@nocobase/app-plugin-api-keys 0.0.0-stage → 1.0.0-beta.14

package/dist/server/api-keys.js

@@ -0,0 +1,199 @@
+import { apiKey as betterAuthApiKey, } from '@better-auth/api-key';
+import { isServiceAccount } from '@nocobase/app-plugin-authentication/server';
+import { APIError, createAuthEndpoint, createAuthMiddleware, getSessionFromCtx, } from 'better-auth/api';
+import { isDeviceApprovalPath, isKeyManagementPath } from './key-sessions.js';
+/**
+ * Where the plugin's provider puts the application's own-key policy (`ScopedApiKeys.setOwnKeyPolicy`), so the hook on
+ * Better Auth's own `/api-key/create` asks the same question `/api/apiKeys` does.
+ */
+export const OWN_KEY_POLICY_SLOT = Symbol.for('@nocobase/app-plugin-api-keys/own-key-policy');
+/** The slot of a plugin `apiKey()` made, or undefined for any other plugin. */
+export function ownKeyPolicySlotOf(plugin) {
+    if (typeof plugin !== 'object' || plugin === null)
+        return undefined;
+    return Reflect.get(plugin, OWN_KEY_POLICY_SLOT);
+}
+/**
+ * Better Auth's API Key plugin with the defaults a NocoBase application wants.
+ *
+ * `enableSessionForAPIKeys` is the one that has to be set: Better Auth
+ * defaults it off, and with it off a key authenticates nothing — the Settings
+ * page still issues keys, and every request carrying one answers 401.
+ *
+ * Every option is overridable, `enableSessionForAPIKeys` included, so passing
+ * all three back reproduces Better Auth's own behaviour exactly.
+ */
+function createApiKeysPlugin(options = {}) {
+    const configurations = (Array.isArray(options) ? options : [options]).map((configuration) => ({
+        enableSessionForAPIKeys: true,
+        rateLimit: { enabled: false },
+        requireName: true,
+        ...configuration,
+    }));
+    const plugin = betterAuthApiKey(Array.isArray(options) ? configurations : configurations[0]);
+    const managedQuery = plugin.endpoints.getApiKey.options.query.partial();
+    const managedBody = plugin.endpoints.deleteApiKey.options.body;
+    function requireDatabaseConfiguration(configId) {
+        const id = configId ?? 'default';
+        const config = configurations.find((item) => (item.configId ?? 'default') === id);
+        if (!config)
+            throw new Error(`API key configuration "${id}" is not registered.`);
+        if (config.customStorage ||
+            (config.storage && config.storage !== 'database'))
+            throw new Error('Server API key management requires the default database schema and storage.');
+        return id;
+    }
+    const headers = [
+        ...new Set(configurations.flatMap((configuration) => configuration.apiKeyHeaders === undefined
+            ? ['x-api-key']
+            : Array.isArray(configuration.apiKeyHeaders)
+                ? configuration.apiKeyHeaders
+                : [configuration.apiKeyHeaders])),
+    ];
+    const policy = { current: null };
+    const presentedKey = (requestHeaders) => {
+        for (const header of headers) {
+            const value = requestHeaders?.get(header);
+            if (value)
+                return value;
+        }
+        return null;
+    };
+    const result = {
+        ...plugin,
+        options: { configurations },
+        hooks: {
+            ...plugin.hooks,
+            before: [
+                ...plugin.hooks.before,
+                {
+                    // Runs after Better Auth has turned the key into a session. No key manages keys: every `/api-key/*`
+                    // endpoint takes a sign-in, and so does approving a device's sign-in (`/device/*`), which issues a session. A scoped key, and any key of a service account, reaches no account endpoint at
+                    // all: it cannot change the profile, list sessions or sign out either. Only `/get-session` answers, before
+                    // this hook runs.
+                    matcher: (ctx) => presentedKey(ctx.headers) !== null,
+                    handler: createAuthMiddleware(async (ctx) => {
+                        const key = presentedKey(ctx.headers);
+                        const session = ctx.context.session;
+                        if (!key || !session || session.session.token !== key)
+                            return;
+                        if (isKeyManagementPath(ctx.path))
+                            throw APIError.from('FORBIDDEN', {
+                                code: 'API_KEY_SESSION_FORBIDDEN',
+                                message: 'API keys are managed only from a signed-in session.',
+                            });
+                        if (isDeviceApprovalPath(ctx.path))
+                            throw APIError.from('FORBIDDEN', {
+                                code: 'API_KEY_SESSION_FORBIDDEN',
+                                message: 'A device sign-in is approved only from a signed-in session.',
+                            });
+                        let scoped = isServiceAccount(session.user);
+                        if (!scoped) {
+                            const row = await ctx.context.adapter.findOne({
+                                model: 'apikey',
+                                where: [{ field: 'id', value: session.session.id }],
+                            });
+                            scoped = row?.permissions != null;
+                        }
+                        if (scoped)
+                            throw APIError.from('FORBIDDEN', {
+                                code: 'SCOPED_KEY_FORBIDDEN',
+                                message: 'A scoped API key or a service-account key cannot use account endpoints.',
+                            });
+                    }),
+                },
+                {
+                    // A person creating a key of their own from a sign-in: the application may say who may
+                    // (`ScopedApiKeys.setOwnKeyPolicy`). A server call carries no session and is the caller's to authorize.
+                    matcher: (ctx) => ctx.path === '/api-key/create',
+                    handler: createAuthMiddleware(async (ctx) => {
+                        const check = policy.current;
+                        if (!check || presentedKey(ctx.headers) !== null)
+                            return;
+                        const session = await getSessionFromCtx(ctx);
+                        if (session && !(await check(session.user.id)))
+                            throw APIError.from('FORBIDDEN', {
+                                code: 'API_KEY_CREATION_FORBIDDEN',
+                                message: 'You may not create API keys of your own.',
+                            });
+                    }),
+                },
+                // The added hooks answer nothing, so they fit the upstream list, whose type names only what Better Auth's hook
+                // returns.
+            ],
+        },
+        endpoints: {
+            ...plugin.endpoints,
+            getServerApiKey: createAuthEndpoint.serverOnly({ method: 'GET', query: managedQuery }, async (ctx) => {
+                const configId = requireDatabaseConfiguration(ctx.query.configId);
+                if (!ctx.query.id)
+                    return null;
+                const row = await ctx.context.adapter.findOne({
+                    model: 'apikey',
+                    where: [
+                        { field: 'id', value: ctx.query.id },
+                        { field: 'configId', value: configId },
+                    ],
+                });
+                if (!row)
+                    return null;
+                const { key: _hash, ...key } = row;
+                return {
+                    ...key,
+                    permissions: typeof key.permissions === 'string'
+                        ? JSON.parse(key.permissions)
+                        : (key.permissions ?? null),
+                };
+            }),
+            deleteServerApiKey: createAuthEndpoint.serverOnly({ method: 'POST', body: managedBody }, async (ctx) => {
+                const configId = requireDatabaseConfiguration(ctx.body.configId);
+                await ctx.context.adapter.deleteMany({
+                    model: 'apikey',
+                    where: [
+                        { field: 'id', value: ctx.body.keyId },
+                        { field: 'configId', value: configId },
+                    ],
+                });
+                return { success: true };
+            }),
+        },
+    };
+    Object.defineProperty(result, OWN_KEY_POLICY_SLOT, { value: policy });
+    return result;
+}
+/**
+ * The API key a request carries, read the way the plugin reads it to authenticate a request: from the header each
+ * configuration that turns keys into sessions names, `x-api-key` unless configured. A configuration with a
+ * `customAPIKeyGetter` is skipped, because that getter needs a Better Auth endpoint context this caller does not have.
+ */
+export function findRequestApiKey(plugin, headers) {
+    for (const name of requestApiKeyHeaders(plugin)) {
+        const value = headers.get(name);
+        if (value)
+            return value;
+    }
+    return undefined;
+}
+/**
+ * The headers a request may carry its API key in, in the order `findRequestApiKey` reads them: those of each
+ * configuration that turns keys into sessions, `x-api-key` unless configured, without one that has a
+ * `customAPIKeyGetter`.
+ */
+export function requestApiKeyHeaders(plugin) {
+    const headers = [];
+    for (const configuration of plugin.options.configurations) {
+        if (!configuration.enableSessionForAPIKeys)
+            continue;
+        if (configuration.customAPIKeyGetter)
+            continue;
+        const names = configuration.apiKeyHeaders ?? 'x-api-key';
+        for (const name of Array.isArray(names) ? names : [names])
+            if (!headers.includes(name))
+                headers.push(name);
+    }
+    return headers;
+}
+export function apiKey(options = {}) {
+    return createApiKeysPlugin(options);
+}
+//# sourceMappingURL=api-keys.js.map

package/dist/server/api-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-keys.js","sourceRoot":"","sources":["../../server/api-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,MAAM,IAAI,gBAAgB,GAE3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,4CAA4C,CAAC;AAC9E,OAAO,EACL,QAAQ,EACR,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAgC9E;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAkB,MAAM,CAAC,GAAG,CAC1D,8CAA8C,CAC/C,CAAC;AAMF,+EAA+E;AAC/E,MAAM,UAAU,kBAAkB,CAChC,MAAe;IAEf,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACpE,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAChB,CAAC;AACjC,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,mBAAmB,CAC1B,UAAqE,EAAE;IAEvE,MAAM,cAAc,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CACvE,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;QAClB,uBAAuB,EAAE,IAAI;QAC7B,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;QAC7B,WAAW,EAAE,IAAI;QACjB,GAAG,aAAa;KACjB,CAAC,CACH,CAAC;IACF,MAAM,MAAM,GAAG,gBAAgB,CAC7B,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAC5D,CAAC;IACF,MAAM,YAAY,GAChB,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;IACrD,MAAM,WAAW,GAAgB,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC;IAC5E,SAAS,4BAA4B,CAAC,QAA4B;QAChE,MAAM,EAAE,GAAG,QAAQ,IAAI,SAAS,CAAC;QACjC,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAChC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,SAAS,CAAC,KAAK,EAAE,CAC9C,CAAC;QACF,IAAI,CAAC,MAAM;YACT,MAAM,IAAI,KAAK,CAAC,0BAA0B,EAAE,sBAAsB,CAAC,CAAC;QACtE,IACE,MAAM,CAAC,aAAa;YACpB,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,KAAK,UAAU,CAAC;YAEjD,MAAM,IAAI,KAAK,CACb,6EAA6E,CAC9E,CAAC;QACJ,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,OAAO,GAAG;QACd,GAAG,IAAI,GAAG,CACR,cAAc,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,EAAE,CACvC,aAAa,CAAC,aAAa,KAAK,SAAS;YACvC,CAAC,CAAC,CAAC,WAAW,CAAC;YACf,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,aAAa,CAAC;gBAC1C,CAAC,CAAC,aAAa,CAAC,aAAa;gBAC7B,CAAC,CAAC,CAAC,aAAa,CAAC,aAAa,CAAC,CACpC,CACF;KACF,CAAC;IACF,MAAM,MAAM,GAAqB,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACnD,MAAM,YAAY,GAAG,CAAC,cAAmC,EAAE,EAAE;QAC3D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YAC1C,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;QAC1B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IACF,MAAM,MAAM,GAAG;QACb,GAAG,MAAM;QACT,OAAO,EAAE,EAAE,cAAc,EAAE;QAC3B,KAAK,EAAE;YACL,GAAG,MAAM,CAAC,KAAK;YACf,MAAM,EAAE;gBACN,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM;gBACtB;oBACE,oGAAoG;oBACpG,2LAA2L;oBAC3L,2GAA2G;oBAC3G,kBAAkB;oBAClB,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE,CACtC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI;oBACpC,OAAO,EAAE,oBAAoB,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;wBAC1C,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;wBACtC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC;wBACpC,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,KAAK,GAAG;4BAAE,OAAO;wBAC9D,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC;4BAC/B,MAAM,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE;gCAC/B,IAAI,EAAE,2BAA2B;gCACjC,OAAO,EAAE,qDAAqD;6BAC/D,CAAC,CAAC;wBACL,IAAI,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC;4BAChC,MAAM,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE;gCAC/B,IAAI,EAAE,2BAA2B;gCACjC,OAAO,EACL,6DAA6D;6BAChE,CAAC,CAAC;wBACL,IAAI,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;wBAC5C,IAAI,CAAC,MAAM,EAAE,CAAC;4BACZ,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAE1C;gCACD,KAAK,EAAE,QAAQ;gCACf,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;6BACpD,CAAC,CAAC;4BACH,MAAM,GAAG,GAAG,EAAE,WAAW,IAAI,IAAI,CAAC;wBACpC,CAAC;wBACD,IAAI,MAAM;4BACR,MAAM,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE;gCAC/B,IAAI,EAAE,sBAAsB;gCAC5B,OAAO,EACL,yEAAyE;6BAC5E,CAAC,CAAC;oBACP,CAAC,CAAC;iBACH;gBACD;oBACE,uFAAuF;oBACvF,wGAAwG;oBACxG,OAAO,EAAE,CAAC,GAAsB,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,iBAAiB;oBACnE,OAAO,EAAE,oBAAoB,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;wBAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC;wBAC7B,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI;4BAAE,OAAO;wBACzD,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;wBAC7C,IAAI,OAAO,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;4BAC5C,MAAM,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE;gCAC/B,IAAI,EAAE,4BAA4B;gCAClC,OAAO,EAAE,0CAA0C;6BACpD,CAAC,CAAC;oBACP,CAAC,CAAC;iBACH;gBACD,+GAA+G;gBAC/G,WAAW;aACoC;SAClD;QACD,SAAS,EAAE;YACT,GAAG,MAAM,CAAC,SAAS;YACnB,eAAe,EAAE,kBAAkB,CAAC,UAAU,CAC5C,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,EACtC,KAAK,EAAE,GAAG,EAAE,EAAE;gBACZ,MAAM,QAAQ,GAAG,4BAA4B,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAClE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE;oBAAE,OAAO,IAAI,CAAC;gBAC/B,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAS;oBACpD,KAAK,EAAE,QAAQ;oBACf,KAAK,EAAE;wBACL,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE;wBACpC,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE;qBACvC;iBACF,CAAC,CAAC;gBACH,IAAI,CAAC,GAAG;oBAAE,OAAO,IAAI,CAAC;gBACtB,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,GAAG,EAAE,GAAG,GAAG,CAAC;gBACnC,OAAO;oBACL,GAAG,GAAG;oBACN,WAAW,EACT,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ;wBACjC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAA2B;wBACxD,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC;iBAChC,CAAC;YACJ,CAAC,CACF;YACD,kBAAkB,EAAE,kBAAkB,CAAC,UAAU,CAC/C,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,EACrC,KAAK,EAAE,GAAG,EAAE,EAAE;gBACZ,MAAM,QAAQ,GAAG,4BAA4B,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACjE,MAAM,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC;oBACnC,KAAK,EAAE,QAAQ;oBACf,KAAK,EAAE;wBACL,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE;wBACtC,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE;qBACvC;iBACF,CAAC,CAAC;gBACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC3B,CAAC,CACF;SACF;KACF,CAAC;IACF,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,mBAAmB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACtE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAAsC,EACtC,OAAgB;IAEhB,KAAK,MAAM,IAAI,IAAI,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IAC1B,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAsC;IAEtC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,aAAa,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QAC1D,IAAI,CAAC,aAAa,CAAC,uBAAuB;YAAE,SAAS;QACrD,IAAI,aAAa,CAAC,kBAAkB;YAAE,SAAS;QAC/C,MAAM,KAAK,GAAG,aAAa,CAAC,aAAa,IAAI,WAAW,CAAC;QACzD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YACvD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,MAAM,CACpB,UAAqE,EAAE;IAEvE,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAC;AACtC,CAAC"}

package/dist/server/index.d.ts

@@ -0,0 +1,23 @@
+export { default } from './plugin.js';
+/**
+ * Better Auth's API Key plugin with NocoBase defaults and trusted server operations.
+ *
+ * It carries Better Auth's name, options, and behaviour, so Better Auth's
+ * documentation applies unchanged. It is exported from here rather than
+ * installed separately by each application because this package ships the
+ * `apikey` table migration, and that table has to match the schema this
+ * version of `@better-auth/api-key` declares.
+ */
+export { apiKey, findRequestApiKey, OWN_KEY_POLICY_SLOT, ownKeyPolicySlotOf, type ApiKeysPlugin, type ApiKeysPluginOptions, type OwnKeyPolicySlot, } from './api-keys.js';
+export { createApiKeyApiDocsAccess } from './api-docs.js';
+export { API_KEY_ERROR_CODES, API_KEY_TABLE_NAME } from '@better-auth/api-key';
+export type { ApiKey, ApiKeyConfigurationOptions, ApiKeyOptions, } from '@better-auth/api-key';
+export { ApiKeyService, removeUserApiKeys, type ServerApiKeySummary, type CreateServerApiKeyInput, } from './service.js';
+export { ApiKeyScopeError, createApiKeyScopes, type AccessMapping, type MappedAccess, type ApiKeyScopes, type KeyScopeObjectSource, } from './scopes.js';
+export { API_KEY_HEADER, DEVICE_APPROVAL_PATHS, KEY_MANAGEMENT_PATH_PREFIXES, isApiKeySession, isDeviceApprovalPath, isKeyManagementPath, requireSignInSession, } from './key-sessions.js';
+export { ApiKeyRequestError, connectOwnKeyPolicy, DEFAULT_SCOPED_KEY_DAYS, ScopedApiKeys, type ApiKeysConfig, type CheckedApiKey, type OwnKeyPolicy, type ScopedApiKeysOptions, } from './scoped-keys.js';
+export { apiKeyScopesToken, scopedApiKeysToken } from './tokens.js';
+export { API_KEYS_ERROR_DOMAIN, toApiKeysApiError } from './routes/errors.js';
+export { ApiKeysProvider } from './providers/index.js';
+export * from '../shared/scopes.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/server/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAEtC;;;;;;;;GAQG;AACH,OAAO,EACL,MAAM,EACN,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,GACtB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAE1D,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE/E,YAAY,EACV,MAAM,EACN,0BAA0B,EAC1B,aAAa,GACd,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,GAC7B,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,oBAAoB,GAC1B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,4BAA4B,EAC5B,eAAe,EACf,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,uBAAuB,EACvB,aAAa,EACb,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,oBAAoB,GAC1B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,cAAc,qBAAqB,CAAC"}

package/dist/server/index.js

@@ -0,0 +1,22 @@
+export { default } from './plugin.js';
+/**
+ * Better Auth's API Key plugin with NocoBase defaults and trusted server operations.
+ *
+ * It carries Better Auth's name, options, and behaviour, so Better Auth's
+ * documentation applies unchanged. It is exported from here rather than
+ * installed separately by each application because this package ships the
+ * `apikey` table migration, and that table has to match the schema this
+ * version of `@better-auth/api-key` declares.
+ */
+export { apiKey, findRequestApiKey, OWN_KEY_POLICY_SLOT, ownKeyPolicySlotOf, } from './api-keys.js';
+export { createApiKeyApiDocsAccess } from './api-docs.js';
+export { API_KEY_ERROR_CODES, API_KEY_TABLE_NAME } from '@better-auth/api-key';
+export { ApiKeyService, removeUserApiKeys, } from './service.js';
+export { ApiKeyScopeError, createApiKeyScopes, } from './scopes.js';
+export { API_KEY_HEADER, DEVICE_APPROVAL_PATHS, KEY_MANAGEMENT_PATH_PREFIXES, isApiKeySession, isDeviceApprovalPath, isKeyManagementPath, requireSignInSession, } from './key-sessions.js';
+export { ApiKeyRequestError, connectOwnKeyPolicy, DEFAULT_SCOPED_KEY_DAYS, ScopedApiKeys, } from './scoped-keys.js';
+export { apiKeyScopesToken, scopedApiKeysToken } from './tokens.js';
+export { API_KEYS_ERROR_DOMAIN, toApiKeysApiError } from './routes/errors.js';
+export { ApiKeysProvider } from './providers/index.js';
+export * from '../shared/scopes.js';
+//# sourceMappingURL=index.js.map

package/dist/server/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAEtC;;;;;;;;GAQG;AACH,OAAO,EACL,MAAM,EACN,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,GAInB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAE1D,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAO/E,OAAO,EACL,aAAa,EACb,iBAAiB,GAGlB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,gBAAgB,EAChB,kBAAkB,GAKnB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,4BAA4B,EAC5B,eAAe,EACf,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,uBAAuB,EACvB,aAAa,GAKd,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,cAAc,qBAAqB,CAAC"}

package/dist/server/key-sessions.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Telling a session made from an API key apart from a sign-in. Managing API keys takes a sign-in: no key, scoped or
+ * not, creates, rotates or revokes keys, so a leaked key cannot mint its own successors or remove the evidence. For the
+ * same reason no key approves another device's sign-in (Better Auth's device authorization), which issues a session.
+ */
+import type { AuthEnv } from '@nocobase/app-plugin-authentication/server';
+import type { MiddlewareHandler } from 'hono';
+/** The header a key arrives in; Better Auth's default `apiKeyHeaders`. */
+export declare const API_KEY_HEADER = "x-api-key";
+/** The Better Auth endpoints no API key may reach, whatever its scope: every `/api-key/*` endpoint. */
+export declare const KEY_MANAGEMENT_PATH_PREFIXES: readonly string[];
+/** Whether a Better Auth endpoint path manages API keys. */
+export declare function isKeyManagementPath(path: string): boolean;
+/**
+ * Whether a session was made from an API key: Better Auth's key session carries the key as its token, which a
+ * sign-in session never matches.
+ */
+export declare function isApiKeySession(session: {
+    readonly session: {
+        readonly token: string;
+    };
+}, headers: Headers, headerNames?: readonly string[]): boolean;
+/**
+ * The Better Auth endpoints that review, approve or deny a device authorization (`deviceAuthorization()`): approving
+ * issues the device a session, so no API key reaches them.
+ */
+export declare const DEVICE_APPROVAL_PATHS: readonly string[];
+/** Whether a Better Auth endpoint path reviews, approves or denies a device authorization. */
+export declare function isDeviceApprovalPath(path: string): boolean;
+/**
+ * Refuses a request whose session came from an API key with 403 `API_KEY_SESSION_FORBIDDEN`. Install after
+ * `auth.required()` on every route that manages keys, a service account's included.
+ */
+export declare function requireSignInSession(): MiddlewareHandler<AuthEnv>;
+//# sourceMappingURL=key-sessions.d.ts.map

package/dist/server/key-sessions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-sessions.d.ts","sourceRoot":"","sources":["../../server/key-sessions.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,4CAA4C,CAAC;AAE1E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAE9C,0EAA0E;AAC1E,eAAO,MAAM,cAAc,cAAc,CAAC;AAE1C,uGAAuG;AACvG,eAAO,MAAM,4BAA4B,EAAE,SAAS,MAAM,EAAkB,CAAC;AAE7E,4DAA4D;AAC5D,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE;IAAE,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,EACzD,OAAO,EAAE,OAAO,EAChB,WAAW,GAAE,SAAS,MAAM,EAAqB,GAChD,OAAO,CAKT;AAED;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAIlD,CAAC;AAEF,8FAA8F;AAC9F,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,IAAI,iBAAiB,CAAC,OAAO,CAAC,CAejE"}

package/dist/server/key-sessions.js

@@ -0,0 +1,50 @@
+import { ApiError, apiErrorHandler } from '@nocobase/app-server/router';
+/** The header a key arrives in; Better Auth's default `apiKeyHeaders`. */
+export const API_KEY_HEADER = 'x-api-key';
+/** The Better Auth endpoints no API key may reach, whatever its scope: every `/api-key/*` endpoint. */
+export const KEY_MANAGEMENT_PATH_PREFIXES = ['/api-key/'];
+/** Whether a Better Auth endpoint path manages API keys. */
+export function isKeyManagementPath(path) {
+    return KEY_MANAGEMENT_PATH_PREFIXES.some((prefix) => path.startsWith(prefix));
+}
+/**
+ * Whether a session was made from an API key: Better Auth's key session carries the key as its token, which a
+ * sign-in session never matches.
+ */
+export function isApiKeySession(session, headers, headerNames = [API_KEY_HEADER]) {
+    return headerNames.some((name) => {
+        const key = headers.get(name);
+        return Boolean(key) && session.session.token === key;
+    });
+}
+/**
+ * The Better Auth endpoints that review, approve or deny a device authorization (`deviceAuthorization()`): approving
+ * issues the device a session, so no API key reaches them.
+ */
+export const DEVICE_APPROVAL_PATHS = [
+    '/device',
+    '/device/approve',
+    '/device/deny',
+];
+/** Whether a Better Auth endpoint path reviews, approves or denies a device authorization. */
+export function isDeviceApprovalPath(path) {
+    return DEVICE_APPROVAL_PATHS.includes(path);
+}
+/**
+ * Refuses a request whose session came from an API key with 403 `API_KEY_SESSION_FORBIDDEN`. Install after
+ * `auth.required()` on every route that manages keys, a service account's included.
+ */
+export function requireSignInSession() {
+    return async (context, next) => {
+        const auth = context.get('auth');
+        if (auth && isApiKeySession(auth, context.req.raw.headers))
+            return apiErrorHandler(new ApiError({
+                status: 'PERMISSION_DENIED',
+                reason: 'API_KEY_SESSION_FORBIDDEN',
+                domain: 'apiKeys',
+                message: 'API keys are managed only from a signed-in session.',
+            }), context);
+        await next();
+    };
+}
+//# sourceMappingURL=key-sessions.js.map

package/dist/server/key-sessions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-sessions.js","sourceRoot":"","sources":["../../server/key-sessions.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAGxE,0EAA0E;AAC1E,MAAM,CAAC,MAAM,cAAc,GAAG,WAAW,CAAC;AAE1C,uGAAuG;AACvG,MAAM,CAAC,MAAM,4BAA4B,GAAsB,CAAC,WAAW,CAAC,CAAC;AAE7E,4DAA4D;AAC5D,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,4BAA4B,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AAChF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAyD,EACzD,OAAgB,EAChB,cAAiC,CAAC,cAAc,CAAC;IAEjD,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;QAC/B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9B,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,KAAK,GAAG,CAAC;IACvD,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAsB;IACtD,SAAS;IACT,iBAAiB;IACjB,cAAc;CACf,CAAC;AAEF,8FAA8F;AAC9F,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,OAAO,qBAAqB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,IAAI,IAAI,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC;YACxD,OAAO,eAAe,CACpB,IAAI,QAAQ,CAAC;gBACX,MAAM,EAAE,mBAAmB;gBAC3B,MAAM,EAAE,2BAA2B;gBACnC,MAAM,EAAE,SAAS;gBACjB,OAAO,EAAE,qDAAqD;aAC/D,CAAC,EACF,OAAO,CACR,CAAC;QACJ,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC"}

package/dist/server/plugin.d.ts

@@ -0,0 +1,4 @@
+import { type AppServerPlugin } from '@nocobase/app-server/plugins';
+declare const apiKeysPlugin: AppServerPlugin;
+export default apiKeysPlugin;
+//# sourceMappingURL=plugin.d.ts.map

package/dist/server/plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../server/plugin.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,8BAA8B,CAAC;AAKtC,QAAA,MAAM,aAAa,EAAE,eAQnB,CAAC;AAEH,eAAe,aAAa,CAAC"}

package/dist/server/plugin.js

@@ -0,0 +1,15 @@
+import path from 'node:path';
+import { defineServerPlugin, } from '@nocobase/app-server/plugins';
+import serviceProviders from './providers/index.js';
+import routes from './routes/index.js';
+const apiKeysPlugin = defineServerPlugin({
+    baseDir: path.resolve(import.meta.dirname, '..'),
+    packageName: '@nocobase/app-plugin-api-keys',
+    serviceProviders,
+    routes,
+    database: {
+        migrations: './database/migrations',
+    },
+});
+export default apiKeysPlugin;
+//# sourceMappingURL=plugin.js.map

package/dist/server/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../server/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EACL,kBAAkB,GAEnB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,gBAAgB,MAAM,sBAAsB,CAAC;AACpD,OAAO,MAAM,MAAM,mBAAmB,CAAC;AAEvC,MAAM,aAAa,GAAoB,kBAAkB,CAAC;IACxD,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC;IAChD,WAAW,EAAE,+BAA+B;IAC5C,gBAAgB;IAChB,MAAM;IACN,QAAQ,EAAE;QACR,UAAU,EAAE,uBAAuB;KACpC;CACF,CAAC,CAAC;AAEH,eAAe,aAAa,CAAC"}

package/dist/server/providers/index.d.ts

@@ -0,0 +1,19 @@
+import type { AppPluginApplication, AppPluginProviderConstructor } from '@nocobase/app-server/plugins';
+import { ServiceProvider } from '@nocobase/service-provider';
+/**
+ * Binds the key-scope registry and the scoped-key service, and at boot teaches authentication and authorization to
+ * recognize a scoped key: `auth.required()` refuses one unless the route opts in, and the authorization identity of a
+ * request made with one carries its `keyScope`. Also lets a request carrying a valid API key read the application's API
+ * documentation, and adds the API key header to the document as a security scheme.
+ */
+export declare class ApiKeysProvider extends ServiceProvider<AppPluginApplication> {
+    readonly name: string;
+    private readonly releases;
+    private booted;
+    register(): void;
+    boot(): Promise<void>;
+    shutdown(): Promise<void>;
+}
+export declare const serviceProviders: readonly AppPluginProviderConstructor[];
+export default serviceProviders;
+//# sourceMappingURL=index.d.ts.map

package/dist/server/providers/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../server/providers/index.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,oBAAoB,EACpB,4BAA4B,EAC7B,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAc7D;;;;;GAKG;AACH,qBAAa,eAAgB,SAAQ,eAAe,CAAC,oBAAoB,CAAC;IACxE,SAAgB,IAAI,EAAE,MAAM,CAAmC;IAC/D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAsB;IAC/C,OAAO,CAAC,MAAM,CAAS;IAEP,QAAQ,IAAI,IAAI;IAmBV,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAuC3B,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAI1C;AAED,eAAO,MAAM,gBAAgB,EAAE,SAAS,4BAA4B,EAEnE,CAAC;AAEF,eAAe,gBAAgB,CAAC"}

package/dist/server/providers/index.js

@@ -0,0 +1,72 @@
+import { authenticationToken } from '@nocobase/app-plugin-authentication/server';
+import { authorizationToken } from '@nocobase/app-plugin-authorization';
+import { apiDocsToken } from '@nocobase/app-server/router';
+import { databaseManagerToken } from '@nocobase/db';
+import { ServiceProvider } from '@nocobase/service-provider';
+import { createApiKeyApiDocsAccess, createApiKeySecurityFragment, } from '../api-docs.js';
+import { connectOwnKeyPolicy, ScopedApiKeys, } from '../scoped-keys.js';
+import { apiKeyScopesToken, createApiKeyScopes } from '../scopes.js';
+import { scopedApiKeysToken } from '../tokens.js';
+/**
+ * Binds the key-scope registry and the scoped-key service, and at boot teaches authentication and authorization to
+ * recognize a scoped key: `auth.required()` refuses one unless the route opts in, and the authorization identity of a
+ * request made with one carries its `keyScope`. Also lets a request carrying a valid API key read the application's API
+ * documentation, and adds the API key header to the document as a security scheme.
+ */
+export class ApiKeysProvider extends ServiceProvider {
+    name = '@nocobase/app-plugin-api-keys';
+    releases = [];
+    booted = false;
+    register() {
+        const { container } = this.app;
+        container.singleton(apiKeyScopesToken, () => createApiKeyScopes());
+        container.singleton(scopedApiKeysToken, (resolver) => new ScopedApiKeys({
+            auth: resolver.resolve(authenticationToken),
+            connection: () => resolver.resolve(databaseManagerToken).connection(),
+            scopes: resolver.resolve(apiKeyScopesToken),
+            authorization: () => container.has(authorizationToken)
+                ? resolver.resolve(authorizationToken)
+                : undefined,
+            config: () => this.app.config.get('apiKeys'),
+        }));
+    }
+    async boot() {
+        const { container } = this.app;
+        if (this.booted ||
+            !container.has(authenticationToken) ||
+            !container.has(databaseManagerToken))
+            return;
+        this.booted = true;
+        if (container.has(apiDocsToken)) {
+            const apiDocs = container.resolve(apiDocsToken);
+            const resolveAuth = () => container.resolve(authenticationToken);
+            apiDocs.addAccess(createApiKeyApiDocsAccess(resolveAuth));
+            // Resolved on the first request for the document, like the access check, so starting the application builds nothing.
+            apiDocs.addFragment(() => createApiKeySecurityFragment(resolveAuth));
+        }
+        const keys = container.resolve(scopedApiKeysToken);
+        const auth = container.resolve(authenticationToken);
+        this.releases.push(await connectOwnKeyPolicy(auth, keys));
+        this.releases.push(auth.addScopedCredentialCheck(async (session, request) => (await keys.resolve(session, request)) !== null));
+        if (container.has(authorizationToken))
+            container.resolve(authorizationToken).use(async (request, next) => {
+                const session = request.http.get('auth');
+                if (session && typeof session === 'object' && 'session' in session) {
+                    const scope = await keys.resolve(session, request.http.req.raw);
+                    if (scope)
+                        request.keyScope = scope;
+                }
+                await next();
+            });
+    }
+    shutdown() {
+        for (const release of this.releases.splice(0))
+            release();
+        return Promise.resolve();
+    }
+}
+export const serviceProviders = [
+    ApiKeysProvider,
+];
+export default serviceProviders;
+//# sourceMappingURL=index.js.map

package/dist/server/providers/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../server/providers/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAC;AACjF,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAKxE,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAE7D,OAAO,EACL,yBAAyB,EACzB,4BAA4B,GAC7B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,mBAAmB,EACnB,aAAa,GAEd,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAElD;;;;;GAKG;AACH,MAAM,OAAO,eAAgB,SAAQ,eAAqC;IACxD,IAAI,GAAW,+BAA+B,CAAC;IAC9C,QAAQ,GAAmB,EAAE,CAAC;IACvC,MAAM,GAAG,KAAK,CAAC;IAEP,QAAQ;QACtB,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC;QAC/B,SAAS,CAAC,SAAS,CAAC,iBAAiB,EAAE,GAAG,EAAE,CAAC,kBAAkB,EAAE,CAAC,CAAC;QACnE,SAAS,CAAC,SAAS,CACjB,kBAAkB,EAClB,CAAC,QAAQ,EAAE,EAAE,CACX,IAAI,aAAa,CAAC;YAChB,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,mBAAmB,CAAC;YAC3C,UAAU,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,UAAU,EAAE;YACrE,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,iBAAiB,CAAC;YAC3C,aAAa,EAAE,GAAG,EAAE,CAClB,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC;gBAC/B,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,kBAAkB,CAAC;gBACtC,CAAC,CAAC,SAAS;YACf,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAgB,SAAS,CAAC;SAC5D,CAAC,CACL,CAAC;IACJ,CAAC;IAEe,KAAK,CAAC,IAAI;QACxB,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC;QAC/B,IACE,IAAI,CAAC,MAAM;YACX,CAAC,SAAS,CAAC,GAAG,CAAC,mBAAmB,CAAC;YACnC,CAAC,SAAS,CAAC,GAAG,CAAC,oBAAoB,CAAC;YAEpC,OAAO;QACT,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YAChC,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YAChD,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;YACjE,OAAO,CAAC,SAAS,CAAC,yBAAyB,CAAC,WAAW,CAAC,CAAC,CAAC;YAC1D,qHAAqH;YACrH,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,4BAA4B,CAAC,WAAW,CAAC,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;QACpD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QAC1D,IAAI,CAAC,QAAQ,CAAC,IAAI,CAChB,IAAI,CAAC,wBAAwB,CAC3B,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CACzB,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,KAAK,IAAI,CAClD,CACF,CAAC;QACF,IAAI,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC;YACnC,SAAS,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;gBAChE,MAAM,OAAO,GAAY,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAe,CAAC,CAAC;gBAC3D,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,SAAS,IAAI,OAAO,EAAE,CAAC;oBACnE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAC9B,OAA6C,EAC7C,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CACrB,CAAC;oBACF,IAAI,KAAK;wBAAE,OAAO,CAAC,QAAQ,GAAG,KAAK,CAAC;gBACtC,CAAC;gBACD,MAAM,IAAI,EAAE,CAAC;YACf,CAAC,CAAC,CAAC;IACP,CAAC;IAEe,QAAQ;QACtB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YAAE,OAAO,EAAE,CAAC;QACzD,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,CAAC,MAAM,gBAAgB,GAA4C;IACvE,eAAe;CAChB,CAAC;AAEF,eAAe,gBAAgB,CAAC"}

package/dist/server/routes/errors.d.ts

@@ -0,0 +1,8 @@
+/** The error domain of the API keys plugin: its URL namespace. */
+export declare const API_KEYS_ERROR_DOMAIN = "apiKeys";
+/**
+ * The plugin's own errors as `ApiError`, domain `apiKeys`, with their code as the reason; anything else is returned
+ * unchanged for `apiErrorHandler`. Exported so an application's own key routes answer the same way.
+ */
+export declare function toApiKeysApiError(error: unknown): unknown;
+//# sourceMappingURL=errors.d.ts.map

package/dist/server/routes/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../server/routes/errors.ts"],"names":[],"mappings":"AAKA,kEAAkE;AAClE,eAAO,MAAM,qBAAqB,YAAY,CAAC;AAe/C;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAwBzD"}

package/dist/server/routes/errors.js

@@ -0,0 +1,48 @@
+import { ApiError } from '@nocobase/app-server/router';
+import { ApiKeyRequestError } from '../scoped-keys.js';
+import { ApiKeyScopeError } from '../scopes.js';
+/** The error domain of the API keys plugin: its URL namespace. */
+export const API_KEYS_ERROR_DOMAIN = 'apiKeys';
+const FIELD_OF = {
+    EXPIRY_REQUIRED: 'expiresInDays',
+    INVALID_EXPIRY: 'expiresInDays',
+};
+function statusOf(error) {
+    if (error.status === 403)
+        return 'PERMISSION_DENIED';
+    if (error.status === 404)
+        return 'NOT_FOUND';
+    return error.code === 'KEY_NOT_SCOPED'
+        ? 'FAILED_PRECONDITION'
+        : 'INVALID_ARGUMENT';
+}
+/**
+ * The plugin's own errors as `ApiError`, domain `apiKeys`, with their code as the reason; anything else is returned
+ * unchanged for `apiErrorHandler`. Exported so an application's own key routes answer the same way.
+ */
+export function toApiKeysApiError(error) {
+    if (error instanceof ApiKeyScopeError)
+        return new ApiError({
+            status: 'INVALID_ARGUMENT',
+            reason: error.code,
+            domain: API_KEYS_ERROR_DOMAIN,
+            message: error.message,
+            fieldViolations: [{ field: 'scope', description: error.message }],
+            cause: error,
+        });
+    if (error instanceof ApiKeyRequestError) {
+        const field = FIELD_OF[error.code];
+        return new ApiError({
+            status: statusOf(error),
+            reason: error.code,
+            domain: API_KEYS_ERROR_DOMAIN,
+            message: error.message,
+            ...(field
+                ? { fieldViolations: [{ field, description: error.message }] }
+                : {}),
+            cause: error,
+        });
+    }
+    return error;
+}
+//# sourceMappingURL=errors.js.map

package/dist/server/routes/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../server/routes/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAuB,MAAM,6BAA6B,CAAC;AAE5E,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhD,kEAAkE;AAClE,MAAM,CAAC,MAAM,qBAAqB,GAAG,SAAS,CAAC;AAE/C,MAAM,QAAQ,GAAqC;IACjD,eAAe,EAAE,eAAe;IAChC,cAAc,EAAE,eAAe;CAChC,CAAC;AAEF,SAAS,QAAQ,CAAC,KAAyB;IACzC,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,mBAAmB,CAAC;IACrD,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,WAAW,CAAC;IAC7C,OAAO,KAAK,CAAC,IAAI,KAAK,gBAAgB;QACpC,CAAC,CAAC,qBAAqB;QACvB,CAAC,CAAC,kBAAkB,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,IAAI,KAAK,YAAY,gBAAgB;QACnC,OAAO,IAAI,QAAQ,CAAC;YAClB,MAAM,EAAE,kBAAkB;YAC1B,MAAM,EAAE,KAAK,CAAC,IAAI;YAClB,MAAM,EAAE,qBAAqB;YAC7B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,eAAe,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;YACjE,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,IAAI,KAAK,YAAY,kBAAkB,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACnC,OAAO,IAAI,QAAQ,CAAC;YAClB,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC;YACvB,MAAM,EAAE,KAAK,CAAC,IAAI;YAClB,MAAM,EAAE,qBAAqB;YAC7B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG,CAAC,KAAK;gBACP,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE;gBAC9D,CAAC,CAAC,EAAE,CAAC;YACP,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/server/routes/index.d.ts

@@ -0,0 +1,10 @@
+import type { AppPluginApplication } from '@nocobase/app-server/plugins';
+import { type AppApiRouteContribution, type AppRouteContribution } from '@nocobase/app-server/router';
+/**
+ * `/api/apiKeys`: a person's own keys, with or without a scope. Self-service: every endpoint acts on the caller's
+ * keys only, and only from a sign-in: a request made with any API key is refused (`requireSignInSession`).
+ */
+export declare const apiRoutes: AppApiRouteContribution<AppPluginApplication>;
+declare const routes: readonly AppRouteContribution<AppPluginApplication>[];
+export default routes;
+//# sourceMappingURL=index.d.ts.map

package/dist/server/routes/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../server/routes/index.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,EAWL,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EAC1B,MAAM,6BAA6B,CAAC;AAqCrC;;;GAGG;AACH,eAAO,MAAM,SAAS,EAAE,uBAAuB,CAAC,oBAAoB,CA+MhE,CAAC;AAEL,QAAA,MAAM,MAAM,EAAE,SAAS,oBAAoB,CAAC,oBAAoB,CAAC,EAEhE,CAAC;AAEF,eAAe,MAAM,CAAC"}