@game-infra/api-schemas-core 0.0.0 → 0.4.0

package/dist/serviceToken.d.ts

@@ -0,0 +1,393 @@
+import { type InferOutput } from "valibot";
+/**
+ * Service tokens are long-lived credentials a script or backend service
+ * presents to game-infra APIs on behalf of the account that created them.
+ *
+ * The issuer never stores the token. It stores only the reference needed to
+ * withdraw one — the token id, its owner, and its expiry — and the token itself
+ * carries that id, so revocation is a write against the id rather than a lookup
+ * of the secret. A token is therefore shown exactly once, at creation.
+ */
+/**
+ * Bounds shared by the UI and the service, so both reject the same input.
+ *
+ * The TTL ceiling is a year: past that the token stops being a credential
+ * anyone rotates and becomes one nobody remembers issuing, and the expiry is
+ * the only thing that retires a token no one revokes.
+ *
+ * @example
+ * ```ts
+ * import { ServiceTokenValidation } from '@game-infra/api-schemas-core'
+ *
+ * const ttl = Math.min(requested, ServiceTokenValidation.MAX_TTL_SECONDS)
+ * ```
+ */
+export declare const ServiceTokenValidation: {
+    readonly MIN_NAME_LENGTH: 1;
+    readonly MAX_NAME_LENGTH: 100;
+    /** One hour. Shorter than this and the token cannot outlive a login. */
+    readonly MIN_TTL_SECONDS: number;
+    /** 365 days. */
+    readonly MAX_TTL_SECONDS: number;
+    /** 30 days — the default a caller gets when it names no TTL. */
+    readonly DEFAULT_TTL_SECONDS: number;
+    /** Token ids are `st_` plus 32 lowercase hex characters. */
+    readonly TOKEN_ID_PATTERN: RegExp;
+};
+/**
+ * A stored service-token id.
+ *
+ * @example
+ * ```ts
+ * import { ServiceTokenIdSchema } from '@game-infra/api-schemas-core'
+ * import { parse } from 'valibot'
+ *
+ * parse(ServiceTokenIdSchema, 'st_0123456789abcdef0123456789abcdef')
+ * ```
+ */
+export declare const ServiceTokenIdSchema: import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").RegexAction<string, "Not a service-token id">]>;
+/**
+ * Everything the issuer keeps about a service token — which is everything
+ * except the token.
+ *
+ * @example
+ * ```ts
+ * import type { ServiceToken } from '@game-infra/api-schemas-core'
+ *
+ * const isLive = (token: ServiceToken) => !token.revokedAt && Date.parse(token.expiresAt) > Date.now()
+ * ```
+ */
+export declare const ServiceTokenSchema: import("valibot").ObjectSchema<{
+    /** Token id, carried by the token as its `jti` claim. */
+    readonly id: import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").RegexAction<string, "Not a service-token id">]>;
+    /** Caller-supplied label, the only way a human tells two tokens apart. */
+    readonly name: import("valibot").StringSchema<undefined>;
+    /** Account the token acts as. */
+    readonly userId: import("valibot").NumberSchema<undefined>;
+    /** Username of that account, as of issue time. */
+    readonly username: import("valibot").StringSchema<undefined>;
+    /** Authorization claims the token carries; never wider than the creator's. */
+    readonly claims: import("valibot").ArraySchema<import("valibot").StringSchema<undefined>, undefined>;
+    /** ISO-8601 issue time. */
+    readonly createdAt: import("valibot").StringSchema<undefined>;
+    /** ISO-8601 expiry, stamped into the token and not extendable. */
+    readonly expiresAt: import("valibot").StringSchema<undefined>;
+    /** ISO-8601 revocation time, or `null` while the token is still honoured. */
+    readonly revokedAt: import("valibot").NullableSchema<import("valibot").StringSchema<undefined>, undefined>;
+    /** ISO-8601 time the token last validated successfully, or `null`. */
+    readonly lastUsedAt: import("valibot").NullableSchema<import("valibot").StringSchema<undefined>, undefined>;
+}, undefined>;
+/**
+ * Inferred stored service-token record.
+ *
+ * @example
+ * ```ts
+ * import type { ServiceToken } from '@game-infra/api-schemas-core'
+ *
+ * const id: ServiceToken['id'] = 'st_0123456789abcdef0123456789abcdef'
+ * ```
+ */
+export type ServiceToken = InferOutput<typeof ServiceTokenSchema>;
+/**
+ * Request to mint a service token.
+ *
+ * `claims` is a request, not a grant: the service intersects it with the
+ * creator's own claims, so a token can never reach further than the account
+ * that created it.
+ *
+ * @example
+ * ```ts
+ * import { CreateServiceTokenRequestSchema } from '@game-infra/api-schemas-core'
+ * import { parse } from 'valibot'
+ *
+ * parse(CreateServiceTokenRequestSchema, { name: 'nightly-import', ttlSeconds: 604800 })
+ * ```
+ */
+export declare const CreateServiceTokenRequestSchema: import("valibot").ObjectSchema<{
+    readonly name: import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").MinLengthAction<string, 1, "Name is required">, import("valibot").MaxLengthAction<string, 100, undefined>]>;
+    readonly ttlSeconds: import("valibot").OptionalSchema<import("valibot").SchemaWithPipe<readonly [import("valibot").NumberSchema<undefined>, import("valibot").IntegerAction<number, "TTL must be a whole number of seconds">, import("valibot").MinValueAction<number, number, undefined>, import("valibot").MaxValueAction<number, number, undefined>]>, undefined>;
+    readonly claims: import("valibot").OptionalSchema<import("valibot").ArraySchema<import("valibot").StringSchema<undefined>, undefined>, undefined>;
+}, undefined>;
+/**
+ * Inferred create-service-token request.
+ *
+ * @example
+ * ```ts
+ * import type { CreateServiceTokenRequest } from '@game-infra/api-schemas-core'
+ *
+ * const request: CreateServiceTokenRequest = { name: 'nightly-import' }
+ * ```
+ */
+export type CreateServiceTokenRequest = InferOutput<typeof CreateServiceTokenRequestSchema>;
+/**
+ * The one and only response that carries the token itself.
+ *
+ * @example
+ * ```ts
+ * import type { CreateServiceTokenResponse } from '@game-infra/api-schemas-core'
+ *
+ * const show = (response: CreateServiceTokenResponse) => response.token
+ * ```
+ */
+export declare const CreateServiceTokenResponseSchema: import("valibot").ObjectSchema<{
+    readonly success: import("valibot").BooleanSchema<undefined>;
+    readonly error: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+} & {
+    /** The signed token. Not stored, and not retrievable again. */
+    token: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+    serviceToken: import("valibot").OptionalSchema<import("valibot").ObjectSchema<{
+        /** Token id, carried by the token as its `jti` claim. */
+        readonly id: import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").RegexAction<string, "Not a service-token id">]>;
+        /** Caller-supplied label, the only way a human tells two tokens apart. */
+        readonly name: import("valibot").StringSchema<undefined>;
+        /** Account the token acts as. */
+        readonly userId: import("valibot").NumberSchema<undefined>;
+        /** Username of that account, as of issue time. */
+        readonly username: import("valibot").StringSchema<undefined>;
+        /** Authorization claims the token carries; never wider than the creator's. */
+        readonly claims: import("valibot").ArraySchema<import("valibot").StringSchema<undefined>, undefined>;
+        /** ISO-8601 issue time. */
+        readonly createdAt: import("valibot").StringSchema<undefined>;
+        /** ISO-8601 expiry, stamped into the token and not extendable. */
+        readonly expiresAt: import("valibot").StringSchema<undefined>;
+        /** ISO-8601 revocation time, or `null` while the token is still honoured. */
+        readonly revokedAt: import("valibot").NullableSchema<import("valibot").StringSchema<undefined>, undefined>;
+        /** ISO-8601 time the token last validated successfully, or `null`. */
+        readonly lastUsedAt: import("valibot").NullableSchema<import("valibot").StringSchema<undefined>, undefined>;
+    }, undefined>, undefined>;
+}, undefined>;
+/**
+ * Inferred create-service-token response.
+ *
+ * @example
+ * ```ts
+ * import type { CreateServiceTokenResponse } from '@game-infra/api-schemas-core'
+ *
+ * const ok: CreateServiceTokenResponse['success'] = true
+ * ```
+ */
+export type CreateServiceTokenResponse = InferOutput<typeof CreateServiceTokenResponseSchema>;
+/**
+ * The caller's own service tokens, newest first.
+ *
+ * @example
+ * ```ts
+ * import type { ListServiceTokensResponse } from '@game-infra/api-schemas-core'
+ *
+ * const count = (response: ListServiceTokensResponse) => response.serviceTokens?.length ?? 0
+ * ```
+ */
+export declare const ListServiceTokensResponseSchema: import("valibot").ObjectSchema<{
+    readonly success: import("valibot").BooleanSchema<undefined>;
+    readonly error: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+} & {
+    serviceTokens: import("valibot").OptionalSchema<import("valibot").ArraySchema<import("valibot").ObjectSchema<{
+        /** Token id, carried by the token as its `jti` claim. */
+        readonly id: import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").RegexAction<string, "Not a service-token id">]>;
+        /** Caller-supplied label, the only way a human tells two tokens apart. */
+        readonly name: import("valibot").StringSchema<undefined>;
+        /** Account the token acts as. */
+        readonly userId: import("valibot").NumberSchema<undefined>;
+        /** Username of that account, as of issue time. */
+        readonly username: import("valibot").StringSchema<undefined>;
+        /** Authorization claims the token carries; never wider than the creator's. */
+        readonly claims: import("valibot").ArraySchema<import("valibot").StringSchema<undefined>, undefined>;
+        /** ISO-8601 issue time. */
+        readonly createdAt: import("valibot").StringSchema<undefined>;
+        /** ISO-8601 expiry, stamped into the token and not extendable. */
+        readonly expiresAt: import("valibot").StringSchema<undefined>;
+        /** ISO-8601 revocation time, or `null` while the token is still honoured. */
+        readonly revokedAt: import("valibot").NullableSchema<import("valibot").StringSchema<undefined>, undefined>;
+        /** ISO-8601 time the token last validated successfully, or `null`. */
+        readonly lastUsedAt: import("valibot").NullableSchema<import("valibot").StringSchema<undefined>, undefined>;
+    }, undefined>, undefined>, undefined>;
+    /**
+     * The retention window the issuer applies before deleting an expired
+     * record, in seconds.
+     *
+     * A client cannot work out which records a purge would actually remove
+     * without it: an expired token's row survives until the window has passed
+     * too, so "expired" and "purgeable" are different sets, and a UI counting the
+     * first offers to delete rows the service will keep. Optional because a
+     * deployment predating this field does not send it.
+     */
+    retentionSeconds: import("valibot").OptionalSchema<import("valibot").NumberSchema<undefined>, undefined>;
+}, undefined>;
+/**
+ * Inferred list-service-tokens response.
+ *
+ * @example
+ * ```ts
+ * import type { ListServiceTokensResponse } from '@game-infra/api-schemas-core'
+ *
+ * const ok: ListServiceTokensResponse['success'] = true
+ * ```
+ */
+export type ListServiceTokensResponse = InferOutput<typeof ListServiceTokensResponseSchema>;
+/**
+ * Result of revoking a service token.
+ *
+ * @example
+ * ```ts
+ * import type { RevokeServiceTokenResponse } from '@game-infra/api-schemas-core'
+ *
+ * const when = (response: RevokeServiceTokenResponse) => response.serviceToken?.revokedAt
+ * ```
+ */
+export declare const RevokeServiceTokenResponseSchema: import("valibot").ObjectSchema<{
+    readonly success: import("valibot").BooleanSchema<undefined>;
+    readonly error: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+} & {
+    serviceToken: import("valibot").OptionalSchema<import("valibot").ObjectSchema<{
+        /** Token id, carried by the token as its `jti` claim. */
+        readonly id: import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").RegexAction<string, "Not a service-token id">]>;
+        /** Caller-supplied label, the only way a human tells two tokens apart. */
+        readonly name: import("valibot").StringSchema<undefined>;
+        /** Account the token acts as. */
+        readonly userId: import("valibot").NumberSchema<undefined>;
+        /** Username of that account, as of issue time. */
+        readonly username: import("valibot").StringSchema<undefined>;
+        /** Authorization claims the token carries; never wider than the creator's. */
+        readonly claims: import("valibot").ArraySchema<import("valibot").StringSchema<undefined>, undefined>;
+        /** ISO-8601 issue time. */
+        readonly createdAt: import("valibot").StringSchema<undefined>;
+        /** ISO-8601 expiry, stamped into the token and not extendable. */
+        readonly expiresAt: import("valibot").StringSchema<undefined>;
+        /** ISO-8601 revocation time, or `null` while the token is still honoured. */
+        readonly revokedAt: import("valibot").NullableSchema<import("valibot").StringSchema<undefined>, undefined>;
+        /** ISO-8601 time the token last validated successfully, or `null`. */
+        readonly lastUsedAt: import("valibot").NullableSchema<import("valibot").StringSchema<undefined>, undefined>;
+    }, undefined>, undefined>;
+}, undefined>;
+/**
+ * Inferred revoke-service-token response.
+ *
+ * @example
+ * ```ts
+ * import type { RevokeServiceTokenResponse } from '@game-infra/api-schemas-core'
+ *
+ * const ok: RevokeServiceTokenResponse['success'] = true
+ * ```
+ */
+export type RevokeServiceTokenResponse = InferOutput<typeof RevokeServiceTokenResponseSchema>;
+/**
+ * Token a service or script asks the issuer to check.
+ *
+ * @example
+ * ```ts
+ * import { ServiceTokenValidateRequestSchema } from '@game-infra/api-schemas-core'
+ * import { parse } from 'valibot'
+ *
+ * parse(ServiceTokenValidateRequestSchema, { token: 'eyJhbGciOi...' })
+ * ```
+ */
+export declare const ServiceTokenValidateRequestSchema: import("valibot").ObjectSchema<{
+    readonly token: import("valibot").StringSchema<undefined>;
+}, undefined>;
+/**
+ * Inferred service-token validation request.
+ *
+ * @example
+ * ```ts
+ * import type { ServiceTokenValidateRequest } from '@game-infra/api-schemas-core'
+ *
+ * const request: ServiceTokenValidateRequest = { token: 'eyJhbGciOi...' }
+ * ```
+ */
+export type ServiceTokenValidateRequest = InferOutput<typeof ServiceTokenValidateRequestSchema>;
+/**
+ * Why a service token was not accepted.
+ *
+ * `revoked` and `unknown` are the two answers a signature check alone cannot
+ * give, and they are the reason this endpoint exists next to `/auth/validate`:
+ * `unknown` covers a correctly signed token whose record has been purged, which
+ * a caller must treat exactly like a revoked one.
+ *
+ * @example
+ * ```ts
+ * import { ServiceTokenRejectionSchema } from '@game-infra/api-schemas-core'
+ * import { parse } from 'valibot'
+ *
+ * parse(ServiceTokenRejectionSchema, 'revoked')
+ * ```
+ */
+export declare const ServiceTokenRejectionSchema: import("valibot").UnionSchema<[import("valibot").LiteralSchema<"invalid", undefined>, import("valibot").LiteralSchema<"expired", undefined>, import("valibot").LiteralSchema<"revoked", undefined>, import("valibot").LiteralSchema<"unknown", undefined>, import("valibot").LiteralSchema<"wrongTokenType", undefined>], undefined>;
+/**
+ * Inferred service-token rejection reason.
+ *
+ * @example
+ * ```ts
+ * import type { ServiceTokenRejection } from '@game-infra/api-schemas-core'
+ *
+ * const reason: ServiceTokenRejection = 'expired'
+ * ```
+ */
+export type ServiceTokenRejection = InferOutput<typeof ServiceTokenRejectionSchema>;
+/**
+ * Verdict on a service token: signature, expiry, and the revocation list.
+ *
+ * @example
+ * ```ts
+ * import type { ServiceTokenValidateResponse } from '@game-infra/api-schemas-core'
+ *
+ * const accept = (response: ServiceTokenValidateResponse) => response.valid === true
+ * ```
+ */
+export declare const ServiceTokenValidateResponseSchema: import("valibot").ObjectSchema<{
+    readonly success: import("valibot").BooleanSchema<undefined>;
+    readonly error: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+} & {
+    valid: import("valibot").OptionalSchema<import("valibot").BooleanSchema<undefined>, undefined>;
+    /** Set only when `valid` is false. */
+    reason: import("valibot").OptionalSchema<import("valibot").UnionSchema<[import("valibot").LiteralSchema<"invalid", undefined>, import("valibot").LiteralSchema<"expired", undefined>, import("valibot").LiteralSchema<"revoked", undefined>, import("valibot").LiteralSchema<"unknown", undefined>, import("valibot").LiteralSchema<"wrongTokenType", undefined>], undefined>, undefined>;
+    tokenId: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+    userId: import("valibot").OptionalSchema<import("valibot").NumberSchema<undefined>, undefined>;
+    username: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+    claims: import("valibot").OptionalSchema<import("valibot").ArraySchema<import("valibot").StringSchema<undefined>, undefined>, undefined>;
+    expiresAt: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+}, undefined>;
+/**
+ * Inferred service-token validation response.
+ *
+ * @example
+ * ```ts
+ * import type { ServiceTokenValidateResponse } from '@game-infra/api-schemas-core'
+ *
+ * const ok: ServiceTokenValidateResponse['success'] = true
+ * ```
+ */
+export type ServiceTokenValidateResponse = InferOutput<typeof ServiceTokenValidateResponseSchema>;
+/**
+ * How many obsolete token records a purge deleted.
+ *
+ * A record is obsolete once the token it describes has expired past the
+ * retention window: an expired token fails signature-and-expiry verification
+ * everywhere, so keeping its record buys neither revocation nor an answer.
+ *
+ * @example
+ * ```ts
+ * import type { PurgeServiceTokensResponse } from '@game-infra/api-schemas-core'
+ *
+ * const freed = (response: PurgeServiceTokensResponse) => response.purged ?? 0
+ * ```
+ */
+export declare const PurgeServiceTokensResponseSchema: import("valibot").ObjectSchema<{
+    readonly success: import("valibot").BooleanSchema<undefined>;
+    readonly error: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+} & {
+    purged: import("valibot").OptionalSchema<import("valibot").NumberSchema<undefined>, undefined>;
+    /** Retention window applied, in seconds, so a caller can explain the count. */
+    retentionSeconds: import("valibot").OptionalSchema<import("valibot").NumberSchema<undefined>, undefined>;
+}, undefined>;
+/**
+ * Inferred purge-service-tokens response.
+ *
+ * @example
+ * ```ts
+ * import type { PurgeServiceTokensResponse } from '@game-infra/api-schemas-core'
+ *
+ * const ok: PurgeServiceTokensResponse['success'] = true
+ * ```
+ */
+export type PurgeServiceTokensResponse = InferOutput<typeof PurgeServiceTokensResponseSchema>;
+//# sourceMappingURL=serviceToken.d.ts.map

package/dist/serviceToken.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serviceToken.d.ts","sourceRoot":"","sources":["../src/serviceToken.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,WAAW,EAiBjB,MAAM,SAAS,CAAC;AAIjB;;;;;;;;GAQG;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,sBAAsB;aACjC,eAAe,EAAE,CAAC;aAClB,eAAe,EAAE,GAAG;IACpB,wEAAwE;aACxE,eAAe;IACf,gBAAgB;aAChB,eAAe;IACf,gEAAgE;aAChE,mBAAmB;IACnB,4DAA4D;aAC5D,gBAAgB;CACR,CAAC;AAEX;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,yJAGhC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB;IAC7B,yDAAyD;;IAEzD,0EAA0E;;IAE1E,iCAAiC;;IAEjC,kDAAkD;;IAElD,8EAA8E;;IAE9E,2BAA2B;;IAE3B,kEAAkE;;IAElE,6EAA6E;;IAE7E,sEAAsE;;aAEtE,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,MAAM,YAAY,GAAG,WAAW,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAElE;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,+BAA+B;;;;aAe1C,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,MAAM,yBAAyB,GAAG,WAAW,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAE5F;;;;;;;;;GASG;AACH,eAAO,MAAM,gCAAgC;;;;IAC3C,+DAA+D;;;QAvF/D,yDAAyD;;QAEzD,0EAA0E;;QAE1E,iCAAiC;;QAEjC,kDAAkD;;QAElD,8EAA8E;;QAE9E,2BAA2B;;QAE3B,kEAAkE;;QAElE,6EAA6E;;QAE7E,sEAAsE;;;aA0EtE,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,MAAM,0BAA0B,GAAG,WAAW,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE9F;;;;;;;;;GASG;AACH,eAAO,MAAM,+BAA+B;;;;;QAlH1C,yDAAyD;;QAEzD,0EAA0E;;QAE1E,iCAAiC;;QAEjC,kDAAkD;;QAElD,8EAA8E;;QAE9E,2BAA2B;;QAE3B,kEAAkE;;QAElE,6EAA6E;;QAE7E,sEAAsE;;;IAoGtE;;;;;;;;;OASG;;aAEH,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,MAAM,yBAAyB,GAAG,WAAW,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAE5F;;;;;;;;;GASG;AACH,eAAO,MAAM,gCAAgC;;;;;QAvJ3C,yDAAyD;;QAEzD,0EAA0E;;QAE1E,iCAAiC;;QAEjC,kDAAkD;;QAElD,8EAA8E;;QAE9E,2BAA2B;;QAE3B,kEAAkE;;QAElE,6EAA6E;;QAE7E,sEAAsE;;;aAyItE,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,MAAM,0BAA0B,GAAG,WAAW,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE9F;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iCAAiC;;aAA8B,CAAC;AAE7E;;;;;;;;;GASG;AACH,MAAM,MAAM,2BAA2B,GAAG,WAAW,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAEhG;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,2BAA2B,sUAMtC,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,MAAM,qBAAqB,GAAG,WAAW,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEpF;;;;;;;;;GASG;AACH,eAAO,MAAM,kCAAkC;;;;;IAE7C,sCAAsC;;;;;;;aAOtC,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,MAAM,4BAA4B,GAAG,WAAW,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAElG;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,gCAAgC;;;;;IAE3C,+EAA+E;;aAE/E,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,MAAM,0BAA0B,GAAG,WAAW,CAAC,OAAO,gCAAgC,CAAC,CAAC"}

package/dist/serviceToken.js

@@ -0,0 +1,227 @@
+import { array, boolean, integer, literal, maxLength, maxValue, minLength, minValue, nullable, number, object, optional, pipe, regex, string, union, } from "valibot";
+import { createSuccessResponseSchema } from "./common.js";
+/**
+ * Service tokens are long-lived credentials a script or backend service
+ * presents to game-infra APIs on behalf of the account that created them.
+ *
+ * The issuer never stores the token. It stores only the reference needed to
+ * withdraw one — the token id, its owner, and its expiry — and the token itself
+ * carries that id, so revocation is a write against the id rather than a lookup
+ * of the secret. A token is therefore shown exactly once, at creation.
+ */
+/**
+ * Bounds shared by the UI and the service, so both reject the same input.
+ *
+ * The TTL ceiling is a year: past that the token stops being a credential
+ * anyone rotates and becomes one nobody remembers issuing, and the expiry is
+ * the only thing that retires a token no one revokes.
+ *
+ * @example
+ * ```ts
+ * import { ServiceTokenValidation } from '@game-infra/api-schemas-core'
+ *
+ * const ttl = Math.min(requested, ServiceTokenValidation.MAX_TTL_SECONDS)
+ * ```
+ */
+export const ServiceTokenValidation = {
+    MIN_NAME_LENGTH: 1,
+    MAX_NAME_LENGTH: 100,
+    /** One hour. Shorter than this and the token cannot outlive a login. */
+    MIN_TTL_SECONDS: 60 * 60,
+    /** 365 days. */
+    MAX_TTL_SECONDS: 365 * 24 * 60 * 60,
+    /** 30 days — the default a caller gets when it names no TTL. */
+    DEFAULT_TTL_SECONDS: 30 * 24 * 60 * 60,
+    /** Token ids are `st_` plus 32 lowercase hex characters. */
+    TOKEN_ID_PATTERN: /^st_[0-9a-f]{32}$/,
+};
+/**
+ * A stored service-token id.
+ *
+ * @example
+ * ```ts
+ * import { ServiceTokenIdSchema } from '@game-infra/api-schemas-core'
+ * import { parse } from 'valibot'
+ *
+ * parse(ServiceTokenIdSchema, 'st_0123456789abcdef0123456789abcdef')
+ * ```
+ */
+export const ServiceTokenIdSchema = pipe(string(), regex(ServiceTokenValidation.TOKEN_ID_PATTERN, "Not a service-token id"));
+/**
+ * Everything the issuer keeps about a service token — which is everything
+ * except the token.
+ *
+ * @example
+ * ```ts
+ * import type { ServiceToken } from '@game-infra/api-schemas-core'
+ *
+ * const isLive = (token: ServiceToken) => !token.revokedAt && Date.parse(token.expiresAt) > Date.now()
+ * ```
+ */
+export const ServiceTokenSchema = object({
+    /** Token id, carried by the token as its `jti` claim. */
+    id: ServiceTokenIdSchema,
+    /** Caller-supplied label, the only way a human tells two tokens apart. */
+    name: string(),
+    /** Account the token acts as. */
+    userId: number(),
+    /** Username of that account, as of issue time. */
+    username: string(),
+    /** Authorization claims the token carries; never wider than the creator's. */
+    claims: array(string()),
+    /** ISO-8601 issue time. */
+    createdAt: string(),
+    /** ISO-8601 expiry, stamped into the token and not extendable. */
+    expiresAt: string(),
+    /** ISO-8601 revocation time, or `null` while the token is still honoured. */
+    revokedAt: nullable(string()),
+    /** ISO-8601 time the token last validated successfully, or `null`. */
+    lastUsedAt: nullable(string()),
+});
+/**
+ * Request to mint a service token.
+ *
+ * `claims` is a request, not a grant: the service intersects it with the
+ * creator's own claims, so a token can never reach further than the account
+ * that created it.
+ *
+ * @example
+ * ```ts
+ * import { CreateServiceTokenRequestSchema } from '@game-infra/api-schemas-core'
+ * import { parse } from 'valibot'
+ *
+ * parse(CreateServiceTokenRequestSchema, { name: 'nightly-import', ttlSeconds: 604800 })
+ * ```
+ */
+export const CreateServiceTokenRequestSchema = object({
+    name: pipe(string(), minLength(ServiceTokenValidation.MIN_NAME_LENGTH, "Name is required"), maxLength(ServiceTokenValidation.MAX_NAME_LENGTH)),
+    ttlSeconds: optional(pipe(number(), integer("TTL must be a whole number of seconds"), minValue(ServiceTokenValidation.MIN_TTL_SECONDS), maxValue(ServiceTokenValidation.MAX_TTL_SECONDS))),
+    claims: optional(array(string())),
+});
+/**
+ * The one and only response that carries the token itself.
+ *
+ * @example
+ * ```ts
+ * import type { CreateServiceTokenResponse } from '@game-infra/api-schemas-core'
+ *
+ * const show = (response: CreateServiceTokenResponse) => response.token
+ * ```
+ */
+export const CreateServiceTokenResponseSchema = createSuccessResponseSchema({
+    /** The signed token. Not stored, and not retrievable again. */
+    token: optional(string()),
+    serviceToken: optional(ServiceTokenSchema),
+});
+/**
+ * The caller's own service tokens, newest first.
+ *
+ * @example
+ * ```ts
+ * import type { ListServiceTokensResponse } from '@game-infra/api-schemas-core'
+ *
+ * const count = (response: ListServiceTokensResponse) => response.serviceTokens?.length ?? 0
+ * ```
+ */
+export const ListServiceTokensResponseSchema = createSuccessResponseSchema({
+    serviceTokens: optional(array(ServiceTokenSchema)),
+    /**
+     * The retention window the issuer applies before deleting an expired
+     * record, in seconds.
+     *
+     * A client cannot work out which records a purge would actually remove
+     * without it: an expired token's row survives until the window has passed
+     * too, so "expired" and "purgeable" are different sets, and a UI counting the
+     * first offers to delete rows the service will keep. Optional because a
+     * deployment predating this field does not send it.
+     */
+    retentionSeconds: optional(number()),
+});
+/**
+ * Result of revoking a service token.
+ *
+ * @example
+ * ```ts
+ * import type { RevokeServiceTokenResponse } from '@game-infra/api-schemas-core'
+ *
+ * const when = (response: RevokeServiceTokenResponse) => response.serviceToken?.revokedAt
+ * ```
+ */
+export const RevokeServiceTokenResponseSchema = createSuccessResponseSchema({
+    serviceToken: optional(ServiceTokenSchema),
+});
+/**
+ * Token a service or script asks the issuer to check.
+ *
+ * @example
+ * ```ts
+ * import { ServiceTokenValidateRequestSchema } from '@game-infra/api-schemas-core'
+ * import { parse } from 'valibot'
+ *
+ * parse(ServiceTokenValidateRequestSchema, { token: 'eyJhbGciOi...' })
+ * ```
+ */
+export const ServiceTokenValidateRequestSchema = object({ token: string() });
+/**
+ * Why a service token was not accepted.
+ *
+ * `revoked` and `unknown` are the two answers a signature check alone cannot
+ * give, and they are the reason this endpoint exists next to `/auth/validate`:
+ * `unknown` covers a correctly signed token whose record has been purged, which
+ * a caller must treat exactly like a revoked one.
+ *
+ * @example
+ * ```ts
+ * import { ServiceTokenRejectionSchema } from '@game-infra/api-schemas-core'
+ * import { parse } from 'valibot'
+ *
+ * parse(ServiceTokenRejectionSchema, 'revoked')
+ * ```
+ */
+export const ServiceTokenRejectionSchema = union([
+    literal("invalid"),
+    literal("expired"),
+    literal("revoked"),
+    literal("unknown"),
+    literal("wrongTokenType"),
+]);
+/**
+ * Verdict on a service token: signature, expiry, and the revocation list.
+ *
+ * @example
+ * ```ts
+ * import type { ServiceTokenValidateResponse } from '@game-infra/api-schemas-core'
+ *
+ * const accept = (response: ServiceTokenValidateResponse) => response.valid === true
+ * ```
+ */
+export const ServiceTokenValidateResponseSchema = createSuccessResponseSchema({
+    valid: optional(boolean()),
+    /** Set only when `valid` is false. */
+    reason: optional(ServiceTokenRejectionSchema),
+    tokenId: optional(string()),
+    userId: optional(number()),
+    username: optional(string()),
+    claims: optional(array(string())),
+    expiresAt: optional(string()),
+});
+/**
+ * How many obsolete token records a purge deleted.
+ *
+ * A record is obsolete once the token it describes has expired past the
+ * retention window: an expired token fails signature-and-expiry verification
+ * everywhere, so keeping its record buys neither revocation nor an answer.
+ *
+ * @example
+ * ```ts
+ * import type { PurgeServiceTokensResponse } from '@game-infra/api-schemas-core'
+ *
+ * const freed = (response: PurgeServiceTokensResponse) => response.purged ?? 0
+ * ```
+ */
+export const PurgeServiceTokensResponseSchema = createSuccessResponseSchema({
+    purged: optional(number()),
+    /** Retention window applied, in seconds, so a caller can explain the count. */
+    retentionSeconds: optional(number()),
+});
+//# sourceMappingURL=serviceToken.js.map

package/dist/serviceToken.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serviceToken.js","sourceRoot":"","sources":["../src/serviceToken.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,EACL,OAAO,EACP,OAAO,EACP,OAAO,EACP,SAAS,EACT,QAAQ,EACR,SAAS,EACT,QAAQ,EACR,QAAQ,EACR,MAAM,EACN,MAAM,EACN,QAAQ,EACR,IAAI,EACJ,KAAK,EACL,MAAM,EACN,KAAK,GACN,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC;AAE1D;;;;;;;;GAQG;AAEH;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,eAAe,EAAE,CAAC;IAClB,eAAe,EAAE,GAAG;IACpB,wEAAwE;IACxE,eAAe,EAAE,EAAE,GAAG,EAAE;IACxB,gBAAgB;IAChB,eAAe,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;IACnC,gEAAgE;IAChE,mBAAmB,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;IACtC,4DAA4D;IAC5D,gBAAgB,EAAE,mBAAmB;CAC7B,CAAC;AAEX;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CACtC,MAAM,EAAE,EACR,KAAK,CAAC,sBAAsB,CAAC,gBAAgB,EAAE,wBAAwB,CAAC,CACzE,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC;IACvC,yDAAyD;IACzD,EAAE,EAAE,oBAAoB;IACxB,0EAA0E;IAC1E,IAAI,EAAE,MAAM,EAAE;IACd,iCAAiC;IACjC,MAAM,EAAE,MAAM,EAAE;IAChB,kDAAkD;IAClD,QAAQ,EAAE,MAAM,EAAE;IAClB,8EAA8E;IAC9E,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;IACvB,2BAA2B;IAC3B,SAAS,EAAE,MAAM,EAAE;IACnB,kEAAkE;IAClE,SAAS,EAAE,MAAM,EAAE;IACnB,6EAA6E;IAC7E,SAAS,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IAC7B,sEAAsE;IACtE,UAAU,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;CAC/B,CAAC,CAAC;AAcH;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,MAAM,CAAC;IACpD,IAAI,EAAE,IAAI,CACR,MAAM,EAAE,EACR,SAAS,CAAC,sBAAsB,CAAC,eAAe,EAAE,kBAAkB,CAAC,EACrE,SAAS,CAAC,sBAAsB,CAAC,eAAe,CAAC,CAClD;IACD,UAAU,EAAE,QAAQ,CAClB,IAAI,CACF,MAAM,EAAE,EACR,OAAO,CAAC,uCAAuC,CAAC,EAChD,QAAQ,CAAC,sBAAsB,CAAC,eAAe,CAAC,EAChD,QAAQ,CAAC,sBAAsB,CAAC,eAAe,CAAC,CACjD,CACF;IACD,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;CAClC,CAAC,CAAC;AAcH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,2BAA2B,CAAC;IAC1E,+DAA+D;IAC/D,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACzB,YAAY,EAAE,QAAQ,CAAC,kBAAkB,CAAC;CAC3C,CAAC,CAAC;AAcH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,2BAA2B,CAAC;IACzE,aAAa,EAAE,QAAQ,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAClD;;;;;;;;;OASG;IACH,gBAAgB,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;CACrC,CAAC,CAAC;AAcH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,2BAA2B,CAAC;IAC1E,YAAY,EAAE,QAAQ,CAAC,kBAAkB,CAAC;CAC3C,CAAC,CAAC;AAcH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;AAc7E;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,KAAK,CAAC;IAC/C,OAAO,CAAC,SAAS,CAAC;IAClB,OAAO,CAAC,SAAS,CAAC;IAClB,OAAO,CAAC,SAAS,CAAC;IAClB,OAAO,CAAC,SAAS,CAAC;IAClB,OAAO,CAAC,gBAAgB,CAAC;CAC1B,CAAC,CAAC;AAcH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,2BAA2B,CAAC;IAC5E,KAAK,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;IAC1B,sCAAsC;IACtC,MAAM,EAAE,QAAQ,CAAC,2BAA2B,CAAC;IAC7C,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IAC3B,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IAC1B,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IAC5B,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACjC,SAAS,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;CAC9B,CAAC,CAAC;AAcH;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,2BAA2B,CAAC;IAC1E,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IAC1B,+EAA+E;IAC/E,gBAAgB,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;CACrC,CAAC,CAAC"}