@happyvertical/smrt-profiles 0.51.10 → 0.51.12
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/AGENTS.md +27 -0
- package/dist/chunks/{ApiKey-BTC7nWG1.js → ApiKey-DIqCzx-g.js} +4 -3
- package/dist/chunks/ApiKey-DIqCzx-g.js.map +1 -0
- package/dist/chunks/{ApiKeyCollection-DsxaLEwc.js → ApiKeyCollection-CNFptBxU.js} +3 -3
- package/dist/chunks/{ApiKeyCollection-DsxaLEwc.js.map → ApiKeyCollection-CNFptBxU.js.map} +1 -1
- package/dist/chunks/{AuditLogCollection-N5ItRtEK.js → AuditLogCollection-DxR3ZG6_.js} +2 -2
- package/dist/chunks/{AuditLogCollection-N5ItRtEK.js.map → AuditLogCollection-DxR3ZG6_.js.map} +1 -1
- package/dist/chunks/{NostrIdentity-C39j4O4k.js → NostrIdentity-CbnAJgg9.js} +5 -4
- package/dist/chunks/{NostrIdentity-C39j4O4k.js.map → NostrIdentity-CbnAJgg9.js.map} +1 -1
- package/dist/chunks/{NostrIdentityCollection-PzvQ54Nm.js → NostrIdentityCollection-BXtvB0Sd.js} +2 -2
- package/dist/chunks/{NostrIdentityCollection-PzvQ54Nm.js.map → NostrIdentityCollection-BXtvB0Sd.js.map} +1 -1
- package/dist/chunks/{OidcIdentity-DjV_QkWf.js → OidcIdentity-DISriiph.js} +3 -3
- package/dist/chunks/{OidcIdentity-DjV_QkWf.js.map → OidcIdentity-DISriiph.js.map} +1 -1
- package/dist/chunks/{OidcIdentityCollection-DjHxIEKC.js → OidcIdentityCollection-B6im_oL_.js} +3 -3
- package/dist/chunks/{OidcIdentityCollection-DjHxIEKC.js.map → OidcIdentityCollection-B6im_oL_.js.map} +1 -1
- package/dist/chunks/{ProfileAssetCollection-D1WJn8UN.js → ProfileAssetCollection-CuwaiTOk.js} +3 -3
- package/dist/chunks/{ProfileAssetCollection-D1WJn8UN.js.map → ProfileAssetCollection-CuwaiTOk.js.map} +1 -1
- package/dist/chunks/{ProfileCollection-kMs3qYEZ.js → ProfileCollection-BAC5weFA.js} +76 -76
- package/dist/chunks/{ProfileCollection-kMs3qYEZ.js.map → ProfileCollection-BAC5weFA.js.map} +1 -1
- package/dist/chunks/{ProfileMetadataCollection-BqOi6QaP.js → ProfileMetadataCollection-DyVxb-Tn.js} +2 -2
- package/dist/chunks/{ProfileMetadataCollection-BqOi6QaP.js.map → ProfileMetadataCollection-DyVxb-Tn.js.map} +1 -1
- package/dist/chunks/{ProfileMetafieldCollection-C-jB8Zdj.js → ProfileMetafieldCollection-KSYFXBxU.js} +2 -2
- package/dist/chunks/{ProfileMetafieldCollection-C-jB8Zdj.js.map → ProfileMetafieldCollection-KSYFXBxU.js.map} +1 -1
- package/dist/chunks/{ProfileRelationshipCollection-DvTSsUBr.js → ProfileRelationshipCollection-DigPX3kC.js} +5 -5
- package/dist/chunks/{ProfileRelationshipCollection-DvTSsUBr.js.map → ProfileRelationshipCollection-DigPX3kC.js.map} +1 -1
- package/dist/chunks/{ProfileRelationshipTermCollection-C2bd2BSh.js → ProfileRelationshipTermCollection-UkhmGHcr.js} +2 -2
- package/dist/chunks/{ProfileRelationshipTermCollection-C2bd2BSh.js.map → ProfileRelationshipTermCollection-UkhmGHcr.js.map} +1 -1
- package/dist/chunks/{ProfileRelationshipType-BtEked7O.js → ProfileRelationshipType-D1WLqC2B.js} +2 -2
- package/dist/chunks/{ProfileRelationshipType-BtEked7O.js.map → ProfileRelationshipType-D1WLqC2B.js.map} +1 -1
- package/dist/chunks/{ProfileRelationshipTypeCollection-zT0bdM5A.js → ProfileRelationshipTypeCollection-BapU-NS3.js} +3 -3
- package/dist/chunks/{ProfileRelationshipTypeCollection-zT0bdM5A.js.map → ProfileRelationshipTypeCollection-BapU-NS3.js.map} +1 -1
- package/dist/chunks/{oidcProvisioningPrimitives-BAlBZaYo.js → oidcProvisioningPrimitives-BPWWsNb7.js} +4 -4
- package/dist/chunks/{oidcProvisioningPrimitives-BAlBZaYo.js.map → oidcProvisioningPrimitives-BPWWsNb7.js.map} +1 -1
- package/dist/chunks/{resolveIdentity-DfXnbA4H.js → resolveIdentity-QEWj65PQ.js} +16 -16
- package/dist/chunks/{resolveIdentity-DfXnbA4H.js.map → resolveIdentity-QEWj65PQ.js.map} +1 -1
- package/dist/index.d.ts +49 -0
- package/dist/index.js +63 -23
- package/dist/index.js.map +1 -1
- package/dist/internal/oidc-provisioning.js +2 -2
- package/dist/manifest.json +4 -1
- package/dist/smrt-knowledge.json +5 -5
- package/dist/utils.js +4 -4
- package/package.json +12 -11
- package/dist/chunks/ApiKey-BTC7nWG1.js.map +0 -1
package/AGENTS.md
CHANGED
|
@@ -39,6 +39,33 @@ Auth helpers in `src/auth/` build profiles from external identity claims:
|
|
|
39
39
|
canonical Profile changes.
|
|
40
40
|
- `createProfileFromNostr(email, nostrData)` — creates `Profile` + `NostrIdentity` for Nostr-authenticated users.
|
|
41
41
|
|
|
42
|
+
## Agent (bot) profiles (#2995)
|
|
43
|
+
|
|
44
|
+
An automated agent is an author, and every authoring seam in the framework
|
|
45
|
+
(`ChatMessage.senderProfileId`, `ChatParticipant.profileId`, a persona's
|
|
46
|
+
`actsAsProfileId`) is a `crossPackageRef` to `Profile` — a native uuid column on
|
|
47
|
+
PostgreSQL/DuckDB. A slug-style agent id is therefore not a representable author
|
|
48
|
+
(`22P02`). `src/agent-profile.ts` is the owning-package API that turns one into
|
|
49
|
+
a real Profile so no consumer mints bot profiles itself and no uuid column is
|
|
50
|
+
weakened to text:
|
|
51
|
+
|
|
52
|
+
- `resolveAgentProfile(profiles, { agentId, tenantId, name? })` /
|
|
53
|
+
`resolveAgentProfileId(...)` — resolve, creating on first use, the `bot`
|
|
54
|
+
Profile an agent authors as. Idempotent and tenant-bound: identity is keyed on
|
|
55
|
+
`(tenantId, slug = agentId, context = AGENT_PROFILE_CONTEXT)`, matching the
|
|
56
|
+
model's `(tenant_id, slug, context, _meta_type)` unique key, so an agent id
|
|
57
|
+
resolves to a distinct profile per tenant and never collides with a
|
|
58
|
+
person/organization sharing the slug. Classification is the `bot` ProfileType
|
|
59
|
+
(`AGENT_PROFILE_TYPE_SLUG`), created on demand. Parallel first use converges
|
|
60
|
+
on the natural key rather than on whoever's INSERT won (each attempt re-reads
|
|
61
|
+
before and after writing), which matters because NULLs are distinct in the
|
|
62
|
+
`(tenant_id, slug, context)` unique index, so an untenanted agent is not
|
|
63
|
+
arbitrated by the database (smrt#2360). Pinned against real PostgreSQL by
|
|
64
|
+
`src/__tests__/agent-profile-postgres.test.ts`
|
|
65
|
+
(`pnpm --filter @happyvertical/smrt-profiles test:postgres`).
|
|
66
|
+
|
|
67
|
+
First consumer: `@happyvertical/smrt-chat`'s `ChatService`.
|
|
68
|
+
|
|
42
69
|
## Key Methods
|
|
43
70
|
|
|
44
71
|
- `Profile.getAssets()` / `addAsset()` / `removeAsset()` and the matching `ProfileCollection` wrappers — canonical owned asset helpers backed by `profile_assets`.
|
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import { y as __exportAll } from "./NostrIdentity-
|
|
1
|
+
import { y as __exportAll } from "./NostrIdentity-CbnAJgg9.js";
|
|
2
2
|
import { SmrtObject, field, foreignKey, smrt } from "@happyvertical/smrt-core";
|
|
3
3
|
import { createHash, randomBytes } from "node:crypto";
|
|
4
4
|
//#region src/models/ApiKey.ts
|
|
@@ -122,7 +122,7 @@ var ApiKey = class extends SmrtObject {
|
|
|
122
122
|
*/
|
|
123
123
|
static async verify(key, options = {}) {
|
|
124
124
|
const keyHash = ApiKey.hashKey(key);
|
|
125
|
-
const { ApiKeyCollection } = await import("./ApiKeyCollection-
|
|
125
|
+
const { ApiKeyCollection } = await import("./ApiKeyCollection-CNFptBxU.js").then((n) => n.n);
|
|
126
126
|
const apiKey = await (await ApiKeyCollection.create(options)).findOne({ where: { keyHash } });
|
|
127
127
|
if (!apiKey) return null;
|
|
128
128
|
if (!apiKey.isValid()) return null;
|
|
@@ -135,6 +135,7 @@ __decorateClass([foreignKey("Profile", { required: true })], ApiKey.prototype, "
|
|
|
135
135
|
__decorateClass([field({ indexed: true })], ApiKey.prototype, "keyHash", 2);
|
|
136
136
|
ApiKey = __decorateClass([smrt({
|
|
137
137
|
tableName: "api_keys",
|
|
138
|
+
sensitive: true,
|
|
138
139
|
api: { include: ["list", "get"] },
|
|
139
140
|
mcp: { include: ["list", "get"] },
|
|
140
141
|
cli: {
|
|
@@ -150,4 +151,4 @@ ApiKey = __decorateClass([smrt({
|
|
|
150
151
|
//#endregion
|
|
151
152
|
export { ApiKey_exports as n, ApiKey as t };
|
|
152
153
|
|
|
153
|
-
//# sourceMappingURL=ApiKey-
|
|
154
|
+
//# sourceMappingURL=ApiKey-DIqCzx-g.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"ApiKey-DIqCzx-g.js","names":[],"sources":["../../src/models/ApiKey.ts"],"sourcesContent":["/**\n * ApiKey - API keys for CLI and CI authentication\n *\n * Provides secure API key management with hashing, scopes, and expiration.\n * Keys are stored as hashes - the plaintext is only returned on creation.\n */\n\nimport { createHash, randomBytes } from 'node:crypto';\nimport {\n field,\n foreignKey,\n SmrtObject,\n type SmrtObjectOptions,\n smrt,\n} from '@happyvertical/smrt-core';\nimport type { Profile } from './Profile';\n\nexport interface ApiKeyOptions extends SmrtObjectOptions {\n profileId?: string;\n name?: string;\n scopes?: string[];\n expiresAt?: Date | null;\n}\n\nexport interface GenerateKeyResult {\n key: string;\n apiKey: ApiKey;\n}\n\n@smrt({\n tableName: 'api_keys',\n // The API-key store. Never in the change feed (#2937).\n sensitive: true,\n api: { include: ['list', 'get'] },\n mcp: { include: ['list', 'get'] },\n // create/revoke are admin operations invoked in-process via the CLI; only\n // read-only list/get are exposed over HTTP.\n cli: { include: ['list', 'get', 'create', 'revoke'], skipApiCheck: true },\n})\nexport class ApiKey extends SmrtObject {\n /**\n * Link to the Profile (Person, Organization, Bot)\n */\n @foreignKey('Profile', { required: true })\n profileId?: string;\n\n /**\n * SHA-256 hash of the API key.\n *\n * Indexed: `verify()` looks keys up by this hash on every authenticated\n * request (#2364, epic #2382 finding A3).\n */\n @field({ indexed: true })\n keyHash: string = '';\n\n /**\n * First 8 characters of the key for identification (e.g., \"sk_live_a1b2...\")\n */\n keyPrefix: string = '';\n\n /**\n * Human-readable name for the key (e.g., \"CI Bot\", \"Local CLI\")\n */\n name: string = '';\n\n /**\n * Scopes/permissions for this key\n */\n scopes: string[] = [];\n\n /**\n * Last time this key was used\n */\n lastUsedAt: Date | null = null;\n\n /**\n * When this key expires (null = never)\n */\n expiresAt: Date | null = null;\n\n /**\n * When this key was revoked (null = active)\n */\n revokedAt: Date | null = null;\n\n constructor(options: ApiKeyOptions = {}) {\n super(options);\n if (options.profileId) this.profileId = options.profileId;\n if (options.name) this.name = options.name;\n if (options.scopes) this.scopes = options.scopes;\n if (options.expiresAt !== undefined) this.expiresAt = options.expiresAt;\n }\n\n /**\n * Get the linked Profile\n */\n async getProfile(): Promise<Profile | null> {\n return (await this.getRelated('profileId')) as Profile | null;\n }\n\n /**\n * Check if this key is valid (not expired, not revoked)\n */\n isValid(): boolean {\n if (this.revokedAt) return false;\n if (this.expiresAt && this.expiresAt < new Date()) return false;\n return true;\n }\n\n /**\n * Check if this key has a specific scope\n */\n hasScope(scope: string): boolean {\n return this.scopes.includes(scope) || this.scopes.includes('*');\n }\n\n /**\n * Revoke this key\n */\n async revoke(): Promise<void> {\n this.revokedAt = new Date();\n await this.save();\n }\n\n /**\n * Record usage of this key\n */\n async recordUsage(): Promise<void> {\n for (let attempt = 0; attempt < 4; attempt += 1) {\n if (this.isPersisted) await this.loadFromId();\n if (!this.isValid()) return;\n this.lastUsedAt = new Date();\n try {\n await this.save();\n return;\n } catch (error) {\n if (\n attempt === 3 ||\n !(\n error instanceof Error &&\n 'code' in error &&\n error.code === 'RUNTIME_REVISION_CONFLICT'\n )\n ) {\n throw error;\n }\n }\n }\n }\n\n /**\n * Hash an API key\n */\n static hashKey(key: string): string {\n return createHash('sha256').update(key).digest('hex');\n }\n\n /**\n * Generate a new API key for a profile\n */\n static async generate(\n profile: Profile,\n options: {\n name: string;\n scopes?: string[];\n expiresAt?: Date | null;\n db?: SmrtObjectOptions['db'];\n },\n ): Promise<GenerateKeyResult> {\n // Generate a random key: sk_live_<32 random bytes as hex>\n const randomPart = randomBytes(32).toString('hex');\n const key = `sk_live_${randomPart}`;\n const keyPrefix = key.substring(0, 16);\n const keyHash = ApiKey.hashKey(key);\n\n const apiKey = new ApiKey({\n db: options.db || profile.options?.db,\n profileId: profile.id as string,\n name: options.name,\n scopes: options.scopes || ['*'],\n expiresAt: options.expiresAt ?? null,\n });\n apiKey.keyHash = keyHash;\n apiKey.keyPrefix = keyPrefix;\n\n await apiKey.initialize();\n await apiKey.save();\n\n return { key, apiKey };\n }\n\n /**\n * Verify an API key and return the ApiKey record if valid\n */\n static async verify(\n key: string,\n options: SmrtObjectOptions = {},\n ): Promise<ApiKey | null> {\n const keyHash = ApiKey.hashKey(key);\n\n const { ApiKeyCollection } = await import(\n '../collections/ApiKeyCollection'\n );\n const collection = await ApiKeyCollection.create(options);\n\n const apiKey = await collection.findOne({\n where: { keyHash },\n });\n\n if (!apiKey) return null;\n if (!apiKey.isValid()) return null;\n\n // Record usage\n await apiKey.recordUsage();\n\n // A concurrent revocation may have been observed while recordUsage()\n // rehydrated after a revision conflict. Never authenticate that key.\n if (!apiKey.isValid()) return null;\n\n return apiKey;\n }\n}\n"],"mappings":";;;;;;;;;;;;;AAuCO,IAAM,SAAN,cAAqB,WAAW;CAKrC;CASA,UAAkB;;;;CAKlB,YAAoB;;;;CAKpB,OAAe;;;;CAKf,SAAmB,CAAC;;;;CAKpB,aAA0B;;;;CAK1B,YAAyB;;;;CAKzB,YAAyB;CAEzB,YAAY,UAAyB,CAAC,GAAG;EACvC,MAAM,OAAO;EACb,IAAI,QAAQ,WAAW,KAAK,YAAY,QAAQ;EAChD,IAAI,QAAQ,MAAM,KAAK,OAAO,QAAQ;EACtC,IAAI,QAAQ,QAAQ,KAAK,SAAS,QAAQ;EAC1C,IAAI,QAAQ,cAAc,KAAA,GAAW,KAAK,YAAY,QAAQ;CAChE;;;;CAKA,MAAM,aAAsC;EAC1C,OAAQ,MAAM,KAAK,WAAW,WAAW;CAC3C;;;;CAKA,UAAmB;EACjB,IAAI,KAAK,WAAW,OAAO;EAC3B,IAAI,KAAK,aAAa,KAAK,4BAAY,IAAI,KAAK,GAAG,OAAO;EAC1D,OAAO;CACT;;;;CAKA,SAAS,OAAwB;EAC/B,OAAO,KAAK,OAAO,SAAS,KAAK,KAAK,KAAK,OAAO,SAAS,GAAG;CAChE;;;;CAKA,MAAM,SAAwB;EAC5B,KAAK,4BAAY,IAAI,KAAK;EAC1B,MAAM,KAAK,KAAK;CAClB;;;;CAKA,MAAM,cAA6B;EACjC,KAAA,IAAS,UAAU,GAAG,UAAU,GAAG,WAAW,GAAG;GAC/C,IAAI,KAAK,aAAa,MAAM,KAAK,WAAW;GAC5C,IAAI,CAAC,KAAK,QAAQ,GAAG;GACrB,KAAK,6BAAa,IAAI,KAAK;GAC3B,IAAI;IACF,MAAM,KAAK,KAAK;IAChB;GACF,SAAS,OAAO;IACd,IACE,YAAY,KACZ,EACE,iBAAiB,SACjB,UAAU,SACV,MAAM,SAAS,8BAGjB,MAAM;GAEV;EACF;CACF;;;;CAKA,OAAO,QAAQ,KAAqB;EAClC,OAAO,WAAW,QAAQ,CAAA,CAAE,OAAO,GAAG,CAAA,CAAE,OAAO,KAAK;CACtD;;;;CAKA,aAAa,SACX,SACA,SAM4B;EAG5B,MAAM,MAAM,WADO,YAAY,EAAE,CAAA,CAAE,SAAS,KACrB;EACvB,MAAM,YAAY,IAAI,UAAU,GAAG,EAAE;EACrC,MAAM,UAAU,OAAO,QAAQ,GAAG;EAElC,MAAM,SAAS,IAAI,OAAO;GACxB,IAAI,QAAQ,MAAM,QAAQ,SAAS;GACnC,WAAW,QAAQ;GACnB,MAAM,QAAQ;GACd,QAAQ,QAAQ,UAAU,CAAC,GAAG;GAC9B,WAAW,QAAQ,aAAa;EAClC,CAAC;EACD,OAAO,UAAU;EACjB,OAAO,YAAY;EAEnB,MAAM,OAAO,WAAW;EACxB,MAAM,OAAO,KAAK;EAElB,OAAO;GAAE;GAAK;EAAO;CACvB;;;;CAKA,aAAa,OACX,KACA,UAA6B,CAAC,GACN;EACxB,MAAM,UAAU,OAAO,QAAQ,GAAG;EAElC,MAAM,EAAE,qBAAqB,MAAM,OACjC,iCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;EAIF,MAAM,SAAS,OAAM,MAFI,iBAAiB,OAAO,OAAO,EAAA,CAExB,QAAQ,EACtC,OAAO,EAAE,QAAQ,EACnB,CAAC;EAED,IAAI,CAAC,QAAQ,OAAO;EACpB,IAAI,CAAC,OAAO,QAAQ,GAAG,OAAO;EAG9B,MAAM,OAAO,YAAY;EAIzB,IAAI,CAAC,OAAO,QAAQ,GAAG,OAAO;EAE9B,OAAO;CACT;AACF;AAjLE,gBAAA,CADC,WAAW,WAAW,EAAE,UAAU,KAAK,CAAC,CAAA,GAJ9B,OAKX,WAAA,aAAA,CAAA;AASA,gBAAA,CADC,MAAM,EAAE,SAAS,KAAK,CAAC,CAAA,GAbb,OAcX,WAAA,WAAA,CAAA;AAdW,SAAN,gBAAA,CAVN,KAAK;CACJ,WAAW;CAEX,WAAW;CACX,KAAK,EAAE,SAAS,CAAC,QAAQ,KAAK,EAAE;CAChC,KAAK,EAAE,SAAS,CAAC,QAAQ,KAAK,EAAE;CAGhC,KAAK;EAAE,SAAS;GAAC;GAAQ;GAAO;GAAU;EAAQ;EAAG,cAAc;CAAK;AAC1E,CAAC,CAAA,GACY,MAAA"}
|
|
@@ -1,5 +1,5 @@
|
|
|
1
|
-
import { y as __exportAll } from "./NostrIdentity-
|
|
2
|
-
import { t as ApiKey } from "./ApiKey-
|
|
1
|
+
import { y as __exportAll } from "./NostrIdentity-CbnAJgg9.js";
|
|
2
|
+
import { t as ApiKey } from "./ApiKey-DIqCzx-g.js";
|
|
3
3
|
import { SmrtCollection } from "@happyvertical/smrt-core";
|
|
4
4
|
//#region src/collections/ApiKeyCollection.ts
|
|
5
5
|
var ApiKeyCollection_exports = /* @__PURE__ */ __exportAll({ ApiKeyCollection: () => ApiKeyCollection });
|
|
@@ -81,4 +81,4 @@ var ApiKeyCollection = class extends SmrtCollection {
|
|
|
81
81
|
//#endregion
|
|
82
82
|
export { ApiKeyCollection_exports as n, ApiKeyCollection as t };
|
|
83
83
|
|
|
84
|
-
//# sourceMappingURL=ApiKeyCollection-
|
|
84
|
+
//# sourceMappingURL=ApiKeyCollection-CNFptBxU.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"ApiKeyCollection-
|
|
1
|
+
{"version":3,"file":"ApiKeyCollection-CNFptBxU.js","names":[],"sources":["../../src/collections/ApiKeyCollection.ts"],"sourcesContent":["/**\n * ApiKeyCollection - Collection for managing API keys\n */\n\nimport { SmrtCollection } from '@happyvertical/smrt-core';\nimport { ApiKey, type GenerateKeyResult } from '../models/ApiKey';\nimport type { Profile } from '../models/Profile';\n\nexport class ApiKeyCollection extends SmrtCollection<ApiKey> {\n static readonly _itemClass = ApiKey;\n\n /**\n * Find all keys for a profile\n */\n async findByProfile(profileId: string): Promise<ApiKey[]> {\n return await this.list({\n where: { profileId },\n });\n }\n\n /**\n * Find active (non-revoked, non-expired) keys for a profile\n */\n async findActiveByProfile(profileId: string): Promise<ApiKey[]> {\n const keys = await this.findByProfile(profileId);\n return keys.filter((key) => key.isValid());\n }\n\n /**\n * Find key by hash\n */\n async findByHash(keyHash: string): Promise<ApiKey | null> {\n return await this.findOne({\n where: { keyHash },\n });\n }\n\n /**\n * Verify an API key string and return the record if valid\n */\n async verify(key: string): Promise<ApiKey | null> {\n const keyHash = ApiKey.hashKey(key);\n const apiKey = await this.findByHash(keyHash);\n\n if (!apiKey) return null;\n if (!apiKey.isValid()) return null;\n\n // Record usage\n await apiKey.recordUsage();\n\n // recordUsage() reloads after a concurrent-write conflict. A revocation\n // observed by that reload must fail this authentication attempt closed.\n if (!apiKey.isValid()) return null;\n\n return apiKey;\n }\n\n /**\n * Generate a new key for a profile\n */\n async generateForProfile(\n profile: Profile,\n options: {\n name: string;\n scopes?: string[];\n expiresAt?: Date | null;\n },\n ): Promise<GenerateKeyResult> {\n return await ApiKey.generate(profile, {\n ...options,\n db: this.options.db,\n });\n }\n\n /**\n * Revoke all keys for a profile\n */\n async revokeAllForProfile(profileId: string): Promise<number> {\n const keys = await this.findActiveByProfile(profileId);\n for (const key of keys) {\n await key.revoke();\n }\n return keys.length;\n }\n\n /**\n * Revoke a specific key by prefix\n */\n async revokeByPrefix(keyPrefix: string): Promise<boolean> {\n const key = await this.findOne({\n where: { keyPrefix },\n });\n\n if (key?.isValid()) {\n await key.revoke();\n return true;\n }\n return false;\n }\n\n /**\n * Clean up expired keys (soft delete by setting revokedAt)\n */\n async cleanupExpired(): Promise<number> {\n const now = new Date();\n const allKeys = await this.list({});\n let cleaned = 0;\n\n for (const key of allKeys) {\n if (key.expiresAt && key.expiresAt < now && !key.revokedAt) {\n key.revokedAt = now;\n await key.save();\n cleaned++;\n }\n }\n\n return cleaned;\n }\n}\n"],"mappings":";;;;;AAQO,IAAM,mBAAN,cAA+B,eAAuB;CAC3D,OAAgB,aAAa;;;;CAK7B,MAAM,cAAc,WAAsC;EACxD,OAAO,MAAM,KAAK,KAAK,EACrB,OAAO,EAAE,UAAU,EACrB,CAAC;CACH;;;;CAKA,MAAM,oBAAoB,WAAsC;EAE9D,QAAO,MADY,KAAK,cAAc,SAAS,EAAA,CACnC,QAAQ,QAAQ,IAAI,QAAQ,CAAC;CAC3C;;;;CAKA,MAAM,WAAW,SAAyC;EACxD,OAAO,MAAM,KAAK,QAAQ,EACxB,OAAO,EAAE,QAAQ,EACnB,CAAC;CACH;;;;CAKA,MAAM,OAAO,KAAqC;EAChD,MAAM,UAAU,OAAO,QAAQ,GAAG;EAClC,MAAM,SAAS,MAAM,KAAK,WAAW,OAAO;EAE5C,IAAI,CAAC,QAAQ,OAAO;EACpB,IAAI,CAAC,OAAO,QAAQ,GAAG,OAAO;EAG9B,MAAM,OAAO,YAAY;EAIzB,IAAI,CAAC,OAAO,QAAQ,GAAG,OAAO;EAE9B,OAAO;CACT;;;;CAKA,MAAM,mBACJ,SACA,SAK4B;EAC5B,OAAO,MAAM,OAAO,SAAS,SAAS;GACpC,GAAG;GACH,IAAI,KAAK,QAAQ;EACnB,CAAC;CACH;;;;CAKA,MAAM,oBAAoB,WAAoC;EAC5D,MAAM,OAAO,MAAM,KAAK,oBAAoB,SAAS;EACrD,KAAA,MAAW,OAAO,MAChB,MAAM,IAAI,OAAO;EAEnB,OAAO,KAAK;CACd;;;;CAKA,MAAM,eAAe,WAAqC;EACxD,MAAM,MAAM,MAAM,KAAK,QAAQ,EAC7B,OAAO,EAAE,UAAU,EACrB,CAAC;EAED,IAAI,KAAK,QAAQ,GAAG;GAClB,MAAM,IAAI,OAAO;GACjB,OAAO;EACT;EACA,OAAO;CACT;;;;CAKA,MAAM,iBAAkC;EACtC,MAAM,sBAAM,IAAI,KAAK;EACrB,MAAM,UAAU,MAAM,KAAK,KAAK,CAAC,CAAC;EAClC,IAAI,UAAU;EAEd,KAAA,MAAW,OAAO,SAChB,IAAI,IAAI,aAAa,IAAI,YAAY,OAAO,CAAC,IAAI,WAAW;GAC1D,IAAI,YAAY;GAChB,MAAM,IAAI,KAAK;GACf;EACF;EAGF,OAAO;CACT;AACF"}
|
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import { y as __exportAll } from "./NostrIdentity-
|
|
1
|
+
import { y as __exportAll } from "./NostrIdentity-CbnAJgg9.js";
|
|
2
2
|
import { SmrtCollection, SmrtObject, foreignKey, smrt } from "@happyvertical/smrt-core";
|
|
3
3
|
import { TenantScoped, tenantId } from "@happyvertical/smrt-tenancy";
|
|
4
4
|
//#region src/models/AuditLog.ts
|
|
@@ -188,4 +188,4 @@ var AuditLogCollection = class extends SmrtCollection {
|
|
|
188
188
|
//#endregion
|
|
189
189
|
export { AuditLogCollection_exports as n, AuditLog as r, AuditLogCollection as t };
|
|
190
190
|
|
|
191
|
-
//# sourceMappingURL=AuditLogCollection-
|
|
191
|
+
//# sourceMappingURL=AuditLogCollection-DxR3ZG6_.js.map
|
package/dist/chunks/{AuditLogCollection-N5ItRtEK.js.map → AuditLogCollection-DxR3ZG6_.js.map}
RENAMED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"AuditLogCollection-
|
|
1
|
+
{"version":3,"file":"AuditLogCollection-DxR3ZG6_.js","names":[],"sources":["../../src/models/AuditLog.ts","../../src/collections/AuditLogCollection.ts"],"sourcesContent":["/**\n * AuditLog - Tracks all actions for full audit trail\n *\n * Records who did what, when, and how (web, CLI, CI, webhook, MCP).\n * Supports pass-through identity for CI workflows.\n */\n\nimport {\n foreignKey,\n SmrtObject,\n type SmrtObjectOptions,\n smrt,\n} from '@happyvertical/smrt-core';\nimport { TenantScoped, tenantId } from '@happyvertical/smrt-tenancy';\nimport type { Profile } from './Profile';\n\nexport type AuditSource = 'web' | 'cli' | 'ci' | 'webhook' | 'mcp';\n\nexport interface AuditLogOptions extends SmrtObjectOptions {\n profileId?: string;\n action?: string;\n resourceType?: string;\n resourceId?: string;\n source?: AuditSource;\n metadata?: Record<string, unknown>;\n onBehalfOfId?: string | null;\n tenantId?: string | null;\n}\n\n@TenantScoped({ mode: 'optional', allowSuperAdminBypass: true })\n@smrt({\n tableName: 'audit_logs',\n api: { include: ['list', 'get'] },\n mcp: { include: ['list', 'get'] },\n cli: { include: ['list'] },\n})\nexport class AuditLog extends SmrtObject {\n @tenantId({ nullable: true })\n tenantId: string | null = null;\n\n /**\n * The profile who performed the action\n */\n @foreignKey('Profile', { required: true })\n profileId?: string;\n\n /**\n * Action performed (e.g., 'issue.update', 'feedback.incorporate')\n */\n action: string = '';\n\n /**\n * Type of resource affected (e.g., 'Issue', 'Repository')\n */\n resourceType: string = '';\n\n /**\n * ID of the affected resource\n */\n resourceId: string = '';\n\n /**\n * Source of the action\n */\n source: AuditSource = 'web';\n\n /**\n * Additional context (CI run ID, request ID, etc.)\n */\n metadata: Record<string, unknown> = {};\n\n /**\n * For pass-through identity in CI - the actual person who triggered\n */\n @foreignKey('Profile', { nullable: true })\n onBehalfOfId?: string | null;\n\n constructor(options: AuditLogOptions = {}) {\n super(options);\n if (options.profileId) this.profileId = options.profileId;\n if (options.action) this.action = options.action;\n if (options.resourceType) this.resourceType = options.resourceType;\n if (options.resourceId) this.resourceId = options.resourceId;\n if (options.source) this.source = options.source;\n if (options.metadata) this.metadata = options.metadata;\n if (options.onBehalfOfId !== undefined)\n this.onBehalfOfId = options.onBehalfOfId;\n }\n\n /**\n * Get the profile who performed the action\n */\n async getProfile(): Promise<Profile | null> {\n return (await this.getRelated('profileId')) as Profile | null;\n }\n\n /**\n * Get the profile on whose behalf the action was performed (if any)\n */\n async getOnBehalfOf(): Promise<Profile | null> {\n if (!this.onBehalfOfId) return null;\n return (await this.getRelated('onBehalfOfId')) as Profile | null;\n }\n\n /**\n * Get the effective actor (onBehalfOf if set, otherwise profile)\n */\n async getEffectiveActor(): Promise<Profile | null> {\n const onBehalfOf = await this.getOnBehalfOf();\n if (onBehalfOf) return onBehalfOf;\n return await this.getProfile();\n }\n\n /**\n * Create an audit log entry\n */\n static async record(\n options: AuditLogOptions & {\n profile: Profile;\n onBehalfOf?: Profile | null;\n },\n ): Promise<AuditLog> {\n const log = new AuditLog({\n ...options,\n profileId: options.profile.id as string,\n onBehalfOfId: options.onBehalfOf?.id as string | undefined,\n });\n await log.initialize();\n await log.save();\n return log;\n }\n}\n","/**\n * AuditLogCollection - Collection for querying audit logs\n */\n\nimport { SmrtCollection } from '@happyvertical/smrt-core';\nimport { AuditLog, type AuditSource } from '../models/AuditLog';\nimport type { Profile } from '../models/Profile';\n\nexport class AuditLogCollection extends SmrtCollection<AuditLog> {\n static readonly _itemClass = AuditLog;\n\n /**\n * Find logs for a profile (actions they performed)\n */\n async findByProfile(profileId: string): Promise<AuditLog[]> {\n return await this.list({\n where: { profileId },\n orderBy: 'createdAt DESC',\n });\n }\n\n /**\n * Find logs for a resource\n */\n async findByResource(\n resourceType: string,\n resourceId: string,\n ): Promise<AuditLog[]> {\n return await this.list({\n where: { resourceType, resourceId },\n orderBy: 'createdAt DESC',\n });\n }\n\n /**\n * Find logs by action type\n */\n async findByAction(action: string): Promise<AuditLog[]> {\n return await this.list({\n where: { action },\n orderBy: 'createdAt DESC',\n });\n }\n\n /**\n * Find logs by source\n */\n async findBySource(source: AuditSource): Promise<AuditLog[]> {\n return await this.list({\n where: { source },\n orderBy: 'createdAt DESC',\n });\n }\n\n /**\n * Find logs where actions were performed on behalf of someone\n */\n async findOnBehalfOf(profileId: string): Promise<AuditLog[]> {\n return await this.list({\n where: { onBehalfOfId: profileId },\n orderBy: 'createdAt DESC',\n });\n }\n\n /**\n * Record a new audit log entry\n */\n async record(options: {\n profile: Profile;\n action: string;\n resourceType: string;\n resourceId: string;\n source?: AuditSource;\n metadata?: Record<string, unknown>;\n onBehalfOf?: Profile | null;\n }): Promise<AuditLog> {\n const log = new AuditLog({\n ...this.options,\n profileId: options.profile.id as string,\n action: options.action,\n resourceType: options.resourceType,\n resourceId: options.resourceId,\n source: options.source || 'web',\n metadata: options.metadata || {},\n onBehalfOfId: options.onBehalfOf?.id as string | undefined,\n });\n await log.initialize();\n await log.save();\n return log;\n }\n\n /**\n * Get recent activity for a profile\n */\n async getRecentActivity(\n profileId: string,\n limit: number = 50,\n ): Promise<AuditLog[]> {\n return await this.list({\n where: { profileId },\n orderBy: 'createdAt DESC',\n limit,\n });\n }\n\n /**\n * Get activity timeline for a resource\n */\n async getResourceTimeline(\n resourceType: string,\n resourceId: string,\n ): Promise<AuditLog[]> {\n return await this.list({\n where: { resourceType, resourceId },\n orderBy: 'createdAt ASC',\n });\n }\n}\n"],"mappings":";;;;;;;;;;;;AAoCO,IAAM,WAAN,cAAuB,WAAW;CAEvC,WAA0B;CAM1B;;;;CAKA,SAAiB;;;;CAKjB,eAAuB;;;;CAKvB,aAAqB;;;;CAKrB,SAAsB;;;;CAKtB,WAAoC,CAAC;CAMrC;CAEA,YAAY,UAA2B,CAAC,GAAG;EACzC,MAAM,OAAO;EACb,IAAI,QAAQ,WAAW,KAAK,YAAY,QAAQ;EAChD,IAAI,QAAQ,QAAQ,KAAK,SAAS,QAAQ;EAC1C,IAAI,QAAQ,cAAc,KAAK,eAAe,QAAQ;EACtD,IAAI,QAAQ,YAAY,KAAK,aAAa,QAAQ;EAClD,IAAI,QAAQ,QAAQ,KAAK,SAAS,QAAQ;EAC1C,IAAI,QAAQ,UAAU,KAAK,WAAW,QAAQ;EAC9C,IAAI,QAAQ,iBAAiB,KAAA,GAC3B,KAAK,eAAe,QAAQ;CAChC;;;;CAKA,MAAM,aAAsC;EAC1C,OAAQ,MAAM,KAAK,WAAW,WAAW;CAC3C;;;;CAKA,MAAM,gBAAyC;EAC7C,IAAI,CAAC,KAAK,cAAc,OAAO;EAC/B,OAAQ,MAAM,KAAK,WAAW,cAAc;CAC9C;;;;CAKA,MAAM,oBAA6C;EACjD,MAAM,aAAa,MAAM,KAAK,cAAc;EAC5C,IAAI,YAAY,OAAO;EACvB,OAAO,MAAM,KAAK,WAAW;CAC/B;;;;CAKA,aAAa,OACX,SAImB;EACnB,MAAM,MAAM,IAAI,SAAS;GACvB,GAAG;GACH,WAAW,QAAQ,QAAQ;GAC3B,cAAc,QAAQ,YAAY;EACpC,CAAC;EACD,MAAM,IAAI,WAAW;EACrB,MAAM,IAAI,KAAK;EACf,OAAO;CACT;AACF;AA7FE,gBAAA,CADC,SAAS,EAAE,UAAU,KAAK,CAAC,CAAA,GADjB,SAEX,WAAA,YAAA,CAAA;AAMA,gBAAA,CADC,WAAW,WAAW,EAAE,UAAU,KAAK,CAAC,CAAA,GAP9B,SAQX,WAAA,aAAA,CAAA;AA+BA,gBAAA,CADC,WAAW,WAAW,EAAE,UAAU,KAAK,CAAC,CAAA,GAtC9B,SAuCX,WAAA,gBAAA,CAAA;AAvCW,WAAN,gBAAA,CAPN,aAAa;CAAE,MAAM;CAAY,uBAAuB;AAAK,CAAC,GAC9D,KAAK;CACJ,WAAW;CACX,KAAK,EAAE,SAAS,CAAC,QAAQ,KAAK,EAAE;CAChC,KAAK,EAAE,SAAS,CAAC,QAAQ,KAAK,EAAE;CAChC,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE;AAC3B,CAAC,CAAA,GACY,QAAA;;;;AC5BN,IAAM,qBAAN,cAAiC,eAAyB;CAC/D,OAAgB,aAAa;;;;CAK7B,MAAM,cAAc,WAAwC;EAC1D,OAAO,MAAM,KAAK,KAAK;GACrB,OAAO,EAAE,UAAU;GACnB,SAAS;EACX,CAAC;CACH;;;;CAKA,MAAM,eACJ,cACA,YACqB;EACrB,OAAO,MAAM,KAAK,KAAK;GACrB,OAAO;IAAE;IAAc;GAAW;GAClC,SAAS;EACX,CAAC;CACH;;;;CAKA,MAAM,aAAa,QAAqC;EACtD,OAAO,MAAM,KAAK,KAAK;GACrB,OAAO,EAAE,OAAO;GAChB,SAAS;EACX,CAAC;CACH;;;;CAKA,MAAM,aAAa,QAA0C;EAC3D,OAAO,MAAM,KAAK,KAAK;GACrB,OAAO,EAAE,OAAO;GAChB,SAAS;EACX,CAAC;CACH;;;;CAKA,MAAM,eAAe,WAAwC;EAC3D,OAAO,MAAM,KAAK,KAAK;GACrB,OAAO,EAAE,cAAc,UAAU;GACjC,SAAS;EACX,CAAC;CACH;;;;CAKA,MAAM,OAAO,SAQS;EACpB,MAAM,MAAM,IAAI,SAAS;GACvB,GAAG,KAAK;GACR,WAAW,QAAQ,QAAQ;GAC3B,QAAQ,QAAQ;GAChB,cAAc,QAAQ;GACtB,YAAY,QAAQ;GACpB,QAAQ,QAAQ,UAAU;GAC1B,UAAU,QAAQ,YAAY,CAAC;GAC/B,cAAc,QAAQ,YAAY;EACpC,CAAC;EACD,MAAM,IAAI,WAAW;EACrB,MAAM,IAAI,KAAK;EACf,OAAO;CACT;;;;CAKA,MAAM,kBACJ,WACA,QAAgB,IACK;EACrB,OAAO,MAAM,KAAK,KAAK;GACrB,OAAO,EAAE,UAAU;GACnB,SAAS;GACT;EACF,CAAC;CACH;;;;CAKA,MAAM,oBACJ,cACA,YACqB;EACrB,OAAO,MAAM,KAAK,KAAK;GACrB,OAAO;IAAE;IAAc;GAAW;GAClC,SAAS;EACX,CAAC;CACH;AACF"}
|
|
@@ -3061,21 +3061,21 @@ var NostrIdentity = class extends SmrtObject {
|
|
|
3061
3061
|
* Find identity by public key
|
|
3062
3062
|
*/
|
|
3063
3063
|
static async findByPubkey(pubkey, options = {}) {
|
|
3064
|
-
const { NostrIdentityCollection } = await import("./NostrIdentityCollection-
|
|
3064
|
+
const { NostrIdentityCollection } = await import("./NostrIdentityCollection-BXtvB0Sd.js").then((n) => n.n);
|
|
3065
3065
|
return await (await NostrIdentityCollection.create(options)).findOne({ where: { pubkey } });
|
|
3066
3066
|
}
|
|
3067
3067
|
/**
|
|
3068
3068
|
* Find identity by email
|
|
3069
3069
|
*/
|
|
3070
3070
|
static async findByEmail(email, options = {}) {
|
|
3071
|
-
const { NostrIdentityCollection } = await import("./NostrIdentityCollection-
|
|
3071
|
+
const { NostrIdentityCollection } = await import("./NostrIdentityCollection-BXtvB0Sd.js").then((n) => n.n);
|
|
3072
3072
|
return await (await NostrIdentityCollection.create(options)).findOne({ where: { email: email.toLowerCase() } });
|
|
3073
3073
|
}
|
|
3074
3074
|
/**
|
|
3075
3075
|
* Find identity by NIP-05 username
|
|
3076
3076
|
*/
|
|
3077
3077
|
static async findByNip05(username, options = {}) {
|
|
3078
|
-
const { NostrIdentityCollection } = await import("./NostrIdentityCollection-
|
|
3078
|
+
const { NostrIdentityCollection } = await import("./NostrIdentityCollection-BXtvB0Sd.js").then((n) => n.n);
|
|
3079
3079
|
return await (await NostrIdentityCollection.create(options)).findOne({ where: { nip05Username: username.toLowerCase() } });
|
|
3080
3080
|
}
|
|
3081
3081
|
/**
|
|
@@ -3144,6 +3144,7 @@ __decorateClass([foreignKey("Profile", { required: true })], NostrIdentity.proto
|
|
|
3144
3144
|
__decorateClass([field({ indexed: true })], NostrIdentity.prototype, "pubkey", 2);
|
|
3145
3145
|
NostrIdentity = __decorateClass([smrt({
|
|
3146
3146
|
tableName: "nostr_identities",
|
|
3147
|
+
sensitive: true,
|
|
3147
3148
|
api: { include: ["list", "get"] },
|
|
3148
3149
|
mcp: { include: ["list", "get"] },
|
|
3149
3150
|
cli: { include: ["list", "get"] }
|
|
@@ -3151,4 +3152,4 @@ NostrIdentity = __decorateClass([smrt({
|
|
|
3151
3152
|
//#endregion
|
|
3152
3153
|
export { verifyAuthEvent as _, decryptPrivkey as a, generateNostrKeypair as c, isValidPubkey as d, npubToPubkey as f, signEvent as g, pubkeyToNpub as h, createAuthEvent as i, getPublicKey as l, privkeyToNsec as m, NostrIdentity_exports as n, deriveEncryptionKey as o, nsecToPrivkey as p, computeEventId as r, encryptPrivkey as s, NostrIdentity as t, isValidPrivkey as u, verifyNostrSignature as v, __exportAll as y };
|
|
3153
3154
|
|
|
3154
|
-
//# sourceMappingURL=NostrIdentity-
|
|
3155
|
+
//# sourceMappingURL=NostrIdentity-CbnAJgg9.js.map
|