@kici-dev/orchestrator 0.1.3 → 0.1.6

package/dist/secrets/routing-key-scope.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Helpers for enforcing the `routing_key` scope on admin tokens.
+ *
+ * `admin_tokens.routing_key` is an optional column. A token created with
+ * `kici-admin token create --routing-key <key>` is restricted to operations
+ * that target that exact routing key:
+ *
+ *   - Routes that take an explicit routing key (URL param, query param, or
+ *     request body) MUST gate access with `enforceRoutingKeyScope`. Routes
+ *     that target an entity by ID look up the row's `routing_key` column
+ *     first and pass that to `enforceRoutingKeyScope`.
+ *   - Routes that target an org or that operate orchestrator-wide (no
+ *     routing-key concept at all) MUST refuse routing-key tokens via
+ *     `requireUnscopedToken`.
+ *
+ * Both helpers return a Hono `Response` to short-circuit the handler when
+ * access is denied, or `null` to let the handler continue. The middleware
+ * mounted in each admin route file is responsible for calling
+ * `c.set('routingKey', tokenInfo.routingKey)` so these helpers can read it.
+ */
+import type { Context } from 'hono';
+/**
+ * Reject the request with 403 when the calling token has a routing-key
+ * scope and the request targets a different routing key.
+ *
+ * Pass `requested = null | undefined` for routes that explicitly do not
+ * carry a routing key — in that case the call is also rejected for
+ * scoped tokens. Use {@link requireUnscopedToken} when the route is
+ * orchestrator-wide or org-scoped (no per-routing-key variant exists at
+ * all) to make the intent explicit.
+ *
+ * Returns a `Response` to short-circuit the handler when access is
+ * denied, or `null` to let the handler continue.
+ */
+export declare function enforceRoutingKeyScope(c: Context, requested: string | null | undefined): Response | null;
+/**
+ * Reject the request with 403 when the calling token has any routing-key
+ * scope. Use this on routes that operate on orchestrator-wide state,
+ * org-level state, or any other surface where the routing-key concept
+ * does not apply.
+ */
+export declare function requireUnscopedToken(c: Context): Response | null;
+//# sourceMappingURL=routing-key-scope.d.ts.map