@nacre.work/api 0.0.0

package/dist/service-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-keys.d.ts","sourceRoot":"","sources":["../src/service-keys.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAA;AAE9B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AAE5C;;;;;;;;;;;;;;;GAeG;AAEH,8EAA8E;AAC9E,eAAO,MAAM,UAAU,cAAc,CAAA;AAErC;;;;;;;;GAQG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE5C;AAED,wBAAgB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE1C;AAED,oEAAoE;AACpE,wBAAgB,WAAW,IAAI,MAAM,CAEpC;AAED,eAAO,MAAM,mBAAmB,GAAI,OAAO,MAAM,KAAG,OAAuC,CAAA;AAE3F,MAAM,WAAW,kBAAkB;IACjC,8EAA8E;IAC9E,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAAA;CACvD;AAED;;;;;;GAMG;AACH,qBAAa,mBAAoB,YAAW,kBAAkB;IAE1D,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBADL,IAAI,EAAE,IAAI,EACV,IAAI,CAAC,EAAE,MAAM,YAAA;IAG1B,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;CAiD7D;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAClC;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,cAAc,EAAE,CAAC,CAAA;IAC3D,6DAA6D;IAC7D,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,cAAc,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC1F,gFAAgF;IAChF,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACxD;AAED,qBAAa,uBAAwB,YAAW,eAAe;IAE3D,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBADL,IAAI,EAAE,IAAI,EACV,IAAI,CAAC,EAAE,MAAM,YAAA;IAGhC,OAAO,KAAK,KAAK,GAEhB;IAEK,IAAI,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,cAAc,EAAE,CAAC;IAkC3D,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,cAAc,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAgC1F,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAoB9D"}

package/dist/service-keys.js

@@ -0,0 +1,158 @@
+import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
+import { withOrg } from '@nacre.work/core';
+/**
+ * Service account keys.
+ *
+ * The one credential in the system meant to outlive a session. `init` issues a
+ * token that expires in an hour, which is right for getting through the
+ * quickstart and useless for an agent that runs for a week — until this
+ * existed, `NACRE_SERVICE_KEY` had nothing to put in it.
+ *
+ * The shape is not invented here: migration 0001 gave `service_accounts` a
+ * `key_hash`, a `key_prefix`, and a `revoked_at`, which is an opaque key stored
+ * hashed and looked up by a non-secret prefix. This implements that.
+ *
+ * A key is shown once, at creation, and never again. Storing anything
+ * reversible would make a database backup a set of live credentials, and the
+ * whole point of `key_hash` is that a stolen dump is not one.
+ */
+/** Identifies the credential type on sight, in a log or a pasted variable. */
+export const KEY_PREFIX = 'nacre_sk_';
+/**
+ * The lookup prefix: the marker plus the first 8 characters of the secret.
+ *
+ * Long enough that the indexed lookup returns one row in practice, short enough
+ * that it is not a meaningful head start — 8 base64url characters is 48 bits,
+ * against a 256-bit secret. It is stored in clear and shown in listings on
+ * purpose: an operator revoking a key needs to tell two apart, and the whole
+ * key is gone.
+ */
+export function prefixOf(key) {
+    return key.slice(0, KEY_PREFIX.length + 8);
+}
+export function hashOf(key) {
+    return createHash('sha256').update(key, 'utf8').digest('hex');
+}
+/** 32 bytes from the CSPRNG. Not a UUID — those are not secrets. */
+export function generateKey() {
+    return `${KEY_PREFIX}${randomBytes(32).toString('base64url')}`;
+}
+export const looksLikeServiceKey = (value) => value.startsWith(KEY_PREFIX);
+/**
+ * Resolve a key against the database.
+ *
+ * Undefined for unknown, revoked, malformed and wrong alike — the caller turns
+ * all of them into the same 401 a bad JWT gets, so which one it was cannot be
+ * read off the response.
+ */
+export class PostgresServiceKeys {
+    pool;
+    role;
+    constructor(pool, role) {
+        this.pool = pool;
+        this.role = role;
+    }
+    async resolve(key) {
+        if (!looksLikeServiceKey(key))
+            return undefined;
+        const client = await this.pool.connect();
+        try {
+            // Across organizations: the key is what says which one, so there is no
+            // org to scope to yet. This is why the lookup runs here rather than
+            // inside withOrg, and why every column it reads is on service_accounts
+            // rather than joined from tenant data.
+            const { rows } = await client.query(`SELECT id, org_id, key_hash FROM service_accounts
+          WHERE key_prefix = $1 AND revoked_at IS NULL`, [prefixOf(key)]);
+            const expected = Buffer.from(hashOf(key), 'utf8');
+            for (const row of rows) {
+                const stored = Buffer.from(row.key_hash, 'utf8');
+                // Constant-time, and length-checked first because timingSafeEqual
+                // throws on a mismatch rather than returning false.
+                if (stored.length !== expected.length)
+                    continue;
+                if (!timingSafeEqual(stored, expected))
+                    continue;
+                // Best-effort. A failure to record when a key was last used must not
+                // fail the request it authenticated — the column is for an operator
+                // pruning dead keys, not for the decision.
+                void client
+                    .query('UPDATE service_accounts SET last_used_at = now() WHERE id = $1', [row.id])
+                    .catch(() => undefined);
+                // 'member', always. A service account holds nothing by virtue of being
+                // one; every permission it has comes from a grant, which is what
+                // docs/mcp.md means by "permissions are exactly the service account's".
+                return {
+                    orgId: row.org_id,
+                    principal: { type: 'service_account', id: row.id },
+                    role: 'member',
+                };
+            }
+            return undefined;
+        }
+        finally {
+            client.release();
+        }
+    }
+}
+export class PostgresServiceAccounts {
+    pool;
+    role;
+    constructor(pool, role) {
+        this.pool = pool;
+        this.role = role;
+    }
+    get scope() {
+        return this.role === undefined ? {} : { role: this.role };
+    }
+    async list(auth) {
+        return withOrg(this.pool, auth.orgId, async (client) => {
+            const { rows } = await client.query(`SELECT id, name, key_prefix, created_at, last_used_at, revoked_at
+             FROM service_accounts WHERE org_id = $1 ORDER BY created_at`, [auth.orgId]);
+            // Revoked ones are listed rather than hidden: "this key was revoked on
+            // Tuesday" is the answer to the question an operator is actually
+            // asking, and a key that vanishes looks like one that never existed.
+            return rows.map((r) => ({
+                id: r.id,
+                name: r.name,
+                keyPrefix: r.key_prefix,
+                createdAt: r.created_at.toISOString(),
+                lastUsedAt: r.last_used_at?.toISOString() ?? null,
+                revokedAt: r.revoked_at?.toISOString() ?? null,
+            }));
+        }, this.scope);
+    }
+    async create(auth, name) {
+        const key = generateKey();
+        return withOrg(this.pool, auth.orgId, async (client) => {
+            const { rows } = await client.query(`INSERT INTO service_accounts (org_id, name, key_hash, key_prefix)
+           VALUES ($1,$2,$3,$4) RETURNING id, created_at`, [auth.orgId, name, hashOf(key), prefixOf(key)]);
+            const row = rows[0];
+            if (row === undefined)
+                throw new Error('the service account insert returned no row');
+            return {
+                key,
+                account: {
+                    id: row.id,
+                    name,
+                    keyPrefix: prefixOf(key),
+                    createdAt: row.created_at.toISOString(),
+                    lastUsedAt: null,
+                    revokedAt: null,
+                },
+            };
+        }, this.scope);
+    }
+    async revoke(auth, id) {
+        if (!/^[0-9a-f-]{36}$/i.test(id))
+            return false;
+        return withOrg(this.pool, auth.orgId, async (client) => {
+            // Revoked, never deleted. The audit log refers to this id, and a row
+            // that disappears turns every past event into an unresolvable
+            // reference — which is the one thing an access log must not do.
+            const { rowCount } = await client.query(`UPDATE service_accounts SET revoked_at = now()
+            WHERE org_id = $1 AND id = $2 AND revoked_at IS NULL`, [auth.orgId, id]);
+            return (rowCount ?? 0) > 0;
+        }, this.scope);
+    }
+}
+//# sourceMappingURL=service-keys.js.map

package/dist/service-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-keys.js","sourceRoot":"","sources":["../src/service-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAEtE,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAK1C;;;;;;;;;;;;;;;GAeG;AAEH,8EAA8E;AAC9E,MAAM,CAAC,MAAM,UAAU,GAAG,WAAW,CAAA;AAErC;;;;;;;;GAQG;AACH,MAAM,UAAU,QAAQ,CAAC,GAAW;IAClC,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;AAC5C,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,GAAW;IAChC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC/D,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,WAAW;IACzB,OAAO,GAAG,UAAU,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAA;AAChE,CAAC;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,KAAa,EAAW,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;AAO3F;;;;;;GAMG;AACH,MAAM,OAAO,mBAAmB;IAEX;IACA;IAFnB,YACmB,IAAU,EACV,IAAa;QADb,SAAI,GAAJ,IAAI,CAAM;QACV,SAAI,GAAJ,IAAI,CAAS;IAC7B,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,GAAW;QACvB,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC;YAAE,OAAO,SAAS,CAAA;QAE/C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAA;QACxC,IAAI,CAAC;YACH,uEAAuE;YACvE,oEAAoE;YACpE,uEAAuE;YACvE,uCAAuC;YACvC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CAKjC;uDAC+C,EAC/C,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAChB,CAAA;YAED,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAA;YACjD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;gBAChD,kEAAkE;gBAClE,oDAAoD;gBACpD,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;oBAAE,SAAQ;gBAC/C,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC;oBAAE,SAAQ;gBAEhD,qEAAqE;gBACrE,oEAAoE;gBACpE,2CAA2C;gBAC3C,KAAK,MAAM;qBACR,KAAK,CAAC,gEAAgE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;qBACjF,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;gBAEzB,uEAAuE;gBACvE,iEAAiE;gBACjE,wEAAwE;gBACxE,OAAO;oBACL,KAAK,EAAE,GAAG,CAAC,MAAM;oBACjB,SAAS,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE;oBAClD,IAAI,EAAE,QAAQ;iBACf,CAAA;YACH,CAAC;YAED,OAAO,SAAS,CAAA;QAClB,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,OAAO,EAAE,CAAA;QAClB,CAAC;IACH,CAAC;CACF;AAmBD,MAAM,OAAO,uBAAuB;IAEf;IACA;IAFnB,YACmB,IAAU,EACV,IAAa;QADb,SAAI,GAAJ,IAAI,CAAM;QACV,SAAI,GAAJ,IAAI,CAAS;IAC7B,CAAC;IAEJ,IAAY,KAAK;QACf,OAAO,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAA;IAC3D,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAiB;QAC1B,OAAO,OAAO,CACZ,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,KAAK,EACV,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CAQjC;yEAC+D,EAC/D,CAAC,IAAI,CAAC,KAAK,CAAC,CACb,CAAA;YAED,uEAAuE;YACvE,iEAAiE;YACjE,qEAAqE;YACrE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACtB,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,SAAS,EAAE,CAAC,CAAC,UAAU;gBACvB,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE;gBACrC,UAAU,EAAE,CAAC,CAAC,YAAY,EAAE,WAAW,EAAE,IAAI,IAAI;gBACjD,SAAS,EAAE,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,IAAI,IAAI;aAC/C,CAAC,CAAC,CAAA;QACL,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAiB,EAAE,IAAY;QAC1C,MAAM,GAAG,GAAG,WAAW,EAAE,CAAA;QAEzB,OAAO,OAAO,CACZ,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,KAAK,EACV,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC;yDAC+C,EAC/C,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAC/C,CAAA;YAED,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;YACnB,IAAI,GAAG,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;YAEpF,OAAO;gBACL,GAAG;gBACH,OAAO,EAAE;oBACP,EAAE,EAAE,GAAG,CAAC,EAAE;oBACV,IAAI;oBACJ,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC;oBACxB,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE;oBACvC,UAAU,EAAE,IAAI;oBAChB,SAAS,EAAE,IAAI;iBAChB;aACF,CAAA;QACH,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAiB,EAAE,EAAU;QACxC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,OAAO,KAAK,CAAA;QAE9C,OAAO,OAAO,CACZ,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,KAAK,EACV,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,qEAAqE;YACrE,8DAA8D;YAC9D,gEAAgE;YAChE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACrC;iEACuD,EACvD,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CACjB,CAAA;YACD,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAA;QAC5B,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;IACH,CAAC;CACF"}

package/package.json

@@ -0,0 +1,40 @@
+{
+  "name": "@nacre.work/api",
+  "version": "0.0.0",
+  "description": "REST API and authorization service",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/nacre-work/nacre.git",
+    "directory": "packages/api"
+  },
+  "homepage": "https://nacre.work",
+  "license": "Apache-2.0",
+  "type": "module",
+  "scripts": {
+    "build": "tsc -b",
+    "dev": "tsx watch src/index.ts"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "dependencies": {
+    "@nacre.work/core": "workspace:*",
+    "jose": "^6.2.7",
+    "pg": "^8.22.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.20.1",
+    "@types/pg": "^8.20.3"
+  }
+}