@hammadj/better-auth 1.5.0-beta.9

package/dist/plugins/api-key/routes/update-api-key.mjs

@@ -0,0 +1,248 @@
+import { getDate } from "../../../utils/date.mjs";
+import { getSessionFromCtx } from "../../../api/routes/session.mjs";
+import "../../../api/index.mjs";
+import { API_KEY_ERROR_CODES } from "../error-codes.mjs";
+import { getApiKeyById, migrateDoubleStringifiedMetadata, setApiKey } from "../adapter.mjs";
+import { API_KEY_TABLE_NAME } from "../index.mjs";
+import { APIError } from "@better-auth/core/error";
+import { safeJSONParse } from "@better-auth/core/utils/json";
+import { createAuthEndpoint } from "@better-auth/core/api";
+import * as z from "zod";
+
+//#region src/plugins/api-key/routes/update-api-key.ts
+const updateApiKeyBodySchema = z.object({
+	keyId: z.string().meta({ description: "The id of the Api Key" }),
+	userId: z.coerce.string().meta({ description: "The id of the user which the api key belongs to. server-only. Eg: \"some-user-id\"" }).optional(),
+	name: z.string().meta({ description: "The name of the key" }).optional(),
+	enabled: z.boolean().meta({ description: "Whether the Api Key is enabled or not" }).optional(),
+	remaining: z.number().meta({ description: "The number of remaining requests" }).min(1).optional(),
+	refillAmount: z.number().meta({ description: "The refill amount" }).optional(),
+	refillInterval: z.number().meta({ description: "The refill interval" }).optional(),
+	metadata: z.any().optional(),
+	expiresIn: z.number().meta({ description: "Expiration time of the Api Key in seconds" }).min(1).optional().nullable(),
+	rateLimitEnabled: z.boolean().meta({ description: "Whether the key has rate limiting enabled." }).optional(),
+	rateLimitTimeWindow: z.number().meta({ description: "The duration in milliseconds where each request is counted. server-only. Eg: 1000" }).optional(),
+	rateLimitMax: z.number().meta({ description: "Maximum amount of requests allowed within a window. Once the `maxRequests` is reached, the request will be rejected until the `timeWindow` has passed, at which point the `timeWindow` will be reset. server-only. Eg: 100" }).optional(),
+	permissions: z.record(z.string(), z.array(z.string())).meta({ description: "Update the permissions on the API Key. server-only." }).optional().nullable()
+});
+function updateApiKey({ opts, schema, deleteAllExpiredApiKeys }) {
+	return createAuthEndpoint("/api-key/update", {
+		method: "POST",
+		body: updateApiKeyBodySchema,
+		metadata: { openapi: {
+			description: "Update an existing API key by ID",
+			responses: { "200": {
+				description: "API key updated successfully",
+				content: { "application/json": { schema: {
+					type: "object",
+					properties: {
+						id: {
+							type: "string",
+							description: "ID"
+						},
+						name: {
+							type: "string",
+							nullable: true,
+							description: "The name of the key"
+						},
+						start: {
+							type: "string",
+							nullable: true,
+							description: "Shows the first few characters of the API key, including the prefix. This allows you to show those few characters in the UI to make it easier for users to identify the API key."
+						},
+						prefix: {
+							type: "string",
+							nullable: true,
+							description: "The API Key prefix. Stored as plain text."
+						},
+						userId: {
+							type: "string",
+							description: "The owner of the user id"
+						},
+						refillInterval: {
+							type: "number",
+							nullable: true,
+							description: "The interval in milliseconds between refills of the `remaining` count. Example: 3600000 // refill every hour (3600000ms = 1h)"
+						},
+						refillAmount: {
+							type: "number",
+							nullable: true,
+							description: "The amount to refill"
+						},
+						lastRefillAt: {
+							type: "string",
+							format: "date-time",
+							nullable: true,
+							description: "The last refill date"
+						},
+						enabled: {
+							type: "boolean",
+							description: "Sets if key is enabled or disabled",
+							default: true
+						},
+						rateLimitEnabled: {
+							type: "boolean",
+							description: "Whether the key has rate limiting enabled"
+						},
+						rateLimitTimeWindow: {
+							type: "number",
+							nullable: true,
+							description: "The duration in milliseconds"
+						},
+						rateLimitMax: {
+							type: "number",
+							nullable: true,
+							description: "Maximum amount of requests allowed within a window"
+						},
+						requestCount: {
+							type: "number",
+							description: "The number of requests made within the rate limit time window"
+						},
+						remaining: {
+							type: "number",
+							nullable: true,
+							description: "Remaining requests (every time api key is used this should updated and should be updated on refill as well)"
+						},
+						lastRequest: {
+							type: "string",
+							format: "date-time",
+							nullable: true,
+							description: "When last request occurred"
+						},
+						expiresAt: {
+							type: "string",
+							format: "date-time",
+							nullable: true,
+							description: "Expiry date of a key"
+						},
+						createdAt: {
+							type: "string",
+							format: "date-time",
+							description: "created at"
+						},
+						updatedAt: {
+							type: "string",
+							format: "date-time",
+							description: "updated at"
+						},
+						metadata: {
+							type: "object",
+							nullable: true,
+							additionalProperties: true,
+							description: "Extra metadata about the apiKey"
+						},
+						permissions: {
+							type: "string",
+							nullable: true,
+							description: "Permissions for the api key (stored as JSON string)"
+						}
+					},
+					required: [
+						"id",
+						"userId",
+						"enabled",
+						"rateLimitEnabled",
+						"requestCount",
+						"createdAt",
+						"updatedAt"
+					]
+				} } }
+			} }
+		} }
+	}, async (ctx) => {
+		const { keyId, expiresIn, enabled, metadata, refillAmount, refillInterval, remaining, name, permissions, rateLimitEnabled, rateLimitTimeWindow, rateLimitMax } = ctx.body;
+		const session = await getSessionFromCtx(ctx);
+		const authRequired = ctx.request || ctx.headers;
+		const user = authRequired && !session ? null : session?.user || { id: ctx.body.userId };
+		if (!user?.id) throw APIError.from("UNAUTHORIZED", API_KEY_ERROR_CODES.UNAUTHORIZED_SESSION);
+		if (session && ctx.body.userId && session?.user.id !== ctx.body.userId) throw APIError.from("UNAUTHORIZED", API_KEY_ERROR_CODES.UNAUTHORIZED_SESSION);
+		if (authRequired) {
+			if (refillAmount !== void 0 || refillInterval !== void 0 || rateLimitMax !== void 0 || rateLimitTimeWindow !== void 0 || rateLimitEnabled !== void 0 || remaining !== void 0 || permissions !== void 0) throw APIError.from("BAD_REQUEST", API_KEY_ERROR_CODES.SERVER_ONLY_PROPERTY);
+		}
+		let apiKey = null;
+		apiKey = await getApiKeyById(ctx, keyId, opts);
+		if (apiKey && apiKey.userId !== user.id) apiKey = null;
+		if (!apiKey) throw APIError.from("NOT_FOUND", API_KEY_ERROR_CODES.KEY_NOT_FOUND);
+		const newValues = {};
+		if (name !== void 0) {
+			if (name.length < opts.minimumNameLength) throw APIError.from("BAD_REQUEST", API_KEY_ERROR_CODES.INVALID_NAME_LENGTH);
+			else if (name.length > opts.maximumNameLength) throw APIError.from("BAD_REQUEST", API_KEY_ERROR_CODES.INVALID_NAME_LENGTH);
+			newValues.name = name;
+		}
+		if (enabled !== void 0) newValues.enabled = enabled;
+		if (expiresIn !== void 0) {
+			if (opts.keyExpiration.disableCustomExpiresTime === true) throw APIError.from("BAD_REQUEST", API_KEY_ERROR_CODES.KEY_DISABLED_EXPIRATION);
+			if (expiresIn !== null) {
+				const expiresIn_in_days = expiresIn / (3600 * 24);
+				if (expiresIn_in_days < opts.keyExpiration.minExpiresIn) throw APIError.from("BAD_REQUEST", API_KEY_ERROR_CODES.EXPIRES_IN_IS_TOO_SMALL);
+				else if (expiresIn_in_days > opts.keyExpiration.maxExpiresIn) throw APIError.from("BAD_REQUEST", API_KEY_ERROR_CODES.EXPIRES_IN_IS_TOO_LARGE);
+			}
+			newValues.expiresAt = expiresIn ? getDate(expiresIn, "sec") : null;
+		}
+		if (metadata !== void 0 && opts.enableMetadata === true) {
+			if (typeof metadata !== "object") throw APIError.from("BAD_REQUEST", API_KEY_ERROR_CODES.INVALID_METADATA_TYPE);
+			newValues.metadata = metadata;
+		}
+		if (remaining !== void 0) newValues.remaining = remaining;
+		if (refillAmount !== void 0 || refillInterval !== void 0) {
+			if (refillAmount !== void 0 && refillInterval === void 0) throw APIError.from("BAD_REQUEST", API_KEY_ERROR_CODES.REFILL_AMOUNT_AND_INTERVAL_REQUIRED);
+			else if (refillInterval !== void 0 && refillAmount === void 0) throw APIError.from("BAD_REQUEST", API_KEY_ERROR_CODES.REFILL_INTERVAL_AND_AMOUNT_REQUIRED);
+			newValues.refillAmount = refillAmount;
+			newValues.refillInterval = refillInterval;
+		}
+		if (rateLimitEnabled !== void 0) newValues.rateLimitEnabled = rateLimitEnabled;
+		if (rateLimitTimeWindow !== void 0) newValues.rateLimitTimeWindow = rateLimitTimeWindow;
+		if (rateLimitMax !== void 0) newValues.rateLimitMax = rateLimitMax;
+		if (permissions !== void 0) newValues.permissions = JSON.stringify(permissions);
+		if (Object.keys(newValues).length === 0) throw APIError.from("BAD_REQUEST", API_KEY_ERROR_CODES.NO_VALUES_TO_UPDATE);
+		let newApiKey = apiKey;
+		try {
+			if (opts.storage === "secondary-storage" && opts.fallbackToDatabase) {
+				const dbUpdated = await ctx.context.adapter.update({
+					model: API_KEY_TABLE_NAME,
+					where: [{
+						field: "id",
+						value: apiKey.id
+					}],
+					update: newValues
+				});
+				if (dbUpdated) {
+					await setApiKey(ctx, dbUpdated, opts);
+					newApiKey = dbUpdated;
+				}
+			} else if (opts.storage === "database") {
+				const result = await ctx.context.adapter.update({
+					model: API_KEY_TABLE_NAME,
+					where: [{
+						field: "id",
+						value: apiKey.id
+					}],
+					update: newValues
+				});
+				if (result) newApiKey = result;
+			} else {
+				const updated = {
+					...apiKey,
+					...newValues,
+					updatedAt: /* @__PURE__ */ new Date()
+				};
+				await setApiKey(ctx, updated, opts);
+				newApiKey = updated;
+			}
+		} catch (error) {
+			throw APIError.fromStatus("INTERNAL_SERVER_ERROR", { message: error?.message });
+		}
+		deleteAllExpiredApiKeys(ctx.context);
+		const migratedMetadata = await migrateDoubleStringifiedMetadata(ctx, newApiKey, opts);
+		const { key: _key, ...returningApiKey } = newApiKey;
+		return ctx.json({
+			...returningApiKey,
+			metadata: migratedMetadata,
+			permissions: returningApiKey.permissions ? safeJSONParse(returningApiKey.permissions) : null
+		});
+	});
+}
+
+//#endregion
+export { updateApiKey };
+//# sourceMappingURL=update-api-key.mjs.map

package/dist/plugins/api-key/routes/update-api-key.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-api-key.mjs","names":["ERROR_CODES"],"sources":["../../../../src/plugins/api-key/routes/update-api-key.ts"],"sourcesContent":["import type { AuthContext } from \"@better-auth/core\";\nimport { createAuthEndpoint } from \"@better-auth/core/api\";\nimport { APIError } from \"@better-auth/core/error\";\nimport { safeJSONParse } from \"@better-auth/core/utils/json\";\nimport * as z from \"zod\";\nimport { getSessionFromCtx } from \"../../../api\";\nimport { getDate } from \"../../../utils/date\";\nimport { API_KEY_TABLE_NAME, API_KEY_ERROR_CODES as ERROR_CODES } from \"..\";\nimport {\n\tgetApiKeyById,\n\tmigrateDoubleStringifiedMetadata,\n\tsetApiKey,\n} from \"../adapter\";\nimport type { apiKeySchema } from \"../schema\";\nimport type { ApiKey } from \"../types\";\nimport type { PredefinedApiKeyOptions } from \".\";\n\nconst updateApiKeyBodySchema = z.object({\n\tkeyId: z.string().meta({\n\t\tdescription: \"The id of the Api Key\",\n\t}),\n\tuserId: z.coerce\n\t\t.string()\n\t\t.meta({\n\t\t\tdescription:\n\t\t\t\t'The id of the user which the api key belongs to. server-only. Eg: \"some-user-id\"',\n\t\t})\n\t\t.optional(),\n\tname: z\n\t\t.string()\n\t\t.meta({\n\t\t\tdescription: \"The name of the key\",\n\t\t})\n\t\t.optional(),\n\tenabled: z\n\t\t.boolean()\n\t\t.meta({\n\t\t\tdescription: \"Whether the Api Key is enabled or not\",\n\t\t})\n\t\t.optional(),\n\tremaining: z\n\t\t.number()\n\t\t.meta({\n\t\t\tdescription: \"The number of remaining requests\",\n\t\t})\n\t\t.min(1)\n\t\t.optional(),\n\trefillAmount: z\n\t\t.number()\n\t\t.meta({\n\t\t\tdescription: \"The refill amount\",\n\t\t})\n\t\t.optional(),\n\trefillInterval: z\n\t\t.number()\n\t\t.meta({\n\t\t\tdescription: \"The refill interval\",\n\t\t})\n\t\t.optional(),\n\tmetadata: z.any().optional(),\n\texpiresIn: z\n\t\t.number()\n\t\t.meta({\n\t\t\tdescription: \"Expiration time of the Api Key in seconds\",\n\t\t})\n\t\t.min(1)\n\t\t.optional()\n\t\t.nullable(),\n\trateLimitEnabled: z\n\t\t.boolean()\n\t\t.meta({\n\t\t\tdescription: \"Whether the key has rate limiting enabled.\",\n\t\t})\n\t\t.optional(),\n\trateLimitTimeWindow: z\n\t\t.number()\n\t\t.meta({\n\t\t\tdescription:\n\t\t\t\t\"The duration in milliseconds where each request is counted. server-only. Eg: 1000\",\n\t\t})\n\t\t.optional(),\n\trateLimitMax: z\n\t\t.number()\n\t\t.meta({\n\t\t\tdescription:\n\t\t\t\t\"Maximum amount of requests allowed within a window. Once the `maxRequests` is reached, the request will be rejected until the `timeWindow` has passed, at which point the `timeWindow` will be reset. server-only. Eg: 100\",\n\t\t})\n\t\t.optional(),\n\tpermissions: z\n\t\t.record(z.string(), z.array(z.string()))\n\t\t.meta({\n\t\t\tdescription: \"Update the permissions on the API Key. server-only.\",\n\t\t})\n\t\t.optional()\n\t\t.nullable(),\n});\n\nexport function updateApiKey({\n\topts,\n\tschema,\n\tdeleteAllExpiredApiKeys,\n}: {\n\topts: PredefinedApiKeyOptions;\n\tschema: ReturnType<typeof apiKeySchema>;\n\tdeleteAllExpiredApiKeys(\n\t\tctx: AuthContext,\n\t\tbyPassLastCheckTime?: boolean | undefined,\n\t): void;\n}) {\n\treturn createAuthEndpoint(\n\t\t\"/api-key/update\",\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\tbody: updateApiKeyBodySchema,\n\t\t\tmetadata: {\n\t\t\t\topenapi: {\n\t\t\t\t\tdescription: \"Update an existing API key by ID\",\n\t\t\t\t\tresponses: {\n\t\t\t\t\t\t\"200\": {\n\t\t\t\t\t\t\tdescription: \"API key updated successfully\",\n\t\t\t\t\t\t\tcontent: {\n\t\t\t\t\t\t\t\t\"application/json\": {\n\t\t\t\t\t\t\t\t\tschema: {\n\t\t\t\t\t\t\t\t\t\ttype: \"object\",\n\t\t\t\t\t\t\t\t\t\tproperties: {\n\t\t\t\t\t\t\t\t\t\t\tid: {\n\t\t\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\t\t\tdescription: \"ID\",\n\t\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\t\tname: {\n\t\t\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\t\t\tnullable: true,\n\t\t\t\t\t\t\t\t\t\t\t\tdescription: \"The name of the key\",\n\t\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\t\tstart: {\n\t\t\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\t\t\tnullable: true,\n\t\t\t\t\t\t\t\t\t\t\t\tdescription:\n\t\t\t\t\t\t\t\t\t\t\t\t\t\"Shows the first few characters of the API key, including the prefix. This allows you to show those few characters in the UI to make it easier for users to identify the API key.\",\n\t\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\t\tprefix: {\n\t\t\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\t\t\tnullable: true,\n\t\t\t\t\t\t\t\t\t\t\t\tdescription:\n\t\t\t\t\t\t\t\t\t\t\t\t\t\"The API Key prefix. Stored as plain text.\",\n\t\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\t\tuserId: {\n\t\t\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\t\t\tdescription: \"The owner of the user id\",\n\t\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\t\trefillInterval: {\n\t\t\t\t\t\t\t\t\t\t\t\ttype: \"number\",\n\t\t\t\t\t\t\t\t\t\t\t\tnullable: true,\n\t\t\t\t\t\t\t\t\t\t\t\tdescription:\n\t\t\t\t\t\t\t\t\t\t\t\t\t\"The interval in milliseconds between refills of the `remaining` count. Example: 3600000 // refill every hour (3600000ms = 1h)\",\n\t\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\t\trefillAmount: {\n\t\t\t\t\t\t\t\t\t\t\t\ttype: \"number\",\n\t\t\t\t\t\t\t\t\t\t\t\tnullable: true,\n\t\t\t\t\t\t\t\t\t\t\t\tdescription: \"The amount to refill\",\n\t\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\t\tlastRefillAt: {\n\t\t\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\t\t\tformat: \"date-time\",\n\t\t\t\t\t\t\t\t\t\t\t\tnullable: true,\n\t\t\t\t\t\t\t\t\t\t\t\tdescription: \"The last refill date\",\n\t\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\t\tenabled: {\n\t\t\t\t\t\t\t\t\t\t\t\ttype: \"boolean\",\n\t\t\t\t\t\t\t\t\t\t\t\tdescription: \"Sets if key is enabled or disabled\",\n\t\t\t\t\t\t\t\t\t\t\t\tdefault: true,\n\t\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\t\trateLimitEnabled: {\n\t\t\t\t\t\t\t\t\t\t\t\ttype: \"boolean\",\n\t\t\t\t\t\t\t\t\t\t\t\tdescription:\n\t\t\t\t\t\t\t\t\t\t\t\t\t\"Whether the key has rate limiting enabled\",\n\t\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\t\trateLimitTimeWindow: {\n\t\t\t\t\t\t\t\t\t\t\t\ttype: \"number\",\n\t\t\t\t\t\t\t\t\t\t\t\tnullable: true,\n\t\t\t\t\t\t\t\t\t\t\t\tdescription: \"The duration in milliseconds\",\n\t\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\t\trateLimitMax: {\n\t\t\t\t\t\t\t\t\t\t\t\ttype: \"number\",\n\t\t\t\t\t\t\t\t\t\t\t\tnullable: true,\n\t\t\t\t\t\t\t\t\t\t\t\tdescription:\n\t\t\t\t\t\t\t\t\t\t\t\t\t\"Maximum amount of requests allowed within a window\",\n\t\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\t\trequestCount: {\n\t\t\t\t\t\t\t\t\t\t\t\ttype: \"number\",\n\t\t\t\t\t\t\t\t\t\t\t\tdescription:\n\t\t\t\t\t\t\t\t\t\t\t\t\t\"The number of requests made within the rate limit time window\",\n\t\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\t\tremaining: {\n\t\t\t\t\t\t\t\t\t\t\t\ttype: \"number\",\n\t\t\t\t\t\t\t\t\t\t\t\tnullable: true,\n\t\t\t\t\t\t\t\t\t\t\t\tdescription:\n\t\t\t\t\t\t\t\t\t\t\t\t\t\"Remaining requests (every time api key is used this should updated and should be updated on refill as well)\",\n\t\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\t\tlastRequest: {\n\t\t\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\t\t\tformat: \"date-time\",\n\t\t\t\t\t\t\t\t\t\t\t\tnullable: true,\n\t\t\t\t\t\t\t\t\t\t\t\tdescription: \"When last request occurred\",\n\t\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\t\texpiresAt: {\n\t\t\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\t\t\tformat: \"date-time\",\n\t\t\t\t\t\t\t\t\t\t\t\tnullable: true,\n\t\t\t\t\t\t\t\t\t\t\t\tdescription: \"Expiry date of a key\",\n\t\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\t\tcreatedAt: {\n\t\t\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\t\t\tformat: \"date-time\",\n\t\t\t\t\t\t\t\t\t\t\t\tdescription: \"created at\",\n\t\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\t\tupdatedAt: {\n\t\t\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\t\t\tformat: \"date-time\",\n\t\t\t\t\t\t\t\t\t\t\t\tdescription: \"updated at\",\n\t\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\t\tmetadata: {\n\t\t\t\t\t\t\t\t\t\t\t\ttype: \"object\",\n\t\t\t\t\t\t\t\t\t\t\t\tnullable: true,\n\t\t\t\t\t\t\t\t\t\t\t\tadditionalProperties: true,\n\t\t\t\t\t\t\t\t\t\t\t\tdescription: \"Extra metadata about the apiKey\",\n\t\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\t\tpermissions: {\n\t\t\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\t\t\tnullable: true,\n\t\t\t\t\t\t\t\t\t\t\t\tdescription:\n\t\t\t\t\t\t\t\t\t\t\t\t\t\"Permissions for the api key (stored as JSON string)\",\n\t\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\trequired: [\n\t\t\t\t\t\t\t\t\t\t\t\"id\",\n\t\t\t\t\t\t\t\t\t\t\t\"userId\",\n\t\t\t\t\t\t\t\t\t\t\t\"enabled\",\n\t\t\t\t\t\t\t\t\t\t\t\"rateLimitEnabled\",\n\t\t\t\t\t\t\t\t\t\t\t\"requestCount\",\n\t\t\t\t\t\t\t\t\t\t\t\"createdAt\",\n\t\t\t\t\t\t\t\t\t\t\t\"updatedAt\",\n\t\t\t\t\t\t\t\t\t\t],\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t},\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t},\n\t\t},\n\t\tasync (ctx) => {\n\t\t\tconst {\n\t\t\t\tkeyId,\n\t\t\t\texpiresIn,\n\t\t\t\tenabled,\n\t\t\t\tmetadata,\n\t\t\t\trefillAmount,\n\t\t\t\trefillInterval,\n\t\t\t\tremaining,\n\t\t\t\tname,\n\t\t\t\tpermissions,\n\t\t\t\trateLimitEnabled,\n\t\t\t\trateLimitTimeWindow,\n\t\t\t\trateLimitMax,\n\t\t\t} = ctx.body;\n\n\t\t\tconst session = await getSessionFromCtx(ctx);\n\t\t\tconst authRequired = ctx.request || ctx.headers;\n\t\t\tconst user =\n\t\t\t\tauthRequired && !session\n\t\t\t\t\t? null\n\t\t\t\t\t: session?.user || { id: ctx.body.userId };\n\n\t\t\tif (!user?.id) {\n\t\t\t\tthrow APIError.from(\"UNAUTHORIZED\", ERROR_CODES.UNAUTHORIZED_SESSION);\n\t\t\t}\n\n\t\t\tif (session && ctx.body.userId && session?.user.id !== ctx.body.userId) {\n\t\t\t\tthrow APIError.from(\"UNAUTHORIZED\", ERROR_CODES.UNAUTHORIZED_SESSION);\n\t\t\t}\n\n\t\t\tif (authRequired) {\n\t\t\t\t// if this endpoint was being called from the client,\n\t\t\t\t// we must make sure they can't use server-only properties.\n\t\t\t\tif (\n\t\t\t\t\trefillAmount !== undefined ||\n\t\t\t\t\trefillInterval !== undefined ||\n\t\t\t\t\trateLimitMax !== undefined ||\n\t\t\t\t\trateLimitTimeWindow !== undefined ||\n\t\t\t\t\trateLimitEnabled !== undefined ||\n\t\t\t\t\tremaining !== undefined ||\n\t\t\t\t\tpermissions !== undefined\n\t\t\t\t) {\n\t\t\t\t\tthrow APIError.from(\"BAD_REQUEST\", ERROR_CODES.SERVER_ONLY_PROPERTY);\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tlet apiKey: ApiKey | null = null;\n\n\t\t\tapiKey = await getApiKeyById(ctx, keyId, opts);\n\n\t\t\t// Verify ownership\n\t\t\tif (apiKey && apiKey.userId !== user.id) {\n\t\t\t\tapiKey = null;\n\t\t\t}\n\n\t\t\tif (!apiKey) {\n\t\t\t\tthrow APIError.from(\"NOT_FOUND\", ERROR_CODES.KEY_NOT_FOUND);\n\t\t\t}\n\n\t\t\tconst newValues: Partial<ApiKey> = {};\n\n\t\t\tif (name !== undefined) {\n\t\t\t\tif (name.length < opts.minimumNameLength) {\n\t\t\t\t\tthrow APIError.from(\"BAD_REQUEST\", ERROR_CODES.INVALID_NAME_LENGTH);\n\t\t\t\t} else if (name.length > opts.maximumNameLength) {\n\t\t\t\t\tthrow APIError.from(\"BAD_REQUEST\", ERROR_CODES.INVALID_NAME_LENGTH);\n\t\t\t\t}\n\t\t\t\tnewValues.name = name;\n\t\t\t}\n\n\t\t\tif (enabled !== undefined) {\n\t\t\t\tnewValues.enabled = enabled;\n\t\t\t}\n\t\t\tif (expiresIn !== undefined) {\n\t\t\t\tif (opts.keyExpiration.disableCustomExpiresTime === true) {\n\t\t\t\t\tthrow APIError.from(\n\t\t\t\t\t\t\"BAD_REQUEST\",\n\t\t\t\t\t\tERROR_CODES.KEY_DISABLED_EXPIRATION,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tif (expiresIn !== null) {\n\t\t\t\t\t// if expires is not null, check if it's under the valid range\n\t\t\t\t\t// if it IS null, this means the user wants to disable expiration time on the key\n\t\t\t\t\tconst expiresIn_in_days = expiresIn / (60 * 60 * 24);\n\n\t\t\t\t\tif (expiresIn_in_days < opts.keyExpiration.minExpiresIn) {\n\t\t\t\t\t\tthrow APIError.from(\n\t\t\t\t\t\t\t\"BAD_REQUEST\",\n\t\t\t\t\t\t\tERROR_CODES.EXPIRES_IN_IS_TOO_SMALL,\n\t\t\t\t\t\t);\n\t\t\t\t\t} else if (expiresIn_in_days > opts.keyExpiration.maxExpiresIn) {\n\t\t\t\t\t\tthrow APIError.from(\n\t\t\t\t\t\t\t\"BAD_REQUEST\",\n\t\t\t\t\t\t\tERROR_CODES.EXPIRES_IN_IS_TOO_LARGE,\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\tnewValues.expiresAt = expiresIn ? getDate(expiresIn, \"sec\") : null;\n\t\t\t}\n\n\t\t\tif (metadata !== undefined && opts.enableMetadata === true) {\n\t\t\t\tif (typeof metadata !== \"object\") {\n\t\t\t\t\tthrow APIError.from(\"BAD_REQUEST\", ERROR_CODES.INVALID_METADATA_TYPE);\n\t\t\t\t}\n\t\t\t\t// The adapter will automatically apply the schema transform to stringify\n\t\t\t\tnewValues.metadata = metadata;\n\t\t\t}\n\t\t\tif (remaining !== undefined) {\n\t\t\t\tnewValues.remaining = remaining;\n\t\t\t}\n\t\t\tif (refillAmount !== undefined || refillInterval !== undefined) {\n\t\t\t\tif (refillAmount !== undefined && refillInterval === undefined) {\n\t\t\t\t\tthrow APIError.from(\n\t\t\t\t\t\t\"BAD_REQUEST\",\n\t\t\t\t\t\tERROR_CODES.REFILL_AMOUNT_AND_INTERVAL_REQUIRED,\n\t\t\t\t\t);\n\t\t\t\t} else if (refillInterval !== undefined && refillAmount === undefined) {\n\t\t\t\t\tthrow APIError.from(\n\t\t\t\t\t\t\"BAD_REQUEST\",\n\t\t\t\t\t\tERROR_CODES.REFILL_INTERVAL_AND_AMOUNT_REQUIRED,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tnewValues.refillAmount = refillAmount;\n\t\t\t\tnewValues.refillInterval = refillInterval;\n\t\t\t}\n\n\t\t\tif (rateLimitEnabled !== undefined) {\n\t\t\t\tnewValues.rateLimitEnabled = rateLimitEnabled;\n\t\t\t}\n\t\t\tif (rateLimitTimeWindow !== undefined) {\n\t\t\t\tnewValues.rateLimitTimeWindow = rateLimitTimeWindow;\n\t\t\t}\n\t\t\tif (rateLimitMax !== undefined) {\n\t\t\t\tnewValues.rateLimitMax = rateLimitMax;\n\t\t\t}\n\n\t\t\tif (permissions !== undefined) {\n\t\t\t\t//@ts-expect-error - we need this to be a string to save into DB.\n\t\t\t\tnewValues.permissions = JSON.stringify(permissions);\n\t\t\t}\n\n\t\t\tif (Object.keys(newValues).length === 0) {\n\t\t\t\tthrow APIError.from(\"BAD_REQUEST\", ERROR_CODES.NO_VALUES_TO_UPDATE);\n\t\t\t}\n\n\t\t\tlet newApiKey: ApiKey = apiKey;\n\t\t\ttry {\n\t\t\t\tif (opts.storage === \"secondary-storage\" && opts.fallbackToDatabase) {\n\t\t\t\t\tconst dbUpdated = await ctx.context.adapter.update<ApiKey>({\n\t\t\t\t\t\tmodel: API_KEY_TABLE_NAME,\n\t\t\t\t\t\twhere: [\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\tfield: \"id\",\n\t\t\t\t\t\t\t\tvalue: apiKey.id,\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t],\n\t\t\t\t\t\tupdate: newValues,\n\t\t\t\t\t});\n\t\t\t\t\tif (dbUpdated) {\n\t\t\t\t\t\tawait setApiKey(ctx, dbUpdated, opts);\n\t\t\t\t\t\tnewApiKey = dbUpdated;\n\t\t\t\t\t}\n\t\t\t\t} else if (opts.storage === \"database\") {\n\t\t\t\t\tconst result = await ctx.context.adapter.update<ApiKey>({\n\t\t\t\t\t\tmodel: API_KEY_TABLE_NAME,\n\t\t\t\t\t\twhere: [\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\tfield: \"id\",\n\t\t\t\t\t\t\t\tvalue: apiKey.id,\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t],\n\t\t\t\t\t\tupdate: newValues,\n\t\t\t\t\t});\n\t\t\t\t\tif (result) newApiKey = result;\n\t\t\t\t} else {\n\t\t\t\t\tconst updated: ApiKey = {\n\t\t\t\t\t\t...apiKey,\n\t\t\t\t\t\t...newValues,\n\t\t\t\t\t\tupdatedAt: new Date(),\n\t\t\t\t\t};\n\t\t\t\t\tawait setApiKey(ctx, updated, opts);\n\t\t\t\t\tnewApiKey = updated;\n\t\t\t\t}\n\t\t\t} catch (error: any) {\n\t\t\t\tthrow APIError.fromStatus(\"INTERNAL_SERVER_ERROR\", {\n\t\t\t\t\tmessage: error?.message,\n\t\t\t\t});\n\t\t\t}\n\n\t\t\tdeleteAllExpiredApiKeys(ctx.context);\n\n\t\t\t// Migrate legacy double-stringified metadata if needed\n\t\t\tconst migratedMetadata = await migrateDoubleStringifiedMetadata(\n\t\t\t\tctx,\n\t\t\t\tnewApiKey,\n\t\t\t\topts,\n\t\t\t);\n\n\t\t\tconst { key: _key, ...returningApiKey } = newApiKey;\n\n\t\t\treturn ctx.json({\n\t\t\t\t...returningApiKey,\n\t\t\t\tmetadata: migratedMetadata,\n\t\t\t\tpermissions: returningApiKey.permissions\n\t\t\t\t\t? safeJSONParse<{\n\t\t\t\t\t\t\t[key: string]: string[];\n\t\t\t\t\t\t}>(returningApiKey.permissions)\n\t\t\t\t\t: null,\n\t\t\t});\n\t\t},\n\t);\n}\n"],"mappings":";;;;;;;;;;;;AAiBA,MAAM,yBAAyB,EAAE,OAAO;CACvC,OAAO,EAAE,QAAQ,CAAC,KAAK,EACtB,aAAa,yBACb,CAAC;CACF,QAAQ,EAAE,OACR,QAAQ,CACR,KAAK,EACL,aACC,sFACD,CAAC,CACD,UAAU;CACZ,MAAM,EACJ,QAAQ,CACR,KAAK,EACL,aAAa,uBACb,CAAC,CACD,UAAU;CACZ,SAAS,EACP,SAAS,CACT,KAAK,EACL,aAAa,yCACb,CAAC,CACD,UAAU;CACZ,WAAW,EACT,QAAQ,CACR,KAAK,EACL,aAAa,oCACb,CAAC,CACD,IAAI,EAAE,CACN,UAAU;CACZ,cAAc,EACZ,QAAQ,CACR,KAAK,EACL,aAAa,qBACb,CAAC,CACD,UAAU;CACZ,gBAAgB,EACd,QAAQ,CACR,KAAK,EACL,aAAa,uBACb,CAAC,CACD,UAAU;CACZ,UAAU,EAAE,KAAK,CAAC,UAAU;CAC5B,WAAW,EACT,QAAQ,CACR,KAAK,EACL,aAAa,6CACb,CAAC,CACD,IAAI,EAAE,CACN,UAAU,CACV,UAAU;CACZ,kBAAkB,EAChB,SAAS,CACT,KAAK,EACL,aAAa,8CACb,CAAC,CACD,UAAU;CACZ,qBAAqB,EACnB,QAAQ,CACR,KAAK,EACL,aACC,qFACD,CAAC,CACD,UAAU;CACZ,cAAc,EACZ,QAAQ,CACR,KAAK,EACL,aACC,8NACD,CAAC,CACD,UAAU;CACZ,aAAa,EACX,OAAO,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CACvC,KAAK,EACL,aAAa,uDACb,CAAC,CACD,UAAU,CACV,UAAU;CACZ,CAAC;AAEF,SAAgB,aAAa,EAC5B,MACA,QACA,2BAQE;AACF,QAAO,mBACN,mBACA;EACC,QAAQ;EACR,MAAM;EACN,UAAU,EACT,SAAS;GACR,aAAa;GACb,WAAW,EACV,OAAO;IACN,aAAa;IACb,SAAS,EACR,oBAAoB,EACnB,QAAQ;KACP,MAAM;KACN,YAAY;MACX,IAAI;OACH,MAAM;OACN,aAAa;OACb;MACD,MAAM;OACL,MAAM;OACN,UAAU;OACV,aAAa;OACb;MACD,OAAO;OACN,MAAM;OACN,UAAU;OACV,aACC;OACD;MACD,QAAQ;OACP,MAAM;OACN,UAAU;OACV,aACC;OACD;MACD,QAAQ;OACP,MAAM;OACN,aAAa;OACb;MACD,gBAAgB;OACf,MAAM;OACN,UAAU;OACV,aACC;OACD;MACD,cAAc;OACb,MAAM;OACN,UAAU;OACV,aAAa;OACb;MACD,cAAc;OACb,MAAM;OACN,QAAQ;OACR,UAAU;OACV,aAAa;OACb;MACD,SAAS;OACR,MAAM;OACN,aAAa;OACb,SAAS;OACT;MACD,kBAAkB;OACjB,MAAM;OACN,aACC;OACD;MACD,qBAAqB;OACpB,MAAM;OACN,UAAU;OACV,aAAa;OACb;MACD,cAAc;OACb,MAAM;OACN,UAAU;OACV,aACC;OACD;MACD,cAAc;OACb,MAAM;OACN,aACC;OACD;MACD,WAAW;OACV,MAAM;OACN,UAAU;OACV,aACC;OACD;MACD,aAAa;OACZ,MAAM;OACN,QAAQ;OACR,UAAU;OACV,aAAa;OACb;MACD,WAAW;OACV,MAAM;OACN,QAAQ;OACR,UAAU;OACV,aAAa;OACb;MACD,WAAW;OACV,MAAM;OACN,QAAQ;OACR,aAAa;OACb;MACD,WAAW;OACV,MAAM;OACN,QAAQ;OACR,aAAa;OACb;MACD,UAAU;OACT,MAAM;OACN,UAAU;OACV,sBAAsB;OACtB,aAAa;OACb;MACD,aAAa;OACZ,MAAM;OACN,UAAU;OACV,aACC;OACD;MACD;KACD,UAAU;MACT;MACA;MACA;MACA;MACA;MACA;MACA;MACA;KACD,EACD,EACD;IACD,EACD;GACD,EACD;EACD,EACD,OAAO,QAAQ;EACd,MAAM,EACL,OACA,WACA,SACA,UACA,cACA,gBACA,WACA,MACA,aACA,kBACA,qBACA,iBACG,IAAI;EAER,MAAM,UAAU,MAAM,kBAAkB,IAAI;EAC5C,MAAM,eAAe,IAAI,WAAW,IAAI;EACxC,MAAM,OACL,gBAAgB,CAAC,UACd,OACA,SAAS,QAAQ,EAAE,IAAI,IAAI,KAAK,QAAQ;AAE5C,MAAI,CAAC,MAAM,GACV,OAAM,SAAS,KAAK,gBAAgBA,oBAAY,qBAAqB;AAGtE,MAAI,WAAW,IAAI,KAAK,UAAU,SAAS,KAAK,OAAO,IAAI,KAAK,OAC/D,OAAM,SAAS,KAAK,gBAAgBA,oBAAY,qBAAqB;AAGtE,MAAI,cAGH;OACC,iBAAiB,UACjB,mBAAmB,UACnB,iBAAiB,UACjB,wBAAwB,UACxB,qBAAqB,UACrB,cAAc,UACd,gBAAgB,OAEhB,OAAM,SAAS,KAAK,eAAeA,oBAAY,qBAAqB;;EAItE,IAAI,SAAwB;AAE5B,WAAS,MAAM,cAAc,KAAK,OAAO,KAAK;AAG9C,MAAI,UAAU,OAAO,WAAW,KAAK,GACpC,UAAS;AAGV,MAAI,CAAC,OACJ,OAAM,SAAS,KAAK,aAAaA,oBAAY,cAAc;EAG5D,MAAM,YAA6B,EAAE;AAErC,MAAI,SAAS,QAAW;AACvB,OAAI,KAAK,SAAS,KAAK,kBACtB,OAAM,SAAS,KAAK,eAAeA,oBAAY,oBAAoB;YACzD,KAAK,SAAS,KAAK,kBAC7B,OAAM,SAAS,KAAK,eAAeA,oBAAY,oBAAoB;AAEpE,aAAU,OAAO;;AAGlB,MAAI,YAAY,OACf,WAAU,UAAU;AAErB,MAAI,cAAc,QAAW;AAC5B,OAAI,KAAK,cAAc,6BAA6B,KACnD,OAAM,SAAS,KACd,eACAA,oBAAY,wBACZ;AAEF,OAAI,cAAc,MAAM;IAGvB,MAAM,oBAAoB,aAAa,OAAU;AAEjD,QAAI,oBAAoB,KAAK,cAAc,aAC1C,OAAM,SAAS,KACd,eACAA,oBAAY,wBACZ;aACS,oBAAoB,KAAK,cAAc,aACjD,OAAM,SAAS,KACd,eACAA,oBAAY,wBACZ;;AAGH,aAAU,YAAY,YAAY,QAAQ,WAAW,MAAM,GAAG;;AAG/D,MAAI,aAAa,UAAa,KAAK,mBAAmB,MAAM;AAC3D,OAAI,OAAO,aAAa,SACvB,OAAM,SAAS,KAAK,eAAeA,oBAAY,sBAAsB;AAGtE,aAAU,WAAW;;AAEtB,MAAI,cAAc,OACjB,WAAU,YAAY;AAEvB,MAAI,iBAAiB,UAAa,mBAAmB,QAAW;AAC/D,OAAI,iBAAiB,UAAa,mBAAmB,OACpD,OAAM,SAAS,KACd,eACAA,oBAAY,oCACZ;YACS,mBAAmB,UAAa,iBAAiB,OAC3D,OAAM,SAAS,KACd,eACAA,oBAAY,oCACZ;AAEF,aAAU,eAAe;AACzB,aAAU,iBAAiB;;AAG5B,MAAI,qBAAqB,OACxB,WAAU,mBAAmB;AAE9B,MAAI,wBAAwB,OAC3B,WAAU,sBAAsB;AAEjC,MAAI,iBAAiB,OACpB,WAAU,eAAe;AAG1B,MAAI,gBAAgB,OAEnB,WAAU,cAAc,KAAK,UAAU,YAAY;AAGpD,MAAI,OAAO,KAAK,UAAU,CAAC,WAAW,EACrC,OAAM,SAAS,KAAK,eAAeA,oBAAY,oBAAoB;EAGpE,IAAI,YAAoB;AACxB,MAAI;AACH,OAAI,KAAK,YAAY,uBAAuB,KAAK,oBAAoB;IACpE,MAAM,YAAY,MAAM,IAAI,QAAQ,QAAQ,OAAe;KAC1D,OAAO;KACP,OAAO,CACN;MACC,OAAO;MACP,OAAO,OAAO;MACd,CACD;KACD,QAAQ;KACR,CAAC;AACF,QAAI,WAAW;AACd,WAAM,UAAU,KAAK,WAAW,KAAK;AACrC,iBAAY;;cAEH,KAAK,YAAY,YAAY;IACvC,MAAM,SAAS,MAAM,IAAI,QAAQ,QAAQ,OAAe;KACvD,OAAO;KACP,OAAO,CACN;MACC,OAAO;MACP,OAAO,OAAO;MACd,CACD;KACD,QAAQ;KACR,CAAC;AACF,QAAI,OAAQ,aAAY;UAClB;IACN,MAAM,UAAkB;KACvB,GAAG;KACH,GAAG;KACH,2BAAW,IAAI,MAAM;KACrB;AACD,UAAM,UAAU,KAAK,SAAS,KAAK;AACnC,gBAAY;;WAEL,OAAY;AACpB,SAAM,SAAS,WAAW,yBAAyB,EAClD,SAAS,OAAO,SAChB,CAAC;;AAGH,0BAAwB,IAAI,QAAQ;EAGpC,MAAM,mBAAmB,MAAM,iCAC9B,KACA,WACA,KACA;EAED,MAAM,EAAE,KAAK,MAAM,GAAG,oBAAoB;AAE1C,SAAO,IAAI,KAAK;GACf,GAAG;GACH,UAAU;GACV,aAAa,gBAAgB,cAC1B,cAEE,gBAAgB,YAAY,GAC9B;GACH,CAAC;GAEH"}

package/dist/plugins/api-key/routes/verify-api-key.mjs

@@ -0,0 +1,223 @@
+import { isAPIError } from "../../../utils/is-api-error.mjs";
+import { role } from "../../access/access.mjs";
+import "../../access/index.mjs";
+import { API_KEY_ERROR_CODES } from "../error-codes.mjs";
+import { deleteApiKey, getApiKey, migrateDoubleStringifiedMetadata, setApiKey } from "../adapter.mjs";
+import { isRateLimited } from "../rate-limit.mjs";
+import { API_KEY_TABLE_NAME, defaultKeyHasher } from "../index.mjs";
+import { APIError } from "@better-auth/core/error";
+import { safeJSONParse } from "@better-auth/core/utils/json";
+import { createAuthEndpoint } from "@better-auth/core/api";
+import * as z from "zod";
+
+//#region src/plugins/api-key/routes/verify-api-key.ts
+async function validateApiKey({ hashedKey, ctx, opts, schema, permissions }) {
+	const apiKey = await getApiKey(ctx, hashedKey, opts);
+	if (!apiKey) throw APIError.from("UNAUTHORIZED", API_KEY_ERROR_CODES.INVALID_API_KEY);
+	if (apiKey.enabled === false) throw APIError.from("UNAUTHORIZED", API_KEY_ERROR_CODES.KEY_DISABLED);
+	if (apiKey.expiresAt) {
+		if (Date.now() > new Date(apiKey.expiresAt).getTime()) {
+			const deleteExpiredKey = async () => {
+				if (opts.storage === "secondary-storage" && opts.fallbackToDatabase) {
+					await deleteApiKey(ctx, apiKey, opts);
+					await ctx.context.adapter.delete({
+						model: API_KEY_TABLE_NAME,
+						where: [{
+							field: "id",
+							value: apiKey.id
+						}]
+					});
+				} else if (opts.storage === "secondary-storage") await deleteApiKey(ctx, apiKey, opts);
+				else await ctx.context.adapter.delete({
+					model: API_KEY_TABLE_NAME,
+					where: [{
+						field: "id",
+						value: apiKey.id
+					}]
+				});
+			};
+			if (opts.deferUpdates) ctx.context.runInBackground(deleteExpiredKey().catch((error) => {
+				ctx.context.logger.error("Deferred update failed:", error);
+			}));
+			else await deleteExpiredKey();
+			throw APIError.from("UNAUTHORIZED", API_KEY_ERROR_CODES.KEY_EXPIRED);
+		}
+	}
+	if (permissions) {
+		const apiKeyPermissions = apiKey.permissions ? safeJSONParse(apiKey.permissions) : null;
+		if (!apiKeyPermissions) throw APIError.from("UNAUTHORIZED", API_KEY_ERROR_CODES.KEY_NOT_FOUND);
+		if (!role(apiKeyPermissions).authorize(permissions).success) throw APIError.from("UNAUTHORIZED", API_KEY_ERROR_CODES.KEY_NOT_FOUND);
+	}
+	let remaining = apiKey.remaining;
+	let lastRefillAt = apiKey.lastRefillAt;
+	if (apiKey.remaining === 0 && apiKey.refillAmount === null) {
+		const deleteExhaustedKey = async () => {
+			if (opts.storage === "secondary-storage" && opts.fallbackToDatabase) {
+				await deleteApiKey(ctx, apiKey, opts);
+				await ctx.context.adapter.delete({
+					model: API_KEY_TABLE_NAME,
+					where: [{
+						field: "id",
+						value: apiKey.id
+					}]
+				});
+			} else if (opts.storage === "secondary-storage") await deleteApiKey(ctx, apiKey, opts);
+			else await ctx.context.adapter.delete({
+				model: API_KEY_TABLE_NAME,
+				where: [{
+					field: "id",
+					value: apiKey.id
+				}]
+			});
+		};
+		if (opts.deferUpdates) ctx.context.runInBackground(deleteExhaustedKey().catch((error) => {
+			ctx.context.logger.error("Deferred update failed:", error);
+		}));
+		else await deleteExhaustedKey();
+		throw APIError.from("TOO_MANY_REQUESTS", API_KEY_ERROR_CODES.USAGE_EXCEEDED);
+	} else if (remaining !== null) {
+		const now = Date.now();
+		const refillInterval = apiKey.refillInterval;
+		const refillAmount = apiKey.refillAmount;
+		const lastTime = new Date(lastRefillAt ?? apiKey.createdAt).getTime();
+		if (refillInterval && refillAmount) {
+			if (now - lastTime > refillInterval) {
+				remaining = refillAmount;
+				lastRefillAt = /* @__PURE__ */ new Date();
+			}
+		}
+		if (remaining === 0) throw APIError.from("TOO_MANY_REQUESTS", API_KEY_ERROR_CODES.USAGE_EXCEEDED);
+		else remaining--;
+	}
+	const { message, success, update, tryAgainIn } = isRateLimited(apiKey, opts);
+	if (success === false) throw new APIError("UNAUTHORIZED", {
+		message: message ?? void 0,
+		code: "RATE_LIMITED",
+		details: { tryAgainIn }
+	});
+	const updated = {
+		...apiKey,
+		...update,
+		remaining,
+		lastRefillAt,
+		updatedAt: /* @__PURE__ */ new Date()
+	};
+	const performUpdate = async () => {
+		if (opts.storage === "database") return ctx.context.adapter.update({
+			model: API_KEY_TABLE_NAME,
+			where: [{
+				field: "id",
+				value: apiKey.id
+			}],
+			update: {
+				...updated,
+				id: void 0
+			}
+		});
+		else if (opts.storage === "secondary-storage" && opts.fallbackToDatabase) {
+			const dbUpdated = await ctx.context.adapter.update({
+				model: API_KEY_TABLE_NAME,
+				where: [{
+					field: "id",
+					value: apiKey.id
+				}],
+				update: {
+					...updated,
+					id: void 0
+				}
+			});
+			if (dbUpdated) await setApiKey(ctx, dbUpdated, opts);
+			return dbUpdated;
+		} else {
+			await setApiKey(ctx, updated, opts);
+			return updated;
+		}
+	};
+	let newApiKey = null;
+	if (opts.deferUpdates) {
+		ctx.context.runInBackground(performUpdate().catch((error) => {
+			ctx.context.logger.error("Failed to update API key:", error);
+		}));
+		newApiKey = updated;
+	} else {
+		newApiKey = await performUpdate();
+		if (!newApiKey) throw APIError.from("INTERNAL_SERVER_ERROR", API_KEY_ERROR_CODES.FAILED_TO_UPDATE_API_KEY);
+	}
+	return newApiKey;
+}
+const verifyApiKeyBodySchema = z.object({
+	key: z.string().meta({ description: "The key to verify" }),
+	permissions: z.record(z.string(), z.array(z.string())).meta({ description: "The permissions to verify." }).optional()
+});
+function verifyApiKey({ opts, schema, deleteAllExpiredApiKeys }) {
+	return createAuthEndpoint({
+		method: "POST",
+		body: verifyApiKeyBodySchema
+	}, async (ctx) => {
+		const { key } = ctx.body;
+		if (opts.customAPIKeyValidator) {
+			if (!await opts.customAPIKeyValidator({
+				ctx,
+				key
+			})) return ctx.json({
+				valid: false,
+				error: {
+					message: API_KEY_ERROR_CODES.INVALID_API_KEY,
+					code: "KEY_NOT_FOUND"
+				},
+				key: null
+			});
+		}
+		const hashed = opts.disableKeyHashing ? key : await defaultKeyHasher(key);
+		let apiKey = null;
+		try {
+			apiKey = await validateApiKey({
+				hashedKey: hashed,
+				permissions: ctx.body.permissions,
+				ctx,
+				opts,
+				schema
+			});
+			if (opts.deferUpdates) ctx.context.runInBackground(deleteAllExpiredApiKeys(ctx.context).catch((err) => {
+				ctx.context.logger.error("Failed to delete expired API keys:", err);
+			}));
+		} catch (error) {
+			ctx.context.logger.error("Failed to validate API key:", error);
+			if (isAPIError(error)) return ctx.json({
+				valid: false,
+				error: {
+					message: error.body?.message,
+					code: error.body?.code
+				},
+				key: null
+			});
+			return ctx.json({
+				valid: false,
+				error: {
+					message: API_KEY_ERROR_CODES.INVALID_API_KEY,
+					code: "INVALID_API_KEY"
+				},
+				key: null
+			});
+		}
+		const { key: _, ...returningApiKey } = apiKey ?? {
+			key: 1,
+			permissions: void 0
+		};
+		let migratedMetadata = null;
+		if (apiKey) migratedMetadata = await migrateDoubleStringifiedMetadata(ctx, apiKey, opts);
+		returningApiKey.permissions = returningApiKey.permissions ? safeJSONParse(returningApiKey.permissions) : null;
+		return ctx.json({
+			valid: true,
+			error: null,
+			key: apiKey === null ? null : {
+				...returningApiKey,
+				metadata: migratedMetadata
+			}
+		});
+	});
+}
+
+//#endregion
+export { validateApiKey, verifyApiKey };
+//# sourceMappingURL=verify-api-key.mjs.map

package/dist/plugins/api-key/routes/verify-api-key.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-api-key.mjs","names":["ERROR_CODES"],"sources":["../../../../src/plugins/api-key/routes/verify-api-key.ts"],"sourcesContent":["import type { AuthContext, GenericEndpointContext } from \"@better-auth/core\";\nimport { createAuthEndpoint } from \"@better-auth/core/api\";\nimport { APIError } from \"@better-auth/core/error\";\nimport { safeJSONParse } from \"@better-auth/core/utils/json\";\nimport * as z from \"zod\";\nimport { isAPIError } from \"../../../utils/is-api-error\";\nimport { role } from \"../../access\";\nimport { API_KEY_TABLE_NAME, API_KEY_ERROR_CODES as ERROR_CODES } from \"..\";\nimport { defaultKeyHasher } from \"../\";\nimport {\n\tdeleteApiKey,\n\tgetApiKey,\n\tmigrateDoubleStringifiedMetadata,\n\tsetApiKey,\n} from \"../adapter\";\nimport { isRateLimited } from \"../rate-limit\";\nimport type { apiKeySchema } from \"../schema\";\nimport type { ApiKey } from \"../types\";\nimport type { PredefinedApiKeyOptions } from \".\";\n\nexport async function validateApiKey({\n\thashedKey,\n\tctx,\n\topts,\n\tschema,\n\tpermissions,\n}: {\n\thashedKey: string;\n\topts: PredefinedApiKeyOptions;\n\tschema: ReturnType<typeof apiKeySchema>;\n\tpermissions?: Record<string, string[]> | undefined;\n\tctx: GenericEndpointContext;\n}) {\n\tconst apiKey = await getApiKey(ctx, hashedKey, opts);\n\n\tif (!apiKey) {\n\t\tthrow APIError.from(\"UNAUTHORIZED\", ERROR_CODES.INVALID_API_KEY);\n\t}\n\n\tif (apiKey.enabled === false) {\n\t\tthrow APIError.from(\"UNAUTHORIZED\", ERROR_CODES.KEY_DISABLED);\n\t}\n\n\tif (apiKey.expiresAt) {\n\t\tconst now = Date.now();\n\t\tconst expiresAt = new Date(apiKey.expiresAt).getTime();\n\t\tif (now > expiresAt) {\n\t\t\tconst deleteExpiredKey = async () => {\n\t\t\t\tif (opts.storage === \"secondary-storage\" && opts.fallbackToDatabase) {\n\t\t\t\t\tawait deleteApiKey(ctx, apiKey, opts);\n\t\t\t\t\tawait ctx.context.adapter.delete({\n\t\t\t\t\t\tmodel: API_KEY_TABLE_NAME,\n\t\t\t\t\t\twhere: [{ field: \"id\", value: apiKey.id }],\n\t\t\t\t\t});\n\t\t\t\t} else if (opts.storage === \"secondary-storage\") {\n\t\t\t\t\tawait deleteApiKey(ctx, apiKey, opts);\n\t\t\t\t} else {\n\t\t\t\t\tawait ctx.context.adapter.delete({\n\t\t\t\t\t\tmodel: API_KEY_TABLE_NAME,\n\t\t\t\t\t\twhere: [{ field: \"id\", value: apiKey.id }],\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t};\n\n\t\t\tif (opts.deferUpdates) {\n\t\t\t\tctx.context.runInBackground(\n\t\t\t\t\tdeleteExpiredKey().catch((error) => {\n\t\t\t\t\t\tctx.context.logger.error(\"Deferred update failed:\", error);\n\t\t\t\t\t}),\n\t\t\t\t);\n\t\t\t} else {\n\t\t\t\tawait deleteExpiredKey();\n\t\t\t}\n\n\t\t\tthrow APIError.from(\"UNAUTHORIZED\", ERROR_CODES.KEY_EXPIRED);\n\t\t}\n\t}\n\n\tif (permissions) {\n\t\tconst apiKeyPermissions = apiKey.permissions\n\t\t\t? safeJSONParse<{\n\t\t\t\t\t[key: string]: string[];\n\t\t\t\t}>(apiKey.permissions)\n\t\t\t: null;\n\n\t\tif (!apiKeyPermissions) {\n\t\t\tthrow APIError.from(\"UNAUTHORIZED\", ERROR_CODES.KEY_NOT_FOUND);\n\t\t}\n\t\tconst r = role(apiKeyPermissions as any);\n\t\tconst result = r.authorize(permissions);\n\t\tif (!result.success) {\n\t\t\tthrow APIError.from(\"UNAUTHORIZED\", ERROR_CODES.KEY_NOT_FOUND);\n\t\t}\n\t}\n\n\tlet remaining = apiKey.remaining;\n\tlet lastRefillAt = apiKey.lastRefillAt;\n\n\tif (apiKey.remaining === 0 && apiKey.refillAmount === null) {\n\t\tconst deleteExhaustedKey = async () => {\n\t\t\tif (opts.storage === \"secondary-storage\" && opts.fallbackToDatabase) {\n\t\t\t\tawait deleteApiKey(ctx, apiKey, opts);\n\t\t\t\tawait ctx.context.adapter.delete({\n\t\t\t\t\tmodel: API_KEY_TABLE_NAME,\n\t\t\t\t\twhere: [{ field: \"id\", value: apiKey.id }],\n\t\t\t\t});\n\t\t\t} else if (opts.storage === \"secondary-storage\") {\n\t\t\t\tawait deleteApiKey(ctx, apiKey, opts);\n\t\t\t} else {\n\t\t\t\tawait ctx.context.adapter.delete({\n\t\t\t\t\tmodel: API_KEY_TABLE_NAME,\n\t\t\t\t\twhere: [{ field: \"id\", value: apiKey.id }],\n\t\t\t\t});\n\t\t\t}\n\t\t};\n\n\t\tif (opts.deferUpdates) {\n\t\t\tctx.context.runInBackground(\n\t\t\t\tdeleteExhaustedKey().catch((error) => {\n\t\t\t\t\tctx.context.logger.error(\"Deferred update failed:\", error);\n\t\t\t\t}),\n\t\t\t);\n\t\t} else {\n\t\t\tawait deleteExhaustedKey();\n\t\t}\n\n\t\tthrow APIError.from(\"TOO_MANY_REQUESTS\", ERROR_CODES.USAGE_EXCEEDED);\n\t} else if (remaining !== null) {\n\t\tconst now = Date.now();\n\t\tconst refillInterval = apiKey.refillInterval;\n\t\tconst refillAmount = apiKey.refillAmount;\n\t\tconst lastTime = new Date(lastRefillAt ?? apiKey.createdAt).getTime();\n\n\t\tif (refillInterval && refillAmount) {\n\t\t\t// if they provide refill info, then we should refill once the interval is reached.\n\n\t\t\tconst timeSinceLastRequest = now - lastTime;\n\t\t\tif (timeSinceLastRequest > refillInterval) {\n\t\t\t\tremaining = refillAmount;\n\t\t\t\tlastRefillAt = new Date();\n\t\t\t}\n\t\t}\n\n\t\tif (remaining === 0) {\n\t\t\t// if there are no more remaining requests, than the key is invalid\n\t\t\tthrow APIError.from(\"TOO_MANY_REQUESTS\", ERROR_CODES.USAGE_EXCEEDED);\n\t\t} else {\n\t\t\tremaining--;\n\t\t}\n\t}\n\n\tconst { message, success, update, tryAgainIn } = isRateLimited(apiKey, opts);\n\n\tif (success === false) {\n\t\tthrow new APIError(\"UNAUTHORIZED\", {\n\t\t\tmessage: message ?? undefined,\n\t\t\tcode: \"RATE_LIMITED\" as const,\n\t\t\tdetails: {\n\t\t\t\ttryAgainIn,\n\t\t\t},\n\t\t});\n\t}\n\n\tconst updated: ApiKey = {\n\t\t...apiKey,\n\t\t...update,\n\t\tremaining,\n\t\tlastRefillAt,\n\t\tupdatedAt: new Date(),\n\t};\n\n\tconst performUpdate = async (): Promise<ApiKey | null> => {\n\t\tif (opts.storage === \"database\") {\n\t\t\treturn ctx.context.adapter.update<ApiKey>({\n\t\t\t\tmodel: API_KEY_TABLE_NAME,\n\t\t\t\twhere: [{ field: \"id\", value: apiKey.id }],\n\t\t\t\tupdate: { ...updated, id: undefined },\n\t\t\t});\n\t\t} else if (\n\t\t\topts.storage === \"secondary-storage\" &&\n\t\t\topts.fallbackToDatabase\n\t\t) {\n\t\t\tconst dbUpdated = await ctx.context.adapter.update<ApiKey>({\n\t\t\t\tmodel: API_KEY_TABLE_NAME,\n\t\t\t\twhere: [{ field: \"id\", value: apiKey.id }],\n\t\t\t\tupdate: { ...updated, id: undefined },\n\t\t\t});\n\t\t\tif (dbUpdated) {\n\t\t\t\tawait setApiKey(ctx, dbUpdated, opts);\n\t\t\t}\n\t\t\treturn dbUpdated;\n\t\t} else {\n\t\t\tawait setApiKey(ctx, updated, opts);\n\t\t\treturn updated;\n\t\t}\n\t};\n\n\tlet newApiKey: ApiKey | null = null;\n\n\tif (opts.deferUpdates) {\n\t\tctx.context.runInBackground(\n\t\t\tperformUpdate().catch((error) => {\n\t\t\t\tctx.context.logger.error(\"Failed to update API key:\", error);\n\t\t\t}),\n\t\t);\n\t\tnewApiKey = updated;\n\t} else {\n\t\tnewApiKey = await performUpdate();\n\t\tif (!newApiKey) {\n\t\t\tthrow APIError.from(\n\t\t\t\t\"INTERNAL_SERVER_ERROR\",\n\t\t\t\tERROR_CODES.FAILED_TO_UPDATE_API_KEY,\n\t\t\t);\n\t\t}\n\t}\n\n\treturn newApiKey;\n}\n\nconst verifyApiKeyBodySchema = z.object({\n\tkey: z.string().meta({\n\t\tdescription: \"The key to verify\",\n\t}),\n\tpermissions: z\n\t\t.record(z.string(), z.array(z.string()))\n\t\t.meta({\n\t\t\tdescription: \"The permissions to verify.\",\n\t\t})\n\t\t.optional(),\n});\n\nexport function verifyApiKey({\n\topts,\n\tschema,\n\tdeleteAllExpiredApiKeys,\n}: {\n\topts: PredefinedApiKeyOptions;\n\tschema: ReturnType<typeof apiKeySchema>;\n\tdeleteAllExpiredApiKeys(\n\t\tctx: AuthContext,\n\t\tbyPassLastCheckTime?: boolean | undefined,\n\t): Promise<void>;\n}) {\n\treturn createAuthEndpoint(\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\tbody: verifyApiKeyBodySchema,\n\t\t},\n\t\tasync (ctx) => {\n\t\t\tconst { key } = ctx.body;\n\n\t\t\tif (opts.customAPIKeyValidator) {\n\t\t\t\tconst isValid = await opts.customAPIKeyValidator({ ctx, key });\n\t\t\t\tif (!isValid) {\n\t\t\t\t\treturn ctx.json({\n\t\t\t\t\t\tvalid: false,\n\t\t\t\t\t\terror: {\n\t\t\t\t\t\t\tmessage: ERROR_CODES.INVALID_API_KEY,\n\t\t\t\t\t\t\tcode: \"KEY_NOT_FOUND\" as const,\n\t\t\t\t\t\t},\n\t\t\t\t\t\tkey: null,\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tconst hashed = opts.disableKeyHashing ? key : await defaultKeyHasher(key);\n\n\t\t\tlet apiKey: ApiKey | null = null;\n\n\t\t\ttry {\n\t\t\t\tapiKey = await validateApiKey({\n\t\t\t\t\thashedKey: hashed,\n\t\t\t\t\tpermissions: ctx.body.permissions,\n\t\t\t\t\tctx,\n\t\t\t\t\topts,\n\t\t\t\t\tschema,\n\t\t\t\t});\n\n\t\t\t\tif (opts.deferUpdates) {\n\t\t\t\t\tctx.context.runInBackground(\n\t\t\t\t\t\tdeleteAllExpiredApiKeys(ctx.context).catch((err) => {\n\t\t\t\t\t\t\tctx.context.logger.error(\n\t\t\t\t\t\t\t\t\"Failed to delete expired API keys:\",\n\t\t\t\t\t\t\t\terr,\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t}),\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t} catch (error) {\n\t\t\t\tctx.context.logger.error(\"Failed to validate API key:\", error);\n\t\t\t\tif (isAPIError(error)) {\n\t\t\t\t\treturn ctx.json({\n\t\t\t\t\t\tvalid: false,\n\t\t\t\t\t\terror: {\n\t\t\t\t\t\t\tmessage: error.body?.message,\n\t\t\t\t\t\t\tcode: error.body?.code as string,\n\t\t\t\t\t\t},\n\t\t\t\t\t\tkey: null,\n\t\t\t\t\t});\n\t\t\t\t}\n\n\t\t\t\treturn ctx.json({\n\t\t\t\t\tvalid: false,\n\t\t\t\t\terror: {\n\t\t\t\t\t\tmessage: ERROR_CODES.INVALID_API_KEY,\n\t\t\t\t\t\tcode: \"INVALID_API_KEY\" as const,\n\t\t\t\t\t},\n\t\t\t\t\tkey: null,\n\t\t\t\t});\n\t\t\t}\n\n\t\t\tconst { key: _, ...returningApiKey } = apiKey ?? {\n\t\t\t\tkey: 1,\n\t\t\t\tpermissions: undefined,\n\t\t\t};\n\n\t\t\t// Migrate legacy double-stringified metadata if needed\n\t\t\tlet migratedMetadata: Record<string, any> | null = null;\n\t\t\tif (apiKey) {\n\t\t\t\tmigratedMetadata = await migrateDoubleStringifiedMetadata(\n\t\t\t\t\tctx,\n\t\t\t\t\tapiKey,\n\t\t\t\t\topts,\n\t\t\t\t);\n\t\t\t}\n\n\t\t\treturningApiKey.permissions = returningApiKey.permissions\n\t\t\t\t? safeJSONParse<{\n\t\t\t\t\t\t[key: string]: string[];\n\t\t\t\t\t}>(returningApiKey.permissions)\n\t\t\t\t: null;\n\n\t\t\treturn ctx.json({\n\t\t\t\tvalid: true,\n\t\t\t\terror: null,\n\t\t\t\tkey:\n\t\t\t\t\tapiKey === null\n\t\t\t\t\t\t? null\n\t\t\t\t\t\t: ({\n\t\t\t\t\t\t\t\t...returningApiKey,\n\t\t\t\t\t\t\t\tmetadata: migratedMetadata,\n\t\t\t\t\t\t\t} as Omit<ApiKey, \"key\">),\n\t\t\t});\n\t\t},\n\t);\n}\n"],"mappings":";;;;;;;;;;;;;AAoBA,eAAsB,eAAe,EACpC,WACA,KACA,MACA,QACA,eAOE;CACF,MAAM,SAAS,MAAM,UAAU,KAAK,WAAW,KAAK;AAEpD,KAAI,CAAC,OACJ,OAAM,SAAS,KAAK,gBAAgBA,oBAAY,gBAAgB;AAGjE,KAAI,OAAO,YAAY,MACtB,OAAM,SAAS,KAAK,gBAAgBA,oBAAY,aAAa;AAG9D,KAAI,OAAO,WAGV;MAFY,KAAK,KAAK,GACJ,IAAI,KAAK,OAAO,UAAU,CAAC,SAAS,EACjC;GACpB,MAAM,mBAAmB,YAAY;AACpC,QAAI,KAAK,YAAY,uBAAuB,KAAK,oBAAoB;AACpE,WAAM,aAAa,KAAK,QAAQ,KAAK;AACrC,WAAM,IAAI,QAAQ,QAAQ,OAAO;MAChC,OAAO;MACP,OAAO,CAAC;OAAE,OAAO;OAAM,OAAO,OAAO;OAAI,CAAC;MAC1C,CAAC;eACQ,KAAK,YAAY,oBAC3B,OAAM,aAAa,KAAK,QAAQ,KAAK;QAErC,OAAM,IAAI,QAAQ,QAAQ,OAAO;KAChC,OAAO;KACP,OAAO,CAAC;MAAE,OAAO;MAAM,OAAO,OAAO;MAAI,CAAC;KAC1C,CAAC;;AAIJ,OAAI,KAAK,aACR,KAAI,QAAQ,gBACX,kBAAkB,CAAC,OAAO,UAAU;AACnC,QAAI,QAAQ,OAAO,MAAM,2BAA2B,MAAM;KACzD,CACF;OAED,OAAM,kBAAkB;AAGzB,SAAM,SAAS,KAAK,gBAAgBA,oBAAY,YAAY;;;AAI9D,KAAI,aAAa;EAChB,MAAM,oBAAoB,OAAO,cAC9B,cAEE,OAAO,YAAY,GACrB;AAEH,MAAI,CAAC,kBACJ,OAAM,SAAS,KAAK,gBAAgBA,oBAAY,cAAc;AAI/D,MAAI,CAFM,KAAK,kBAAyB,CACvB,UAAU,YAAY,CAC3B,QACX,OAAM,SAAS,KAAK,gBAAgBA,oBAAY,cAAc;;CAIhE,IAAI,YAAY,OAAO;CACvB,IAAI,eAAe,OAAO;AAE1B,KAAI,OAAO,cAAc,KAAK,OAAO,iBAAiB,MAAM;EAC3D,MAAM,qBAAqB,YAAY;AACtC,OAAI,KAAK,YAAY,uBAAuB,KAAK,oBAAoB;AACpE,UAAM,aAAa,KAAK,QAAQ,KAAK;AACrC,UAAM,IAAI,QAAQ,QAAQ,OAAO;KAChC,OAAO;KACP,OAAO,CAAC;MAAE,OAAO;MAAM,OAAO,OAAO;MAAI,CAAC;KAC1C,CAAC;cACQ,KAAK,YAAY,oBAC3B,OAAM,aAAa,KAAK,QAAQ,KAAK;OAErC,OAAM,IAAI,QAAQ,QAAQ,OAAO;IAChC,OAAO;IACP,OAAO,CAAC;KAAE,OAAO;KAAM,OAAO,OAAO;KAAI,CAAC;IAC1C,CAAC;;AAIJ,MAAI,KAAK,aACR,KAAI,QAAQ,gBACX,oBAAoB,CAAC,OAAO,UAAU;AACrC,OAAI,QAAQ,OAAO,MAAM,2BAA2B,MAAM;IACzD,CACF;MAED,OAAM,oBAAoB;AAG3B,QAAM,SAAS,KAAK,qBAAqBA,oBAAY,eAAe;YAC1D,cAAc,MAAM;EAC9B,MAAM,MAAM,KAAK,KAAK;EACtB,MAAM,iBAAiB,OAAO;EAC9B,MAAM,eAAe,OAAO;EAC5B,MAAM,WAAW,IAAI,KAAK,gBAAgB,OAAO,UAAU,CAAC,SAAS;AAErE,MAAI,kBAAkB,cAIrB;OAD6B,MAAM,WACR,gBAAgB;AAC1C,gBAAY;AACZ,mCAAe,IAAI,MAAM;;;AAI3B,MAAI,cAAc,EAEjB,OAAM,SAAS,KAAK,qBAAqBA,oBAAY,eAAe;MAEpE;;CAIF,MAAM,EAAE,SAAS,SAAS,QAAQ,eAAe,cAAc,QAAQ,KAAK;AAE5E,KAAI,YAAY,MACf,OAAM,IAAI,SAAS,gBAAgB;EAClC,SAAS,WAAW;EACpB,MAAM;EACN,SAAS,EACR,YACA;EACD,CAAC;CAGH,MAAM,UAAkB;EACvB,GAAG;EACH,GAAG;EACH;EACA;EACA,2BAAW,IAAI,MAAM;EACrB;CAED,MAAM,gBAAgB,YAAoC;AACzD,MAAI,KAAK,YAAY,WACpB,QAAO,IAAI,QAAQ,QAAQ,OAAe;GACzC,OAAO;GACP,OAAO,CAAC;IAAE,OAAO;IAAM,OAAO,OAAO;IAAI,CAAC;GAC1C,QAAQ;IAAE,GAAG;IAAS,IAAI;IAAW;GACrC,CAAC;WAEF,KAAK,YAAY,uBACjB,KAAK,oBACJ;GACD,MAAM,YAAY,MAAM,IAAI,QAAQ,QAAQ,OAAe;IAC1D,OAAO;IACP,OAAO,CAAC;KAAE,OAAO;KAAM,OAAO,OAAO;KAAI,CAAC;IAC1C,QAAQ;KAAE,GAAG;KAAS,IAAI;KAAW;IACrC,CAAC;AACF,OAAI,UACH,OAAM,UAAU,KAAK,WAAW,KAAK;AAEtC,UAAO;SACD;AACN,SAAM,UAAU,KAAK,SAAS,KAAK;AACnC,UAAO;;;CAIT,IAAI,YAA2B;AAE/B,KAAI,KAAK,cAAc;AACtB,MAAI,QAAQ,gBACX,eAAe,CAAC,OAAO,UAAU;AAChC,OAAI,QAAQ,OAAO,MAAM,6BAA6B,MAAM;IAC3D,CACF;AACD,cAAY;QACN;AACN,cAAY,MAAM,eAAe;AACjC,MAAI,CAAC,UACJ,OAAM,SAAS,KACd,yBACAA,oBAAY,yBACZ;;AAIH,QAAO;;AAGR,MAAM,yBAAyB,EAAE,OAAO;CACvC,KAAK,EAAE,QAAQ,CAAC,KAAK,EACpB,aAAa,qBACb,CAAC;CACF,aAAa,EACX,OAAO,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CACvC,KAAK,EACL,aAAa,8BACb,CAAC,CACD,UAAU;CACZ,CAAC;AAEF,SAAgB,aAAa,EAC5B,MACA,QACA,2BAQE;AACF,QAAO,mBACN;EACC,QAAQ;EACR,MAAM;EACN,EACD,OAAO,QAAQ;EACd,MAAM,EAAE,QAAQ,IAAI;AAEpB,MAAI,KAAK,uBAER;OAAI,CADY,MAAM,KAAK,sBAAsB;IAAE;IAAK;IAAK,CAAC,CAE7D,QAAO,IAAI,KAAK;IACf,OAAO;IACP,OAAO;KACN,SAASA,oBAAY;KACrB,MAAM;KACN;IACD,KAAK;IACL,CAAC;;EAIJ,MAAM,SAAS,KAAK,oBAAoB,MAAM,MAAM,iBAAiB,IAAI;EAEzE,IAAI,SAAwB;AAE5B,MAAI;AACH,YAAS,MAAM,eAAe;IAC7B,WAAW;IACX,aAAa,IAAI,KAAK;IACtB;IACA;IACA;IACA,CAAC;AAEF,OAAI,KAAK,aACR,KAAI,QAAQ,gBACX,wBAAwB,IAAI,QAAQ,CAAC,OAAO,QAAQ;AACnD,QAAI,QAAQ,OAAO,MAClB,sCACA,IACA;KACA,CACF;WAEM,OAAO;AACf,OAAI,QAAQ,OAAO,MAAM,+BAA+B,MAAM;AAC9D,OAAI,WAAW,MAAM,CACpB,QAAO,IAAI,KAAK;IACf,OAAO;IACP,OAAO;KACN,SAAS,MAAM,MAAM;KACrB,MAAM,MAAM,MAAM;KAClB;IACD,KAAK;IACL,CAAC;AAGH,UAAO,IAAI,KAAK;IACf,OAAO;IACP,OAAO;KACN,SAASA,oBAAY;KACrB,MAAM;KACN;IACD,KAAK;IACL,CAAC;;EAGH,MAAM,EAAE,KAAK,GAAG,GAAG,oBAAoB,UAAU;GAChD,KAAK;GACL,aAAa;GACb;EAGD,IAAI,mBAA+C;AACnD,MAAI,OACH,oBAAmB,MAAM,iCACxB,KACA,QACA,KACA;AAGF,kBAAgB,cAAc,gBAAgB,cAC3C,cAEE,gBAAgB,YAAY,GAC9B;AAEH,SAAO,IAAI,KAAK;GACf,OAAO;GACP,OAAO;GACP,KACC,WAAW,OACR,OACC;IACD,GAAG;IACH,UAAU;IACV;GACJ,CAAC;GAEH"}

package/dist/plugins/api-key/schema.d.mts

@@ -0,0 +1,11 @@
+//#region src/plugins/api-key/schema.d.ts
+declare const apiKeySchema: ({
+  timeWindow,
+  rateLimitMax
+}: {
+  timeWindow: number;
+  rateLimitMax: number;
+}) => BetterAuthPluginDBSchema;
+//#endregion
+export { apiKeySchema };
+//# sourceMappingURL=schema.d.mts.map