@kyro-cms/core 0.9.8 → 0.9.9

package/dist/chunk-KGJRJ7CU.cjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/access/types.ts","../src/auth/api-key.ts","../src/access/checker.ts"],"names":["timingSafeEqual","hasPermission"],"mappings":";;;;;;AA+CA,eAAsB,cAAA,CACpB,QACA,IAAA,EACgC;AAChC,EAAA,IAAI,OAAO,WAAW,SAAA,EAAW;AAC/B,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,IAAI,OAAO,WAAW,UAAA,EAAY;AAChC,IAAA,OAAO,MAAM,OAAO,IAAI,CAAA;AAAA,EAC1B;AACA,EAAA,OAAO,IAAA;AACT;AAEO,SAAS,qBACX,YAAA,EACU;AACb,EAAA,MAAM,SAAsB,EAAC;AAC7B,EAAA,KAAA,MAAW,UAAU,YAAA,EAAc;AACjC,IAAA,IAAI,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,EAAU;AACxC,MAAA,MAAA,CAAO,MAAA,CAAO,QAAQ,MAAM,CAAA;AAAA,IAC9B;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAEO,SAAS,cAAA,CACd,QACA,IAAA,EACkC;AAClC,EAAA,OAAO,cAAA,CAAe,MAAA,EAAQ,IAAI,CAAA,CAAE,KAAK,CAAA,MAAA,KAAU;AACjD,IAAA,IAAI,MAAA,KAAW,MAAM,OAAO,MAAA;AAC5B,IAAA,IAAI,MAAA,KAAW,OAAO,OAAO,EAAE,KAAK,EAAE,GAAA,EAAK,MAAK,EAAE;AAClD,IAAA,OAAO,MAAA;AAAA,EACT,CAAC,CAAA;AACH;AC7CO,IAAM,kBAAA,GAAqB;AAElC,SAAS,kBAAkB,GAAA,EAAqB;AAC9C,EAAA,OAAO,GAAA,CAAI,SAAA,CAAU,CAAA,EAAG,CAAC,CAAA;AAC3B;AAEA,SAAS,mBAAA,CAAoB,GAAW,CAAA,EAAoB;AAC1D,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,CAAA,CAAE,MAAA,EAAQ;AACzB,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,IAAI;AACF,IAAA,OAAOA,sBAAA,CAAgB,OAAO,IAAA,CAAK,CAAC,GAAG,MAAA,CAAO,IAAA,CAAK,CAAC,CAAC,CAAA;AAAA,EACvD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAEA,eAAsB,cAAA,CACpB,MAAA,EACA,EAAA,EACA,UAAA,EACiC;AACjC,EAAA,IAAI,CAAC,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,EAAU;AACzC,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,qBAAA,EAAsB;AAAA,EACtD;AAEA,EAAA,IAAI,CAAC,MAAA,CAAO,UAAA,CAAW,OAAO,CAAA,EAAG;AAC/B,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,wBAAA,EAAyB;AAAA,EACzD;AAEA,EAAA,MAAM,SAAA,GAAY,kBAAkB,MAAM,CAAA;AAE1C,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,MAAM,EAAA,CAAG,IAAA,CAAK;AAAA,MAC3B,UAAA,EAAY,kBAAA;AAAA,MACZ,OAAO,EAAE,SAAA,EAAW,EAAE,MAAA,EAAQ,WAAU,EAAE;AAAA,MAC1C,KAAA,EAAO,GAAA;AAAA,MACP,IAAA,EAAM;AAAA,KACP,CAAA;AAED,IAAA,IAAI,CAAC,MAAA,CAAO,IAAA,IAAQ,MAAA,CAAO,IAAA,CAAK,WAAW,CAAA,EAAG;AAC5C,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,iBAAA,EAAkB;AAAA,IAClD;AAEA,IAAA,IAAI,UAAA,GAAkC,IAAA;AACtC,IAAA,KAAA,MAAW,GAAA,IAAO,OAAO,IAAA,EAAM;AAC7B,MAAA,MAAM,MAAA,GAAS,GAAA;AACf,MAAA,IAAI,mBAAA,CAAoB,MAAA,CAAO,GAAA,EAAK,MAAM,CAAA,EAAG;AAC3C,QAAA,UAAA,GAAa,MAAA;AACb,QAAA;AAAA,MACF;AAAA,IACF;AAEA,IAAA,IAAI,CAAC,UAAA,EAAY;AACf,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,iBAAA,EAAkB;AAAA,IAClD;AAEA,IAAA,IAAI,WAAW,SAAA,EAAW;AACxB,MAAA,MAAM,SAAA,GAAY,IAAI,IAAA,CAAK,UAAA,CAAW,SAAS,CAAA;AAC/C,MAAA,IAAI,SAAA,mBAAY,IAAI,IAAA,EAAK,EAAG;AAC1B,QAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,qBAAA,EAAsB;AAAA,MACtD;AAAA,IACF;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,GAAG,MAAA,CAAO;AAAA,QACd,UAAA,EAAY,kBAAA;AAAA,QACZ,IAAI,UAAA,CAAW,EAAA;AAAA,QACf,MAAM,EAAE,UAAA,EAAA,qBAAgB,IAAA,EAAK,EAAE,aAAY;AAAE,OAC9C,CAAA;AAAA,IACH,CAAA,CAAA,MAAQ;AAAA,IAER;AAEA,IAAA,MAAM,IAAA,GAA0B;AAAA,MAC9B,IAAI,UAAA,CAAW,MAAA;AAAA,MACf,IAAA,EAAO,WAAmB,IAAA,IAAQ,QAAA;AAAA,MAClC,UAAW,UAAA,CAAmB;AAAA,KAChC;AAEA,IAAA,IAAI,UAAA,EAAY;AACd,MAAA,MAAM,MAAA,GAAS,MAAM,UAAA,CAAW,UAAA,CAAW,MAAM,CAAA;AACjD,MAAA,IAAI,MAAA,EAAQ;AACV,QAAA,MAAA,CAAO,MAAA,CAAO,MAAM,MAAM,CAAA;AAAA,MAC5B;AAAA,IACF;AAEA,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,IAAA;AAAA,MACP,QAAQ,UAAA,CAAW,MAAA;AAAA,MACnB,IAAA;AAAA,MACA,WAAA,EAAa,UAAA,CAAW,WAAA,IAAe,EAAC;AAAA,MACxC,UAAU,UAAA,CAAW,EAAA;AAAA,MACrB,UAAU,IAAA,CAAK,QAAA;AAAA,MACf,MAAM,IAAA,CAAK;AAAA,KACb;AAAA,EACF,SAAS,KAAA,EAAO;AACd,IAAA,OAAA,CAAQ,KAAA,CAAM,8BAA8B,KAAK,CAAA;AACjD,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,4BAAA,EAA6B;AAAA,EAC7D;AACF;AAEO,SAAS,yBAAyB,OAAA,EAAiC;AACxE,EAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,eAAe,CAAA;AACtD,EAAA,IAAI,UAAA,EAAY;AACd,IAAA,IAAI,UAAA,CAAW,UAAA,CAAW,SAAS,CAAA,EAAG;AACpC,MAAA,OAAO,UAAA,CAAW,KAAA,CAAM,CAAC,CAAA,CAAE,IAAA,EAAK;AAAA,IAClC;AACA,IAAA,IAAI,UAAA,CAAW,UAAA,CAAW,SAAS,CAAA,EAAG;AACpC,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAEA,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,WAAW,CAAA;AAC/C,EAAA,IAAI,OAAA,EAAS;AACX,IAAA,OAAO,QAAQ,IAAA,EAAK;AAAA,EACtB;AAEA,EAAA,OAAO,IAAA;AACT;AAEO,SAAS,oBACd,MAAA,EACsB;AACtB,EAAA,IAAI,CAAC,MAAA,CAAO,KAAA,IAAS,CAAC,OAAO,MAAA,EAAQ;AACnC,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,OAAO;AAAA,IACL,QAAQ,MAAA,CAAO,MAAA;AAAA,IACf,IAAA,EAAM,MAAA,CAAO,IAAA,IAAQ,EAAC;AAAA,IACtB,WAAA,EAAa,MAAA,CAAO,WAAA,IAAe,EAAC;AAAA,IACpC,QAAA,EAAU,OAAO,QAAA,IAAY,EAAA;AAAA,IAC7B,UAAU,MAAA,CAAO,QAAA;AAAA,IACjB,MAAM,MAAA,CAAO;AAAA,GACf;AACF;AAEO,SAAS,mBAAA,CACd,aACA,QAAA,EACS;AACT,EAAA,IAAI,WAAA,CAAY,MAAA,KAAW,CAAA,EAAG,OAAO,KAAA;AACrC,EAAA,IAAI,WAAA,CAAY,QAAA,CAAS,GAAG,CAAA,EAAG,OAAO,IAAA;AACtC,EAAA,IAAI,WAAA,CAAY,QAAA,CAAS,QAAQ,CAAA,EAAG,OAAO,IAAA;AAE3C,EAAA,MAAM,CAAC,QAAA,EAAU,MAAM,CAAA,GAAI,QAAA,CAAS,MAAM,GAAG,CAAA;AAC7C,EAAA,IAAI,YAAY,QAAA,CAAS,CAAA,EAAG,QAAQ,CAAA,EAAA,CAAI,GAAG,OAAO,IAAA;AAElD,EAAA,OAAO,KAAA;AACT;AAEO,SAAS,cAAA,GAAyB;AACvC,EAAA,MAAM,KAAA,GAAQ,sCAAA;AACd,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,EAAA,EAAI,CAAA,EAAA,EAAK;AAC3B,IAAA,MAAA,IAAU,KAAA,CAAM,KAAK,KAAA,CAAM,IAAA,CAAK,QAAO,GAAI,KAAA,CAAM,MAAM,CAAC,CAAA;AAAA,EAC1D;AACA,EAAA,OAAO,QAAQ,MAAM,CAAA,CAAA;AACvB;AAEO,SAAS,qBAAqB,GAAA,EAAqB;AACxD,EAAA,OAAO,GAAA,CAAI,SAAA,CAAU,CAAA,EAAG,CAAC,CAAA;AAC3B;;;AC9KA,SAAS,mBACP,SAAA,EACQ;AACR,EAAA,IAAI,SAAA,KAAc,QAAQ,OAAO,MAAA;AACjC,EAAA,IAAI,SAAA,KAAc,UAAU,OAAO,QAAA;AACnC,EAAA,IAAI,SAAA,KAAc,UAAU,OAAO,QAAA;AACnC,EAAA,OAAO,QAAA;AACT;AAEA,SAAS,gBAAA,CACP,WACA,aAAA,EACS;AACT,EAAA,MAAM,MAAA,GAAkC;AAAA,IACtC,IAAA,EAAM,KAAA;AAAA,IACN,MAAM,SAAA,KAAc,MAAA;AAAA,IACpB,MAAA,EAAQ,SAAA,KAAc,MAAA,IAAU,SAAA,KAAc,QAAA;AAAA,IAC9C,MAAA,EAAQ,SAAA,KAAc,MAAA,IAAU,SAAA,KAAc,YAAY,SAAA,KAAc,QAAA;AAAA,IACxE,QAAQ,SAAA,KAAc,MAAA,IAAU,cAAc,QAAA,IAAY,SAAA,KAAc,YAAY,SAAA,KAAc,QAAA;AAAA,IAClG,KAAA,EAAO;AAAA,GACT;AACA,EAAA,OAAO,MAAA,CAAO,aAAa,CAAA,IAAK,KAAA;AAClC;AAEA,eAAsB,sBACpB,MAAA,EACA,SAAA,EACA,OAAA,EACA,OAAA,GAAyB,EAAC,EACE;AAC5B,EAAA,MAAM,EAAE,IAAA,EAAM,GAAA,EAAK,QAAA,EAAU,QAAO,GAAI,OAAA;AACxC,EAAA,MAAM,EAAE,kBAAA,GAAqB,IAAA,EAAM,aAAA,GAAgB,QAAO,GAAI,OAAA;AAC9D,EAAA,MAAM,UAAA,GAAa,MAAA,CAAO,MAAA,GAAS,SAAS,CAAA;AAG5C,EAAA,IAAI,UAAA,EAAY;AACd,IAAA,MAAM,OAAA,GAAU,MAAM,cAAA,CAAe,UAAA,EAAY;AAAA,MAC/C,GAAA;AAAA,MACA,IAAA;AAAA,MACA;AAAA,KACD,CAAA;AACD,IAAA,IAAI,YAAY,KAAA,EAAO;AACrB,MAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,eAAA,EAAiB,QAAQ,GAAA,EAAI;AAAA,IAC/D;AACA,IAAA,IAAI,OAAO,YAAY,QAAA,EAAU;AAC/B,MAAA,OAAO,EAAE,OAAA,EAAS,IAAA,EAAM,UAAA,EAAY,OAAA,EAAuB;AAAA,IAC7D;AACA,IAAA,OAAO,EAAE,SAAS,IAAA,EAAK;AAAA,EACzB;AAGA,EAAA,IAAI,MAAA,EAAQ,WAAA,EAAa,MAAA,GAAS,CAAA,EAAG;AACnC,IAAA,MAAM,WAAW,MAAA,CAAO,IAAA;AACxB,IAAA,MAAM,MAAA,GAAS,mBAAmB,SAAS,CAAA;AAC3C,IAAA,MAAM,UAAA,GAAa,CAAA,EAAG,QAAQ,CAAA,CAAA,EAAI,MAAM,CAAA,CAAA;AACxC,IAAA,IACE,CAAC,mBAAA,CAAoB,MAAA,CAAO,WAAA,EAAa,UAAU,CAAA,IACnD,CAAC,mBAAA,CAAoB,MAAA,CAAO,WAAA,EAAa,CAAA,EAAG,QAAQ,QAAQ,CAAA,EAC5D;AACA,MAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,yCAAA,EAA2C,QAAQ,GAAA,EAAI;AAAA,IACzF;AACA,IAAA,OAAO,EAAE,SAAS,IAAA,EAAK;AAAA,EACzB;AAGA,EAAA,IAAI,IAAA,EAAM;AACR,IAAA,MAAM,WAAW,MAAA,CAAO,IAAA;AACxB,IAAA,MAAM,MAAA,GAAS,mBAAmB,SAAS,CAAA;AAC3C,IAAA,MAAM,UAAA,GAAa,CAAA,EAAG,QAAQ,CAAA,CAAA,EAAI,MAAM,CAAA,CAAA;AAExC,IAAA,MAAM,OAAA,GAAUC,+BAAA;AAAA,MACd,EAAE,IAAI,IAAA,CAAK,EAAA,EAAI,OAAO,IAAA,CAAK,KAAA,EAAO,IAAA,EAAM,IAAA,CAAK,IAAA,EAAK;AAAA,MAClD;AAAA,KACF;AACA,IAAA,MAAM,QAAA,GAAWA,+BAAA;AAAA,MACf,EAAE,IAAI,IAAA,CAAK,EAAA,EAAI,OAAO,IAAA,CAAK,KAAA,EAAO,IAAA,EAAM,IAAA,CAAK,IAAA,EAAK;AAAA,MAClD,GAAG,QAAQ,CAAA,MAAA;AAAA,KACb;AAEA,IAAA,IAAI,WAAW,QAAA,EAAU;AACvB,MAAA,OAAO,EAAE,SAAS,IAAA,EAAK;AAAA,IACzB;AACA,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,wCAAA,EAA0C,QAAQ,GAAA,EAAI;AAAA,EACxF;AAGA,EAAA,MAAM,cAAA,GAAiB,gBAAA,CAAiB,SAAA,EAAW,aAAa,CAAA;AAChE,EAAA,IAAI,sBAAsB,cAAA,EAAgB;AACxC,IAAA,OAAO,EAAE,SAAS,IAAA,EAAK;AAAA,EACzB;AAEA,EAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,yBAAA,EAA2B,QAAQ,GAAA,EAAI;AACzE;AAEA,eAAsB,kBACpB,MAAA,EACA,SAAA,EACA,OAAA,EACA,OAAA,GAAyB,EAAC,EACE;AAC5B,EAAA,MAAM,EAAE,IAAA,EAAM,GAAA,EAAK,QAAA,EAAS,GAAI,OAAA;AAChC,EAAA,MAAM,EAAE,kBAAA,GAAqB,IAAA,EAAK,GAAI,OAAA;AACtC,EAAA,MAAM,UAAA,GAAa,MAAA,CAAO,MAAA,GAAS,SAAS,CAAA;AAG5C,EAAA,IAAI,UAAA,EAAY;AACd,IAAA,MAAM,OAAA,GAAU,MAAM,cAAA,CAAe,UAAA,EAAY;AAAA,MAC/C,GAAA;AAAA,MACA,IAAA;AAAA,MACA;AAAA,KACD,CAAA;AACD,IAAA,IAAI,YAAY,KAAA,EAAO;AACrB,MAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,eAAA,EAAiB,QAAQ,GAAA,EAAI;AAAA,IAC/D;AACA,IAAA,OAAO,EAAE,SAAS,IAAA,EAAK;AAAA,EACzB;AAGA,EAAA,IAAI,IAAA,EAAM;AACR,IAAA,MAAM,UAAA,GAAa,WAAW,SAAS,CAAA,CAAA;AACvC,IAAA,MAAM,OAAA,GAAUA,+BAAA;AAAA,MACd,EAAE,IAAI,IAAA,CAAK,EAAA,EAAI,OAAO,IAAA,CAAK,KAAA,EAAO,IAAA,EAAM,IAAA,CAAK,IAAA,EAAK;AAAA,MAClD;AAAA,KACF;AACA,IAAA,MAAM,QAAA,GAAWA,+BAAA;AAAA,MACf,EAAE,IAAI,IAAA,CAAK,EAAA,EAAI,OAAO,IAAA,CAAK,KAAA,EAAO,IAAA,EAAM,IAAA,CAAK,IAAA,EAAK;AAAA,MAClD;AAAA,KACF;AACA,IAAA,IAAI,WAAW,QAAA,EAAU;AACvB,MAAA,OAAO,EAAE,SAAS,IAAA,EAAK;AAAA,IACzB;AACA,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,wCAAA,EAA0C,QAAQ,GAAA,EAAI;AAAA,EACxF;AAGA,EAAA,IAAI,kBAAA,EAAoB;AACtB,IAAA,OAAO,EAAE,SAAS,IAAA,EAAK;AAAA,EACzB;AAEA,EAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,yBAAA,EAA2B,QAAQ,GAAA,EAAI;AACzE","file":"chunk-KGJRJ7CU.cjs","sourcesContent":["import type { User, Request } from '../hooks/types.js';\n\n// ============================================================================\n// Access Control Types\n// ============================================================================\n\nexport interface WhereClause {\n  [field: string]: any;\n}\n\nexport interface AccessArgs {\n  req: Request;\n  user?: User;\n  data?: unknown;\n  doc?: unknown;\n  id?: string;\n  tenantID?: string;\n  context?: Record<string, unknown>;\n}\n\nexport type AccessControl = boolean | ((args: AccessArgs) => Promise<boolean | WhereClause> | boolean | WhereClause);\n\nexport interface CollectionAccess {\n  create?: AccessControl;\n  read?: AccessControl;\n  update?: AccessControl;\n  delete?: AccessControl;\n  admin?: AccessControl;\n  unlock?: AccessControl;\n  readVersions?: AccessControl;\n}\n\nexport interface GlobalAccess {\n  read?: AccessControl;\n  update?: AccessControl;\n}\n\nexport interface FieldAccess {\n  create?: AccessControl;\n  read?: AccessControl;\n  update?: AccessControl;\n}\n\n// ============================================================================\n// Access Control Evaluation\n// ============================================================================\n\nexport async function evaluateAccess(\n  access: AccessControl,\n  args: AccessArgs\n): Promise<boolean | WhereClause> {\n  if (typeof access === 'boolean') {\n    return access;\n  }\n  if (typeof access === 'function') {\n    return await access(args);\n  }\n  return true;\n}\n\nexport function mergeWhereClauses(\n  ...whereClauses: (WhereClause | boolean | undefined)[]\n): WhereClause {\n  const result: WhereClause = {};\n  for (const clause of whereClauses) {\n    if (clause && typeof clause === 'object') {\n      Object.assign(result, clause);\n    }\n  }\n  return result;\n}\n\nexport function getWhereClause(\n  access: AccessControl,\n  args: AccessArgs\n): Promise<WhereClause | undefined> {\n  return evaluateAccess(access, args).then(result => {\n    if (result === true) return undefined;\n    if (result === false) return { _id: { $eq: null } };\n    return result;\n  });\n}\n","import { timingSafeEqual } from \"crypto\";\nimport type { BaseAdapter } from \"../registry/types.js\";\nimport type { AuthUser, UserRole } from \"./types.js\";\n\nexport interface ApiKeyRecord {\n  id: string;\n  userId: string;\n  name: string;\n  key: string;\n  keyPrefix: string;\n  permissions: string[];\n  lastUsedAt?: string;\n  expiresAt?: string;\n  createdAt: string;\n}\n\nexport interface ApiKeyValidationResult {\n  valid: boolean;\n  userId?: string;\n  user?: Partial<AuthUser>;\n  permissions?: string[];\n  apiKeyId?: string;\n  error?: string;\n  tenantId?: string;\n  role?: UserRole;\n}\n\nexport interface ApiKeyContext {\n  userId: string;\n  user: Partial<AuthUser>;\n  permissions: string[];\n  apiKeyId: string;\n  tenantId?: string;\n  role?: UserRole;\n}\n\nexport const API_KEY_COLLECTION = \"_api_keys\";\n\nfunction generateKeyPrefix(key: string): string {\n  return key.substring(0, 8);\n}\n\nfunction constantTimeCompare(a: string, b: string): boolean {\n  if (a.length !== b.length) {\n    return false;\n  }\n  try {\n    return timingSafeEqual(Buffer.from(a), Buffer.from(b));\n  } catch {\n    return false;\n  }\n}\n\nexport async function validateApiKey(\n  rawKey: string,\n  db: BaseAdapter,\n  userLookup?: (userId: string) => Promise<Partial<AuthUser> | null>,\n): Promise<ApiKeyValidationResult> {\n  if (!rawKey || typeof rawKey !== \"string\") {\n    return { valid: false, error: \"No API key provided\" };\n  }\n\n  if (!rawKey.startsWith(\"kyro_\")) {\n    return { valid: false, error: \"Invalid API key format\" };\n  }\n\n  const keyPrefix = generateKeyPrefix(rawKey);\n\n  try {\n    const result = await db.find({\n      collection: API_KEY_COLLECTION,\n      where: { keyPrefix: { equals: keyPrefix } },\n      limit: 100,\n      page: 1,\n    });\n\n    if (!result.docs || result.docs.length === 0) {\n      return { valid: false, error: \"Invalid API key\" };\n    }\n\n    let matchedKey: ApiKeyRecord | null = null;\n    for (const doc of result.docs) {\n      const record = doc as unknown as ApiKeyRecord;\n      if (constantTimeCompare(record.key, rawKey)) {\n        matchedKey = record;\n        break;\n      }\n    }\n\n    if (!matchedKey) {\n      return { valid: false, error: \"Invalid API key\" };\n    }\n\n    if (matchedKey.expiresAt) {\n      const expiresAt = new Date(matchedKey.expiresAt);\n      if (expiresAt < new Date()) {\n        return { valid: false, error: \"API key has expired\" };\n      }\n    }\n\n    try {\n      await db.update({\n        collection: API_KEY_COLLECTION,\n        id: matchedKey.id,\n        data: { lastUsedAt: new Date().toISOString() },\n      });\n    } catch {\n      // Non-critical: don't fail if lastUsedAt update fails\n    }\n\n    const user: Partial<AuthUser> = {\n      id: matchedKey.userId,\n      role: (matchedKey as any).role || \"author\",\n      tenantId: (matchedKey as any).tenantId,\n    };\n\n    if (userLookup) {\n      const dbUser = await userLookup(matchedKey.userId);\n      if (dbUser) {\n        Object.assign(user, dbUser);\n      }\n    }\n\n    return {\n      valid: true,\n      userId: matchedKey.userId,\n      user,\n      permissions: matchedKey.permissions || [],\n      apiKeyId: matchedKey.id,\n      tenantId: user.tenantId,\n      role: user.role,\n    };\n  } catch (error) {\n    console.error(\"[ApiKey] Validation error:\", error);\n    return { valid: false, error: \"Failed to validate API key\" };\n  }\n}\n\nexport function extractApiKeyFromRequest(request: Request): string | null {\n  const authHeader = request.headers.get(\"Authorization\");\n  if (authHeader) {\n    if (authHeader.startsWith(\"ApiKey \")) {\n      return authHeader.slice(7).trim();\n    }\n    if (authHeader.startsWith(\"Bearer \")) {\n      return null;\n    }\n  }\n\n  const xApiKey = request.headers.get(\"X-API-Key\");\n  if (xApiKey) {\n    return xApiKey.trim();\n  }\n\n  return null;\n}\n\nexport function createApiKeyContext(\n  result: ApiKeyValidationResult,\n): ApiKeyContext | null {\n  if (!result.valid || !result.userId) {\n    return null;\n  }\n  return {\n    userId: result.userId,\n    user: result.user || {},\n    permissions: result.permissions || [],\n    apiKeyId: result.apiKeyId || \"\",\n    tenantId: result.tenantId,\n    role: result.role,\n  };\n}\n\nexport function hasApiKeyPermission(\n  permissions: string[],\n  required: string,\n): boolean {\n  if (permissions.length === 0) return false;\n  if (permissions.includes(\"*\")) return true;\n  if (permissions.includes(required)) return true;\n\n  const [resource, action] = required.split(\":\");\n  if (permissions.includes(`${resource}:*`)) return true;\n\n  return false;\n}\n\nexport function generateApiKey(): string {\n  const chars = \"abcdefghijklmnopqrstuvwxyz0123456789\";\n  let suffix = \"\";\n  for (let i = 0; i < 32; i++) {\n    suffix += chars[Math.floor(Math.random() * chars.length)];\n  }\n  return `kyro_${suffix}`;\n}\n\nexport function generateApiKeyPrefix(key: string): string {\n  return key.substring(0, 8);\n}\n","import type { User, Request } from '../hooks/types.js';\nimport { evaluateAccess, type WhereClause } from './types.js';\nimport { hasPermission } from '../auth/rbac/checker.js';\nimport { hasApiKeyPermission } from '../auth/api-key.js';\n\nexport interface AccessCheckResult {\n  allowed: boolean;\n  extraWhere?: WhereClause;\n  error?: string;\n  status?: number;\n}\n\nexport interface AccessContext {\n  user?: User;\n  req?: Request;\n  tenantID?: string;\n  apiKey?: any;\n}\n\nexport interface AccessOptions {\n  enablePublicAccess?: boolean;\n  defaultAccess?: string;\n}\n\nfunction actionToPermission(\n  operation: \"read\" | \"create\" | \"update\" | \"delete\",\n): string {\n  if (operation === \"read\") return \"read\";\n  if (operation === \"create\") return \"create\";\n  if (operation === \"update\") return \"update\";\n  return \"delete\";\n}\n\nfunction isDefaultAllowed(\n  operation: \"read\" | \"create\" | \"update\" | \"delete\",\n  defaultAccess: string,\n): boolean {\n  const levels: Record<string, boolean> = {\n    none: false,\n    read: operation === \"read\",\n    create: operation === \"read\" || operation === \"create\",\n    update: operation === \"read\" || operation === \"create\" || operation === \"update\",\n    delete: operation === \"read\" || operation === \"create\" || operation === \"update\" || operation === \"delete\",\n    admin: true,\n  };\n  return levels[defaultAccess] || false;\n}\n\nexport async function checkCollectionAccess(\n  config: { access?: any; slug: string },\n  operation: \"read\" | \"create\" | \"update\" | \"delete\",\n  context: AccessContext,\n  options: AccessOptions = {},\n): Promise<AccessCheckResult> {\n  const { user, req, tenantID, apiKey } = context;\n  const { enablePublicAccess = true, defaultAccess = \"none\" } = options;\n  const accessRule = config.access?.[operation];\n\n  // Custom access function (highest priority)\n  if (accessRule) {\n    const allowed = await evaluateAccess(accessRule, {\n      req: req!,\n      user,\n      tenantID,\n    });\n    if (allowed === false) {\n      return { allowed: false, error: \"Access denied\", status: 403 };\n    }\n    if (typeof allowed === \"object\") {\n      return { allowed: true, extraWhere: allowed as WhereClause };\n    }\n    return { allowed: true };\n  }\n\n  // API key permission check\n  if (apiKey?.permissions?.length > 0) {\n    const resource = config.slug;\n    const action = actionToPermission(operation);\n    const permission = `${resource}:${action}`;\n    if (\n      !hasApiKeyPermission(apiKey.permissions, permission) &&\n      !hasApiKeyPermission(apiKey.permissions, `${resource}:admin`)\n    ) {\n      return { allowed: false, error: \"Access denied: insufficient permissions\", status: 403 };\n    }\n    return { allowed: true };\n  }\n\n  // No accessRule, no apiKey — authenticated user RBAC\n  if (user) {\n    const resource = config.slug;\n    const action = actionToPermission(operation);\n    const permission = `${resource}:${action}`;\n\n    const userHas = hasPermission(\n      { id: user.id, email: user.email, role: user.role } as any,\n      permission,\n    );\n    const adminHas = hasPermission(\n      { id: user.id, email: user.email, role: user.role } as any,\n      `${resource}:admin`,\n    );\n\n    if (userHas || adminHas) {\n      return { allowed: true };\n    }\n    return { allowed: false, error: \"Access denied: missing RBAC permission\", status: 403 };\n  }\n\n  // Unauthenticated — check public access\n  const defaultAllowed = isDefaultAllowed(operation, defaultAccess);\n  if (enablePublicAccess && defaultAllowed) {\n    return { allowed: true };\n  }\n\n  return { allowed: false, error: \"Authentication required\", status: 401 };\n}\n\nexport async function checkGlobalAccess(\n  config: { access?: any; slug: string },\n  operation: \"read\" | \"update\",\n  context: AccessContext,\n  options: AccessOptions = {},\n): Promise<AccessCheckResult> {\n  const { user, req, tenantID } = context;\n  const { enablePublicAccess = true } = options;\n  const accessRule = config.access?.[operation];\n\n  // Custom access function\n  if (accessRule) {\n    const allowed = await evaluateAccess(accessRule, {\n      req: req!,\n      user,\n      tenantID,\n    });\n    if (allowed === false) {\n      return { allowed: false, error: \"Access denied\", status: 403 };\n    }\n    return { allowed: true };\n  }\n\n  // Authenticated user RBAC\n  if (user) {\n    const permission = `globals:${operation}`;\n    const userHas = hasPermission(\n      { id: user.id, email: user.email, role: user.role } as any,\n      permission,\n    );\n    const adminHas = hasPermission(\n      { id: user.id, email: user.email, role: user.role } as any,\n      \"globals:admin\",\n    );\n    if (userHas || adminHas) {\n      return { allowed: true };\n    }\n    return { allowed: false, error: \"Access denied: missing RBAC permission\", status: 403 };\n  }\n\n  // Unauthenticated\n  if (enablePublicAccess) {\n    return { allowed: true };\n  }\n\n  return { allowed: false, error: \"Authentication required\", status: 401 };\n}\n"]}