@makolabs/ripple 1.6.4 → 1.6.5

package/dist/funcs/user-management.remote.js

@@ -349,19 +349,46 @@ async function refreshTokenIfSelfUpdate(userId) {
 export const updateUserPermissions = command('unchecked', async (options) => {
     const { userId, permissions } = options;
     try {
-        // Fetch all keys for this specific user (not paginated, gets all keys)
+        // Fetch user's active keys
         const allKeysData = await makeAdminRequest(`/admin/keys?client_id=${CLIENT_ID}&sub=${userId}`);
-        // Find ALL active keys for this user (not just one)
         const userKeys = (allKeysData?.data?.data || []).filter((key) => key.status === 'active');
-        // Create new key first, then delete old ones (safer order)
-        const newKey = await createUserPermissions(userId, permissions);
-        // Only delete old keys after new key is successfully created
-        if (userKeys.length > 0 && newKey) {
-            await Promise.all(userKeys.map((key) => makeAdminRequest(`/admin/keys/${key.id}`, {
-                method: 'DELETE'
-            }).catch((err) => {
-                console.warn(`[updateUserPermissions] Failed to delete key ${key.id}:`, err);
-            })));
+        const filteredPermissions = PERMISSION_PREFIX
+            ? permissions.filter((scope) => scope.startsWith(PERMISSION_PREFIX))
+            : permissions;
+        if (userKeys.length === 0) {
+            // No active key exists, create new one
+            const newKeyResult = await createUserPermissions(userId, permissions);
+            const newApiKey = newKeyResult?.data?.key;
+            if (newApiKey) {
+                const currentUser = await makeClerkRequest(`/users/${userId}`);
+                await makeClerkRequest(`/users/${userId}`, {
+                    method: 'PATCH',
+                    body: JSON.stringify({
+                        private_metadata: {
+                            ...(currentUser.private_metadata || {}),
+                            mako_api_key: newApiKey
+                        }
+                    })
+                });
+            }
+        }
+        else {
+            // Use PUT to update existing key (per Mako Auth API spec)
+            const keyId = userKeys[0].id;
+            await makeAdminRequest(`/admin/keys/${keyId}`, {
+                method: 'PUT',
+                body: JSON.stringify({
+                    scopes: filteredPermissions
+                })
+            });
+            // Clean up any extra keys (there should only be one)
+            if (userKeys.length > 1) {
+                await Promise.all(userKeys.slice(1).map((key) => makeAdminRequest(`/admin/keys/${key.id}`, {
+                    method: 'DELETE'
+                }).catch((err) => {
+                    console.warn(`[updateUserPermissions] Failed to delete extra key ${key.id}:`, err);
+                })));
+            }
         }
         await refreshTokenIfSelfUpdate(userId);
     }
@@ -379,30 +406,39 @@ export const generateApiKey = command('unchecked', async (options) => {
         if (filteredPermissions.length === 0 && PERMISSION_PREFIX) {
             filteredPermissions = [`${PERMISSION_PREFIX}readonly`];
         }
-        let oldKeyId = null;
-        if (options.revokeOld) {
-            try {
-                const allKeysData = await makeAdminRequest('/admin/keys');
-                if (allKeysData?.data?.data && Array.isArray(allKeysData.data.data)) {
-                    const userKey = allKeysData.data.data.find((key) => key.sub === options.userId && key.client_id === CLIENT_ID && key.status === 'active');
-                    if (userKey) {
-                        oldKeyId = userKey.id;
-                    }
-                }
-            }
-            catch (e) {
-                console.warn('[generateApiKey] Could not fetch existing key for revocation:', e);
+        // Check if user has existing active key
+        const allKeysData = await makeAdminRequest(`/admin/keys?client_id=${CLIENT_ID}&sub=${options.userId}`);
+        const userKeys = (allKeysData?.data?.data || []).filter((key) => key.status === 'active');
+        let newApiKey;
+        let wasRotated = false;
+        if (userKeys.length > 0 && options.revokeOld) {
+            // Use rotate endpoint (per Mako Auth API spec)
+            const keyId = userKeys[0].id;
+            const rotateResult = await makeAdminRequest(`/admin/keys/${keyId}/rotate`, {
+                method: 'POST',
+                body: JSON.stringify({
+                    scopes: filteredPermissions
+                })
+            });
+            // Rotate endpoint returns key in data.key field
+            newApiKey = rotateResult?.data?.key;
+            wasRotated = true;
+            if (!newApiKey) {
+                throw new Error('Failed to rotate API key - no key in response');
             }
         }
-        const createData = await createUserPermissions(options.userId, filteredPermissions);
-        if (!createData) {
-            throw new Error('Failed to create admin key');
-        }
-        const newApiKey = createData?.data?.key;
-        if (!newApiKey) {
-            console.error('[generateApiKey] No API key in response:', createData);
-            throw new Error('Failed to generate API key - no key in response');
+        else {
+            // Create new key if none exists or revokeOld is false
+            const createData = await createUserPermissions(options.userId, filteredPermissions);
+            if (!createData) {
+                throw new Error('Failed to create admin key');
+            }
+            newApiKey = createData?.data?.key;
+            if (!newApiKey) {
+                throw new Error('Failed to generate API key - no key in response');
+            }
         }
+        // Update Clerk profile with new key
         try {
             const currentUser = await makeClerkRequest(`/users/${options.userId}`);
             await makeClerkRequest(`/users/${options.userId}`, {
@@ -419,22 +455,11 @@ export const generateApiKey = command('unchecked', async (options) => {
             console.error('[generateApiKey] Failed to update Clerk profile:', clerkError);
             console.warn('[generateApiKey] Key generated but could not update Clerk profile');
         }
-        if (oldKeyId) {
-            try {
-                await makeAdminRequest(`/admin/keys/${oldKeyId}`, {
-                    method: 'DELETE'
-                });
-            }
-            catch (revokeError) {
-                console.error('[generateApiKey] Failed to revoke old key:', revokeError);
-                console.warn('[generateApiKey] New key generated but could not revoke old key');
-            }
-        }
         const result = {
             success: true,
             apiKey: newApiKey,
-            message: oldKeyId
-                ? 'New API key generated and old key revoked successfully'
+            message: wasRotated
+                ? 'API key rotated successfully'
                 : 'API key generated successfully'
         };
         return JSON.parse(JSON.stringify(result));

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@makolabs/ripple",
-	"version": "1.6.4",
+	"version": "1.6.5",
 	"description": "Simple Svelte 5 powered component library ✨",
 	"license": "SEE LICENSE IN LICENSE",
 	"repository": {