@lacrous/omnicloud 0.2.33 → 0.2.35

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lacrous/omnicloud",
-  "version": "0.2.33",
+  "version": "0.2.35",
   "description": "SDK and core building blocks for OmniCloud — self-hosted cloud storage powered by your Telegram account.",
   "license": "MIT",
   "type": "module",
@@ -48,9 +48,9 @@
     "prisma": "^6.2.0"
   },
   "devDependencies": {
-    "@omnicloud/core": "0.2.33",
-    "@omnicloud/shared": "0.2.33",
-    "@omnicloud/telegram": "0.2.33",
+    "@omnicloud/core": "0.2.35",
+    "@omnicloud/shared": "0.2.35",
+    "@omnicloud/telegram": "0.2.35",
     "@types/node": "^22.10.0",
     "esbuild": "0.25.12",
     "tsup": "^8.3.0",

package/server/index.js

@@ -770,6 +770,41 @@ function truncate(value, max) {
   return value === null ? null : value.slice(0, max);
 }
 
+// ../core/src/services/api-token-service.ts
+import { randomBytes as randomBytes2 } from "node:crypto";
+var MAX_NAME_LENGTH = 80;
+var ApiTokenService = class {
+  constructor(repo, now = () => /* @__PURE__ */ new Date()) {
+    this.repo = repo;
+    this.now = now;
+  }
+  async issue(userId, name) {
+    const label = name.trim();
+    if (label.length === 0 || label.length > MAX_NAME_LENGTH) {
+      throw new ValidationError(`Token name must be 1 to ${MAX_NAME_LENGTH} characters`);
+    }
+    const token = randomBytes2(32).toString("base64url");
+    const record = await this.repo.create({ userId, name: label, tokenHash: hashToken(token) });
+    return { token, record };
+  }
+  list(userId) {
+    return this.repo.listForUser(userId);
+  }
+  /** Resolves a bearer token to its active record, or null if unknown or revoked. */
+  async resolve(token) {
+    if (!token || token.length < 32 || token.length > 128) return null;
+    const record = await this.repo.findByTokenHash(hashToken(token));
+    if (!record || record.revokedAt !== null) return null;
+    await this.repo.touch(record.id, this.now());
+    return record;
+  }
+  async revoke(userId, id) {
+    const record = await this.repo.findByIdForUser(userId, id);
+    if (!record) throw new NotFoundError("API token not found");
+    if (record.revokedAt === null) await this.repo.revoke(id, this.now());
+  }
+};
+
 // ../core/src/services/version-retention.ts
 function versionsToPrune(versions, currentVersionId, policy, now) {
   const historical = versions.filter((version) => version.id !== currentVersionId).sort((a, b) => b.versionNumber - a.versionNumber);
@@ -2372,7 +2407,7 @@ async function sweepStaleSpools() {
 }
 
 // ../core/src/utils/secret-box.ts
-import { createCipheriv, createDecipheriv, randomBytes as randomBytes2, scryptSync } from "node:crypto";
+import { createCipheriv, createDecipheriv, randomBytes as randomBytes3, scryptSync } from "node:crypto";
 var ALGORITHM = "aes-256-gcm";
 var IV_BYTES = 12;
 var KEY_BYTES = 32;
@@ -2398,7 +2433,7 @@ var SecretBox = class {
   }
   seal(plaintext) {
     const key = this.keys.get(this.currentVersion);
-    const iv = randomBytes2(IV_BYTES);
+    const iv = randomBytes3(IV_BYTES);
     const cipher = createCipheriv(ALGORITHM, key, iv);
     const ciphertext = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
     const tag = cipher.getAuthTag();
@@ -3817,6 +3852,49 @@ function createUploadOperationRepo(prisma) {
     }
   };
 }
+function createApiTokenRepo(prisma) {
+  return {
+    async create(input) {
+      const row = await prisma.apiToken.create({ data: input });
+      return mapApiToken(row);
+    },
+    async findByTokenHash(tokenHash) {
+      const row = await prisma.apiToken.findUnique({ where: { tokenHash } });
+      return row ? mapApiToken(row) : null;
+    },
+    async findByIdForUser(userId, id) {
+      const row = await prisma.apiToken.findFirst({ where: { id, userId } });
+      return row ? mapApiToken(row) : null;
+    },
+    async listForUser(userId) {
+      const rows = await prisma.apiToken.findMany({
+        where: { userId },
+        orderBy: { createdAt: "desc" }
+      });
+      return rows.map(mapApiToken);
+    },
+    async touch(id, at) {
+      await prisma.apiToken.update({ where: { id }, data: { lastUsedAt: at } });
+    },
+    async revoke(id, at) {
+      await prisma.apiToken.updateMany({
+        where: { id, revokedAt: null },
+        data: { revokedAt: at }
+      });
+    }
+  };
+}
+function mapApiToken(row) {
+  return {
+    id: row.id,
+    userId: row.userId,
+    name: row.name,
+    tokenHash: row.tokenHash,
+    createdAt: row.createdAt,
+    revokedAt: row.revokedAt,
+    lastUsedAt: row.lastUsedAt
+  };
+}
 function createBrowserSessionRepo(prisma) {
   return {
     async create(input) {
@@ -4258,6 +4336,7 @@ function createPrismaRepos(prisma, box = null) {
     users: createUserRepo(prisma),
     sessions: createSessionRepo(prisma, box),
     browserSessions: createBrowserSessionRepo(prisma),
+    apiTokens: createApiTokenRepo(prisma),
     uploadOperations: createUploadOperationRepo(prisma),
     storages: createStorageRepo(prisma),
     folders: createFolderRepo(prisma),
@@ -4362,6 +4441,7 @@ function buildContainerFromRepos(config2, repos, overrides = {}) {
     reconciliation: new ReconciliationService(repos, engineFor),
     reconciliationFlow: new ReconciliationFlow(repos, engineFor),
     authSessions: new AuthSessionService(repos.browserSessions),
+    apiTokens: new ApiTokenService(repos.apiTokens),
     engineFor,
     shutdown: async () => {
       await clientManager.disconnectAll();
@@ -4416,12 +4496,22 @@ import multipart from "@fastify/multipart";
 import fastifyStatic from "@fastify/static";
 
 // ../../apps/api/src/auth.ts
-function registerAuthHook(app2, repos, authSessions) {
+function registerAuthHook(app2, repos, authSessions, apiTokens) {
   app2.addHook("preHandler", async (request) => {
     const url = request.routeOptions?.url ?? "";
     if (!url.startsWith("/api/") || url.startsWith("/api/auth/") || url.startsWith("/api/health")) {
       return;
     }
+    const bearer = bearerToken(request.headers.authorization);
+    if (bearer !== void 0) {
+      const token = await apiTokens.resolve(bearer);
+      if (!token) throw new UnauthorizedError();
+      const owner = await repos.users.findById(token.userId);
+      if (!owner) throw new AuthInvalidError("Account no longer exists");
+      request.user = { id: owner.id };
+      request.authSessionId = void 0;
+      return;
+    }
     const session = await authSessions.resolve(request.cookies[SESSION_COOKIE]);
     if (!session) throw new UnauthorizedError();
     const user = await repos.users.findById(session.userId);
@@ -4430,6 +4520,11 @@ function registerAuthHook(app2, repos, authSessions) {
     request.authSessionId = session.id;
   });
 }
+function bearerToken(header) {
+  if (!header) return void 0;
+  const match = /^Bearer\s+(\S+)$/i.exec(header.trim());
+  return match ? match[1] : void 0;
+}
 async function issueSessionCookie(authSessions, request, reply, userId, cookieSecure) {
   const { token } = await authSessions.issue(userId, {
     userAgent: request.headers["user-agent"] ?? null,
@@ -5253,7 +5348,7 @@ function encryptionCheck(configured) {
 }
 
 // ../../apps/api/src/routes/storage.ts
-var VERSION = "0.2.33";
+var VERSION = "0.2.35";
 function registerStorageRoutes(app2, container2) {
   app2.get("/api/health", async () => {
     const database = await probeDatabase(container2);
@@ -5353,6 +5448,38 @@ async function probeDatabase(container2) {
   }
 }
 
+// ../../apps/api/src/routes/tokens.ts
+function registerTokenRoutes(app2, container2) {
+  app2.post("/api/tokens", async (request, reply) => {
+    const body = request.body ?? {};
+    if (typeof body.name !== "string") throw new ValidationError("A token name is required");
+    const issued = await container2.apiTokens.issue(request.user.id, body.name);
+    return reply.status(201).send({
+      id: issued.record.id,
+      name: issued.record.name,
+      createdAt: issued.record.createdAt.toISOString(),
+      token: issued.token
+    });
+  });
+  app2.get("/api/tokens", async (request) => {
+    const tokens = await container2.apiTokens.list(request.user.id);
+    return {
+      tokens: tokens.map((t) => ({
+        id: t.id,
+        name: t.name,
+        createdAt: t.createdAt.toISOString(),
+        lastUsedAt: t.lastUsedAt?.toISOString() ?? null,
+        revokedAt: t.revokedAt?.toISOString() ?? null
+      }))
+    };
+  });
+  app2.delete("/api/tokens/:id", async (request, reply) => {
+    const { id } = request.params;
+    await container2.apiTokens.revoke(request.user.id, id);
+    return reply.status(204).send();
+  });
+}
+
 // ../../apps/api/src/app.ts
 function sendError(reply, status, code, message, requestId, details) {
   void reply.status(status).send({ error: { code, message, requestId, ...details ? { details } : {} } });
@@ -5382,7 +5509,7 @@ async function createApp(container2) {
       }
     }
   });
-  registerAuthHook(app2, container2.repos, container2.authSessions);
+  registerAuthHook(app2, container2.repos, container2.authSessions, container2.apiTokens);
   app2.setErrorHandler((error, request, reply) => {
     if (error instanceof DomainError) {
       sendError(reply, error.status, error.code, error.message, request.id, error.details);
@@ -5410,6 +5537,7 @@ async function createApp(container2) {
   registerFolderRoutes(app2, container2);
   registerCollectionRoutes(app2, container2);
   registerStorageRoutes(app2, container2);
+  registerTokenRoutes(app2, container2);
   const webDistDir = container2.config.webDistDir;
   if (webDistDir && existsSync(webDistDir)) {
     await app2.register(fastifyStatic, { root: resolve(webDistDir), wildcard: false });

package/server/prisma/migrations/6_api_tokens/migration.sql

@@ -0,0 +1,19 @@
+-- Personal API tokens. Only a SHA-256 hash of each secret is stored; revoked tokens
+-- are kept so their history survives, and are rejected by the auth check.
+CREATE TABLE "ApiToken" (
+    "id" TEXT NOT NULL,
+    "userId" TEXT NOT NULL,
+    "name" TEXT NOT NULL,
+    "tokenHash" TEXT NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "revokedAt" TIMESTAMP(3),
+    "lastUsedAt" TIMESTAMP(3),
+
+    CONSTRAINT "ApiToken_pkey" PRIMARY KEY ("id")
+);
+
+CREATE UNIQUE INDEX "ApiToken_tokenHash_key" ON "ApiToken"("tokenHash");
+
+CREATE INDEX "ApiToken_userId_revokedAt_idx" ON "ApiToken"("userId", "revokedAt");
+
+ALTER TABLE "ApiToken" ADD CONSTRAINT "ApiToken_userId_fkey" FOREIGN KEY ("userId") REFERENCES "User"("id") ON DELETE CASCADE ON UPDATE CASCADE;

package/server/prisma/schema.prisma

@@ -31,6 +31,7 @@ model User {
   fileVersions     FileVersion[]
   activityEvents   ActivityEvent[]
   browserSessions  BrowserSession[]
+  apiTokens        ApiToken[]
   uploadOperations UploadOperation[]
 }
 
@@ -74,6 +75,21 @@ model UploadOperation {
   @@index([status, updatedAt])
 }
 
+/// Personal API token for scripts and the SDK. Only a SHA-256 hash of the secret
+/// is stored; the secret itself is shown once, when the token is created.
+model ApiToken {
+  id         String    @id @default(cuid())
+  userId     String
+  user       User      @relation(fields: [userId], references: [id], onDelete: Cascade)
+  name       String
+  tokenHash  String    @unique
+  createdAt  DateTime  @default(now())
+  revokedAt  DateTime?
+  lastUsedAt DateTime?
+
+  @@index([userId, revokedAt])
+}
+
 /// MTProto session string for the user's connected Telegram account.
 /// Never exposed through the API and never logged.
 model TelegramSession {