@kontrolia/db 2.1.4 → 2.1.5

package/dist/migrate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migrate.d.ts","sourceRoot":"","sources":["../src/migrate.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,cAAc;IAC7B;;sDAEkD;IAClD,gBAAgB,EAAE,MAAM,CAAC;IACzB,8CAA8C;IAC9C,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAWD;;;GAGG;AACH,wBAAsB,OAAO,CAAC,EAAE,gBAAgB,EAAE,OAAe,EAAE,EAAE,cAAc,iBAgClF"}
+{"version":3,"file":"migrate.d.ts","sourceRoot":"","sources":["../src/migrate.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,cAAc;IAC7B;;sDAEkD;IAClD,gBAAgB,EAAE,MAAM,CAAC;IACzB,8CAA8C;IAC9C,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAsCD;;;GAGG;AACH,wBAAsB,OAAO,CAAC,EAAE,gBAAgB,EAAE,OAAe,EAAE,EAAE,cAAc,iBAgClF"}

package/dist/migrate.js

@@ -4,13 +4,34 @@ import { fileURLToPath } from "node:url";
 import { Client } from "pg";
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const MIGRATIONS_DIR = join(__dirname, "..", "migrations");
+/**
+ * Bootstraps (and self-heals the location of) the migration-tracking
+ * table, then returns its schema-qualified name for the rest of migrate()
+ * to use. On a genuinely fresh database neither `kontrolia` nor
+ * `kontrolia_auth` exists yet — migration 0001 is what creates the former,
+ * 0020 renames it to the latter — so this table has nowhere but `public`
+ * to start out in. Once `kontrolia_auth` exists (every subsequent run,
+ * fresh or not), it belongs there instead: an install that ran migrate()
+ * before this fix shipped may still have it sitting in `public`, so this
+ * relocates it once, idempotently, rather than leaving two copies around.
+ */
 async function ensureMigrationsTable(client) {
+    const { rows: schemaRows } = await client.query(`select exists (select 1 from information_schema.schemata where schema_name = 'kontrolia_auth') as exists`);
+    const kontroliaAuthExists = schemaRows[0]?.exists ?? false;
+    if (kontroliaAuthExists) {
+        const { rows: publicRows } = await client.query(`select exists (select 1 from information_schema.tables where table_schema = 'public' and table_name = 'kontrolia_migrations') as exists`);
+        if (publicRows[0]?.exists) {
+            await client.query("alter table public.kontrolia_migrations set schema kontrolia_auth");
+        }
+    }
+    const schema = kontroliaAuthExists ? "kontrolia_auth" : "public";
     await client.query(`
-    create table if not exists kontrolia_migrations (
+    create table if not exists ${schema}.kontrolia_migrations (
       filename text primary key,
       applied_at timestamptz not null default now()
     )
   `);
+    return schema;
 }
 /**
  * Applies every .sql file under migrations/ that hasn't run yet, in
@@ -20,8 +41,8 @@ export async function migrate({ connectionString, verbose = false }) {
     const client = new Client({ connectionString });
     await client.connect();
     try {
-        await ensureMigrationsTable(client);
-        const { rows: applied } = await client.query("select filename from kontrolia_migrations");
+        const migrationsTable = `${await ensureMigrationsTable(client)}.kontrolia_migrations`;
+        const { rows: applied } = await client.query(`select filename from ${migrationsTable}`);
         const appliedSet = new Set(applied.map((r) => r.filename));
         const files = (await readdir(MIGRATIONS_DIR)).filter((f) => f.endsWith(".sql")).sort();
         for (const file of files) {
@@ -33,7 +54,7 @@ export async function migrate({ connectionString, verbose = false }) {
             await client.query("begin");
             try {
                 await client.query(sql);
-                await client.query("insert into kontrolia_migrations (filename) values ($1)", [file]);
+                await client.query(`insert into ${migrationsTable} (filename) values ($1)`, [file]);
                 await client.query("commit");
             }
             catch (error) {

package/dist/register-application.d.ts

@@ -14,14 +14,6 @@ export interface RegisterApplicationOptions {
 export interface RegisteredApplication {
     applicationId: string;
     permissionKeys: string[];
-    /**
-     * The plaintext sync API key (see POST /api/applications/sync on
-     * auth-server) — only present the first time this slug is registered.
-     * Only the hash is stored; there is no way to recover it later, so the
-     * caller must surface it to the operator immediately. `null` means the
-     * application already existed and its key (if any) was left untouched.
-     */
-    apiKey: string | null;
 }
 /**
  * Inserts an application and its permission catalog directly against
@@ -30,7 +22,15 @@ export interface RegisteredApplication {
  * go through a platform-admin path), so this is that path: a direct,
  * service-role-equivalent write, the same way migrate() bypasses RLS to
  * apply schema changes. Safe to re-run — the slug and permission key are
- * both upserted, and re-running never rotates an existing api_key_hash.
+ * both upserted.
+ *
+ * Does NOT generate a sync API key — migration 0040 moved keys off
+ * `applications` onto the org-scoped `application_api_keys` table, and at
+ * the point this runs (typically during install, before any organization
+ * necessarily exists or has enabled the app) there's no organization to
+ * scope one to. Generate the first key afterward from admin-panel
+ * (Aplicaciones → tu app → API Keys), once at least one organization has
+ * enabled the application.
  */
 export declare function registerApplication(options: RegisterApplicationOptions): Promise<RegisteredApplication>;
 //# sourceMappingURL=register-application.d.ts.map

package/dist/register-application.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"register-application.d.ts","sourceRoot":"","sources":["../src/register-application.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,0BAA0B;IACzC,4DAA4D;IAC5D,gBAAgB,EAAE,MAAM,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,aAAa,GAAG,SAAS,GAAG,YAAY,CAAC;IACtD,WAAW,EAAE,eAAe,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,qBAAqB;IACpC,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB;;;;;;OAMG;IACH,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,0BAA0B,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAkC7G"}
+{"version":3,"file":"register-application.d.ts","sourceRoot":"","sources":["../src/register-application.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,0BAA0B;IACzC,4DAA4D;IAC5D,gBAAgB,EAAE,MAAM,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,aAAa,GAAG,SAAS,GAAG,YAAY,CAAC;IACtD,WAAW,EAAE,eAAe,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,qBAAqB;IACpC,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,0BAA0B,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAgC7G"}

package/dist/register-application.js

@@ -1,5 +1,4 @@
 import { Client } from "pg";
-import { generateApplicationApiKey, hashApplicationApiKey } from "./api-key.js";
 /**
  * Inserts an application and its permission catalog directly against
  * Postgres. kontrolia_auth.applications/permissions have no insert policy for
@@ -7,17 +6,24 @@ import { generateApplicationApiKey, hashApplicationApiKey } from "./api-key.js";
  * go through a platform-admin path), so this is that path: a direct,
  * service-role-equivalent write, the same way migrate() bypasses RLS to
  * apply schema changes. Safe to re-run — the slug and permission key are
- * both upserted, and re-running never rotates an existing api_key_hash.
+ * both upserted.
+ *
+ * Does NOT generate a sync API key — migration 0040 moved keys off
+ * `applications` onto the org-scoped `application_api_keys` table, and at
+ * the point this runs (typically during install, before any organization
+ * necessarily exists or has enabled the app) there's no organization to
+ * scope one to. Generate the first key afterward from admin-panel
+ * (Aplicaciones → tu app → API Keys), once at least one organization has
+ * enabled the application.
  */
 export async function registerApplication(options) {
     const client = new Client({ connectionString: options.connectionString });
     await client.connect();
     try {
-        const candidateApiKey = generateApplicationApiKey();
-        const { rows: [application], } = await client.query(`insert into kontrolia_auth.applications (name, slug, environment, api_key_hash)
-       values ($1, $2, $3, $4)
+        const { rows: [application], } = await client.query(`insert into kontrolia_auth.applications (name, slug, environment)
+       values ($1, $2, $3)
        on conflict (slug) do update set name = excluded.name, environment = excluded.environment
-       returning id, (xmax = 0) as inserted`, [options.name, options.slug, options.environment, hashApplicationApiKey(candidateApiKey)]);
+       returning id`, [options.name, options.slug, options.environment]);
         if (!application)
             throw new Error(`Failed to upsert application "${options.slug}"`);
         const permissionKeys = [];
@@ -28,7 +34,7 @@ export async function registerApplication(options) {
          on conflict (key) do update set description = excluded.description`, [application.id, permission.resource, permission.action, key, permission.description ?? null]);
             permissionKeys.push(key);
         }
-        return { applicationId: application.id, permissionKeys, apiKey: application.inserted ? candidateApiKey : null };
+        return { applicationId: application.id, permissionKeys };
     }
     finally {
         await client.end();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kontrolia/db",
-  "version": "2.1.4",
+  "version": "2.1.5",
   "license": "MIT",
   "description": "KontrolIA Auth database layer: SQL migrations for the `kontrolia` schema (organizations, RBAC, Custom Access Token Hook) and a connection-string-agnostic migration runner.",
   "keywords": [