@makolabs/ripple 1.6.4 → 1.6.6

package/dist/funcs/user-management.remote.d.ts

@@ -21,3 +21,11 @@ export declare const generateApiKey: import("@sveltejs/kit").RemoteCommand<{
     apiKey: string;
     message: string;
 }>>;
+export declare const verifyToken: import("@sveltejs/kit").RemoteCommand<{
+    apiKey: string;
+}, Promise<{
+    valid: boolean;
+    scopes?: string[];
+    error?: string;
+    token?: string;
+}>>;

package/dist/funcs/user-management.remote.js

@@ -75,6 +75,62 @@ async function makeAdminRequest(endpoint, options = {}) {
     // Ensure all data is serializable by converting to plain objects
     return JSON.parse(JSON.stringify(data));
 }
+async function makeAuthRequest(endpoint, options = {}) {
+    const PRIVATE_BASE_AUTH_URL = env.PRIVATE_BASE_AUTH_URL;
+    if (!PRIVATE_BASE_AUTH_URL) {
+        throw new Error('PRIVATE_BASE_AUTH_URL environment variable is required');
+    }
+    const url = `${PRIVATE_BASE_AUTH_URL}${endpoint}`;
+    const response = await fetch(url, {
+        ...options,
+        headers: {
+            'Content-Type': 'application/json',
+            ...options.headers
+        }
+    });
+    const data = await response.json();
+    // Return both status and data for verification purposes
+    return {
+        ok: response.ok,
+        status: response.status,
+        data: JSON.parse(JSON.stringify(data))
+    };
+}
+async function verifyApiKeyToken(apiKey) {
+    try {
+        const result = await makeAuthRequest('/auth/issue', {
+            method: 'POST',
+            headers: {
+                'X-API-Key': apiKey
+            }
+        });
+        if (result.ok && result.data?.data?.access_token) {
+            // Parse the JWT to get scopes (or use verify endpoint)
+            const verifyResult = await makeAuthRequest('/auth/verify', {
+                method: 'POST',
+                headers: {
+                    'Authorization': `Bearer ${result.data.data.access_token}`
+                }
+            });
+            if (verifyResult.ok && verifyResult.data?.data) {
+                return {
+                    valid: true,
+                    scopes: verifyResult.data.data.scopes || []
+                };
+            }
+        }
+        return {
+            valid: false,
+            error: result.data?.error || `API key verification failed with status ${result.status}`
+        };
+    }
+    catch (error) {
+        return {
+            valid: false,
+            error: error instanceof Error ? error.message : 'Unknown error during verification'
+        };
+    }
+}
 async function createUserPermissions(userId, permissions, clientId = CLIENT_ID) {
     const filteredPermissions = PERMISSION_PREFIX
         ? permissions.filter((scope) => scope.startsWith(PERMISSION_PREFIX))
@@ -349,19 +405,69 @@ async function refreshTokenIfSelfUpdate(userId) {
 export const updateUserPermissions = command('unchecked', async (options) => {
     const { userId, permissions } = options;
     try {
-        // Fetch all keys for this specific user (not paginated, gets all keys)
+        // Fetch user's active keys
         const allKeysData = await makeAdminRequest(`/admin/keys?client_id=${CLIENT_ID}&sub=${userId}`);
-        // Find ALL active keys for this user (not just one)
         const userKeys = (allKeysData?.data?.data || []).filter((key) => key.status === 'active');
-        // Create new key first, then delete old ones (safer order)
-        const newKey = await createUserPermissions(userId, permissions);
-        // Only delete old keys after new key is successfully created
-        if (userKeys.length > 0 && newKey) {
-            await Promise.all(userKeys.map((key) => makeAdminRequest(`/admin/keys/${key.id}`, {
-                method: 'DELETE'
-            }).catch((err) => {
-                console.warn(`[updateUserPermissions] Failed to delete key ${key.id}:`, err);
-            })));
+        const filteredPermissions = PERMISSION_PREFIX
+            ? permissions.filter((scope) => scope.startsWith(PERMISSION_PREFIX))
+            : permissions;
+        if (userKeys.length === 0) {
+            // No active key exists, create new one
+            const newKeyResult = await createUserPermissions(userId, permissions);
+            const newApiKey = newKeyResult?.data?.key;
+            if (newApiKey) {
+                const currentUser = await makeClerkRequest(`/users/${userId}`);
+                await makeClerkRequest(`/users/${userId}`, {
+                    method: 'PATCH',
+                    body: JSON.stringify({
+                        private_metadata: {
+                            ...(currentUser.private_metadata || {}),
+                            mako_api_key: newApiKey
+                        }
+                    })
+                });
+            }
+        }
+        else {
+            // Use PUT to update existing key (per Mako Auth API spec)
+            const keyId = userKeys[0].id;
+            // Get the API key string before updating
+            const keyData = await makeAdminRequest(`/admin/keys/${keyId}`);
+            const apiKeyString = keyData?.data?.key;
+            await makeAdminRequest(`/admin/keys/${keyId}`, {
+                method: 'PUT',
+                body: JSON.stringify({
+                    scopes: filteredPermissions
+                })
+            });
+            // Verify the token has updated scopes
+            if (apiKeyString) {
+                try {
+                    const verification = await verifyApiKeyToken(apiKeyString);
+                    if (verification.valid) {
+                        console.log('[updateUserPermissions] Token verification successful. Scopes:', verification.scopes);
+                        // Check if the scopes match what we expect
+                        const scopesMatch = filteredPermissions.every(perm => verification.scopes?.includes(perm));
+                        if (!scopesMatch) {
+                            console.warn('[updateUserPermissions] Token scopes do not match expected permissions');
+                        }
+                    }
+                    else {
+                        console.warn('[updateUserPermissions] Token verification failed:', verification.error);
+                    }
+                }
+                catch (verifyError) {
+                    console.warn('[updateUserPermissions] Could not verify token:', verifyError);
+                }
+            }
+            // Clean up any extra keys (there should only be one)
+            if (userKeys.length > 1) {
+                await Promise.all(userKeys.slice(1).map((key) => makeAdminRequest(`/admin/keys/${key.id}`, {
+                    method: 'DELETE'
+                }).catch((err) => {
+                    console.warn(`[updateUserPermissions] Failed to delete extra key ${key.id}:`, err);
+                })));
+            }
         }
         await refreshTokenIfSelfUpdate(userId);
     }
@@ -379,30 +485,75 @@ export const generateApiKey = command('unchecked', async (options) => {
         if (filteredPermissions.length === 0 && PERMISSION_PREFIX) {
             filteredPermissions = [`${PERMISSION_PREFIX}readonly`];
         }
-        let oldKeyId = null;
-        if (options.revokeOld) {
+        // Check if user has existing active key
+        const allKeysData = await makeAdminRequest(`/admin/keys?client_id=${CLIENT_ID}&sub=${options.userId}`);
+        const userKeys = (allKeysData?.data?.data || []).filter((key) => key.status === 'active');
+        let newApiKey;
+        let wasRotated = false;
+        if (userKeys.length > 0 && options.revokeOld) {
+            // Use rotate endpoint (per Mako Auth API spec)
+            const keyId = userKeys[0].id;
+            // Get the old API key string before rotating
+            const oldKeyData = await makeAdminRequest(`/admin/keys/${keyId}`);
+            const oldApiKey = oldKeyData?.data?.key;
+            const rotateResult = await makeAdminRequest(`/admin/keys/${keyId}/rotate`, {
+                method: 'POST',
+                body: JSON.stringify({
+                    scopes: filteredPermissions
+                })
+            });
+            // Rotate endpoint returns key in data.key field
+            newApiKey = rotateResult?.data?.key;
+            wasRotated = true;
+            if (!newApiKey) {
+                throw new Error('Failed to rotate API key - no key in response');
+            }
+            // Verify old key is revoked
+            if (oldApiKey) {
+                try {
+                    const oldKeyVerification = await verifyApiKeyToken(oldApiKey);
+                    if (oldKeyVerification.valid) {
+                        console.warn('[generateApiKey] Old API key is still valid after rotation');
+                    }
+                    else {
+                        console.log('[generateApiKey] Old API key successfully revoked');
+                    }
+                }
+                catch (verifyError) {
+                    console.warn('[generateApiKey] Could not verify old key revocation:', verifyError);
+                }
+            }
+            // Verify new key works with correct scopes
             try {
-                const allKeysData = await makeAdminRequest('/admin/keys');
-                if (allKeysData?.data?.data && Array.isArray(allKeysData.data.data)) {
-                    const userKey = allKeysData.data.data.find((key) => key.sub === options.userId && key.client_id === CLIENT_ID && key.status === 'active');
-                    if (userKey) {
-                        oldKeyId = userKey.id;
+                const newKeyVerification = await verifyApiKeyToken(newApiKey);
+                if (newKeyVerification.valid) {
+                    console.log('[generateApiKey] New API key verification successful. Scopes:', newKeyVerification.scopes);
+                    // Check if the scopes match what we expect
+                    const scopesMatch = filteredPermissions.every(perm => newKeyVerification.scopes?.includes(perm));
+                    if (!scopesMatch) {
+                        console.warn('[generateApiKey] New key scopes do not match expected permissions');
                     }
                 }
+                else {
+                    console.warn('[generateApiKey] New API key verification failed:', newKeyVerification.error);
+                }
             }
-            catch (e) {
-                console.warn('[generateApiKey] Could not fetch existing key for revocation:', e);
+            catch (verifyError) {
+                console.warn('[generateApiKey] Could not verify new key:', verifyError);
             }
         }
-        const createData = await createUserPermissions(options.userId, filteredPermissions);
-        if (!createData) {
-            throw new Error('Failed to create admin key');
-        }
-        const newApiKey = createData?.data?.key;
-        if (!newApiKey) {
-            console.error('[generateApiKey] No API key in response:', createData);
-            throw new Error('Failed to generate API key - no key in response');
+        else {
+            // Create new key if none exists or revokeOld is false
+            const createData = await createUserPermissions(options.userId, filteredPermissions);
+            if (!createData) {
+                throw new Error('Failed to create admin key');
+            }
+            newApiKey = createData?.data?.key;
+            if (!newApiKey) {
+                throw new Error('Failed to generate API key - no key in response');
+            }
         }
+        // Update Clerk profile with new key
         try {
             const currentUser = await makeClerkRequest(`/users/${options.userId}`);
             await makeClerkRequest(`/users/${options.userId}`, {
@@ -419,22 +570,11 @@ export const generateApiKey = command('unchecked', async (options) => {
             console.error('[generateApiKey] Failed to update Clerk profile:', clerkError);
             console.warn('[generateApiKey] Key generated but could not update Clerk profile');
         }
-        if (oldKeyId) {
-            try {
-                await makeAdminRequest(`/admin/keys/${oldKeyId}`, {
-                    method: 'DELETE'
-                });
-            }
-            catch (revokeError) {
-                console.error('[generateApiKey] Failed to revoke old key:', revokeError);
-                console.warn('[generateApiKey] New key generated but could not revoke old key');
-            }
-        }
         const result = {
             success: true,
             apiKey: newApiKey,
-            message: oldKeyId
-                ? 'New API key generated and old key revoked successfully'
+            message: wasRotated
+                ? 'API key rotated successfully'
                 : 'API key generated successfully'
         };
         return JSON.parse(JSON.stringify(result));
@@ -444,3 +584,29 @@ export const generateApiKey = command('unchecked', async (options) => {
         throw new Error(`Failed to generate API key: ${error instanceof Error ? error.message : 'Unknown error'}`);
     }
 });
+export const verifyToken = command('unchecked', async (options) => {
+    try {
+        const result = await verifyApiKeyToken(options.apiKey);
+        // Also return the issued token for debugging
+        if (result.valid) {
+            const tokenResult = await makeAuthRequest('/auth/issue', {
+                method: 'POST',
+                headers: {
+                    'X-API-Key': options.apiKey
+                }
+            });
+            return {
+                ...result,
+                token: tokenResult.data?.data?.access_token
+            };
+        }
+        return result;
+    }
+    catch (error) {
+        console.error('[verifyToken] Error:', error);
+        return {
+            valid: false,
+            error: error instanceof Error ? error.message : 'Unknown error during verification'
+        };
+    }
+});

package/dist/index.d.ts

@@ -1031,6 +1031,14 @@ export interface UserManagementAdapter {
         apiKey: string;
         message: string;
     }>;
+    verifyToken?: (options: {
+        apiKey: string;
+    }) => PromiseLike<{
+        valid: boolean;
+        scopes?: string[];
+        error?: string;
+        token?: string;
+    }>;
 }
 export interface UserManagementProps {
     /**

package/dist/user-management/UserModal.svelte

@@ -30,6 +30,8 @@
 	let formElement = $state<HTMLFormElement | null>(null);
 	let showApiKey = $state(false);
 	let regeneratingApiKey = $state(false);
+	let verifyingToken = $state(false);
+	let tokenVerification = $state<{ valid?: boolean; scopes?: string[]; error?: string } | null>(null);
 	let initialRole = $state<string>('');
 
 	// Form data
@@ -131,6 +133,7 @@
 		open = false;
 		formErrors = {};
 		saving = false;
+		tokenVerification = null;
 		if (onClose) onClose();
 	}
 
@@ -184,6 +187,9 @@
 			role: roleValue,
 			permissions: role ? [...role.permissions] : []
 		};
+		
+		// Clear token verification when permissions change
+		tokenVerification = null;
 	}
 
 	async function handleRegenerateApiKey() {
@@ -197,6 +203,7 @@
 
 		try {
 			regeneratingApiKey = true;
+			tokenVerification = null; // Clear previous verification
 			const result = await adapter.generateApiKey({
 				userId: user.id,
 				permissions: formData.permissions,
@@ -221,6 +228,27 @@
 		}
 	}
 
+	async function handleVerifyToken() {
+		if (!adapter?.verifyToken || !apiKey) return;
+
+		try {
+			verifyingToken = true;
+			formErrors.apiKey = undefined;
+			const result = await adapter.verifyToken({ apiKey });
+			tokenVerification = result;
+
+			if (!result.valid) {
+				formErrors.apiKey = result.error || 'Token verification failed';
+			}
+		} catch (error) {
+			console.error('Error verifying token:', error);
+			formErrors.apiKey = error instanceof Error ? error.message : 'Failed to verify token';
+			tokenVerification = { valid: false, error: 'Verification failed' };
+		} finally {
+			verifyingToken = false;
+		}
+	}
+
 	function getModalTitle() {
 		if (mode === 'create') return 'Create New User';
 		return `Edit ${getUserDisplayName(user ?? null)}`;
@@ -320,32 +348,58 @@
 						<label for="api-key" class="text-default-700 block text-sm font-medium">
 							Mako API Key
 						</label>
-						{#if adapter?.generateApiKey}
-							<button
-								type="button"
-								onclick={handleRegenerateApiKey}
-								disabled={regeneratingApiKey ||
-									!formData.permissions ||
-									formData.permissions.length === 0}
-								class="disabled:text-default-400 inline-flex items-center gap-1 text-sm text-blue-600 transition-colors hover:text-blue-700 hover:underline disabled:cursor-not-allowed"
-								aria-label="Regenerate API key"
-							>
-								<svg
-									class="h-4 w-4 {regeneratingApiKey ? 'animate-spin' : ''}"
-									fill="none"
-									stroke="currentColor"
-									viewBox="0 0 24 24"
+						<div class="flex items-center gap-3">
+							{#if adapter?.verifyToken && apiKey}
+								<button
+									type="button"
+									onclick={handleVerifyToken}
+									disabled={verifyingToken}
+									class="disabled:text-default-400 inline-flex items-center gap-1 text-sm text-green-600 transition-colors hover:text-green-700 hover:underline disabled:cursor-not-allowed"
+									aria-label="Verify token"
 								>
-									<path
-										stroke-linecap="round"
-										stroke-linejoin="round"
-										stroke-width="2"
-										d="M4 4v5h.582m15.356 2A8.001 8.001 0 004.582 9m0 0H9m11 11v-5h-.581m0 0a8.003 8.003 0 01-15.357-2m15.357 2H15"
-									></path>
-								</svg>
-								Regenerate
-							</button>
-						{/if}
+									<svg
+										class="h-4 w-4 {verifyingToken ? 'animate-spin' : ''}"
+										fill="none"
+										stroke="currentColor"
+										viewBox="0 0 24 24"
+									>
+										<path
+											stroke-linecap="round"
+											stroke-linejoin="round"
+											stroke-width="2"
+											d="M9 12l2 2 4-4m6 2a9 9 0 11-18 0 9 9 0 0118 0z"
+										></path>
+									</svg>
+									Verify
+								</button>
+							{/if}
+							{#if adapter?.generateApiKey}
+								<button
+									type="button"
+									onclick={handleRegenerateApiKey}
+									disabled={regeneratingApiKey ||
+										!formData.permissions ||
+										formData.permissions.length === 0}
+									class="disabled:text-default-400 inline-flex items-center gap-1 text-sm text-blue-600 transition-colors hover:text-blue-700 hover:underline disabled:cursor-not-allowed"
+									aria-label="Regenerate API key"
+								>
+									<svg
+										class="h-4 w-4 {regeneratingApiKey ? 'animate-spin' : ''}"
+										fill="none"
+										stroke="currentColor"
+										viewBox="0 0 24 24"
+									>
+										<path
+											stroke-linecap="round"
+											stroke-linejoin="round"
+											stroke-width="2"
+											d="M4 4v5h.582m15.356 2A8.001 8.001 0 004.582 9m0 0H9m11 11v-5h-.581m0 0a8.003 8.003 0 01-15.357-2m15.357 2H15"
+										></path>
+									</svg>
+									Regenerate
+								</button>
+							{/if}
+						</div>
 					</div>
 					<div class="relative flex-1">
 						<input
@@ -391,6 +445,38 @@
 					</div>
 					{#if formErrors.apiKey}
 						<p class="text-danger-500 mt-1 text-xs">{formErrors.apiKey}</p>
+					{:else if tokenVerification}
+						{#if tokenVerification.valid}
+							<div class="bg-success-50 border-success-200 mt-2 rounded-lg border p-3">
+								<div class="flex items-start gap-2">
+									<svg class="text-success-600 mt-0.5 h-4 w-4 shrink-0" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+										<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 12l2 2 4-4m6 2a9 9 0 11-18 0 9 9 0 0118 0z"></path>
+									</svg>
+									<div class="min-w-0 flex-1">
+										<p class="text-success-800 text-xs font-medium">Token verified successfully</p>
+										{#if tokenVerification.scopes && tokenVerification.scopes.length > 0}
+											<p class="text-success-700 mt-1 text-xs">
+												Scopes: {tokenVerification.scopes.join(', ')}
+											</p>
+										{/if}
+									</div>
+								</div>
+							</div>
+						{:else}
+							<div class="bg-danger-50 border-danger-200 mt-2 rounded-lg border p-3">
+								<div class="flex items-start gap-2">
+									<svg class="text-danger-600 mt-0.5 h-4 w-4 shrink-0" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+										<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M10 14l2-2m0 0l2-2m-2 2l-2-2m2 2l2 2m7-2a9 9 0 11-18 0 9 9 0 0118 0z"></path>
+									</svg>
+									<div class="min-w-0 flex-1">
+										<p class="text-danger-800 text-xs font-medium">Token verification failed</p>
+										{#if tokenVerification.error}
+											<p class="text-danger-700 mt-1 text-xs">{tokenVerification.error}</p>
+										{/if}
+									</div>
+								</div>
+							</div>
+						{/if}
 					{:else}
 						<p class="text-default-500 mt-1 text-xs">
 							API keys are system-managed and cannot be manually edited

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@makolabs/ripple",
-	"version": "1.6.4",
+	"version": "1.6.6",
 	"description": "Simple Svelte 5 powered component library ✨",
 	"license": "SEE LICENSE IN LICENSE",
 	"repository": {