@mostajs/auth 2.3.2 → 2.3.3

package/dist/lib/check-request.d.ts

@@ -24,6 +24,16 @@ export interface CheckRequestParams {
     }>;
     /** Allow request through without apikey (legacy / public-mode). */
     openMode?: boolean;
+    /**
+     * When no apikey is provided, fall back to a labeled apikey stored in
+     * the api_keys table (typically `public-default`). The fallback's
+     * permissions still apply — so a public-default key with read-only
+     * scope keeps writes blocked even when no key is sent.
+     *
+     * Use case : MCP endpoint that wants to preserve compat with existing
+     * mcp.so / Claude Desktop users who haven't published the apikey yet.
+     */
+    fallbackPublicLabel?: string;
 }
 export interface CheckRequestResult {
     ok: boolean;

package/dist/lib/check-request.js

@@ -36,7 +36,7 @@ function pickQuery(q, name) {
  * (e.g. `if (!result.ok) reply.code(result.status).send(result.body)`).
  */
 export async function checkRequest(params) {
-    const { dialect, headers, query, ip, transport, checks = [], openMode = false } = params;
+    const { dialect, headers, query, ip, transport, checks = [], openMode = false, fallbackPublicLabel } = params;
     // Extract auth identifiers from the request
     const apiKey = pickHeader(headers, 'x-api-key') ??
         (pickHeader(headers, 'authorization')?.replace(/^Bearer\s+/i, '').trim() || undefined) ??
@@ -53,8 +53,53 @@ export async function checkRequest(params) {
         projectName,
         meta: { ip: resolvedIp },
     };
-    // No apikey → either openMode passes through, or 401
+    // No apikey → either fallback to a public labeled key, or openMode pass-through, or 401
     if (!apiKey) {
+        // Fallback to a labeled public apikey (e.g. 'public-default') if configured.
+        // Looks up the row by label, applies its scope checks. Useful for MCP /
+        // demo endpoints that want to preserve compat with users who haven't yet
+        // published the public apikey in their config.
+        if (fallbackPublicLabel && dialect) {
+            try {
+                const { getApiKeyRepo, isScopeAuthorized } = await import('@mostajs/api-keys/server');
+                const repo = getApiKeyRepo(dialect);
+                const fallbackKey = await repo.findOne({ label: fallbackPublicLabel, enabled: true });
+                if (fallbackKey) {
+                    // Normalize legacy permission shape (move projects/operations/transports into scopes)
+                    const perms = fallbackKey.permissions || {};
+                    const scopes = { ...(perms.scopes ?? {}) };
+                    for (const k of ['projects', 'operations', 'transports']) {
+                        if (perms[k] !== undefined && scopes[k] === undefined)
+                            scopes[k] = perms[k];
+                    }
+                    const normPerms = { ...perms, scopes };
+                    // Run the same scope checks against the public key's perms
+                    for (const c of checks) {
+                        if (!isScopeAuthorized(normPerms, c.scope, c.value)) {
+                            return {
+                                ok: false, status: 403,
+                                body: { status: 'error', error: { code: 'FORBIDDEN',
+                                        message: `Public access not authorized for ${c.scope}="${c.value}"`, } },
+                            };
+                        }
+                    }
+                    return {
+                        ok: true, status: 200,
+                        apikey: fallbackKey,
+                        ctx: {
+                            ...baseCtx,
+                            subscription: fallbackKey.label || fallbackKey.id,
+                            permissions: normPerms.scopes ?? {},
+                            accountId: fallbackKey.account || fallbackKey.accountId,
+                            apikeyId: fallbackKey.id,
+                        },
+                    };
+                }
+            }
+            catch {
+                // Fallback failed — fall through to standard 401 / openMode
+            }
+        }
         if (openMode)
             return { ok: true, status: 200, ctx: baseCtx };
         return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mostajs/auth",
-  "version": "2.3.2",
+  "version": "2.3.3",
   "description": "Authentication — NextAuth, password hashing, session management",
   "author": "Dr Hamid MADANI <drmdh@msn.com>",
   "license": "AGPL-3.0-or-later",