@exortek/apikey 1.0.0 → 1.0.1

package/CHANGELOG.md

@@ -1,38 +1,38 @@
 # @exortek/apikey
 
+## 1.0.1
+
+### Patch Changes
+
+- 31223e4: Consolidate duplicated store internals into @exortek/shared utilities (redis-helpers, incr-store,
+  record-store). No public API changes.
+
+  apikey: fix Redis store race condition where a concurrent update() could silently un-revoke a key — revocations now
+  use a tombstone key that update() never touches.
+
+  apikey: fix memory store put() storing by reference instead of copying — now consistent with getById()'s copy-on-read
+  contract.
+
 ## 1.0.0
 
 ### Initial release
 
-- **`createApiKey(options)`** — mint a Stripe-style 3-segment token
-  `<prefix>_<id>_<secret>` (base32-crockford, no ambiguous glyphs).
-  Stores an HMAC-SHA256 hash of the secret plus a plaintext id for
-  O(1) lookup. Optional peppers (newest-first array, each ≥16 bytes)
-  turn a stolen DB into a non-crackable artifact.
-- **`verifyApiKey(rawKey, options)`** — parse, look up by id, timing-safe
-  hash compare, expiry / revocation / scope enforcement. Returns
-  `{ valid: true, userId, scopes, id, prefix, name?, environment?, metadata?, needsRehash? }`
-  or `{ valid: false, reason }` — never throws on a bad key.
-- **Scopes:** `hasAll` / `hasAny` / `covers` with `*` super wildcard and
-  `namespace:*` suffix wildcard.
-- **Pepper rotation:** verify against every pepper, mint with the
-  newest; `needsRehash: true` in the verify result signals the secret
-  matched an older pepper so `rehashApiKey` can silently migrate
-  storage.
-- **`revokeApiKey`** (by key or id), **`revokeAllForUser`**,
-  **`listApiKeys`** (sorted most-recently-used first).
-- **`mask(key)`** log-safe display, **`parseApiKey(key)`** unverified
-  segment extraction.
-- **Stores:** `memoryStore()` and `redisStore(client, options?)` under
-  the `@exortek/apikey/stores` subpath. Standard CRUD (`put` /
-  `getById` / `update` / `revoke` / `revokeAllForUser` / `listByUser`)
-  — bring your own by implementing the interface.
-- **Middleware:** Express (`@exortek/apikey/middleware/express`) and
-  Fastify (`@exortek/apikey/middleware/fastify`) adapters over a
-  shared `middleware/core.js` — `Authorization: Bearer <key>` by
-  default, configurable header + raw scheme + opt-in query-param
-  fallback. Attaches the verify result to `req.apiKey`.
-- **Errors:** `ApiKeyError` + `ErrorCode` catalogue
-  (`INVALID_ARGUMENT` / `INVALID_PREFIX` / `INVALID_PEPPER` /
-  `STORE_ERROR`). Expected verify failures surface as
-  `{ valid: false, reason }`, not exceptions.
+- **`createApiKey(options)`** — mint a Stripe-style 3-segment token `<prefix>_<id>_<secret>` (base32-crockford, no
+  ambiguous glyphs). Stores an HMAC-SHA256 hash of the secret plus a plaintext id for O(1) lookup. Optional peppers
+  (newest-first array, each ≥16 bytes) turn a stolen DB into a non-crackable artifact.
+- **`verifyApiKey(rawKey, options)`** — parse, look up by id, timing-safe hash compare, expiry / revocation / scope
+  enforcement. Returns `{ valid: true, userId, scopes, id, prefix, name?, environment?, metadata?, needsRehash? }` or
+  `{ valid: false, reason }` — never throws on a bad key.
+- **Scopes:** `hasAll` / `hasAny` / `covers` with `*` super wildcard and `namespace:*` suffix wildcard.
+- **Pepper rotation:** verify against every pepper, mint with the newest; `needsRehash: true` in the verify result
+  signals the secret matched an older pepper so `rehashApiKey` can silently migrate storage.
+- **`revokeApiKey`** (by key or id), **`revokeAllForUser`**, **`listApiKeys`** (sorted most-recently-used first).
+- **`mask(key)`** log-safe display, **`parseApiKey(key)`** unverified segment extraction.
+- **Stores:** `memoryStore()` and `redisStore(client, options?)` under the `@exortek/apikey/stores` subpath. Standard
+  CRUD (`put` / `getById` / `update` / `revoke` / `revokeAllForUser` / `listByUser`) — bring your own by implementing
+  the interface.
+- **Middleware:** Express (`@exortek/apikey/middleware/express`) and Fastify (`@exortek/apikey/middleware/fastify`)
+  adapters over a shared `middleware/core.js` — `Authorization: Bearer <key>` by default, configurable header + raw
+  scheme + opt-in query-param fallback. Attaches the verify result to `req.apiKey`.
+- **Errors:** `ApiKeyError` + `ErrorCode` catalogue (`INVALID_ARGUMENT` / `INVALID_PREFIX` / `INVALID_PEPPER` /
+  `STORE_ERROR`). Expected verify failures surface as `{ valid: false, reason }`, not exceptions.

package/dist/index.cjs

@@ -1093,15 +1093,25 @@ function parseApiKey(key) {
   // secret use the base32-crockford alphabet which contains no
   // underscores — so the last two '_' cleanly bound them.
   const lastUnderscore = key.lastIndexOf('_');
-  if (lastUnderscore <= 0) {return null;}
+  if (lastUnderscore <= 0) {
+    return null;
+  }
   const prevUnderscore = key.lastIndexOf('_', lastUnderscore - 1);
-  if (prevUnderscore <= 0) {return null;}
+  if (prevUnderscore <= 0) {
+    return null;
+  }
   const prefix = key.slice(0, prevUnderscore);
   const id = key.slice(prevUnderscore + 1, lastUnderscore);
   const secret = key.slice(lastUnderscore + 1);
-  if (!PREFIX_RE.test(prefix)) {return null;}
-  if (id.length !== ID_CHARS || !CROCKFORD_RE.test(id)) {return null;}
-  if (secret.length !== SECRET_CHARS || !CROCKFORD_RE.test(secret)) {return null;}
+  if (!PREFIX_RE.test(prefix)) {
+    return null;
+  }
+  if (id.length !== ID_CHARS || !CROCKFORD_RE.test(id)) {
+    return null;
+  }
+  if (secret.length !== SECRET_CHARS || !CROCKFORD_RE.test(secret)) {
+    return null;
+  }
   return { prefix, id, secret };
 }
 

package/dist/index.mjs

@@ -1091,15 +1091,25 @@ function parseApiKey(key) {
   // secret use the base32-crockford alphabet which contains no
   // underscores — so the last two '_' cleanly bound them.
   const lastUnderscore = key.lastIndexOf('_');
-  if (lastUnderscore <= 0) {return null;}
+  if (lastUnderscore <= 0) {
+    return null;
+  }
   const prevUnderscore = key.lastIndexOf('_', lastUnderscore - 1);
-  if (prevUnderscore <= 0) {return null;}
+  if (prevUnderscore <= 0) {
+    return null;
+  }
   const prefix = key.slice(0, prevUnderscore);
   const id = key.slice(prevUnderscore + 1, lastUnderscore);
   const secret = key.slice(lastUnderscore + 1);
-  if (!PREFIX_RE.test(prefix)) {return null;}
-  if (id.length !== ID_CHARS || !CROCKFORD_RE.test(id)) {return null;}
-  if (secret.length !== SECRET_CHARS || !CROCKFORD_RE.test(secret)) {return null;}
+  if (!PREFIX_RE.test(prefix)) {
+    return null;
+  }
+  if (id.length !== ID_CHARS || !CROCKFORD_RE.test(id)) {
+    return null;
+  }
+  if (secret.length !== SECRET_CHARS || !CROCKFORD_RE.test(secret)) {
+    return null;
+  }
   return { prefix, id, secret };
 }
 

package/dist/middleware/express.cjs

@@ -914,15 +914,25 @@ function parseApiKey(key) {
   // secret use the base32-crockford alphabet which contains no
   // underscores — so the last two '_' cleanly bound them.
   const lastUnderscore = key.lastIndexOf('_');
-  if (lastUnderscore <= 0) {return null;}
+  if (lastUnderscore <= 0) {
+    return null;
+  }
   const prevUnderscore = key.lastIndexOf('_', lastUnderscore - 1);
-  if (prevUnderscore <= 0) {return null;}
+  if (prevUnderscore <= 0) {
+    return null;
+  }
   const prefix = key.slice(0, prevUnderscore);
   const id = key.slice(prevUnderscore + 1, lastUnderscore);
   const secret = key.slice(lastUnderscore + 1);
-  if (!PREFIX_RE.test(prefix)) {return null;}
-  if (id.length !== ID_CHARS || !CROCKFORD_RE.test(id)) {return null;}
-  if (secret.length !== SECRET_CHARS || !CROCKFORD_RE.test(secret)) {return null;}
+  if (!PREFIX_RE.test(prefix)) {
+    return null;
+  }
+  if (id.length !== ID_CHARS || !CROCKFORD_RE.test(id)) {
+    return null;
+  }
+  if (secret.length !== SECRET_CHARS || !CROCKFORD_RE.test(secret)) {
+    return null;
+  }
   return { prefix, id, secret };
 }
 

package/dist/middleware/express.mjs

@@ -912,15 +912,25 @@ function parseApiKey(key) {
   // secret use the base32-crockford alphabet which contains no
   // underscores — so the last two '_' cleanly bound them.
   const lastUnderscore = key.lastIndexOf('_');
-  if (lastUnderscore <= 0) {return null;}
+  if (lastUnderscore <= 0) {
+    return null;
+  }
   const prevUnderscore = key.lastIndexOf('_', lastUnderscore - 1);
-  if (prevUnderscore <= 0) {return null;}
+  if (prevUnderscore <= 0) {
+    return null;
+  }
   const prefix = key.slice(0, prevUnderscore);
   const id = key.slice(prevUnderscore + 1, lastUnderscore);
   const secret = key.slice(lastUnderscore + 1);
-  if (!PREFIX_RE.test(prefix)) {return null;}
-  if (id.length !== ID_CHARS || !CROCKFORD_RE.test(id)) {return null;}
-  if (secret.length !== SECRET_CHARS || !CROCKFORD_RE.test(secret)) {return null;}
+  if (!PREFIX_RE.test(prefix)) {
+    return null;
+  }
+  if (id.length !== ID_CHARS || !CROCKFORD_RE.test(id)) {
+    return null;
+  }
+  if (secret.length !== SECRET_CHARS || !CROCKFORD_RE.test(secret)) {
+    return null;
+  }
   return { prefix, id, secret };
 }
 

package/dist/middleware/fastify.cjs

@@ -915,15 +915,25 @@ function parseApiKey(key) {
   // secret use the base32-crockford alphabet which contains no
   // underscores — so the last two '_' cleanly bound them.
   const lastUnderscore = key.lastIndexOf('_');
-  if (lastUnderscore <= 0) {return null;}
+  if (lastUnderscore <= 0) {
+    return null;
+  }
   const prevUnderscore = key.lastIndexOf('_', lastUnderscore - 1);
-  if (prevUnderscore <= 0) {return null;}
+  if (prevUnderscore <= 0) {
+    return null;
+  }
   const prefix = key.slice(0, prevUnderscore);
   const id = key.slice(prevUnderscore + 1, lastUnderscore);
   const secret = key.slice(lastUnderscore + 1);
-  if (!PREFIX_RE.test(prefix)) {return null;}
-  if (id.length !== ID_CHARS || !CROCKFORD_RE.test(id)) {return null;}
-  if (secret.length !== SECRET_CHARS || !CROCKFORD_RE.test(secret)) {return null;}
+  if (!PREFIX_RE.test(prefix)) {
+    return null;
+  }
+  if (id.length !== ID_CHARS || !CROCKFORD_RE.test(id)) {
+    return null;
+  }
+  if (secret.length !== SECRET_CHARS || !CROCKFORD_RE.test(secret)) {
+    return null;
+  }
   return { prefix, id, secret };
 }
 

package/dist/middleware/fastify.mjs

@@ -913,15 +913,25 @@ function parseApiKey(key) {
   // secret use the base32-crockford alphabet which contains no
   // underscores — so the last two '_' cleanly bound them.
   const lastUnderscore = key.lastIndexOf('_');
-  if (lastUnderscore <= 0) {return null;}
+  if (lastUnderscore <= 0) {
+    return null;
+  }
   const prevUnderscore = key.lastIndexOf('_', lastUnderscore - 1);
-  if (prevUnderscore <= 0) {return null;}
+  if (prevUnderscore <= 0) {
+    return null;
+  }
   const prefix = key.slice(0, prevUnderscore);
   const id = key.slice(prevUnderscore + 1, lastUnderscore);
   const secret = key.slice(lastUnderscore + 1);
-  if (!PREFIX_RE.test(prefix)) {return null;}
-  if (id.length !== ID_CHARS || !CROCKFORD_RE.test(id)) {return null;}
-  if (secret.length !== SECRET_CHARS || !CROCKFORD_RE.test(secret)) {return null;}
+  if (!PREFIX_RE.test(prefix)) {
+    return null;
+  }
+  if (id.length !== ID_CHARS || !CROCKFORD_RE.test(id)) {
+    return null;
+  }
+  if (secret.length !== SECRET_CHARS || !CROCKFORD_RE.test(secret)) {
+    return null;
+  }
   return { prefix, id, secret };
 }