@nextsparkjs/core 0.1.0-beta.193 → 0.1.0-beta.195

package/dist/lib/api/cors-response.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Core's CORS answer for /api responses, in one place: addCorsHeaders and wrapAuthHandlerWithCors (helpers.ts)
+ * and the common route wrapper (withRateLimitTier) all use it, so every response and preflight a route gives
+ * names the same origin, with or without credentials, for the same request.
+ */
+import { NextResponse } from 'next/server';
+import type { ApplicationConfig } from '../config/config-types';
+type CorsConfig = Pick<ApplicationConfig, 'api'>;
+export declare const CORS_ALLOW_METHODS = "GET, POST, PUT, PATCH, DELETE, OPTIONS";
+export declare const CORS_ALLOW_HEADERS: string;
+/**
+ * True for a path under the admin or developer areas, which answer CORS only to the app's own origin and accept
+ * cookie-authenticated writes only from it (checkRequestOrigin).
+ */
+export declare function isAppOnlyCorsPath(pathname: string): boolean;
+/** A request's path, for corsGrant (undefined when its URL does not parse). */
+export declare function requestPathname(request: Request): string | undefined;
+/** The app's own origins: NEXT_PUBLIC_APP_URL and BETTER_AUTH_URL. */
+export declare function appOrigins(): string[];
+/**
+ * Which origin a CORS response may name, and whether credentials go with it.
+ * A listed origin (getCorsOrigins, wildcard entries allowed) is echoed with
+ * credentials. In development with allowAllOrigins.development, any other
+ * origin is echoed too, but with credentials only when the cookie-write origin
+ * check trusts it (getTrustedOrigins). Any other origin gets no grant: the
+ * response names no origin and sends no credentials header.
+ * Under the admin and developer areas (isAppOnlyCorsPath, given the request's
+ * `pathname`), only the app's own origin is granted, with credentials; no
+ * other origin, listed or not.
+ */
+export declare function corsGrant(origin: string, config: CorsConfig, env: string, pathname?: string): {
+    origin: string;
+    credentials: boolean;
+} | null;
+/** `Vary: Origin` once, however many times CORS is applied to the same response. */
+export declare function varyOnOrigin(headers: Headers): void;
+/** Core's CORS headers for a request's grant (corsGrant; null for none), written onto `headers`. */
+export declare function setCorsHeaders(headers: Headers, grant: {
+    origin: string;
+    credentials: boolean;
+} | null): void;
+/**
+ * `response` with core's CORS for `request`. A response that already names an origin was answered by its
+ * route (addCorsHeaders, or a CORS policy of its own) and is returned as it is. A response with read-only
+ * headers is copied first.
+ */
+export declare function withCors<R extends Response>(response: R, request: Request): R;
+/**
+ * A CORS preflight answered with the same grant the route's responses get. Routes export it as their
+ * `OPTIONS`: without one, Next.js answers OPTIONS itself, with no CORS headers.
+ */
+export declare function corsPreflight(request: Request): NextResponse;
+export {};
+//# sourceMappingURL=cors-response.d.ts.map

package/dist/lib/api/cors-response.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors-response.d.ts","sourceRoot":"","sources":["../../../src/lib/api/cors-response.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAG1C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAG/D,KAAK,UAAU,GAAG,IAAI,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAA;AAEhD,eAAO,MAAM,kBAAkB,2CAA2C,CAAA;AAC1E,eAAO,MAAM,kBAAkB,QAAuF,CAAA;AAKtH;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAI3D;AAED,+EAA+E;AAC/E,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAEpE;AAED,sEAAsE;AACtE,wBAAgB,UAAU,IAAI,MAAM,EAAE,CAKrC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,SAAS,CACvB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,UAAU,EAClB,GAAG,EAAE,MAAM,EACX,QAAQ,CAAC,EAAE,MAAM,GAChB;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CAYjD;AAED,oFAAoF;AACpF,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAGnD;AAED,oGAAoG;AACpG,wBAAgB,cAAc,CAC5B,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,GACrD,IAAI,CAWN;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,CAAC,SAAS,QAAQ,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,GAAG,CAAC,CAa7E;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,YAAY,CAE5D"}

package/dist/lib/api/cors-response.js

@@ -0,0 +1,88 @@
+import { NextResponse } from "next/server";
+import { APP_CONFIG_MERGED } from "../config/index.js";
+import { getCorsOrigins, getTrustedOrigins, isOriginAllowed, normalizeOrigin } from "../utils/cors.js";
+import { CLIENT_REQUEST_HEADERS } from "./client-headers.js";
+const CORS_ALLOW_METHODS = "GET, POST, PUT, PATCH, DELETE, OPTIONS";
+const CORS_ALLOW_HEADERS = ["Content-Type", "Authorization", "X-API-Key", ...CLIENT_REQUEST_HEADERS].join(", ");
+const APP_ONLY_PATH = /(^|\/)api\/(v1\/)?(superadmin|devtools)(\/|$)/;
+function isAppOnlyCorsPath(pathname) {
+  let path = pathname;
+  try {
+    path = decodeURIComponent(pathname);
+  } catch {
+  }
+  return APP_ONLY_PATH.test(path.toLowerCase().replace(/\/{2,}/g, "/"));
+}
+function requestPathname(request) {
+  try {
+    return new URL(request.url).pathname;
+  } catch {
+    return void 0;
+  }
+}
+function appOrigins() {
+  return [process.env.NEXT_PUBLIC_APP_URL, process.env.BETTER_AUTH_URL].flatMap((url) => {
+    if (!url) return [];
+    try {
+      return [new URL(url).origin];
+    } catch {
+      return [];
+    }
+  });
+}
+function corsGrant(origin, config, env, pathname) {
+  const normalizedOrigin = normalizeOrigin(origin);
+  if (pathname !== void 0 && isAppOnlyCorsPath(pathname)) {
+    return appOrigins().includes(normalizedOrigin) ? { origin: normalizedOrigin, credentials: true } : null;
+  }
+  const listed = isOriginAllowed(normalizedOrigin, getCorsOrigins(config, env));
+  if (listed) return { origin: listed, credentials: true };
+  if (env === "development" && config.api.cors.allowAllOrigins.development) {
+    const trusted = isOriginAllowed(normalizedOrigin, getTrustedOrigins(config, normalizedOrigin, env));
+    return { origin: normalizedOrigin, credentials: trusted !== null };
+  }
+  return null;
+}
+function varyOnOrigin(headers) {
+  const vary = headers.get("vary") ?? "";
+  if (!vary.split(",").some((value) => value.trim().toLowerCase() === "origin")) headers.set("Vary", vary ? `${vary}, Origin` : "Origin");
+}
+function setCorsHeaders(headers, grant) {
+  if (grant) {
+    headers.set("Access-Control-Allow-Origin", grant.origin);
+    if (grant.credentials) headers.set("Access-Control-Allow-Credentials", "true");
+  }
+  varyOnOrigin(headers);
+  headers.set("Access-Control-Allow-Methods", CORS_ALLOW_METHODS);
+  headers.set("Access-Control-Allow-Headers", CORS_ALLOW_HEADERS);
+  headers.set("Access-Control-Max-Age", "86400");
+}
+function withCors(response, request) {
+  if (response.headers.has("access-control-allow-origin")) return response;
+  const origin = request.headers.get("origin");
+  const env = process.env.NODE_ENV || "development";
+  const grant = origin ? corsGrant(origin, APP_CONFIG_MERGED, env, requestPathname(request)) : null;
+  try {
+    setCorsHeaders(response.headers, grant);
+    return response;
+  } catch {
+    const copy = new Response(response.body, { status: response.status, statusText: response.statusText, headers: new Headers(response.headers) });
+    setCorsHeaders(copy.headers, grant);
+    return copy;
+  }
+}
+function corsPreflight(request) {
+  return withCors(new NextResponse(null, { status: 204 }), request);
+}
+export {
+  CORS_ALLOW_HEADERS,
+  CORS_ALLOW_METHODS,
+  appOrigins,
+  corsGrant,
+  corsPreflight,
+  isAppOnlyCorsPath,
+  requestPathname,
+  setCorsHeaders,
+  varyOnOrigin,
+  withCors
+};

package/dist/lib/api/entities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"entities.d.ts","sourceRoot":"","sources":["../../../src/lib/api/entities.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,MAAM,WAAW,UAAU;IACzB,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC,WAAW,CAAC,EAAE,OAAO,CAAA;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,IAAI,CAAA;IACb,IAAI,EAAE,UAAU,EAAE,CAAA;IAClB,IAAI,EAAE;QACJ,SAAS,EAAE,MAAM,CAAA;QACjB,IAAI,EAAE,MAAM,CAAA;QACZ,KAAK,EAAE,MAAM,CAAA;QACb,KAAK,EAAE,MAAM,CAAA;QACb,UAAU,EAAE,MAAM,CAAA;QAClB,WAAW,EAAE,OAAO,CAAA;QACpB,WAAW,EAAE,OAAO,CAAA;KACrB,CAAA;CACF;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE;QACP,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;KACtB,CAAA;CACF;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAC/B;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,IAAI,CAAA;IACb,IAAI,EAAE,UAAU,EAAE,CAAA;IAClB,KAAK,EAAE,WAAW,CAAA;IAClB,mBAAmB,EAAE,aAAa,EAAE,CAAA;IACpC,IAAI,EAAE;QACJ,SAAS,EAAE,MAAM,CAAA;QACjB,UAAU,EAAE,MAAM,CAAA;QAClB,WAAW,EAAE,OAAO,CAAA;KACrB,CAAA;CACF;AA2CD;;GAEG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,OAAO,CAAQ;gBAEX,OAAO,SAAY;IAI/B;;;OAGG;YACW,eAAe;IAoC7B;;OAEG;IACG,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,GAAE,gBAAqB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IA+D1F;;OAEG;IACG,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,UAAQ,GAAG,OAAO,CAAC,UAAU,CAAC;IAuCnF;;OAEG;IACG,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAkClH;;OAEG;IACG,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC;IAoC5F;;OAEG;IACG,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IAqCvF;;;OAGG;IACG,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,GAAE,gBAAqB,GAAG,OAAO,CAAC,uBAAuB,CAAC;IA+B3G;;OAEG;IACG,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAuB9D;;OAEG;YACW,mBAAmB;IA6BjC;;OAEG;IACG,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IA+CrE;;OAEG;IACG,oBAAoB,CACxB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EAAE,EACnB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAsBrE;;OAEG;IACG,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,SAAK,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IAsB3F;;OAEG;IACG,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAiBpE;;OAEG;IACH,OAAO,CAAC,oBAAoB;CAK7B;AAGD,eAAO,MAAM,SAAS,iBAAwB,CAAA;AAG9C,eAAO,MAAM,gBAAgB,GAAU,YAAY,MAAM,EAAE,MAAM,UAAU,wBAE1E,CAAA;AAED,eAAO,MAAM,gBAAgB,GAAU,YAAY,MAAM,EAAE,IAAI,MAAM,EAAE,MAAM,OAAO,CAAC,UAAU,CAAC,wBAE/F,CAAA;AAED,eAAO,MAAM,gBAAgB,GAAU,YAAY,MAAM,EAAE,IAAI,MAAM;aArRF,OAAO;QAAM,MAAM;EAuRrF,CAAA;AAED,eAAO,MAAM,aAAa,GAAU,YAAY,MAAM,EAAE,IAAI,MAAM,EAAE,qBAAmB,wBAEtF,CAAA;AAED,eAAO,MAAM,cAAc,GAAU,YAAY,MAAM,EAAE,SAAQ,gBAAqB,gCAErF,CAAA;AAED,eAAO,MAAM,mBAAmB,GAAU,YAAY,MAAM,EAAE,IAAI,MAAM,wBAEvE,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,iBAAiB,GAC5B,kBAAkB,MAAM,EACxB,UAAU,MAAM,EAChB,iBAAiB,MAAM,EACvB,SAAQ,gBAAqB,KAC5B,OAAO,CAAC,UAAU,EAAE,CA2BtB,CAAA;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,WAAgB,GACxB,OAAO,CAAC,QAAQ,CAAC,CAsBnB"}
+{"version":3,"file":"entities.d.ts","sourceRoot":"","sources":["../../../src/lib/api/entities.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,MAAM,WAAW,UAAU;IACzB,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC,WAAW,CAAC,EAAE,OAAO,CAAA;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,IAAI,CAAA;IACb,IAAI,EAAE,UAAU,EAAE,CAAA;IAClB,IAAI,EAAE;QACJ,SAAS,EAAE,MAAM,CAAA;QACjB,IAAI,EAAE,MAAM,CAAA;QACZ,KAAK,EAAE,MAAM,CAAA;QACb,KAAK,EAAE,MAAM,CAAA;QACb,UAAU,EAAE,MAAM,CAAA;QAClB,WAAW,EAAE,OAAO,CAAA;QACpB,WAAW,EAAE,OAAO,CAAA;KACrB,CAAA;CACF;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE;QACP,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;KACtB,CAAA;CACF;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAC/B;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,IAAI,CAAA;IACb,IAAI,EAAE,UAAU,EAAE,CAAA;IAClB,KAAK,EAAE,WAAW,CAAA;IAClB,mBAAmB,EAAE,aAAa,EAAE,CAAA;IACpC,IAAI,EAAE;QACJ,SAAS,EAAE,MAAM,CAAA;QACjB,UAAU,EAAE,MAAM,CAAA;QAClB,WAAW,EAAE,OAAO,CAAA;KACrB,CAAA;CACF;AA2CD;;GAEG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,OAAO,CAAQ;gBAEX,OAAO,SAAY;IAI/B;;;OAGG;YACW,eAAe;IAoC7B;;OAEG;IACG,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,GAAE,gBAAqB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IA+D1F;;OAEG;IACG,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,UAAQ,GAAG,OAAO,CAAC,UAAU,CAAC;IAuCnF;;OAEG;IACG,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAkClH;;OAEG;IACG,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC;IAoC5F;;OAEG;IACG,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IAqCvF;;;OAGG;IACG,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,GAAE,gBAAqB,GAAG,OAAO,CAAC,uBAAuB,CAAC;IA+B3G;;OAEG;IACG,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAuB9D;;OAEG;YACW,mBAAmB;IA6BjC;;OAEG;IACG,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IA+CrE;;OAEG;IACG,oBAAoB,CACxB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EAAE,EACnB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAsBrE;;OAEG;IACG,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,SAAK,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IAsB3F;;OAEG;IACG,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAiBpE;;OAEG;IACH,OAAO,CAAC,oBAAoB;CAK7B;AAGD,eAAO,MAAM,SAAS,iBAAwB,CAAA;AAG9C,eAAO,MAAM,gBAAgB,GAAU,YAAY,MAAM,EAAE,MAAM,UAAU,wBAE1E,CAAA;AAED,eAAO,MAAM,gBAAgB,GAAU,YAAY,MAAM,EAAE,IAAI,MAAM,EAAE,MAAM,OAAO,CAAC,UAAU,CAAC,wBAE/F,CAAA;AAED,eAAO,MAAM,gBAAgB,GAAU,YAAY,MAAM,EAAE,IAAI,MAAM;aArRF,OAAO;QAAM,MAAM;EAuRrF,CAAA;AAED,eAAO,MAAM,aAAa,GAAU,YAAY,MAAM,EAAE,IAAI,MAAM,EAAE,qBAAmB,wBAEtF,CAAA;AAED,eAAO,MAAM,cAAc,GAAU,YAAY,MAAM,EAAE,SAAQ,gBAAqB,gCAErF,CAAA;AAED,eAAO,MAAM,mBAAmB,GAAU,YAAY,MAAM,EAAE,IAAI,MAAM,wBAEvE,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,iBAAiB,GAC5B,kBAAkB,MAAM,EACxB,UAAU,MAAM,EAChB,iBAAiB,MAAM,EACvB,SAAQ,gBAAqB,KAC5B,OAAO,CAAC,UAAU,EAAE,CA2BtB,CAAA;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,WAAgB,GACxB,OAAO,CAAC,QAAQ,CAAC,CAsBnB"}

package/dist/lib/api/entities.js

@@ -1,5 +1,6 @@
 import { getClientEntityApiPath, getClientEntityConfigs } from "../entities/client-entity-meta.js";
 import { withBasePath, withBasePathIfInApp } from "../base-path.js";
+import { BUILDER_SOURCE_HEADER, TEAM_ID_HEADER } from "./client-headers.js";
 function getApiBaseUrl() {
   if (typeof window !== "undefined") {
     return window.location.origin;
@@ -20,7 +21,7 @@ function buildHeaders(additionalHeaders = {}) {
   };
   const teamId = getCurrentTeamId();
   if (teamId) {
-    headers["x-team-id"] = teamId;
+    headers[TEAM_ID_HEADER] = teamId;
   }
   return headers;
 }
@@ -418,7 +419,7 @@ class EntityApiClient {
     delete copyData.createdAt;
     delete copyData.updatedAt;
     const hasBlocks = "blocks" in copyData && Array.isArray(copyData.blocks);
-    return this.create(entityType, copyData, hasBlocks ? { "x-builder-source": "true" } : {});
+    return this.create(entityType, copyData, hasBlocks ? { [BUILDER_SOURCE_HEADER]: "true" } : {});
   }
   /**
    * Detect if entity has custom override (client-side detection)
@@ -474,7 +475,7 @@ async function fetchWithTeam(url, options = {}) {
     headers.set("Content-Type", "application/json");
   }
   if (activeTeamId) {
-    headers.set("x-team-id", activeTeamId);
+    headers.set(TEAM_ID_HEADER, activeTeamId);
   }
   return fetch(withBasePathIfInApp(url), {
     ...options,

package/dist/lib/api/entity/audit-log.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-log.d.ts","sourceRoot":"","sources":["../../../../src/lib/api/entity/audit-log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAE9C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAEvD;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,cAAc,GAAG,IAAI,CAAA;CAC5B;AAED,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,cAAc,GAAG,IAAI,EAC3B,OAAO,EAAE,WAAW,EACpB,UAAU,EAAE,MAAM,EAClB,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC,CAqDf"}
+{"version":3,"file":"audit-log.d.ts","sourceRoot":"","sources":["../../../../src/lib/api/entity/audit-log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAG9C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAEvD;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,cAAc,GAAG,IAAI,CAAA;CAC5B;AAED,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,cAAc,GAAG,IAAI,EAC3B,OAAO,EAAE,WAAW,EACpB,UAAU,EAAE,MAAM,EAClB,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC,CAqDf"}

package/dist/lib/api/entity/audit-log.js

@@ -1,4 +1,5 @@
 import { mutateWithRLS } from "../../db.js";
+import { getRecordedClientIp } from "../client-ip.js";
 async function logGenericHandlerUsage(auth, request, statusCode, responseTime) {
   var _a;
   const userId = (_a = auth == null ? void 0 : auth.user) == null ? void 0 : _a.id;
@@ -9,7 +10,7 @@ async function logGenericHandlerUsage(auth, request, statusCode, responseTime) {
   try {
     endpoint = request.nextUrl.pathname;
     method = request.method;
-    const ipAddress = request.headers.get("x-forwarded-for") || request.headers.get("x-real-ip") || "unknown";
+    const ipAddress = getRecordedClientIp(request.headers);
     const userAgent = request.headers.get("user-agent");
     await mutateWithRLS(
       `INSERT INTO "api_audit_log"

package/dist/lib/api/entity/generic-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generic-handler.d.ts","sourceRoot":"","sources":["../../../../src/lib/api/entity/generic-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AA6wBvD;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAEnF;AA8lBD;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAErF;AAoaD;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAEpJ;AAoND;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAEtJ;AA+YD;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAEtJ;AAwKD;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAEtF"}
+{"version":3,"file":"generic-handler.d.ts","sourceRoot":"","sources":["../../../../src/lib/api/entity/generic-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AA+wBvD;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAEnF;AA8lBD;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAErF;AAyaD;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAEpJ;AAoND;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAEtJ;AA6ZD;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAEtJ;AAwKD;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAEtF"}

package/dist/lib/api/entity/generic-handler.js

@@ -2,6 +2,8 @@ import { NextResponse } from "next/server";
 import { authenticateRequest, createAuthFailureResponse, canBypassTeamContext } from "../auth/dual-auth.js";
 import { resolveEntityFromUrl, validateEntityOperation } from "./resolver.js";
 import { generateEntitySchemas } from "../../entities/schema-generator.js";
+import { publicSlugIssue, otherBasePathSegments } from "../../entities/public-slug.js";
+import { getAllEntityConfigs } from "../../entities/registry.js";
 import { entityResponseSystemColumns, taxonomyResponseFields } from "../../entities/portable/response-shape.js";
 import { queryWithRLS, mutateWithRLS, queryOneWithRLS } from "../../db.js";
 import {
@@ -832,6 +834,10 @@ async function handleGenericCreateImpl(request, audit) {
       return addCorsHeaders(response2, request);
     }
     let validatedData = validation.data;
+    const slugIssue = publicSlugIssue(entityConfig, validatedData, otherBasePathSegments(entityConfig, getAllEntityConfigs()));
+    if (slugIssue) {
+      return addCorsHeaders(createApiError(slugIssue.message, 400, [slugIssue], "VALIDATION_ERROR"), request);
+    }
     const xssField = checkNameFieldXss(entityConfig, validatedData);
     if (xssField) {
       const xssResponse = createApiError(
@@ -1204,7 +1210,7 @@ async function handleGenericUpdate(request, { params }) {
   return runWithAuditLog(request, (audit) => handleGenericUpdateImpl(request, audit, { params }));
 }
 async function handleGenericUpdateImpl(request, audit, { params }) {
-  var _a, _b, _c, _d, _e, _f, _g;
+  var _a, _b, _c, _d, _e, _f, _g, _h;
   try {
     const { id } = await params;
     const resolution = await resolveEntityFromUrl(request.nextUrl.pathname);
@@ -1285,6 +1291,18 @@ async function handleGenericUpdateImpl(request, audit, { params }) {
       return addCorsHeaders(response2, request);
     }
     let validatedData = validation.data;
+    let slugIssue = publicSlugIssue(entityConfig, validatedData, otherBasePathSegments(entityConfig, getAllEntityConfigs()));
+    if (slugIssue) {
+      const current = await queryWithRLS(
+        `SELECT "slug" FROM "${tableName}" WHERE id = $1 AND "teamId" = $2`,
+        [id, teamId],
+        authResult.user.id
+      );
+      if (((_d = current[0]) == null ? void 0 : _d.slug) === validatedData.slug) slugIssue = null;
+    }
+    if (slugIssue) {
+      return addCorsHeaders(createApiError(slugIssue.message, 400, [slugIssue], "VALIDATION_ERROR"), request);
+    }
     const updateXssField = checkNameFieldXss(entityConfig, validatedData);
     if (updateXssField) {
       const updateXssResponse = createApiError(
@@ -1316,7 +1334,7 @@ async function handleGenericUpdateImpl(request, audit, { params }) {
     const values = [];
     let paramCount = 1;
     const builderRequest = isBuilderRequest(request);
-    const entityHasBuilder = ((_d = entityConfig.builder) == null ? void 0 : _d.enabled) === true;
+    const entityHasBuilder = ((_e = entityConfig.builder) == null ? void 0 : _e.enabled) === true;
     if (builderRequest && entityHasBuilder && "blocks" in entityData) {
       let blocksData = entityData.blocks;
       blocksData = await filterOrphanedPatternReferences(blocksData, authResult.user.id);
@@ -1392,7 +1410,7 @@ async function handleGenericUpdateImpl(request, audit, { params }) {
         whereConditions.push(`"teamId" = $${paramCount++}`);
         values.push(teamId);
       }
-      if (!((_e = entityConfig.access) == null ? void 0 : _e.shared)) {
+      if (!((_f = entityConfig.access) == null ? void 0 : _f.shared)) {
         whereConditions.push(`"userId" = $${paramCount++}`);
         values.push(authResult.user.id);
       }
@@ -1436,7 +1454,7 @@ async function handleGenericUpdateImpl(request, audit, { params }) {
       }
       updatedItem = result[0];
     }
-    if ((_f = entityConfig.taxonomies) == null ? void 0 : _f.enabled) {
+    if ((_g = entityConfig.taxonomies) == null ? void 0 : _g.enabled) {
       await processTaxonomyRelations(entityConfig, id, body, authResult.user.id, true);
     }
     if (metadataWasProvided) {
@@ -1448,7 +1466,7 @@ async function handleGenericUpdateImpl(request, audit, { params }) {
       );
     }
     let responseItem = updatedItem;
-    if ((_g = entityConfig.taxonomies) == null ? void 0 : _g.enabled) {
+    if ((_h = entityConfig.taxonomies) == null ? void 0 : _h.enabled) {
       const itemsWithTaxonomies = await includeTaxonomiesInData(
         entityConfig,
         [updatedItem],

package/dist/lib/api/helpers.d.ts

@@ -46,7 +46,9 @@ export declare function validateAndAuthenticateApiRequest(request: NextRequest):
     rateLimitResponse?: NextResponse;
 }>;
 /**
- * Extrae la información de autenticación API de los headers de la request
+ * The API key this request was authenticated with: the one validateApiKey accepted for it (directly, or through
+ * authenticateRequest / validateAndAuthenticateRequest). Throws when no key was validated for the request.
+ * Identity never comes from request headers.
  * @deprecated Use validateAndAuthenticateApiRequest instead
  */
 export declare function getApiAuth(request: NextRequest): ApiKeyAuth;
@@ -106,6 +108,10 @@ export declare function createPaginationMeta(page: number, limit: number, total:
 export declare function logApiUsage(auth: ApiKeyAuth, request: NextRequest, statusCode: number, responseTime?: number, requestBody?: unknown): Promise<void>;
 /**
  * Wrapper para endpoints que agrega logging automático
+ *
+ * Writes an api_audit_log row for a request authenticated with an API key, attributed to the key the handler
+ * validated (getValidatedApiKey), never to identity headers in the request. Requests without a validated key
+ * are not logged here. The request body is not stored, as in entity/audit-log.ts: payloads carry personal data.
  */
 export declare function withApiLogging<T extends unknown[]>(handler: (request: NextRequest, ...args: T) => Promise<NextResponse>): (request: NextRequest, ...args: T) => Promise<NextResponse>;
 /**
@@ -125,7 +131,7 @@ export declare function sanitizeSearchQuery(query: string): string;
 export declare function parseFilters(request: NextRequest): Record<string, string>;
 /**
  * Agrega headers de CORS para API externa
- * Uses unified getCorsOrigins() for single source of truth
+ * Uses unified getCorsOrigins() for single source of truth (see corsGrant)
  */
 export declare function addCorsHeaders(response: NextResponse, request?: NextRequest): Promise<NextResponse>;
 /**

package/dist/lib/api/helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/lib/api/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,UAAU,EAAkB,MAAM,QAAQ,CAAC;AAWpD,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EACL,KAAK,mBAAmB,EAKzB,MAAM,qBAAqB,CAAC;AAG7B,UAAU,WAAW;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE,OAAO,mBAAmB,EAAE,QAAQ,EAAE,CAAC;IAC9C,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,KAAK,IAAI,GAAG,UAAU,GAAG,WAAW,CAAC;AAErC;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,8BAA8B,CAClD,OAAO,EAAE,WAAW,EACpB,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC;IACT,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,iBAAiB,CAAC,EAAE,YAAY,CAAC;IACjC,wEAAwE;IACxE,aAAa,CAAC,EAAE,YAAY,CAAC;CAC9B,CAAC,CAwDD;AAgFD;;;;;;;;GAQG;AACH,wBAAsB,iCAAiC,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC;IACrF,IAAI,EAAE,UAAU,CAAC;IACjB,iBAAiB,CAAC,EAAE,YAAY,CAAC;CAClC,CAAC,CASD;AA+BD;;;GAGG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,WAAW,GAAG,UAAU,CAwB3D;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,YAAY,GAAG,IAAI,CAiB5F;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAE,MAAY;;;;;;GASzG;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,MAAM,GAAE,MAAY,EACpB,OAAO,CAAC,EAAE,OAAO,EACjB,IAAI,CAAC,EAAE,MAAM;;;;;;;;GAWd;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,WAAW,GAAG;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB,CAQA;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM;;;;;;;EAUd;AAED;;GAEG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE,WAAW,EACpB,UAAU,EAAE,MAAM,EAClB,YAAY,CAAC,EAAE,MAAM,EACrB,WAAW,CAAC,EAAE,OAAO,GACpB,OAAO,CAAC,IAAI,CAAC,CA4Bf;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS,OAAO,EAAE,EAChD,OAAO,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,YAAY,CAAC,IAEtD,SAAS,WAAW,EAAE,GAAG,MAAM,CAAC,KAAG,OAAO,CAAC,YAAY,CAAC,CA6CvE;AAED;;GAEG;AACH,OAAO,EAAE,WAAW,EAAE,CAAC;AAEvB;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAUzD;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAezE;AAUD;;;GAGG;AACH,wBAAsB,cAAc,CAAC,QAAQ,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAgDzG;AAED;;GAEG;AACH,wBAAsB,0BAA0B,CAAC,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAG7F;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,EAChC,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,QAAQ,CAAC,CAyCnB;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,eAAe,EAAE,OAAO,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,WAAW,GAAG,UAAU,CA0BhE;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,eAAe,EAAE,OAAO,CAAC;IACzB,UAAU,EAAE,OAAO,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,WAAW,GAAG,WAAW,CA0BlE;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAClE,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,CAAC,EAAE,EACb,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,EAAE,CAAC,CA6BtD;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAClE,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,CAAC,EAAE,EACb,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,OAAO,GACrB,OAAO,CAAC,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;CAAE,CAAC,EAAE,CAAC,CAgExD;AAED;;;GAGG;AACH,wBAAsB,8BAA8B,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAC3E,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,CAAC,EACT,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,CA2BlD;AAED;;;GAGG;AACH,wBAAsB,8BAA8B,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAC3E,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,CAAC,EACT,eAAe,EAAE,OAAO,EACxB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,CAiBlD;AAoBD;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,OAAO,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CA+DjD"}
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/lib/api/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,UAAU,EAAsC,MAAM,QAAQ,CAAC;AAaxE,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EACL,KAAK,mBAAmB,EAKzB,MAAM,qBAAqB,CAAC;AAG7B,UAAU,WAAW;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE,OAAO,mBAAmB,EAAE,QAAQ,EAAE,CAAC;IAC9C,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,KAAK,IAAI,GAAG,UAAU,GAAG,WAAW,CAAC;AAErC;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,8BAA8B,CAClD,OAAO,EAAE,WAAW,EACpB,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC;IACT,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,iBAAiB,CAAC,EAAE,YAAY,CAAC;IACjC,wEAAwE;IACxE,aAAa,CAAC,EAAE,YAAY,CAAC;CAC9B,CAAC,CAwDD;AAgFD;;;;;;;;GAQG;AACH,wBAAsB,iCAAiC,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC;IACrF,IAAI,EAAE,UAAU,CAAC;IACjB,iBAAiB,CAAC,EAAE,YAAY,CAAC;CAClC,CAAC,CASD;AA+BD;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,WAAW,GAAG,UAAU,CAM3D;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,YAAY,GAAG,IAAI,CAiB5F;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAE,MAAY;;;;;;GASzG;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,MAAM,GAAE,MAAY,EACpB,OAAO,CAAC,EAAE,OAAO,EACjB,IAAI,CAAC,EAAE,MAAM;;;;;;;;GAWd;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,WAAW,GAAG;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB,CAQA;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM;;;;;;;EAUd;AAED;;GAEG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE,WAAW,EACpB,UAAU,EAAE,MAAM,EAClB,YAAY,CAAC,EAAE,MAAM,EACrB,WAAW,CAAC,EAAE,OAAO,GACpB,OAAO,CAAC,IAAI,CAAC,CA4Bf;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS,OAAO,EAAE,EAChD,OAAO,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,YAAY,CAAC,IAEtD,SAAS,WAAW,EAAE,GAAG,MAAM,CAAC,KAAG,OAAO,CAAC,YAAY,CAAC,CAkBvE;AAED;;GAEG;AACH,OAAO,EAAE,WAAW,EAAE,CAAC;AAEvB;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAUzD;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAezE;AAUD;;;GAGG;AACH,wBAAsB,cAAc,CAAC,QAAQ,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAkBzG;AAED;;GAEG;AACH,wBAAsB,0BAA0B,CAAC,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAG7F;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,EAChC,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,QAAQ,CAAC,CAuBnB;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,eAAe,EAAE,OAAO,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,WAAW,GAAG,UAAU,CA0BhE;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,eAAe,EAAE,OAAO,CAAC;IACzB,UAAU,EAAE,OAAO,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,WAAW,GAAG,WAAW,CA0BlE;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAClE,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,CAAC,EAAE,EACb,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,EAAE,CAAC,CA6BtD;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAClE,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,CAAC,EAAE,EACb,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,OAAO,GACrB,OAAO,CAAC,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;CAAE,CAAC,EAAE,CAAC,CAgExD;AAED;;;GAGG;AACH,wBAAsB,8BAA8B,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAC3E,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,CAAC,EACT,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,CA2BlD;AAED;;;GAGG;AACH,wBAAsB,8BAA8B,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAC3E,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,CAAC,EACT,eAAe,EAAE,OAAO,EACxB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,CAiBlD;AAoBD;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,OAAO,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CA+DjD"}

package/dist/lib/api/helpers.js

@@ -1,13 +1,15 @@
 import { NextResponse } from "next/server";
-import { validateApiKey } from "./auth.js";
+import { getValidatedApiKey, validateApiKey } from "./auth.js";
 import { mutateWithRLS, queryWithRLS } from "../db.js";
 import { checkRateLimit, addRateLimitHeaders } from "./rate-limit.js";
+import { getRecordedClientIp } from "./client-ip.js";
 import { getApplicationConfig } from "../config/index.js";
 import { auth } from "../auth.js";
 import { MetaService } from "../services/meta.service.js";
 import { ScopeService } from "../services/scope.service.js";
 import { getChildEntities } from "../entities/queries.js";
-import { getCorsOrigins, normalizeOrigin, isOriginAllowed } from "../utils/cors.js";
+import { getCorsOrigins } from "../utils/cors.js";
+import { corsGrant, requestPathname, setCorsHeaders, varyOnOrigin } from "./cors-response.js";
 import { isValidUUID } from "../utils/uuid.js";
 import {
   describeRoute,
@@ -122,26 +124,11 @@ function applyApiKeyRateLimit(auth2) {
   return { auth: auth2 };
 }
 function getApiAuth(request) {
-  const userId = request.headers.get("x-api-user-id");
-  const keyId = request.headers.get("x-api-key-id");
-  const scopesHeader = request.headers.get("x-api-scopes");
-  if (!userId || !keyId || !scopesHeader) {
-    throw new Error("Missing API authentication headers");
-  }
-  let scopes = [];
-  try {
-    const parsed = JSON.parse(scopesHeader);
-    if (Array.isArray(parsed)) {
-      scopes = parsed.filter((s) => typeof s === "string");
-    }
-  } catch {
-    console.warn("[API] Invalid scopes header format");
+  const auth2 = getValidatedApiKey(request);
+  if (!auth2) {
+    throw new Error("No validated API key for this request");
   }
-  return {
-    userId,
-    keyId,
-    scopes
-  };
+  return auth2;
 }
 function checkScope(auth2, requiredScope) {
   if (!scopesSatisfy(auth2.scopes, requiredScope)) {
@@ -203,7 +190,7 @@ async function logApiUsage(auth2, request, statusCode, responseTime, requestBody
   try {
     const endpoint = request.nextUrl.pathname;
     const method = request.method;
-    const ipAddress = request.headers.get("x-forwarded-for") || request.headers.get("x-real-ip") || "unknown";
+    const ipAddress = getRecordedClientIp(request.headers);
     const userAgent = request.headers.get("user-agent");
     await mutateWithRLS(
       `INSERT INTO "api_audit_log" 
@@ -229,31 +216,18 @@ async function logApiUsage(auth2, request, statusCode, responseTime, requestBody
 function withApiLogging(handler) {
   return async (request, ...args) => {
     const startTime = Date.now();
-    let auth2 = null;
-    let requestBody = null;
-    try {
-      try {
-        auth2 = getApiAuth(request);
-      } catch {
-      }
-      if (["POST", "PUT", "PATCH"].includes(request.method)) {
-        try {
-          const clonedRequest = request.clone();
-          requestBody = await clonedRequest.json();
-        } catch {
-        }
-      }
-      const response = await handler(request, ...args);
-      const responseTime = Date.now() - startTime;
+    const log = (status) => {
+      const auth2 = getValidatedApiKey(request);
       if (auth2) {
-        logApiUsage(auth2, request, response.status, responseTime, requestBody).catch(console.error);
+        logApiUsage(auth2, request, status, Date.now() - startTime).catch(console.error);
       }
+    };
+    try {
+      const response = await handler(request, ...args);
+      log(response.status);
       return response;
     } catch (error) {
-      const responseTime = Date.now() - startTime;
-      if (auth2) {
-        logApiUsage(auth2, request, 500, responseTime, requestBody).catch(console.error);
-      }
+      log(500);
       throw error;
     }
   };
@@ -282,32 +256,15 @@ function getAllowedFiltersFromRegistry() {
 async function addCorsHeaders(response, request) {
   const env = process.env.NODE_ENV || "development";
   const config = await getApplicationConfig();
-  const corsConfig = config.api.cors;
-  let allowedOrigin = "null";
+  let grant = null;
   if (request) {
     const origin = request.headers.get("origin");
-    if (origin) {
-      const normalizedOrigin = normalizeOrigin(origin);
-      if (env === "development" && corsConfig.allowAllOrigins.development) {
-        allowedOrigin = normalizedOrigin;
-      } else {
-        const allowedOrigins = getCorsOrigins(config, env);
-        const matched = isOriginAllowed(normalizedOrigin, allowedOrigins);
-        if (matched) {
-          allowedOrigin = matched;
-        }
-      }
-    }
-  } else if (env === "development" && corsConfig.allowAllOrigins.development) {
+    if (origin) grant = corsGrant(origin, config, env, requestPathname(request));
+  } else if (env === "development" && config.api.cors.allowAllOrigins.development) {
     const allowedOrigins = getCorsOrigins(config, env);
-    allowedOrigin = allowedOrigins[0] || "http://localhost:3000";
+    grant = { origin: allowedOrigins[0] || "http://localhost:3000", credentials: true };
   }
-  response.headers.set("Access-Control-Allow-Origin", allowedOrigin);
-  response.headers.append("Vary", "Origin");
-  response.headers.set("Access-Control-Allow-Methods", "GET, POST, PUT, PATCH, DELETE, OPTIONS");
-  response.headers.set("Access-Control-Allow-Headers", "Content-Type, Authorization, X-API-Key, x-team-id, x-builder-source");
-  response.headers.set("Access-Control-Allow-Credentials", "true");
-  response.headers.set("Access-Control-Max-Age", "86400");
+  setCorsHeaders(response.headers, grant);
   return response;
 }
 async function handleCorsPreflightRequest(request) {
@@ -321,25 +278,14 @@ async function wrapAuthHandlerWithCors(handler, request) {
     statusText: response.statusText,
     headers: new Headers(response.headers)
   });
-  const env = process.env.NODE_ENV || "development";
-  const config = await getApplicationConfig();
-  const corsConfig = config.api.cors;
   const origin = request.headers.get("origin");
   if (origin) {
-    const normalizedOrigin = normalizeOrigin(origin);
-    let allowedOrigin = "null";
-    if (env === "development" && corsConfig.allowAllOrigins.development) {
-      allowedOrigin = normalizedOrigin;
-    } else {
-      const allowedOrigins = getCorsOrigins(config, env);
-      const matched = isOriginAllowed(normalizedOrigin, allowedOrigins);
-      if (matched) {
-        allowedOrigin = matched;
-      }
+    const grant = corsGrant(origin, await getApplicationConfig(), process.env.NODE_ENV || "development", requestPathname(request));
+    if (grant) {
+      newResponse.headers.set("Access-Control-Allow-Origin", grant.origin);
+      if (grant.credentials) newResponse.headers.set("Access-Control-Allow-Credentials", "true");
     }
-    newResponse.headers.set("Access-Control-Allow-Origin", allowedOrigin);
-    newResponse.headers.set("Access-Control-Allow-Credentials", "true");
-    newResponse.headers.append("Vary", "Origin");
+    varyOnOrigin(newResponse.headers);
   }
   return newResponse;
 }

package/dist/lib/api/keys.d.ts

@@ -35,6 +35,12 @@ export declare class ApiKeyManager {
      */
     static suggestKeyName(scopes: string[]): string;
 }
+/**
+ * The API key a request presents: the token of `Authorization: Bearer <token>`,
+ * else the `x-api-key` header. validateApiKey checks this value, and the
+ * cookie-write origin check (lib/api/request-origin) reads it too.
+ */
+export declare function presentedApiKey(headers: Headers): string | null;
 /**
  * Definición de scopes disponibles para API keys
  */

package/dist/lib/api/keys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../../src/lib/api/keys.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,qBAAa,aAAa;IACxB;;;OAGG;WACU,cAAc,IAAI,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAyBrF;;OAEG;IACH,MAAM,CAAC,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAM9C;;OAEG;IACH,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;IAKzC;;OAEG;WACU,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAQlD;;OAEG;IACH,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,aAAa,EAAE,MAAM,EAAE,CAAA;KAAE;IAUpF;;OAEG;IACH,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM;CAchD;AAED;;GAEG;AACH,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;CAgCb,CAAC;AAEX,MAAM,MAAM,QAAQ,GAAG,MAAM,OAAO,UAAU,CAAC;AAE/C;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAGrD;AAED,oFAAoF;AACpF,wBAAgB,eAAe,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAIxD;AAED;;GAEG;AACH,eAAO,MAAM,gBAAgB;;;;yBAIgC,QAAQ,EAAE;;;;;yBAKV,QAAQ,EAAE;;;;;yBAKV,QAAQ,EAAE;;;;;yBAKtB,QAAQ,EAAE;;;;;yBAKQ,QAAQ,EAAE;;;;;yBAKxD,QAAQ,EAAE;;CAErB,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,cAAc;;;;CAIjB,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CASd,CAAC;AAEX;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAmB9F"}
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../../src/lib/api/keys.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,qBAAa,aAAa;IACxB;;;OAGG;WACU,cAAc,IAAI,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAyBrF;;OAEG;IACH,MAAM,CAAC,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAM9C;;OAEG;IACH,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;IAKzC;;OAEG;WACU,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAQlD;;OAEG;IACH,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,aAAa,EAAE,MAAM,EAAE,CAAA;KAAE;IAUpF;;OAEG;IACH,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM;CAchD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAI/D;AAED;;GAEG;AACH,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;CAgCb,CAAC;AAEX,MAAM,MAAM,QAAQ,GAAG,MAAM,OAAO,UAAU,CAAC;AAE/C;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAGrD;AAED,oFAAoF;AACpF,wBAAgB,eAAe,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAIxD;AAED;;GAEG;AACH,eAAO,MAAM,gBAAgB;;;;yBAIgC,QAAQ,EAAE;;;;;yBAKV,QAAQ,EAAE;;;;;yBAKV,QAAQ,EAAE;;;;;yBAKtB,QAAQ,EAAE;;;;;yBAKQ,QAAQ,EAAE;;;;;yBAKxD,QAAQ,EAAE;;CAErB,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,cAAc;;;;CAIjB,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CASd,CAAC;AAEX;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAmB9F"}

package/dist/lib/api/keys.js

@@ -68,6 +68,11 @@ class ApiKeyManager {
     return `${categoryNames} Access Key`;
   }
 }
+function presentedApiKey(headers) {
+  const authorization = headers.get("authorization");
+  if (authorization == null ? void 0 : authorization.startsWith("Bearer ")) return authorization.substring(7);
+  return headers.get("x-api-key") || null;
+}
 const API_SCOPES = {
   // Usuarios
   "users:read": "Read user information",
@@ -183,5 +188,6 @@ export {
   SCOPE_CATEGORIES,
   getApiScopes,
   getAppApiScopes,
-  getRateLimitForScopes
+  getRateLimitForScopes,
+  presentedApiKey
 };

package/dist/lib/api/rate-limit.d.ts

@@ -47,6 +47,10 @@ export declare function applyRateLimit(request: NextRequest, keyId: string, scop
 export declare function addRateLimitHeaders(response: NextResponse, keyId: string, scopes: string[]): NextResponse;
 /**
  * Middleware helper para aplicar rate limiting automáticamente
+ *
+ * Limits per API key, with the limits of the key's scopes, when the request presents a key that validates.
+ * The key id and scopes come from that validation, never from request headers; any other request runs the
+ * handler without this limit.
  */
 export declare function withRateLimit<T extends unknown[]>(handler: (request: NextRequest, ...args: T) => Promise<NextResponse>): (request: NextRequest, ...args: T) => Promise<NextResponse>;
 /**

package/dist/lib/api/rate-limit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../../src/lib/api/rate-limit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAIxD,OAAO,EAIL,KAAK,aAAa,EACnB,MAAM,qBAAqB,CAAC;AAE7B,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,UAAU,EAAE,MAAM,EAClB,KAAK,GAAE,MAAa,EACpB,QAAQ,GAAE,MAAc,GACvB,eAAe,CAyCjB;AAED;;;GAGG;AACH,YAAY,EAAE,aAAa,EAAE,CAAC;AAE9B;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAC7C,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE,aAAqB,GAC1B,OAAO,CAAC,eAAe,GAAG;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA6CpD;AAED;;GAEG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,eAAe,GAAG;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,YAAY,CAwB5G;AAED;;;GAGG;AACH,wBAAgB,+BAA+B,IAAI,OAAO,CAEzD;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,WAAW,EACpB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EAAE,GACf,YAAY,GAAG,IAAI,CAkCrB;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,YAAY,EACtB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EAAE,GACf,YAAY,CASd;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS,OAAO,EAAE,EAC/C,OAAO,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,YAAY,CAAC,IAEtD,SAAS,WAAW,EAAE,GAAG,MAAM,CAAC,KAAG,OAAO,CAAC,YAAY,CAAC,CAwCvE;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG;IAChD,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,OAAO,CAAC;CACtB,GAAG,IAAI,CAaP;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAGlD;AAED;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,KAAK,CAAC;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC,CASD;AAED;;GAEG;AACH,wBAAgB,sBAAsB;;;;;EAErC;AAoGD,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,OAAO,EAAE,EACnD,OAAO,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,YAAY,CAAC,EACpE,IAAI,GAAE,aAAqB,IAEb,SAAS,WAAW,EAAE,GAAG,MAAM,CAAC,KAAG,OAAO,CAAC,YAAY,CAAC,CAkCvE"}
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../../src/lib/api/rate-limit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAMxD,OAAO,EAIL,KAAK,aAAa,EACnB,MAAM,qBAAqB,CAAC;AAI7B,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,UAAU,EAAE,MAAM,EAClB,KAAK,GAAE,MAAa,EACpB,QAAQ,GAAE,MAAc,GACvB,eAAe,CAyCjB;AAED;;;GAGG;AACH,YAAY,EAAE,aAAa,EAAE,CAAC;AAE9B;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAC7C,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE,aAAqB,GAC1B,OAAO,CAAC,eAAe,GAAG;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA6CpD;AAED;;GAEG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,eAAe,GAAG;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,YAAY,CAwB5G;AAED;;;GAGG;AACH,wBAAgB,+BAA+B,IAAI,OAAO,CAEzD;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,WAAW,EACpB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EAAE,GACf,YAAY,GAAG,IAAI,CAkCrB;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,YAAY,EACtB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EAAE,GACf,YAAY,CASd;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS,OAAO,EAAE,EAC/C,OAAO,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,YAAY,CAAC,IAEtD,SAAS,WAAW,EAAE,GAAG,MAAM,CAAC,KAAG,OAAO,CAAC,YAAY,CAAC,CA2BvE;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG;IAChD,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,OAAO,CAAC;CACtB,GAAG,IAAI,CAaP;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAGlD;AAED;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,KAAK,CAAC;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC,CASD;AAED;;GAEG;AACH,wBAAgB,sBAAsB;;;;;EAErC;AA4DD,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,OAAO,EAAE,EACnD,OAAO,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,YAAY,CAAC,EACpE,IAAI,GAAE,aAAqB,IAkCb,SAAS,WAAW,EAAE,GAAG,MAAM,CAAC,KAAG,OAAO,CAAC,YAAY,CAAC,CAIvE"}