@nocobase/app-plugin-api-keys 0.0.0-stage → 1.0.0-beta.13

package/dist/client/routes.d.ts

@@ -0,0 +1,22 @@
+import { type AppClientRouteContribution } from '@nocobase/app-client/plugins';
+import type { ApiKeysClientOptions } from './plugin.js';
+export declare const API_KEYS_ROUTE_ID = "@nocobase/app-plugin-api-keys:api-keys";
+/**
+ * The permission that opens the page.
+ *
+ * Keys are self-service — the endpoints behind the page only ever act on the
+ * caller's own keys — so an application that wants every signed-in user to
+ * manage their own grants `page:api-keys/access` to all authenticated users.
+ * It is still declared rather than omitted, so that decision is made in the
+ * application's permissions rather than by the absence of a rule.
+ */
+export declare const API_KEYS_PAGE_ACCESS: {
+    readonly resource: {
+        readonly type: "page";
+        readonly id: "api-keys";
+    };
+    readonly action: "access";
+};
+export declare function createApiKeysRoutes(options: ApiKeysClientOptions): AppClientRouteContribution;
+export declare function normalizeApiKeysRoutePath(value: string): string;
+//# sourceMappingURL=routes.d.ts.map

package/dist/client/routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../client/routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,0BAA0B,EAChC,MAAM,8BAA8B,CAAC;AAGtC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAExD,eAAO,MAAM,iBAAiB,2CAA2C,CAAC;AAE1E;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB;;;;;;CAGvB,CAAC;AAEX,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,oBAAoB,GAC5B,0BAA0B,CAa5B;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAY/D"}

package/dist/client/routes.js

@@ -0,0 +1,42 @@
+import { defineSettingsRoutes, } from '@nocobase/app-client/plugins';
+import { KeyRound } from 'lucide-react';
+export const API_KEYS_ROUTE_ID = '@nocobase/app-plugin-api-keys:api-keys';
+/**
+ * The permission that opens the page.
+ *
+ * Keys are self-service — the endpoints behind the page only ever act on the
+ * caller's own keys — so an application that wants every signed-in user to
+ * manage their own grants `page:api-keys/access` to all authenticated users.
+ * It is still declared rather than omitted, so that decision is made in the
+ * application's permissions rather than by the absence of a rule.
+ */
+export const API_KEYS_PAGE_ACCESS = {
+    resource: { type: 'page', id: 'api-keys' },
+    action: 'access',
+};
+export function createApiKeysRoutes(options) {
+    return defineSettingsRoutes([
+        {
+            name: 'api-keys',
+            path: normalizeApiKeysRoutePath(options.path ?? '/api-keys'),
+            authz: API_KEYS_PAGE_ACCESS,
+            componentLoader: () => import('./pages/api-keys-page.js'),
+            navigation: {
+                title: options.title ?? 'nav.apiKeys',
+                icon: KeyRound,
+            },
+        },
+    ]);
+}
+export function normalizeApiKeysRoutePath(value) {
+    const trimmed = value.trim();
+    if (!trimmed || trimmed === '/') {
+        throw new TypeError('API keys route path must contain a path segment');
+    }
+    const path = `/${trimmed.replace(/^\/+|\/+$/g, '')}`;
+    if (path === '/settings' || path.startsWith('/settings/')) {
+        throw new TypeError('API keys route path is relative to its mount and must not include /settings');
+    }
+    return path;
+}
+//# sourceMappingURL=routes.js.map

package/dist/client/routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../client/routes.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,GAErB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAIxC,MAAM,CAAC,MAAM,iBAAiB,GAAG,wCAAwC,CAAC;AAE1E;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE;IAC1C,MAAM,EAAE,QAAQ;CACR,CAAC;AAEX,MAAM,UAAU,mBAAmB,CACjC,OAA6B;IAE7B,OAAO,oBAAoB,CAAC;QAC1B;YACE,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE,yBAAyB,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;YAC5D,KAAK,EAAE,oBAAoB;YAC3B,eAAe,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,0BAA0B,CAAC;YACzD,UAAU,EAAE;gBACV,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,aAAa;gBACrC,IAAI,EAAE,QAAQ;aACf;SACF;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAAa;IACrD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;QAChC,MAAM,IAAI,SAAS,CAAC,iDAAiD,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC;IACrD,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,SAAS,CACjB,6EAA6E,CAC9E,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/database/migrations/.manifest.json

@@ -0,0 +1,9 @@
+{
+  "version": 1,
+  "files": {
+    "202609150001_create_api_key_table.js": {
+      "sourceChecksum": "370b04daffda210c32e8a2931944bcd9e4b19938483d75e02f9fbb525fea72d5",
+      "artifactChecksum": "270d6f8ec497876bff3aa8d304aa6ad51889b5e5ef632a475e8ca797bd80eb86"
+    }
+  }
+}

package/dist/database/migrations/202609150001_create_api_key_table.js

@@ -0,0 +1,58 @@
+import { defineMigration } from '@nocobase/db';
+/**
+ * Creates the table the Better Auth API Key plugin reads and writes.
+ *
+ * The shape is spelled out here rather than derived from the plugin's own
+ * schema, so a later release of `@better-auth/api-key` cannot change what this
+ * migration did. When that schema gains a field, add it in a new migration.
+ *
+ * The duration fields are milliseconds held in a 32-bit integer, which caps a
+ * refill interval or rate-limit window at roughly 24 days. That is well past
+ * the one-day default and keeps every dialect returning a number; a longer
+ * window needs a widening migration rather than a value that silently wraps.
+ */
+const migration = defineMigration({
+    name: '202609150001_create_api_key_table',
+    async up({ builder }) {
+        await builder.createCollection('apikey', (collection) => {
+            collection.string('id', { length: 64 }).notNull();
+            collection
+                .string('configId', { length: 128 })
+                .notNull()
+                .defaultTo('default');
+            collection.string('name', { length: 255 }).nullable();
+            collection.string('prefix', { length: 64 }).nullable();
+            // The first few characters, shown in the UI so a listed key is
+            // recognizable. `key` itself is a hash and is never displayed.
+            collection.string('start', { length: 64 }).nullable();
+            collection.string('key', { length: 255 }).notNull();
+            collection.string('referenceId', { length: 64 }).notNull();
+            collection.integer('refillInterval').nullable();
+            collection.integer('refillAmount').nullable();
+            collection.datetime('lastRefillAt').nullable();
+            collection.boolean('enabled').notNull().defaultTo(true);
+            collection.boolean('rateLimitEnabled').notNull().defaultTo(true);
+            collection.integer('rateLimitTimeWindow').nullable();
+            collection.integer('rateLimitMax').nullable();
+            collection.integer('requestCount').notNull().defaultTo(0);
+            collection.integer('remaining').nullable();
+            collection.datetime('lastRequest').nullable();
+            collection.datetime('expiresAt').nullable();
+            collection.datetime('createdAt').notNull();
+            collection.datetime('updatedAt').notNull();
+            collection.text('permissions').nullable();
+            collection.text('metadata').nullable();
+            collection.primary('id', { name: 'pk_apikey' });
+            collection.index('key', { name: 'idx_apikey_key' });
+            collection.index('referenceId', { name: 'idx_apikey_reference' });
+            collection.index('configId', { name: 'idx_apikey_config' });
+            collection.index('expiresAt', { name: 'idx_apikey_expires_at' });
+        });
+    },
+    async down({ builder }) {
+        await builder.dropCollection('apikey');
+    },
+});
+export default migration;
+//# sourceMappingURL=202609150001_create_api_key_table.js.map
+// @nocobase/task-manifest v1

package/dist/database/migrations/202609150001_create_api_key_table.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"202609150001_create_api_key_table.js","sourceRoot":"","sources":["../../../database/migrations/202609150001_create_api_key_table.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAA4B,MAAM,cAAc,CAAC;AAEzE;;;;;;;;;;;GAWG;AACH,MAAM,SAAS,GAAwB,eAAe,CAAC;IACrD,IAAI,EAAE,mCAAmC;IAEzC,KAAK,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE;QAClB,MAAM,OAAO,CAAC,gBAAgB,CAAC,QAAQ,EAAE,CAAC,UAAU,EAAE,EAAE;YACtD,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YAClD,UAAU;iBACP,MAAM,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;iBACnC,OAAO,EAAE;iBACT,SAAS,CAAC,SAAS,CAAC,CAAC;YACxB,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;YACtD,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;YACvD,+DAA+D;YAC/D,+DAA+D;YAC/D,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;YACtD,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YACpD,UAAU,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YAC3D,UAAU,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE,CAAC;YAChD,UAAU,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC9C,UAAU,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC/C,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACxD,UAAU,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,OAAO,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACjE,UAAU,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,QAAQ,EAAE,CAAC;YACrD,UAAU,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC9C,UAAU,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YAC1D,UAAU,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC3C,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC9C,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC5C,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC;YAC3C,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC;YAC3C,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC1C,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAC;YAEvC,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;YAChD,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;YACpD,UAAU,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;YAClE,UAAU,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;YAC5D,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE;QACpB,MAAM,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;CACF,CAAC,CAAC;AAEH,eAAe,SAAS,CAAC"}

package/dist/server/api-docs.d.ts

@@ -0,0 +1,24 @@
+import type { Auth } from '@nocobase/app-plugin-authentication/server';
+import type { ApiDocsAccess, ApiDocumentFragment } from '@nocobase/app-server/router';
+/** The security scheme an API key satisfies, in `components.securitySchemes`. */
+export declare const API_KEY_SECURITY_SCHEME = "apiKeyAuth";
+/**
+ * Lets a request carrying a valid API key read the API documentation. The key is checked exactly as for any other
+ * request — Better Auth resolves it to its owner's session, which refuses a disabled, expired or unknown key and a key
+ * whose owner is disabled — but without extending a session, so reading the documentation changes no state.
+ *
+ * Allows nothing when the application has not configured this package's `apiKey()` Better Auth plugin, or when the
+ * request carries no key in the headers that plugin reads.
+ */
+export declare function createApiKeyApiDocsAccess(resolveAuth: () => Pick<Auth, 'getSession' | 'plugin'>): ApiDocsAccess;
+/**
+ * The API key header as the document's security scheme, `apiKeyAuth`, and a top-level requirement naming it, offered
+ * beside the session cookie's: a request carrying either is authenticated. The header is the first one this package's
+ * `apiKey()` Better Auth plugin reads a key from, `x-api-key` unless configured. Swagger UI's "Authorize" takes the key
+ * and sends it in that header.
+ *
+ * Contributes nothing when the application has not configured the `apiKey()` plugin, or when no configuration turns
+ * keys into sessions through a header, because then no request authenticates with a key.
+ */
+export declare function createApiKeySecurityFragment(resolveAuth: () => Pick<Auth, 'plugin'>): ApiDocumentFragment;
+//# sourceMappingURL=api-docs.d.ts.map

package/dist/server/api-docs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-docs.d.ts","sourceRoot":"","sources":["../../server/api-docs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,4CAA4C,CAAC;AACvE,OAAO,KAAK,EACV,aAAa,EACb,mBAAmB,EACpB,MAAM,6BAA6B,CAAC;AAWrC,iFAAiF;AACjF,eAAO,MAAM,uBAAuB,eAAe,CAAC;AAEpD;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CACvC,WAAW,EAAE,MAAM,IAAI,CAAC,IAAI,EAAE,YAAY,GAAG,QAAQ,CAAC,GACrD,aAAa,CAsBf;AAED;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAC1C,WAAW,EAAE,MAAM,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,GACtC,mBAAmB,CAqBrB"}

package/dist/server/api-docs.js

@@ -0,0 +1,73 @@
+import { APIError } from 'better-auth/api';
+import { findRequestApiKey, requestApiKeyHeaders, } from './api-keys.js';
+const PACKAGE_NAME = '@nocobase/app-plugin-api-keys';
+/** The security scheme an API key satisfies, in `components.securitySchemes`. */
+export const API_KEY_SECURITY_SCHEME = 'apiKeyAuth';
+/**
+ * Lets a request carrying a valid API key read the API documentation. The key is checked exactly as for any other
+ * request — Better Auth resolves it to its owner's session, which refuses a disabled, expired or unknown key and a key
+ * whose owner is disabled — but without extending a session, so reading the documentation changes no state.
+ *
+ * Allows nothing when the application has not configured this package's `apiKey()` Better Auth plugin, or when the
+ * request carries no key in the headers that plugin reads.
+ */
+export function createApiKeyApiDocsAccess(resolveAuth) {
+    return {
+        name: PACKAGE_NAME,
+        check: async (context) => {
+            const auth = resolveAuth();
+            const plugin = auth.plugin('api-key');
+            if (!plugin?.options?.configurations)
+                return false;
+            const headers = context.req.raw.headers;
+            const key = findRequestApiKey(plugin, headers);
+            if (!key)
+                return false;
+            try {
+                const session = await auth.getSession(headers, {
+                    disableRefresh: true,
+                });
+                // Better Auth answers a request carrying a key with the key's session, whose token is the key itself.
+                return session?.session.token === key;
+            }
+            catch (error) {
+                if (error instanceof APIError)
+                    return false;
+                throw error;
+            }
+        },
+    };
+}
+/**
+ * The API key header as the document's security scheme, `apiKeyAuth`, and a top-level requirement naming it, offered
+ * beside the session cookie's: a request carrying either is authenticated. The header is the first one this package's
+ * `apiKey()` Better Auth plugin reads a key from, `x-api-key` unless configured. Swagger UI's "Authorize" takes the key
+ * and sends it in that header.
+ *
+ * Contributes nothing when the application has not configured the `apiKey()` plugin, or when no configuration turns
+ * keys into sessions through a header, because then no request authenticates with a key.
+ */
+export function createApiKeySecurityFragment(resolveAuth) {
+    const plugin = resolveAuth().plugin('api-key');
+    const [header, ...alternatives] = plugin?.options?.configurations
+        ? requestApiKeyHeaders(plugin)
+        : [];
+    if (!header)
+        return { owner: PACKAGE_NAME };
+    return {
+        owner: PACKAGE_NAME,
+        namespace: 'apiKeys',
+        components: {
+            securitySchemes: {
+                [API_KEY_SECURITY_SCHEME]: {
+                    type: 'apiKey',
+                    in: 'header',
+                    name: header,
+                    description: `An API key issued on the API keys settings page or through \`/api/auth/api-key/create\`. It acts as the user who owns it.${alternatives.length > 0 ? ` The ${alternatives.map((name) => `\`${name}\``).join(', ')} header${alternatives.length > 1 ? 's carry' : ' carries'} it as well.` : ''}`,
+                },
+            },
+        },
+        security: [{ [API_KEY_SECURITY_SCHEME]: [] }],
+    };
+}
+//# sourceMappingURL=api-docs.js.map

package/dist/server/api-docs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-docs.js","sourceRoot":"","sources":["../../server/api-docs.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE3C,OAAO,EACL,iBAAiB,EACjB,oBAAoB,GAErB,MAAM,eAAe,CAAC;AAEvB,MAAM,YAAY,GAAG,+BAA+B,CAAC;AAErD,iFAAiF;AACjF,MAAM,CAAC,MAAM,uBAAuB,GAAG,YAAY,CAAC;AAEpD;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CACvC,WAAsD;IAEtD,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YACvB,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAgB,SAAS,CAAC,CAAC;YACrD,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,cAAc;gBAAE,OAAO,KAAK,CAAC;YACnD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC;YACxC,MAAM,GAAG,GAAG,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC/C,IAAI,CAAC,GAAG;gBAAE,OAAO,KAAK,CAAC;YACvB,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE;oBAC7C,cAAc,EAAE,IAAI;iBACrB,CAAC,CAAC;gBACH,sGAAsG;gBACtG,OAAO,OAAO,EAAE,OAAO,CAAC,KAAK,KAAK,GAAG,CAAC;YACxC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,QAAQ;oBAAE,OAAO,KAAK,CAAC;gBAC5C,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,4BAA4B,CAC1C,WAAuC;IAEvC,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC,MAAM,CAAgB,SAAS,CAAC,CAAC;IAC9D,MAAM,CAAC,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,MAAM,EAAE,OAAO,EAAE,cAAc;QAC/D,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC;QAC9B,CAAC,CAAC,EAAE,CAAC;IACP,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IAC5C,OAAO;QACL,KAAK,EAAE,YAAY;QACnB,SAAS,EAAE,SAAS;QACpB,UAAU,EAAE;YACV,eAAe,EAAE;gBACf,CAAC,uBAAuB,CAAC,EAAE;oBACzB,IAAI,EAAE,QAAQ;oBACd,EAAE,EAAE,QAAQ;oBACZ,IAAI,EAAE,MAAM;oBACZ,WAAW,EAAE,4HAA4H,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,cAAc,CAAC,CAAC,CAAC,EAAE,EAAE;iBAC/S;aACF;SACF;QACD,QAAQ,EAAE,CAAC,EAAE,CAAC,uBAAuB,CAAC,EAAE,EAAE,EAAE,CAAC;KAC9C,CAAC;AACJ,CAAC"}

package/dist/server/api-keys.d.ts

@@ -0,0 +1,52 @@
+import { apiKey as betterAuthApiKey, type ApiKeyConfigurationOptions } from '@better-auth/api-key';
+import { createAuthEndpoint } from 'better-auth/api';
+import type { ApiKey } from '@better-auth/api-key';
+type ServerEndpoint<Options extends Parameters<typeof createAuthEndpoint.serverOnly>[0], Result> = ReturnType<typeof createAuthEndpoint.serverOnly<string, Options, Result>>;
+type UpstreamPlugin = ReturnType<typeof betterAuthApiKey>;
+type ManagedQuery = ReturnType<UpstreamPlugin['endpoints']['getApiKey']['options']['query']['partial']>;
+type ManagedBody = UpstreamPlugin['endpoints']['deleteApiKey']['options']['body'];
+/** The configurations the plugin was created with, after this package's defaults are applied. */
+export interface ApiKeysPluginOptions {
+    readonly configurations: readonly ApiKeyConfigurationOptions[];
+}
+export type ApiKeysPlugin = Omit<UpstreamPlugin, 'endpoints'> & {
+    /** Read by this package's server, for instance to find the key a request carries; Better Auth ignores it. */
+    options: ApiKeysPluginOptions;
+    endpoints: UpstreamPlugin['endpoints'] & {
+        getServerApiKey: ServerEndpoint<{
+            method: 'GET';
+            query: ManagedQuery;
+        }, Omit<ApiKey, 'key'> | null>;
+        deleteServerApiKey: ServerEndpoint<{
+            method: 'POST';
+            body: ManagedBody;
+        }, {
+            success: boolean;
+        }>;
+    };
+};
+/**
+ * Where the plugin's provider puts the application's own-key policy (`ScopedApiKeys.setOwnKeyPolicy`), so the hook on
+ * Better Auth's own `/api-key/create` asks the same question `/api/apiKeys` does.
+ */
+export declare const OWN_KEY_POLICY_SLOT: unique symbol;
+export interface OwnKeyPolicySlot {
+    current: ((userId: string) => Promise<boolean>) | null;
+}
+/** The slot of a plugin `apiKey()` made, or undefined for any other plugin. */
+export declare function ownKeyPolicySlotOf(plugin: unknown): OwnKeyPolicySlot | undefined;
+/**
+ * The API key a request carries, read the way the plugin reads it to authenticate a request: from the header each
+ * configuration that turns keys into sessions names, `x-api-key` unless configured. A configuration with a
+ * `customAPIKeyGetter` is skipped, because that getter needs a Better Auth endpoint context this caller does not have.
+ */
+export declare function findRequestApiKey(plugin: Pick<ApiKeysPlugin, 'options'>, headers: Headers): string | undefined;
+/**
+ * The headers a request may carry its API key in, in the order `findRequestApiKey` reads them: those of each
+ * configuration that turns keys into sessions, `x-api-key` unless configured, without one that has a
+ * `customAPIKeyGetter`.
+ */
+export declare function requestApiKeyHeaders(plugin: Pick<ApiKeysPlugin, 'options'>): string[];
+export declare function apiKey(options?: ApiKeyConfigurationOptions | ApiKeyConfigurationOptions[]): ApiKeysPlugin;
+export {};
+//# sourceMappingURL=api-keys.d.ts.map

package/dist/server/api-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-keys.d.ts","sourceRoot":"","sources":["../../server/api-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,MAAM,IAAI,gBAAgB,EAC1B,KAAK,0BAA0B,EAChC,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAEL,kBAAkB,EAGnB,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAGnD,KAAK,cAAc,CACjB,OAAO,SAAS,UAAU,CAAC,OAAO,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EACnE,MAAM,IACJ,UAAU,CAAC,OAAO,kBAAkB,CAAC,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AAE9E,KAAK,cAAc,GAAG,UAAU,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAC1D,KAAK,YAAY,GAAG,UAAU,CAC5B,cAAc,CAAC,WAAW,CAAC,CAAC,WAAW,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CACxE,CAAC;AACF,KAAK,WAAW,GACd,cAAc,CAAC,WAAW,CAAC,CAAC,cAAc,CAAC,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC;AACjE,iGAAiG;AACjG,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,cAAc,EAAE,SAAS,0BAA0B,EAAE,CAAC;CAChE;AAED,MAAM,MAAM,aAAa,GAAG,IAAI,CAAC,cAAc,EAAE,WAAW,CAAC,GAAG;IAC9D,6GAA6G;IAC7G,OAAO,EAAE,oBAAoB,CAAC;IAC9B,SAAS,EAAE,cAAc,CAAC,WAAW,CAAC,GAAG;QACvC,eAAe,EAAE,cAAc,CAC7B;YAAE,MAAM,EAAE,KAAK,CAAC;YAAC,KAAK,EAAE,YAAY,CAAA;SAAE,EACtC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,IAAI,CAC3B,CAAC;QACF,kBAAkB,EAAE,cAAc,CAChC;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,WAAW,CAAA;SAAE,EACrC;YAAE,OAAO,EAAE,OAAO,CAAA;SAAE,CACrB,CAAC;KACH,CAAC;CACH,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,mBAAmB,EAAE,OAAO,MAExC,CAAC;AAEF,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;CACxD;AAED,+EAA+E;AAC/E,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,OAAO,GACd,gBAAgB,GAAG,SAAS,CAI9B;AA+KD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC,EACtC,OAAO,EAAE,OAAO,GACf,MAAM,GAAG,SAAS,CAMpB;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC,GACrC,MAAM,EAAE,CAUV;AAED,wBAAgB,MAAM,CACpB,OAAO,GAAE,0BAA0B,GAAG,0BAA0B,EAAO,GACtE,aAAa,CAEf"}

package/dist/server/api-keys.js

@@ -0,0 +1,199 @@
+import { apiKey as betterAuthApiKey, } from '@better-auth/api-key';
+import { isServiceAccount } from '@nocobase/app-plugin-authentication/server';
+import { APIError, createAuthEndpoint, createAuthMiddleware, getSessionFromCtx, } from 'better-auth/api';
+import { isDeviceApprovalPath, isKeyManagementPath } from './key-sessions.js';
+/**
+ * Where the plugin's provider puts the application's own-key policy (`ScopedApiKeys.setOwnKeyPolicy`), so the hook on
+ * Better Auth's own `/api-key/create` asks the same question `/api/apiKeys` does.
+ */
+export const OWN_KEY_POLICY_SLOT = Symbol.for('@nocobase/app-plugin-api-keys/own-key-policy');
+/** The slot of a plugin `apiKey()` made, or undefined for any other plugin. */
+export function ownKeyPolicySlotOf(plugin) {
+    if (typeof plugin !== 'object' || plugin === null)
+        return undefined;
+    return Reflect.get(plugin, OWN_KEY_POLICY_SLOT);
+}
+/**
+ * Better Auth's API Key plugin with the defaults a NocoBase application wants.
+ *
+ * `enableSessionForAPIKeys` is the one that has to be set: Better Auth
+ * defaults it off, and with it off a key authenticates nothing — the Settings
+ * page still issues keys, and every request carrying one answers 401.
+ *
+ * Every option is overridable, `enableSessionForAPIKeys` included, so passing
+ * all three back reproduces Better Auth's own behaviour exactly.
+ */
+function createApiKeysPlugin(options = {}) {
+    const configurations = (Array.isArray(options) ? options : [options]).map((configuration) => ({
+        enableSessionForAPIKeys: true,
+        rateLimit: { enabled: false },
+        requireName: true,
+        ...configuration,
+    }));
+    const plugin = betterAuthApiKey(Array.isArray(options) ? configurations : configurations[0]);
+    const managedQuery = plugin.endpoints.getApiKey.options.query.partial();
+    const managedBody = plugin.endpoints.deleteApiKey.options.body;
+    function requireDatabaseConfiguration(configId) {
+        const id = configId ?? 'default';
+        const config = configurations.find((item) => (item.configId ?? 'default') === id);
+        if (!config)
+            throw new Error(`API key configuration "${id}" is not registered.`);
+        if (config.customStorage ||
+            (config.storage && config.storage !== 'database'))
+            throw new Error('Server API key management requires the default database schema and storage.');
+        return id;
+    }
+    const headers = [
+        ...new Set(configurations.flatMap((configuration) => configuration.apiKeyHeaders === undefined
+            ? ['x-api-key']
+            : Array.isArray(configuration.apiKeyHeaders)
+                ? configuration.apiKeyHeaders
+                : [configuration.apiKeyHeaders])),
+    ];
+    const policy = { current: null };
+    const presentedKey = (requestHeaders) => {
+        for (const header of headers) {
+            const value = requestHeaders?.get(header);
+            if (value)
+                return value;
+        }
+        return null;
+    };
+    const result = {
+        ...plugin,
+        options: { configurations },
+        hooks: {
+            ...plugin.hooks,
+            before: [
+                ...plugin.hooks.before,
+                {
+                    // Runs after Better Auth has turned the key into a session. No key manages keys: every `/api-key/*`
+                    // endpoint takes a sign-in, and so does approving a device's sign-in (`/device/*`), which issues a session. A scoped key, and any key of a service account, reaches no account endpoint at
+                    // all: it cannot change the profile, list sessions or sign out either. Only `/get-session` answers, before
+                    // this hook runs.
+                    matcher: (ctx) => presentedKey(ctx.headers) !== null,
+                    handler: createAuthMiddleware(async (ctx) => {
+                        const key = presentedKey(ctx.headers);
+                        const session = ctx.context.session;
+                        if (!key || !session || session.session.token !== key)
+                            return;
+                        if (isKeyManagementPath(ctx.path))
+                            throw APIError.from('FORBIDDEN', {
+                                code: 'API_KEY_SESSION_FORBIDDEN',
+                                message: 'API keys are managed only from a signed-in session.',
+                            });
+                        if (isDeviceApprovalPath(ctx.path))
+                            throw APIError.from('FORBIDDEN', {
+                                code: 'API_KEY_SESSION_FORBIDDEN',
+                                message: 'A device sign-in is approved only from a signed-in session.',
+                            });
+                        let scoped = isServiceAccount(session.user);
+                        if (!scoped) {
+                            const row = await ctx.context.adapter.findOne({
+                                model: 'apikey',
+                                where: [{ field: 'id', value: session.session.id }],
+                            });
+                            scoped = row?.permissions != null;
+                        }
+                        if (scoped)
+                            throw APIError.from('FORBIDDEN', {
+                                code: 'SCOPED_KEY_FORBIDDEN',
+                                message: 'A scoped API key or a service-account key cannot use account endpoints.',
+                            });
+                    }),
+                },
+                {
+                    // A person creating a key of their own from a sign-in: the application may say who may
+                    // (`ScopedApiKeys.setOwnKeyPolicy`). A server call carries no session and is the caller's to authorize.
+                    matcher: (ctx) => ctx.path === '/api-key/create',
+                    handler: createAuthMiddleware(async (ctx) => {
+                        const check = policy.current;
+                        if (!check || presentedKey(ctx.headers) !== null)
+                            return;
+                        const session = await getSessionFromCtx(ctx);
+                        if (session && !(await check(session.user.id)))
+                            throw APIError.from('FORBIDDEN', {
+                                code: 'API_KEY_CREATION_FORBIDDEN',
+                                message: 'You may not create API keys of your own.',
+                            });
+                    }),
+                },
+                // The added hooks answer nothing, so they fit the upstream list, whose type names only what Better Auth's hook
+                // returns.
+            ],
+        },
+        endpoints: {
+            ...plugin.endpoints,
+            getServerApiKey: createAuthEndpoint.serverOnly({ method: 'GET', query: managedQuery }, async (ctx) => {
+                const configId = requireDatabaseConfiguration(ctx.query.configId);
+                if (!ctx.query.id)
+                    return null;
+                const row = await ctx.context.adapter.findOne({
+                    model: 'apikey',
+                    where: [
+                        { field: 'id', value: ctx.query.id },
+                        { field: 'configId', value: configId },
+                    ],
+                });
+                if (!row)
+                    return null;
+                const { key: _hash, ...key } = row;
+                return {
+                    ...key,
+                    permissions: typeof key.permissions === 'string'
+                        ? JSON.parse(key.permissions)
+                        : (key.permissions ?? null),
+                };
+            }),
+            deleteServerApiKey: createAuthEndpoint.serverOnly({ method: 'POST', body: managedBody }, async (ctx) => {
+                const configId = requireDatabaseConfiguration(ctx.body.configId);
+                await ctx.context.adapter.deleteMany({
+                    model: 'apikey',
+                    where: [
+                        { field: 'id', value: ctx.body.keyId },
+                        { field: 'configId', value: configId },
+                    ],
+                });
+                return { success: true };
+            }),
+        },
+    };
+    Object.defineProperty(result, OWN_KEY_POLICY_SLOT, { value: policy });
+    return result;
+}
+/**
+ * The API key a request carries, read the way the plugin reads it to authenticate a request: from the header each
+ * configuration that turns keys into sessions names, `x-api-key` unless configured. A configuration with a
+ * `customAPIKeyGetter` is skipped, because that getter needs a Better Auth endpoint context this caller does not have.
+ */
+export function findRequestApiKey(plugin, headers) {
+    for (const name of requestApiKeyHeaders(plugin)) {
+        const value = headers.get(name);
+        if (value)
+            return value;
+    }
+    return undefined;
+}
+/**
+ * The headers a request may carry its API key in, in the order `findRequestApiKey` reads them: those of each
+ * configuration that turns keys into sessions, `x-api-key` unless configured, without one that has a
+ * `customAPIKeyGetter`.
+ */
+export function requestApiKeyHeaders(plugin) {
+    const headers = [];
+    for (const configuration of plugin.options.configurations) {
+        if (!configuration.enableSessionForAPIKeys)
+            continue;
+        if (configuration.customAPIKeyGetter)
+            continue;
+        const names = configuration.apiKeyHeaders ?? 'x-api-key';
+        for (const name of Array.isArray(names) ? names : [names])
+            if (!headers.includes(name))
+                headers.push(name);
+    }
+    return headers;
+}
+export function apiKey(options = {}) {
+    return createApiKeysPlugin(options);
+}
+//# sourceMappingURL=api-keys.js.map

package/dist/server/api-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-keys.js","sourceRoot":"","sources":["../../server/api-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,MAAM,IAAI,gBAAgB,GAE3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,4CAA4C,CAAC;AAC9E,OAAO,EACL,QAAQ,EACR,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAgC9E;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAkB,MAAM,CAAC,GAAG,CAC1D,8CAA8C,CAC/C,CAAC;AAMF,+EAA+E;AAC/E,MAAM,UAAU,kBAAkB,CAChC,MAAe;IAEf,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACpE,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAChB,CAAC;AACjC,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,mBAAmB,CAC1B,UAAqE,EAAE;IAEvE,MAAM,cAAc,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CACvE,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;QAClB,uBAAuB,EAAE,IAAI;QAC7B,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;QAC7B,WAAW,EAAE,IAAI;QACjB,GAAG,aAAa;KACjB,CAAC,CACH,CAAC;IACF,MAAM,MAAM,GAAG,gBAAgB,CAC7B,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAC5D,CAAC;IACF,MAAM,YAAY,GAChB,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;IACrD,MAAM,WAAW,GAAgB,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC;IAC5E,SAAS,4BAA4B,CAAC,QAA4B;QAChE,MAAM,EAAE,GAAG,QAAQ,IAAI,SAAS,CAAC;QACjC,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAChC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,SAAS,CAAC,KAAK,EAAE,CAC9C,CAAC;QACF,IAAI,CAAC,MAAM;YACT,MAAM,IAAI,KAAK,CAAC,0BAA0B,EAAE,sBAAsB,CAAC,CAAC;QACtE,IACE,MAAM,CAAC,aAAa;YACpB,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,KAAK,UAAU,CAAC;YAEjD,MAAM,IAAI,KAAK,CACb,6EAA6E,CAC9E,CAAC;QACJ,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,OAAO,GAAG;QACd,GAAG,IAAI,GAAG,CACR,cAAc,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,EAAE,CACvC,aAAa,CAAC,aAAa,KAAK,SAAS;YACvC,CAAC,CAAC,CAAC,WAAW,CAAC;YACf,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,aAAa,CAAC;gBAC1C,CAAC,CAAC,aAAa,CAAC,aAAa;gBAC7B,CAAC,CAAC,CAAC,aAAa,CAAC,aAAa,CAAC,CACpC,CACF;KACF,CAAC;IACF,MAAM,MAAM,GAAqB,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACnD,MAAM,YAAY,GAAG,CAAC,cAAmC,EAAE,EAAE;QAC3D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YAC1C,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;QAC1B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IACF,MAAM,MAAM,GAAG;QACb,GAAG,MAAM;QACT,OAAO,EAAE,EAAE,cAAc,EAAE;QAC3B,KAAK,EAAE;YACL,GAAG,MAAM,CAAC,KAAK;YACf,MAAM,EAAE;gBACN,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM;gBACtB;oBACE,oGAAoG;oBACpG,2LAA2L;oBAC3L,2GAA2G;oBAC3G,kBAAkB;oBAClB,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE,CACtC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI;oBACpC,OAAO,EAAE,oBAAoB,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;wBAC1C,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;wBACtC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC;wBACpC,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,KAAK,GAAG;4BAAE,OAAO;wBAC9D,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC;4BAC/B,MAAM,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE;gCAC/B,IAAI,EAAE,2BAA2B;gCACjC,OAAO,EAAE,qDAAqD;6BAC/D,CAAC,CAAC;wBACL,IAAI,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC;4BAChC,MAAM,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE;gCAC/B,IAAI,EAAE,2BAA2B;gCACjC,OAAO,EACL,6DAA6D;6BAChE,CAAC,CAAC;wBACL,IAAI,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;wBAC5C,IAAI,CAAC,MAAM,EAAE,CAAC;4BACZ,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAE1C;gCACD,KAAK,EAAE,QAAQ;gCACf,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;6BACpD,CAAC,CAAC;4BACH,MAAM,GAAG,GAAG,EAAE,WAAW,IAAI,IAAI,CAAC;wBACpC,CAAC;wBACD,IAAI,MAAM;4BACR,MAAM,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE;gCAC/B,IAAI,EAAE,sBAAsB;gCAC5B,OAAO,EACL,yEAAyE;6BAC5E,CAAC,CAAC;oBACP,CAAC,CAAC;iBACH;gBACD;oBACE,uFAAuF;oBACvF,wGAAwG;oBACxG,OAAO,EAAE,CAAC,GAAsB,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,iBAAiB;oBACnE,OAAO,EAAE,oBAAoB,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;wBAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC;wBAC7B,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI;4BAAE,OAAO;wBACzD,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;wBAC7C,IAAI,OAAO,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;4BAC5C,MAAM,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE;gCAC/B,IAAI,EAAE,4BAA4B;gCAClC,OAAO,EAAE,0CAA0C;6BACpD,CAAC,CAAC;oBACP,CAAC,CAAC;iBACH;gBACD,+GAA+G;gBAC/G,WAAW;aACoC;SAClD;QACD,SAAS,EAAE;YACT,GAAG,MAAM,CAAC,SAAS;YACnB,eAAe,EAAE,kBAAkB,CAAC,UAAU,CAC5C,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,EACtC,KAAK,EAAE,GAAG,EAAE,EAAE;gBACZ,MAAM,QAAQ,GAAG,4BAA4B,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAClE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE;oBAAE,OAAO,IAAI,CAAC;gBAC/B,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAS;oBACpD,KAAK,EAAE,QAAQ;oBACf,KAAK,EAAE;wBACL,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE;wBACpC,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE;qBACvC;iBACF,CAAC,CAAC;gBACH,IAAI,CAAC,GAAG;oBAAE,OAAO,IAAI,CAAC;gBACtB,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,GAAG,EAAE,GAAG,GAAG,CAAC;gBACnC,OAAO;oBACL,GAAG,GAAG;oBACN,WAAW,EACT,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ;wBACjC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAA2B;wBACxD,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC;iBAChC,CAAC;YACJ,CAAC,CACF;YACD,kBAAkB,EAAE,kBAAkB,CAAC,UAAU,CAC/C,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,EACrC,KAAK,EAAE,GAAG,EAAE,EAAE;gBACZ,MAAM,QAAQ,GAAG,4BAA4B,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACjE,MAAM,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC;oBACnC,KAAK,EAAE,QAAQ;oBACf,KAAK,EAAE;wBACL,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE;wBACtC,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE;qBACvC;iBACF,CAAC,CAAC;gBACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC3B,CAAC,CACF;SACF;KACF,CAAC;IACF,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,mBAAmB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACtE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAAsC,EACtC,OAAgB;IAEhB,KAAK,MAAM,IAAI,IAAI,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IAC1B,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAsC;IAEtC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,aAAa,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QAC1D,IAAI,CAAC,aAAa,CAAC,uBAAuB;YAAE,SAAS;QACrD,IAAI,aAAa,CAAC,kBAAkB;YAAE,SAAS;QAC/C,MAAM,KAAK,GAAG,aAAa,CAAC,aAAa,IAAI,WAAW,CAAC;QACzD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YACvD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,MAAM,CACpB,UAAqE,EAAE;IAEvE,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAC;AACtC,CAAC"}

package/dist/server/index.d.ts

@@ -0,0 +1,23 @@
+export { default } from './plugin.js';
+/**
+ * Better Auth's API Key plugin with NocoBase defaults and trusted server operations.
+ *
+ * It carries Better Auth's name, options, and behaviour, so Better Auth's
+ * documentation applies unchanged. It is exported from here rather than
+ * installed separately by each application because this package ships the
+ * `apikey` table migration, and that table has to match the schema this
+ * version of `@better-auth/api-key` declares.
+ */
+export { apiKey, findRequestApiKey, OWN_KEY_POLICY_SLOT, ownKeyPolicySlotOf, type ApiKeysPlugin, type ApiKeysPluginOptions, type OwnKeyPolicySlot, } from './api-keys.js';
+export { createApiKeyApiDocsAccess } from './api-docs.js';
+export { API_KEY_ERROR_CODES, API_KEY_TABLE_NAME } from '@better-auth/api-key';
+export type { ApiKey, ApiKeyConfigurationOptions, ApiKeyOptions, } from '@better-auth/api-key';
+export { ApiKeyService, removeUserApiKeys, type ServerApiKeySummary, type CreateServerApiKeyInput, } from './service.js';
+export { ApiKeyScopeError, createApiKeyScopes, type AccessMapping, type MappedAccess, type ApiKeyScopes, type KeyScopeObjectSource, } from './scopes.js';
+export { API_KEY_HEADER, DEVICE_APPROVAL_PATHS, KEY_MANAGEMENT_PATH_PREFIXES, isApiKeySession, isDeviceApprovalPath, isKeyManagementPath, requireSignInSession, } from './key-sessions.js';
+export { ApiKeyRequestError, connectOwnKeyPolicy, DEFAULT_SCOPED_KEY_DAYS, ScopedApiKeys, type ApiKeysConfig, type CheckedApiKey, type OwnKeyPolicy, type ScopedApiKeysOptions, } from './scoped-keys.js';
+export { apiKeyScopesToken, scopedApiKeysToken } from './tokens.js';
+export { API_KEYS_ERROR_DOMAIN, toApiKeysApiError } from './routes/errors.js';
+export { ApiKeysProvider } from './providers/index.js';
+export * from '../shared/scopes.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/server/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAEtC;;;;;;;;GAQG;AACH,OAAO,EACL,MAAM,EACN,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,GACtB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAE1D,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE/E,YAAY,EACV,MAAM,EACN,0BAA0B,EAC1B,aAAa,GACd,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,GAC7B,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,oBAAoB,GAC1B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,4BAA4B,EAC5B,eAAe,EACf,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,uBAAuB,EACvB,aAAa,EACb,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,oBAAoB,GAC1B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,cAAc,qBAAqB,CAAC"}

package/dist/server/index.js

@@ -0,0 +1,22 @@
+export { default } from './plugin.js';
+/**
+ * Better Auth's API Key plugin with NocoBase defaults and trusted server operations.
+ *
+ * It carries Better Auth's name, options, and behaviour, so Better Auth's
+ * documentation applies unchanged. It is exported from here rather than
+ * installed separately by each application because this package ships the
+ * `apikey` table migration, and that table has to match the schema this
+ * version of `@better-auth/api-key` declares.
+ */
+export { apiKey, findRequestApiKey, OWN_KEY_POLICY_SLOT, ownKeyPolicySlotOf, } from './api-keys.js';
+export { createApiKeyApiDocsAccess } from './api-docs.js';
+export { API_KEY_ERROR_CODES, API_KEY_TABLE_NAME } from '@better-auth/api-key';
+export { ApiKeyService, removeUserApiKeys, } from './service.js';
+export { ApiKeyScopeError, createApiKeyScopes, } from './scopes.js';
+export { API_KEY_HEADER, DEVICE_APPROVAL_PATHS, KEY_MANAGEMENT_PATH_PREFIXES, isApiKeySession, isDeviceApprovalPath, isKeyManagementPath, requireSignInSession, } from './key-sessions.js';
+export { ApiKeyRequestError, connectOwnKeyPolicy, DEFAULT_SCOPED_KEY_DAYS, ScopedApiKeys, } from './scoped-keys.js';
+export { apiKeyScopesToken, scopedApiKeysToken } from './tokens.js';
+export { API_KEYS_ERROR_DOMAIN, toApiKeysApiError } from './routes/errors.js';
+export { ApiKeysProvider } from './providers/index.js';
+export * from '../shared/scopes.js';
+//# sourceMappingURL=index.js.map

package/dist/server/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAEtC;;;;;;;;GAQG;AACH,OAAO,EACL,MAAM,EACN,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,GAInB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAE1D,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAO/E,OAAO,EACL,aAAa,EACb,iBAAiB,GAGlB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,gBAAgB,EAChB,kBAAkB,GAKnB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,4BAA4B,EAC5B,eAAe,EACf,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,uBAAuB,EACvB,aAAa,GAKd,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,cAAc,qBAAqB,CAAC"}

package/dist/server/key-sessions.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Telling a session made from an API key apart from a sign-in. Managing API keys takes a sign-in: no key, scoped or
+ * not, creates, rotates or revokes keys, so a leaked key cannot mint its own successors or remove the evidence. For the
+ * same reason no key approves another device's sign-in (Better Auth's device authorization), which issues a session.
+ */
+import type { AuthEnv } from '@nocobase/app-plugin-authentication/server';
+import type { MiddlewareHandler } from 'hono';
+/** The header a key arrives in; Better Auth's default `apiKeyHeaders`. */
+export declare const API_KEY_HEADER = "x-api-key";
+/** The Better Auth endpoints no API key may reach, whatever its scope: every `/api-key/*` endpoint. */
+export declare const KEY_MANAGEMENT_PATH_PREFIXES: readonly string[];
+/** Whether a Better Auth endpoint path manages API keys. */
+export declare function isKeyManagementPath(path: string): boolean;
+/**
+ * Whether a session was made from an API key: Better Auth's key session carries the key as its token, which a
+ * sign-in session never matches.
+ */
+export declare function isApiKeySession(session: {
+    readonly session: {
+        readonly token: string;
+    };
+}, headers: Headers, headerNames?: readonly string[]): boolean;
+/**
+ * The Better Auth endpoints that review, approve or deny a device authorization (`deviceAuthorization()`): approving
+ * issues the device a session, so no API key reaches them.
+ */
+export declare const DEVICE_APPROVAL_PATHS: readonly string[];
+/** Whether a Better Auth endpoint path reviews, approves or denies a device authorization. */
+export declare function isDeviceApprovalPath(path: string): boolean;
+/**
+ * Refuses a request whose session came from an API key with 403 `API_KEY_SESSION_FORBIDDEN`. Install after
+ * `auth.required()` on every route that manages keys, a service account's included.
+ */
+export declare function requireSignInSession(): MiddlewareHandler<AuthEnv>;
+//# sourceMappingURL=key-sessions.d.ts.map

package/dist/server/key-sessions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-sessions.d.ts","sourceRoot":"","sources":["../../server/key-sessions.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,4CAA4C,CAAC;AAE1E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAE9C,0EAA0E;AAC1E,eAAO,MAAM,cAAc,cAAc,CAAC;AAE1C,uGAAuG;AACvG,eAAO,MAAM,4BAA4B,EAAE,SAAS,MAAM,EAAkB,CAAC;AAE7E,4DAA4D;AAC5D,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE;IAAE,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,EACzD,OAAO,EAAE,OAAO,EAChB,WAAW,GAAE,SAAS,MAAM,EAAqB,GAChD,OAAO,CAKT;AAED;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAIlD,CAAC;AAEF,8FAA8F;AAC9F,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,IAAI,iBAAiB,CAAC,OAAO,CAAC,CAejE"}