']> = TablesInsert<T>
+export type TableUpdate<T extends keyof Database['public']['Tables']> = TablesUpdate<T>
+
+export type SupabaseFunction<T extends keyof Database['public']['Functions']> = Database['public']['Functions'][T]
+
+/**
+ * Strip characters that have special meaning in PostgREST filter syntax.
+ * Use on user-supplied search strings before interpolating into `.or()` filter expressions.
+ *
+ * PostgREST uses `,` as the OR separator and `(` / `)` for logical grouping.
+ * The supabase-js `.or()` method passes strings as-is with no escaping.
+ */
+export function sanitizePostgrestValue(value: string): string {
+  return value.replace(/[,()]/g, '')
+}
+
+export type UpsertUserProfileResult = SupabaseFunction<'upsert_user_profile'>['Returns'][0]

package/src/supabase/index.ts

@@ -1,52 +1,52 @@
-import type { Database, Tables, TablesInsert, TablesUpdate } from './database.types'
-
-export type { Database, Tables, TablesInsert, TablesUpdate, Enums, CompositeTypes, Json } from './database.types'
-
-export { Constants } from './database.types'
-
-export type SupabaseClient = import('@supabase/supabase-js').SupabaseClient<Database>
-
-// Note: supabaseClient is a server-only export available via @repo/core/server
-// DO NOT export it from the main entry point to prevent browser bundling
-
-export type SupabaseUserProfile = Tables<'users'>
-export type SupabaseOrganization = Tables<'organizations'>
-export type SupabaseOrgMembership = Tables<'org_memberships'>
-export type SupabaseTaskSchedule = Tables<'task_schedules'>
-/** @deprecated Use SupabaseTaskSchedule instead. Alias for backward compatibility. */
-export type SupabaseScheduledTask = SupabaseTaskSchedule
-export type SupabaseCommandQueue = Tables<'command_queue'>
-export type SupabaseExecutionLogs = Tables<'execution_logs'>
-export type SupabaseApiKey = Tables<'api_keys'>
-/** API response type for API key list items (omits sensitive key_hash) */
-export type ApiKeyListItem = Omit<SupabaseApiKey, 'key_hash'>
-export type SupabaseOrganizationCredential = Tables<'credentials'>
-
-export type SupabaseUserProfileInsert = TablesInsert<'users'>
-export type SupabaseOrganizationInsert = TablesInsert<'organizations'>
-export type SupabaseTaskScheduleInsert = TablesInsert<'task_schedules'>
-/** @deprecated Use SupabaseTaskScheduleInsert instead. Alias for backward compatibility. */
-export type SupabaseScheduledTaskInsert = SupabaseTaskScheduleInsert
-export type SupabaseCommandQueueInsert = TablesInsert<'command_queue'>
-export type SupabaseApiKeyInsert = TablesInsert<'api_keys'>
-export type SupabaseExecutionLogsInsert = TablesInsert<'execution_logs'>
-export type SupabaseOrganizationCredentialInsert = TablesInsert<'credentials'>
-
-export type SupabaseUserProfileUpdate = TablesUpdate<'users'>
-export type SupabaseOrganizationUpdate = TablesUpdate<'organizations'>
-export type SupabaseTaskScheduleUpdate = TablesUpdate<'task_schedules'>
-/** @deprecated Use SupabaseTaskScheduleUpdate instead. Alias for backward compatibility. */
-export type SupabaseScheduledTaskUpdate = SupabaseTaskScheduleUpdate
-export type SupabaseCommandQueueUpdate = TablesUpdate<'command_queue'>
-export type SupabaseApiKeyUpdate = TablesUpdate<'api_keys'>
-export type SupabaseExecutionLogsUpdate = TablesUpdate<'execution_logs'>
-export type SupabaseOrganizationCredentialUpdate = TablesUpdate<'credentials'>
-
-// Export helper types and utilities
-export type { UpsertUserProfileResult } from './helpers'
-export { sanitizePostgrestValue } from './helpers'
-
-// Composite types for joined queries
-export type SupabaseMembershipWithOrganization = SupabaseOrgMembership & {
-  organization: SupabaseOrganization | null
-}
+import type { Database, Tables, TablesInsert, TablesUpdate } from './database.types'
+
+export type { Database, Tables, TablesInsert, TablesUpdate, Enums, CompositeTypes, Json } from './database.types'
+
+export { Constants } from './database.types'
+
+export type SupabaseClient = import('@supabase/supabase-js').SupabaseClient<Database>
+
+// Note: supabaseClient is a server-only export available via @repo/core/server
+// DO NOT export it from the main entry point to prevent browser bundling
+
+export type SupabaseUserProfile = Tables<'users'>
+export type SupabaseOrganization = Tables<'organizations'>
+export type SupabaseOrgMembership = Tables<'org_memberships'>
+export type SupabaseTaskSchedule = Tables<'task_schedules'>
+/** @deprecated Use SupabaseTaskSchedule instead. Alias for backward compatibility. */
+export type SupabaseScheduledTask = SupabaseTaskSchedule
+export type SupabaseCommandQueue = Tables<'command_queue'>
+export type SupabaseExecutionLogs = Tables<'execution_logs'>
+export type SupabaseApiKey = Tables<'api_keys'>
+/** API response type for API key list items (omits sensitive key_hash) */
+export type ApiKeyListItem = Omit<SupabaseApiKey, 'key_hash'>
+export type SupabaseOrganizationCredential = Tables<'credentials'>
+
+export type SupabaseUserProfileInsert = TablesInsert<'users'>
+export type SupabaseOrganizationInsert = TablesInsert<'organizations'>
+export type SupabaseTaskScheduleInsert = TablesInsert<'task_schedules'>
+/** @deprecated Use SupabaseTaskScheduleInsert instead. Alias for backward compatibility. */
+export type SupabaseScheduledTaskInsert = SupabaseTaskScheduleInsert
+export type SupabaseCommandQueueInsert = TablesInsert<'command_queue'>
+export type SupabaseApiKeyInsert = TablesInsert<'api_keys'>
+export type SupabaseExecutionLogsInsert = TablesInsert<'execution_logs'>
+export type SupabaseOrganizationCredentialInsert = TablesInsert<'credentials'>
+
+export type SupabaseUserProfileUpdate = TablesUpdate<'users'>
+export type SupabaseOrganizationUpdate = TablesUpdate<'organizations'>
+export type SupabaseTaskScheduleUpdate = TablesUpdate<'task_schedules'>
+/** @deprecated Use SupabaseTaskScheduleUpdate instead. Alias for backward compatibility. */
+export type SupabaseScheduledTaskUpdate = SupabaseTaskScheduleUpdate
+export type SupabaseCommandQueueUpdate = TablesUpdate<'command_queue'>
+export type SupabaseApiKeyUpdate = TablesUpdate<'api_keys'>
+export type SupabaseExecutionLogsUpdate = TablesUpdate<'execution_logs'>
+export type SupabaseOrganizationCredentialUpdate = TablesUpdate<'credentials'>
+
+// Export helper types and utilities
+export type { UpsertUserProfileResult } from './helpers'
+export { sanitizePostgrestValue } from './helpers'
+
+// Composite types for joined queries
+export type SupabaseMembershipWithOrganization = SupabaseOrgMembership & {
+  organization: SupabaseOrganization | null
+}

package/src/supabase/server/client.ts

@@ -1,58 +1,58 @@
-/**
- * Centralized Supabase client
- * Single source of truth for database connections across the monorepo
- * Used by: apps/api, organizations/registry (agent/workflow definitions), packages/core (sessions)
- */
-
-import type { SupabaseClient } from '@supabase/supabase-js'
-import type { Database } from '../database.types'
-
-let _supabaseClient: SupabaseClient<Database> | null = null
-
-/**
- * Get Supabase service role client (lazy initialization)
- * Bypasses RLS policies - use with caution, always enforce authorization in application logic
- *
- * @returns Authenticated Supabase client instance
- * @throws Error if SUPABASE_URL or SUPABASE_SERVICE_KEY environment variables are missing
- */
-export async function getSupabaseClient(): Promise<SupabaseClient<Database>> {
-  if (!_supabaseClient) {
-    const { createClient } = await import('@supabase/supabase-js')
-
-    const supabaseUrl = process.env.SUPABASE_URL
-    const supabaseServiceKey = process.env.SUPABASE_SERVICE_KEY
-
-    if (!supabaseUrl || !supabaseServiceKey) {
-      throw new Error('Missing Supabase environment variables: SUPABASE_URL and SUPABASE_SERVICE_KEY are required')
-    }
-
-    _supabaseClient = createClient<Database>(supabaseUrl, supabaseServiceKey, {
-      auth: {
-        autoRefreshToken: false,
-        persistSession: false
-      }
-    })
-  }
-
-  return _supabaseClient
-}
-
-/**
- * Synchronous client getter (for backward compatibility)
- * Returns cached client or throws if not initialized
- *
- * @deprecated Use getSupabaseClient() for new code
- * @throws Error if client not initialized - call getSupabaseClient() first
- */
-export const supabaseClient = new Proxy({} as SupabaseClient<Database>, {
-  get(_target, prop) {
-    if (!_supabaseClient) {
-      throw new Error(
-        'Supabase client not initialized. Call getSupabaseClient() first or use top-level await: ' +
-          'const client = await getSupabaseClient()'
-      )
-    }
-    return Reflect.get(_supabaseClient, prop)
-  }
-})
+/**
+ * Centralized Supabase client
+ * Single source of truth for database connections across the monorepo
+ * Used by: apps/api, organizations/registry (agent/workflow definitions), packages/core (sessions)
+ */
+
+import type { SupabaseClient } from '@supabase/supabase-js'
+import type { Database } from '../database.types'
+
+let _supabaseClient: SupabaseClient<Database> | null = null
+
+/**
+ * Get Supabase service role client (lazy initialization)
+ * Bypasses RLS policies - use with caution, always enforce authorization in application logic
+ *
+ * @returns Authenticated Supabase client instance
+ * @throws Error if SUPABASE_URL or SUPABASE_SERVICE_KEY environment variables are missing
+ */
+export async function getSupabaseClient(): Promise<SupabaseClient<Database>> {
+  if (!_supabaseClient) {
+    const { createClient } = await import('@supabase/supabase-js')
+
+    const supabaseUrl = process.env.SUPABASE_URL
+    const supabaseServiceKey = process.env.SUPABASE_SERVICE_KEY
+
+    if (!supabaseUrl || !supabaseServiceKey) {
+      throw new Error('Missing Supabase environment variables: SUPABASE_URL and SUPABASE_SERVICE_KEY are required')
+    }
+
+    _supabaseClient = createClient<Database>(supabaseUrl, supabaseServiceKey, {
+      auth: {
+        autoRefreshToken: false,
+        persistSession: false
+      }
+    })
+  }
+
+  return _supabaseClient
+}
+
+/**
+ * Synchronous client getter (for backward compatibility)
+ * Returns cached client or throws if not initialized
+ *
+ * @deprecated Use getSupabaseClient() for new code
+ * @throws Error if client not initialized - call getSupabaseClient() first
+ */
+export const supabaseClient = new Proxy({} as SupabaseClient<Database>, {
+  get(_target, prop) {
+    if (!_supabaseClient) {
+      throw new Error(
+        'Supabase client not initialized. Call getSupabaseClient() first or use top-level await: ' +
+          'const client = await getSupabaseClient()'
+      )
+    }
+    return Reflect.get(_supabaseClient, prop)
+  }
+})

package/src/test-utils/README.md

@@ -1,150 +1,42 @@
 # Test Utilities
 
-Shared test utilities for Elevasis monorepo testing. Provides fixtures, mocks, and test helpers following DRY principles.
-
-## Structure
-
-```
-test-utils/
-├── fixtures/           # Test data using real Supabase types
-│   ├── users.ts       # User fixtures (SupabaseUserProfile)
-│   ├── organizations.ts
-│   ├── memberships.ts
-│   └── api-keys.ts
-├── mocks/             # Mock implementations
-│   ├── supabase.ts   # Supabase client mock
-│   └── workos.ts     # WorkOS JWT mock
-└── index.ts          # Re-exports all utilities
-```
-
-## Fixtures
-
-All fixtures use actual Supabase types from `@elevasis/core/supabase` for type safety.
-
-### User Fixtures
+Published test helpers for downstream consumers of `@elevasis/core`.
 
-```typescript
-import { TEST_USERS, createTestUser } from '@elevasis/core/test-utils'
-
-// Pre-defined users
-TEST_USERS.admin         // Platform admin user
-TEST_USERS.regularUser   // Regular user with membership
-TEST_USERS.inactiveUser  // Inactive user
-
-// Create custom user
-const customUser = createTestUser({
-  email: 'custom@example.com',
-  is_platform_admin: true
-})
-```
-
-### Organization Fixtures
+The public `@elevasis/core/test-utils` subpath is intentionally narrow. It exposes:
 
-```typescript
-import { TEST_ORGS, createTestOrg } from '@elevasis/core/test-utils'
-
-TEST_ORGS.acme    // Acme Corp (active, test org)
-TEST_ORGS.beta    // Beta Inc (active, test org)
-TEST_ORGS.gamma   // Gamma LLC (active, test org)
-TEST_ORGS.inactive // Inactive Org
-```
-
-### Membership Fixtures
+- `RLSTestContext` for dev-database RLS integration tests
+- `setupMatchMedia`, `setupResizeObserver`, and `setupBrowserMocks` for jsdom/browser test setup
 
-```typescript
-import { TEST_MEMBERSHIPS, TEST_MEMBERSHIPS_WITH_ORG } from '@elevasis/core/test-utils'
-
-// Simple memberships
-TEST_MEMBERSHIPS.regularUserAcme  // regularUser admin in Acme
-TEST_MEMBERSHIPS.regularUserBeta  // regularUser member in Beta
-
-// Memberships with organization data (for joined queries)
-TEST_MEMBERSHIPS_WITH_ORG.regularUserAcme
-```
-
-### API Key Fixtures
+Internal monorepo fixtures and Vitest-specific mocks still exist under `packages/core/src/test-utils/`, but they are not part of the published package contract.
 
-```typescript
-import { TEST_API_KEYS, TEST_API_KEY_PLAINTEXTS } from '@elevasis/core/test-utils'
-
-// API key records (with hashed keys)
-TEST_API_KEYS.acmeKey
-TEST_API_KEYS.betaKey
-
-// Plaintext keys for Authorization headers
-TEST_API_KEY_PLAINTEXTS.acmeKey  // 'sk_test_acme_12345'
-```
-
-## Mocks
-
-### Supabase Client Mock
+## Published Usage
 
-```typescript
-import { createMockSupabaseClient, TEST_USERS, TEST_ORGS } from '@elevasis/core/test-utils'
-import { vi } from 'vitest'
-
-// Create mock with test data
-const mockClient = createMockSupabaseClient({
-  users: [TEST_USERS.admin, TEST_USERS.regularUser],
-  organizations: [TEST_ORGS.acme, TEST_ORGS.beta]
-})
-
-// Use in tests
-vi.mock('../lib/supabase', () => ({ supabaseClient: mockClient }))
-
-// Query will work with mock data
-const { data } = await supabaseClient
-  .from('users')
-  .select('*')
-  .eq('email', 'admin@test.com')
-  .single()
-// data === TEST_USERS.admin
-```
-
-### WorkOS JWT Mock
+### Browser Mocks
 
 ```typescript
-import { createMockVerifyJWT, mockExtractToken, TEST_USERS } from '@elevasis/core/test-utils'
-import { vi } from 'vitest'
-
-const mockVerifyJWT = createMockVerifyJWT({
-  'valid-token': {
-    workosId: TEST_USERS.admin.workos_user_id,
-    supabaseId: TEST_USERS.admin.id,
-    email: TEST_USERS.admin.email
-  }
-})
-
-vi.mock('../identity/auth/jwt-verifier', () => ({
-  verifyJWT: mockVerifyJWT,
-  extractToken: mockExtractToken
-}))
-
-// JWT verification will return mock user
-const user = await verifyJWT('valid-token')
-// user.email === 'admin@test.com'
-```
-
-## Usage in Apps
-
-Apps can import test utilities directly:
+import { setupBrowserMocks } from '@elevasis/core/test-utils'
+
+setupBrowserMocks()
+```
+
+### RLS Integration Tests
 
 ```typescript
-// In apps/api/src/test-utils/index.ts
-export * from '@elevasis/core/test-utils'  // Re-export shared utilities
-export * from './fastify-test'         // Add app-specific utilities
+import { RLSTestContext } from '@elevasis/core/test-utils'
+
+const ctx = new RLSTestContext()
 ```
-
-## Type Safety
-
-All fixtures use actual Supabase types:
-- Changes to database schema automatically update test types
-- TypeScript compiler validates test data structure
-- Single source of truth for types
-
-## Design Principles
-
-- **DRY:** Shared fixtures in `@elevasis/core`, imported by apps
-- **Type Safety:** Use `SupabaseUserProfile`, `SupabaseOrganization`, etc.
-- **Realistic Data:** Fixtures match production schema and patterns
-- **Composable:** Combine fixtures, mocks, and helpers as needed
+
+`RLSTestContext` requires a configured Supabase development environment:
+
+- `SUPABASE_URL`
+- `SUPABASE_ANON_KEY`
+- `SUPABASE_SERVICE_KEY`
+- `SUPABASE_JWT_SECRET`
+
+## Internal Scope
+
+The following folders remain implementation detail for the monorepo and are not published:
+
+- `fixtures/`
+- `mocks/`

package/src/test-utils/browser-mocks.ts

@@ -1,54 +1,54 @@
-/**
- * Browser Mocks for Testing
- *
- * Centralized browser API mocks for testing React components in jsdom environment.
- * These mocks are required for Mantine components and other UI libraries.
- *
- * @note This file is only used in test environments with jsdom.
- */
-
-/* eslint-disable @typescript-eslint/no-explicit-any */
-
-/**
- * Mock window.matchMedia for testing
- * Required for Mantine components that use media queries
- */
-export function setupMatchMedia(): void {
-  const win = (globalThis as any).window
-  if (typeof win === 'undefined') return
-
-  Object.defineProperty(win, 'matchMedia', {
-    writable: true,
-    value: (query: string) => ({
-      matches: false,
-      media: query,
-      onchange: null,
-      addListener: () => {},
-      removeListener: () => {},
-      addEventListener: () => {},
-      removeEventListener: () => {},
-      dispatchEvent: () => true
-    })
-  })
-}
-
-/**
- * Mock ResizeObserver for testing
- * Required for Mantine components that observe element size changes
- */
-export function setupResizeObserver(): void {
-  ;(globalThis as any).ResizeObserver = class ResizeObserver {
-    observe() {}
-    unobserve() {}
-    disconnect() {}
-  }
-}
-
-/**
- * Setup all browser mocks at once
- * Convenience function for test setup files
- */
-export function setupBrowserMocks(): void {
-  setupMatchMedia()
-  setupResizeObserver()
-}
+/**
+ * Browser Mocks for Testing
+ *
+ * Centralized browser API mocks for testing React components in jsdom environment.
+ * These mocks are required for Mantine components and other UI libraries.
+ *
+ * @note This file is only used in test environments with jsdom.
+ */
+
+/* eslint-disable @typescript-eslint/no-explicit-any */
+
+/**
+ * Mock window.matchMedia for testing
+ * Required for Mantine components that use media queries
+ */
+export function setupMatchMedia(): void {
+  const win = (globalThis as any).window
+  if (typeof win === 'undefined') return
+
+  Object.defineProperty(win, 'matchMedia', {
+    writable: true,
+    value: (query: string) => ({
+      matches: false,
+      media: query,
+      onchange: null,
+      addListener: () => {},
+      removeListener: () => {},
+      addEventListener: () => {},
+      removeEventListener: () => {},
+      dispatchEvent: () => true
+    })
+  })
+}
+
+/**
+ * Mock ResizeObserver for testing
+ * Required for Mantine components that observe element size changes
+ */
+export function setupResizeObserver(): void {
+  ;(globalThis as any).ResizeObserver = class ResizeObserver {
+    observe() {}
+    unobserve() {}
+    disconnect() {}
+  }
+}
+
+/**
+ * Setup all browser mocks at once
+ * Convenience function for test setup files
+ */
+export function setupBrowserMocks(): void {
+  setupMatchMedia()
+  setupResizeObserver()
+}

package/src/test-utils/fixtures/api-keys.ts

@@ -1,52 +1,52 @@
-import type { SupabaseApiKey } from '../../supabase'
-import { TEST_ORGS } from './organizations'
-
-/**
- * Test API key fixtures using actual Supabase types
- * Note: key_hash is bcrypt hash of the plaintext key shown in comments
- */
-export const TEST_API_KEYS: Record<string, SupabaseApiKey> = {
-  acmeKey: {
-    id: '00000000-0000-0000-0000-000000000030',
-    organization_id: TEST_ORGS.acme.id,
-    name: 'Acme Production Key',
-    // Plaintext: sk_test_acme_12345
-    key_hash: '$2b$10$abcdefghijklmnopqrstuvwxyz1234567890ABCDEFGHIJKLMNOP',
-    created_at: '2025-01-01T00:00:00Z',
-    last_used_at: null
-  },
-  betaKey: {
-    id: '00000000-0000-0000-0000-000000000031',
-    organization_id: TEST_ORGS.beta.id,
-    name: 'Beta Development Key',
-    // Plaintext: sk_test_beta_67890
-    key_hash: '$2b$10$zyxwvutsrqponmlkjihgfedcba0987654321ZYXWVUTSRQPONMLKJIH',
-    created_at: '2025-01-01T00:00:00Z',
-    last_used_at: '2025-01-02T00:00:00Z'
-  }
-}
-
-/**
- * Plaintext API keys for testing (matches hashes above conceptually)
- * In real tests, use these for Authorization: Bearer headers
- */
-export const TEST_API_KEY_PLAINTEXTS: Record<string, string> = {
-  acmeKey: 'sk_test_acme_12345',
-  betaKey: 'sk_test_beta_67890',
-  invalid: 'sk_test_invalid_99999'
-}
-
-/**
- * Helper to create custom API key fixture
- */
-export function createTestApiKey(overrides: Partial<SupabaseApiKey>): SupabaseApiKey {
-  return {
-    id: '00000000-0000-0000-0000-999999999999',
-    organization_id: TEST_ORGS.acme.id,
-    name: 'Custom Test Key',
-    key_hash: '$2b$10$customhashvalue1234567890',
-    created_at: '2025-01-01T00:00:00Z',
-    last_used_at: null,
-    ...overrides
-  }
-}
+import type { SupabaseApiKey } from '../../supabase'
+import { TEST_ORGS } from './organizations'
+
+/**
+ * Test API key fixtures using actual Supabase types
+ * Note: key_hash is bcrypt hash of the plaintext key shown in comments
+ */
+export const TEST_API_KEYS: Record<string, SupabaseApiKey> = {
+  acmeKey: {
+    id: '00000000-0000-0000-0000-000000000030',
+    organization_id: TEST_ORGS.acme.id,
+    name: 'Acme Production Key',
+    // Plaintext: sk_test_acme_12345
+    key_hash: '$2b$10$abcdefghijklmnopqrstuvwxyz1234567890ABCDEFGHIJKLMNOP',
+    created_at: '2025-01-01T00:00:00Z',
+    last_used_at: null
+  },
+  betaKey: {
+    id: '00000000-0000-0000-0000-000000000031',
+    organization_id: TEST_ORGS.beta.id,
+    name: 'Beta Development Key',
+    // Plaintext: sk_test_beta_67890
+    key_hash: '$2b$10$zyxwvutsrqponmlkjihgfedcba0987654321ZYXWVUTSRQPONMLKJIH',
+    created_at: '2025-01-01T00:00:00Z',
+    last_used_at: '2025-01-02T00:00:00Z'
+  }
+}
+
+/**
+ * Plaintext API keys for testing (matches hashes above conceptually)
+ * In real tests, use these for Authorization: Bearer headers
+ */
+export const TEST_API_KEY_PLAINTEXTS: Record<string, string> = {
+  acmeKey: 'sk_test_acme_12345',
+  betaKey: 'sk_test_beta_67890',
+  invalid: 'sk_test_invalid_99999'
+}
+
+/**
+ * Helper to create custom API key fixture
+ */
+export function createTestApiKey(overrides: Partial<SupabaseApiKey>): SupabaseApiKey {
+  return {
+    id: '00000000-0000-0000-0000-999999999999',
+    organization_id: TEST_ORGS.acme.id,
+    name: 'Custom Test Key',
+    key_hash: '$2b$10$customhashvalue1234567890',
+    created_at: '2025-01-01T00:00:00Z',
+    last_used_at: null,
+    ...overrides
+  }
+}