@nocobase/app-plugin-api-keys 0.0.0-stage → 1.0.0-beta.14

package/dist/server/routes/index.js

@@ -0,0 +1,177 @@
+import { authenticationToken } from '@nocobase/app-plugin-authentication/server';
+import { authorizationToken, } from '@nocobase/app-plugin-authorization';
+import { apiErrorHandler, apiErrorResponse, apiErrorResponses, apiValidator, cliRoute, dataResponse, defineApiRoutes, describeRoute, emptyResponse, listResponse, } from '@nocobase/app-server/router';
+import { Hono } from 'hono';
+import { requireSignInSession } from '../key-sessions.js';
+import { scopedApiKeysToken } from '../tokens.js';
+import { toApiKeysApiError } from './errors.js';
+import { ApiKeyParams, ApiKeysListMeta, ApiKeyViewSchema, CreateApiKeyInput, CreatedApiKeySchema, KeyScopeObjectSchema, KeyScopeOptionsSchema, ScopeGroupParams, ScopeObjectsQuery, } from './schemas.js';
+const tags = ['ApiKeys'];
+/** Every route refuses a request made with an API key: keys are managed from a sign-in. */
+const signInOnly = 'Takes a signed-in session: a request made with any API key is refused (`403`).';
+const keyNotFound = apiErrorResponse(404, 'The caller has no key with this id (`KEY_NOT_FOUND`).');
+const creationForbidden = apiErrorResponse(403, 'The caller may not use API keys or may not create keys of their own (`API_KEY_CREATION_FORBIDDEN`).');
+/**
+ * `/api/apiKeys`: a person's own keys, with or without a scope. Self-service: every endpoint acts on the caller's
+ * keys only, and only from a sign-in: a request made with any API key is refused (`requireSignInSession`).
+ */
+export const apiRoutes = defineApiRoutes(({ container }) => {
+    const router = new Hono();
+    if (!container.has(authenticationToken))
+        return router;
+    const keys = container.resolve(scopedApiKeysToken);
+    const routes = new Hono();
+    routes.onError((error, context) => apiErrorHandler(toApiKeysApiError(error), context));
+    routes.use('*', container.resolve(authenticationToken).required());
+    // Managing keys takes a sign-in: no key, scoped or not, creates, rotates or revokes keys.
+    routes.use('*', requireSignInSession());
+    if (container.has(authorizationToken))
+        routes.use('*', container.resolve(authorizationToken).middleware());
+    const userId = (context) => context.get('auth').user.id;
+    const identity = async (context) => context.get('authz')?.identity ??
+        (await keys.identityOf(userId(context)));
+    // Creating and rotating are refused before the input is read when the person may not create keys.
+    const mayCreate = async (context, next) => {
+        await keys.requireOwnCreation(userId(context));
+        await next();
+    };
+    routes.get('/scopeOptions', describeRoute({
+        tags,
+        summary: 'List what a scoped key may be limited to',
+        operationId: 'apiKeysListScopeOptions',
+        ...cliRoute({ command: 'api-key scope-options' }),
+        description: signInOnly,
+        responses: {
+            200: dataResponse(KeyScopeOptionsSchema),
+            ...apiErrorResponses,
+        },
+    }), async (context) => context.json({
+        data: {
+            ...(await keys.scopeOptions(userId(context))),
+            mayCreate: await keys.mayCreateOwn(userId(context)),
+        },
+    }));
+    // The records a person may pick for a group: bounded by what they see, and narrowed by `q` or `id`.
+    routes.get('/scopeObjects/:group', describeRoute({
+        tags,
+        summary: 'List the records a scope group may be limited to',
+        operationId: 'apiKeysListScopeObjects',
+        ...cliRoute({
+            command: 'api-key scope-objects',
+            columns: ['id', 'title', 'description'],
+            examples: ['api-key scope-objects pm.projects --q checkout'],
+        }),
+        description: `${signInOnly} Bounded by what the caller can see and narrowed by \`q\` or repeated \`id\`; not paged.`,
+        responses: {
+            200: listResponse(KeyScopeObjectSchema, ApiKeysListMeta),
+            ...apiErrorResponses,
+            404: apiErrorResponse(404, 'The scope group does not exist (`UNKNOWN_SCOPE_GROUP`).'),
+        },
+    }), apiValidator('param', ScopeGroupParams), apiValidator('query', ScopeObjectsQuery), async (context) => {
+        const { group } = context.req.valid('param');
+        const { q, id } = context.req.valid('query');
+        const data = await keys.scopeObjects(group, await identity(context), {
+            ...(q ? { search: q } : {}),
+            ...(id ? { ids: id } : {}),
+        });
+        return context.json({ data, meta: { total: data.length } });
+    });
+    // A person's own keys: a bounded list, not paged.
+    routes.get('/', describeRoute({
+        tags,
+        summary: 'List my API keys',
+        operationId: 'apiKeysListKeys',
+        ...cliRoute({
+            command: 'api-key list',
+            columns: [
+                'id',
+                'name',
+                'start',
+                'enabled',
+                'expiresAt',
+                'lastUsedAt',
+            ],
+        }),
+        description: `${signInOnly} Never returns a key's secret.`,
+        responses: {
+            200: listResponse(ApiKeyViewSchema, ApiKeysListMeta),
+            ...apiErrorResponses,
+        },
+    }), async (context) => {
+        const data = await keys.list(userId(context));
+        return context.json({ data, meta: { total: data.length } });
+    });
+    routes.post('/', mayCreate, describeRoute({
+        tags,
+        summary: 'Create an API key',
+        operationId: 'apiKeysCreateKey',
+        ...cliRoute({
+            command: 'api-key create',
+            examples: [
+                'api-key create --name ci --expires-in-days 90',
+                'api-key create --file key.json',
+            ],
+            bodyFile: 'file',
+        }),
+        description: `${signInOnly} The secret is in this response only. \`scope: null\` makes a key that acts as the caller in full.`,
+        responses: {
+            201: dataResponse(CreatedApiKeySchema, 'The created key.'),
+            ...apiErrorResponses,
+            403: creationForbidden,
+            400: apiErrorResponse(400, 'The expiry or the scope is not allowed (`EXPIRY_REQUIRED`, `INVALID_EXPIRY`, `INVALID_SCOPE`, `EMPTY_SCOPE`, `UNKNOWN_SCOPE_GROUP`, `SCOPE_LEVEL_NOT_OFFERED`, `SCOPE_OBJECTS_NOT_OFFERED`, `UNKNOWN_SCOPE_OBJECT`).'),
+        },
+    }), apiValidator('json', CreateApiKeyInput), async (context) => {
+        context.header('Cache-Control', 'no-store');
+        return context.json({
+            data: await keys.create(userId(context), context.req.valid('json'), await identity(context)),
+        }, 201);
+    });
+    routes.post('/:keyId/rotate', mayCreate, describeRoute({
+        tags,
+        summary: 'Rotate an API key',
+        operationId: 'apiKeysRotateKey',
+        ...cliRoute({
+            command: 'api-key rotate',
+            flags: { keyId: { name: 'key' } },
+            confirm: 'Rotate this key? The old secret stops working.',
+        }),
+        description: `${signInOnly} Replaces the key with a new secret, keeping its name, scope and lifetime; the old secret stops working.`,
+        responses: {
+            200: dataResponse(CreatedApiKeySchema),
+            ...apiErrorResponses,
+            403: creationForbidden,
+            404: keyNotFound,
+        },
+    }), apiValidator('param', ApiKeyParams), async (context) => {
+        context.header('Cache-Control', 'no-store');
+        return context.json({
+            data: await keys.rotate(userId(context), context.req.valid('param').keyId),
+        });
+    });
+    routes.delete('/:keyId', describeRoute({
+        tags,
+        summary: 'Revoke an API key',
+        operationId: 'apiKeysRevokeKey',
+        ...cliRoute({
+            command: 'api-key delete',
+            flags: { keyId: { name: 'key' } },
+            confirm: 'Revoke this key? Whatever uses it stops working.',
+        }),
+        description: signInOnly,
+        responses: {
+            204: emptyResponse('The key was revoked.'),
+            ...apiErrorResponses,
+            404: keyNotFound,
+        },
+    }), apiValidator('param', ApiKeyParams), async (context) => {
+        await keys.revoke(userId(context), context.req.valid('param').keyId);
+        return context.body(null, 204);
+    });
+    router.route('/apiKeys', routes);
+    return router;
+});
+const routes = [
+    apiRoutes,
+];
+export default routes;
+//# sourceMappingURL=index.js.map

package/dist/server/routes/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../server/routes/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAC;AACjF,OAAO,EACL,kBAAkB,GAEnB,MAAM,oCAAoC,CAAC;AAG5C,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,aAAa,EACb,aAAa,EACb,YAAY,GAGb,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,IAAI,EAAwC,MAAM,MAAM,CAAC;AAElE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EACL,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,cAAc,CAAC;AAEtB,MAAM,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;AAEzB,2FAA2F;AAC3F,MAAM,UAAU,GACd,gFAAgF,CAAC;AAEnF,MAAM,WAAW,GAAG,gBAAgB,CAClC,GAAG,EACH,uDAAuD,CACxD,CAAC;AACF,MAAM,iBAAiB,GAAG,gBAAgB,CACxC,GAAG,EACH,qGAAqG,CACtG,CAAC;AAMF;;;GAGG;AACH,MAAM,CAAC,MAAM,SAAS,GACpB,eAAe,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE;IAChC,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;IAC1B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAAE,OAAO,MAAM,CAAC;IACvD,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,IAAI,IAAI,EAAO,CAAC;IAC/B,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAChC,eAAe,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CACnD,CAAC;IACF,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IACnE,0FAA0F;IAC1F,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,oBAAoB,EAAE,CAAC,CAAC;IACxC,IAAI,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC;QACnC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,CAAC,OAAqB,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAE,CAAC,IAAI,CAAC,EAAE,CAAC;IACvE,MAAM,QAAQ,GAAG,KAAK,EAAE,OAAqB,EAAE,EAAE,CAC/C,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,QAAQ;QAC9B,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3C,kGAAkG;IAClG,MAAM,SAAS,GAA2B,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAChE,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/C,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;IAEF,MAAM,CAAC,GAAG,CACR,eAAe,EACf,aAAa,CAAC;QACZ,IAAI;QACJ,OAAO,EAAE,0CAA0C;QACnD,WAAW,EAAE,yBAAyB;QACtC,GAAG,QAAQ,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC;QACjD,WAAW,EAAE,UAAU;QACvB,SAAS,EAAE;YACT,GAAG,EAAE,YAAY,CAAC,qBAAqB,CAAC;YACxC,GAAG,iBAAiB;SACrB;KACF,CAAC,EACF,KAAK,EAAE,OAAO,EAAE,EAAE,CAChB,OAAO,CAAC,IAAI,CAAC;QACX,IAAI,EAAE;YACJ,GAAG,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;YAC7C,SAAS,EAAE,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;SACpD;KACF,CAAC,CACL,CAAC;IACF,oGAAoG;IACpG,MAAM,CAAC,GAAG,CACR,sBAAsB,EACtB,aAAa,CAAC;QACZ,IAAI;QACJ,OAAO,EAAE,kDAAkD;QAC3D,WAAW,EAAE,yBAAyB;QACtC,GAAG,QAAQ,CAAC;YACV,OAAO,EAAE,uBAAuB;YAChC,OAAO,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,aAAa,CAAC;YACvC,QAAQ,EAAE,CAAC,gDAAgD,CAAC;SAC7D,CAAC;QACF,WAAW,EAAE,GAAG,UAAU,0FAA0F;QACpH,SAAS,EAAE;YACT,GAAG,EAAE,YAAY,CAAC,oBAAoB,EAAE,eAAe,CAAC;YACxD,GAAG,iBAAiB;YACpB,GAAG,EAAE,gBAAgB,CACnB,GAAG,EACH,yDAAyD,CAC1D;SACF;KACF,CAAC,EACF,YAAY,CAAC,OAAO,EAAE,gBAAgB,CAAC,EACvC,YAAY,CAAC,OAAO,EAAE,iBAAiB,CAAC,EACxC,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,QAAQ,CAAC,OAAO,CAAC,EAAE;YACnE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3B,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3B,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9D,CAAC,CACF,CAAC;IACF,kDAAkD;IAClD,MAAM,CAAC,GAAG,CACR,GAAG,EACH,aAAa,CAAC;QACZ,IAAI;QACJ,OAAO,EAAE,kBAAkB;QAC3B,WAAW,EAAE,iBAAiB;QAC9B,GAAG,QAAQ,CAAC;YACV,OAAO,EAAE,cAAc;YACvB,OAAO,EAAE;gBACP,IAAI;gBACJ,MAAM;gBACN,OAAO;gBACP,SAAS;gBACT,WAAW;gBACX,YAAY;aACb;SACF,CAAC;QACF,WAAW,EAAE,GAAG,UAAU,gCAAgC;QAC1D,SAAS,EAAE;YACT,GAAG,EAAE,YAAY,CAAC,gBAAgB,EAAE,eAAe,CAAC;YACpD,GAAG,iBAAiB;SACrB;KACF,CAAC,EACF,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QAC9C,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9D,CAAC,CACF,CAAC;IACF,MAAM,CAAC,IAAI,CACT,GAAG,EACH,SAAS,EACT,aAAa,CAAC;QACZ,IAAI;QACJ,OAAO,EAAE,mBAAmB;QAC5B,WAAW,EAAE,kBAAkB;QAC/B,GAAG,QAAQ,CAAC;YACV,OAAO,EAAE,gBAAgB;YACzB,QAAQ,EAAE;gBACR,+CAA+C;gBAC/C,gCAAgC;aACjC;YACD,QAAQ,EAAE,MAAM;SACjB,CAAC;QACF,WAAW,EAAE,GAAG,UAAU,oGAAoG;QAC9H,SAAS,EAAE;YACT,GAAG,EAAE,YAAY,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;YAC1D,GAAG,iBAAiB;YACpB,GAAG,EAAE,iBAAiB;YACtB,GAAG,EAAE,gBAAgB,CACnB,GAAG,EACH,sNAAsN,CACvN;SACF;KACF,CAAC,EACF,YAAY,CAAC,MAAM,EAAE,iBAAiB,CAAC,EACvC,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC5C,OAAO,OAAO,CAAC,IAAI,CACjB;YACE,IAAI,EAAE,MAAM,IAAI,CAAC,MAAM,CACrB,MAAM,CAAC,OAAO,CAAC,EACf,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EACzB,MAAM,QAAQ,CAAC,OAAO,CAAC,CACxB;SACF,EACD,GAAG,CACJ,CAAC;IACJ,CAAC,CACF,CAAC;IACF,MAAM,CAAC,IAAI,CACT,gBAAgB,EAChB,SAAS,EACT,aAAa,CAAC;QACZ,IAAI;QACJ,OAAO,EAAE,mBAAmB;QAC5B,WAAW,EAAE,kBAAkB;QAC/B,GAAG,QAAQ,CAAC;YACV,OAAO,EAAE,gBAAgB;YACzB,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;YACjC,OAAO,EAAE,gDAAgD;SAC1D,CAAC;QACF,WAAW,EAAE,GAAG,UAAU,0GAA0G;QACpI,SAAS,EAAE;YACT,GAAG,EAAE,YAAY,CAAC,mBAAmB,CAAC;YACtC,GAAG,iBAAiB;YACpB,GAAG,EAAE,iBAAiB;YACtB,GAAG,EAAE,WAAW;SACjB;KACF,CAAC,EACF,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,EACnC,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC5C,OAAO,OAAO,CAAC,IAAI,CAAC;YAClB,IAAI,EAAE,MAAM,IAAI,CAAC,MAAM,CACrB,MAAM,CAAC,OAAO,CAAC,EACf,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CACjC;SACF,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IACF,MAAM,CAAC,MAAM,CACX,SAAS,EACT,aAAa,CAAC;QACZ,IAAI;QACJ,OAAO,EAAE,mBAAmB;QAC5B,WAAW,EAAE,kBAAkB;QAC/B,GAAG,QAAQ,CAAC;YACV,OAAO,EAAE,gBAAgB;YACzB,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;YACjC,OAAO,EAAE,kDAAkD;SAC5D,CAAC;QACF,WAAW,EAAE,UAAU;QACvB,SAAS,EAAE;YACT,GAAG,EAAE,aAAa,CAAC,sBAAsB,CAAC;YAC1C,GAAG,iBAAiB;YACpB,GAAG,EAAE,WAAW;SACjB;KACF,CAAC,EACF,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,EACnC,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC;QACrE,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACjC,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACjC,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC,CAAC;AAEL,MAAM,MAAM,GAA0D;IACpE,SAAS;CACV,CAAC;AAEF,eAAe,MAAM,CAAC"}

package/dist/server/routes/schemas.d.ts

@@ -0,0 +1,25 @@
+import { z } from 'zod';
+import { type ApiKeyView, type CreateApiKeyRequest, type CreatedApiKey, type KeyScopeObject, type KeyScopeOptions, type KeyScopeInput } from '../../shared/scopes.js';
+/** A key's scope; which groups exist and what they offer is checked by `ApiKeyScopes.validate`. */
+export declare const KeyScopeInputSchema: z.ZodType<KeyScopeInput>;
+/** The body of `POST /apiKeys`. */
+export declare const CreateApiKeyInput: z.ZodType<CreateApiKeyRequest>;
+export declare const ApiKeyParams: z.ZodObject<{
+    keyId: z.ZodString;
+}>;
+export declare const ScopeGroupParams: z.ZodObject<{
+    group: z.ZodString;
+}>;
+/** The query of `GET /apiKeys/scopeObjects/:group`: a search, or the records to look up by id (`id` repeated). */
+export declare const ScopeObjectsQuery: z.ZodType<{
+    q?: string | undefined;
+    id?: string[] | undefined;
+}>;
+export declare const KeyScopeOptionsSchema: z.ZodType<KeyScopeOptions>;
+export declare const KeyScopeObjectSchema: z.ZodType<KeyScopeObject>;
+export declare const ApiKeyViewSchema: z.ZodType<ApiKeyView>;
+export declare const CreatedApiKeySchema: z.ZodType<CreatedApiKey>;
+export declare const ApiKeysListMeta: z.ZodType<{
+    total: number;
+}>;
+//# sourceMappingURL=schemas.d.ts.map

package/dist/server/routes/schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../../server/routes/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAGL,KAAK,UAAU,EACf,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,eAAe,EAGpB,KAAK,aAAa,EAEnB,MAAM,wBAAwB,CAAC;AAahC,mGAAmG;AACnG,eAAO,MAAM,mBAAmB,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAEvD,CAAC;AAEH,mCAAmC;AACnC,eAAO,MAAM,iBAAiB,EAAE,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAO5D,CAAC;AAEF,eAAO,MAAM,YAAY,EAAE,CAAC,CAAC,SAAS,CAAC;IAAE,KAAK,EAAE,CAAC,CAAC,SAAS,CAAA;CAAE,CAE3D,CAAC;AAEH,eAAO,MAAM,gBAAgB,EAAE,CAAC,CAAC,SAAS,CAAC;IAAE,KAAK,EAAE,CAAC,CAAC,SAAS,CAAA;CAAE,CAE/D,CAAC;AAIH,kHAAkH;AAClH,eAAO,MAAM,iBAAiB,EAAE,CAAC,CAAC,OAAO,CAAC;IACxC,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvB,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;CAC3B,CAQC,CAAC;AAgCH,eAAO,MAAM,qBAAqB,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CA2C3D,CAAC;AAEH,eAAO,MAAM,oBAAoB,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAIzD,CAAC;AAEH,eAAO,MAAM,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAgBrB,CAAC;AAE/B,eAAO,MAAM,mBAAmB,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAOpB,CAAC;AAEtC,eAAO,MAAM,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAEvD,CAAC"}

package/dist/server/routes/schemas.js

@@ -0,0 +1,127 @@
+import { z } from 'zod';
+import { KEY_SCOPE_LEVELS, } from '../../shared/scopes.js';
+const KeyScopeLevelSchema = z.enum(KEY_SCOPE_LEVELS);
+const KeyScopeGroupGrantSchema = z.strictObject({
+    level: KeyScopeLevelSchema,
+    objects: z
+        .union([z.literal('all'), z.array(z.string().min(1)).min(1)])
+        .optional(),
+});
+/** A key's scope; which groups exist and what they offer is checked by `ApiKeyScopes.validate`. */
+export const KeyScopeInputSchema = z.strictObject({
+    groups: z.record(z.string().min(1), KeyScopeGroupGrantSchema),
+});
+/** The body of `POST /apiKeys`. */
+export const CreateApiKeyInput = z.strictObject({
+    name: z.string(),
+    description: z.string().nullable().optional(),
+    expiresInDays: z.number().int().nullable(),
+    scope: KeyScopeInputSchema.nullable(),
+});
+export const ApiKeyParams = z.object({
+    keyId: z.string().min(1),
+});
+export const ScopeGroupParams = z.object({
+    group: z.string().min(1),
+});
+const MAX_PICKED_IDS = 100;
+/** The query of `GET /apiKeys/scopeObjects/:group`: a search, or the records to look up by id (`id` repeated). */
+export const ScopeObjectsQuery = z.object({
+    q: z.string().max(200).optional(),
+    id: z
+        .union([z.string().min(1), z.array(z.string().min(1)).max(MAX_PICKED_IDS)])
+        .optional()
+        .transform((value) => value === undefined ? undefined : Array.isArray(value) ? value : [value]),
+});
+// Response schemas: they document what the routes send; nothing validates a response against them.
+const dateTime = () => z.string().meta({ format: 'date-time' });
+const LocalizedTextSchema = z
+    .union([z.string(), z.object({ key: z.string(), ns: z.string() })])
+    .meta({
+    ref: 'ApiKeysLocalizedText',
+    description: 'Plain text, or an i18n key in a namespace.',
+});
+const AccessRefSchema = z.discriminatedUnion('kind', [
+    z.object({ kind: z.literal('page'), id: z.string() }),
+    z.object({ kind: z.literal('settings'), id: z.string(), action: z.string() }),
+    z.object({ kind: z.literal('business'), id: z.string(), action: z.string() }),
+]);
+const GrantResponseSchema = z.object({
+    level: KeyScopeLevelSchema,
+    objects: z.union([z.literal('all'), z.array(z.string())]).optional(),
+});
+const KeyScopeResponseSchema = z
+    .object({ groups: z.record(z.string(), GrantResponseSchema) })
+    .meta({
+    ref: 'ApiKeysKeyScope',
+    description: 'What the key may do, group by group; a group left out grants nothing.',
+});
+export const KeyScopeOptionsSchema = z.object({
+    groups: z
+        .array(z.object({
+        id: z.string(),
+        category: z.enum(['business', 'administration', 'account']),
+        title: LocalizedTextSchema,
+        description: LocalizedTextSchema.nullable(),
+        levels: z.array(KeyScopeLevelSchema),
+        access: z.partialRecord(KeyScopeLevelSchema, z.array(AccessRefSchema)),
+        held: z.partialRecord(KeyScopeLevelSchema, z.boolean()).meta({
+            description: 'Whether the caller holds everything up to each level; false shows it greyed out.',
+        }),
+        objects: z
+            .object({ business: z.string(), title: LocalizedTextSchema })
+            .nullable(),
+    }))
+        .meta({ description: 'Empty when scoped keys are not offered.' }),
+    presets: z.array(z.object({
+        id: z.string(),
+        title: LocalizedTextSchema,
+        description: LocalizedTextSchema.nullable(),
+        groups: z.record(z.string(), z.object({
+            level: KeyScopeLevelSchema,
+            objects: z.enum(['all', 'pick']).optional(),
+        })),
+        expiresInDays: z.number().int().nullable(),
+    })),
+    maxScopedKeyDays: z.number().int().nullable().meta({
+        description: 'The longest a scoped key may live, in days; null when "never expires" is allowed.',
+    }),
+    defaultExpiresInDays: z.number().int(),
+    mayCreate: z.boolean().optional().meta({
+        description: 'Whether the caller may create keys of their own.',
+    }),
+});
+export const KeyScopeObjectSchema = z.object({
+    id: z.string(),
+    title: z.string(),
+    description: z.string().optional(),
+});
+export const ApiKeyViewSchema = z
+    .object({
+    id: z.string(),
+    name: z.string().nullable(),
+    description: z.string().nullable(),
+    start: z.string().nullable().meta({
+        description: 'The first characters of the key, to recognize it.',
+    }),
+    enabled: z.boolean(),
+    createdAt: dateTime(),
+    expiresAt: dateTime().nullable(),
+    lastUsedAt: dateTime().nullable(),
+    scope: KeyScopeResponseSchema.nullable().meta({
+        description: 'Null for a key that acts as its owner in full.',
+    }),
+})
+    .meta({ ref: 'ApiKeysKey' });
+export const CreatedApiKeySchema = z
+    .object({
+    key: ApiKeyViewSchema,
+    secret: z.string().meta({
+        description: 'The key itself, shown only in this response.',
+    }),
+})
+    .meta({ ref: 'ApiKeysCreatedKey' });
+export const ApiKeysListMeta = z.object({
+    total: z.number().int(),
+});
+//# sourceMappingURL=schemas.js.map

package/dist/server/routes/schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../../server/routes/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,gBAAgB,GAWjB,MAAM,wBAAwB,CAAC;AAEhC,MAAM,mBAAmB,GAA6B,CAAC,CAAC,IAAI,CAC1D,gBAAuD,CACxD,CAAC;AAEF,MAAM,wBAAwB,GAAkC,CAAC,CAAC,YAAY,CAAC;IAC7E,KAAK,EAAE,mBAAmB;IAC1B,OAAO,EAAE,CAAC;SACP,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;SAC5D,QAAQ,EAAE;CACd,CAAC,CAAC;AAEH,mGAAmG;AACnG,MAAM,CAAC,MAAM,mBAAmB,GAA6B,CAAC,CAAC,YAAY,CAAC;IAC1E,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,wBAAwB,CAAC;CAC9D,CAAC,CAAC;AAEH,mCAAmC;AACnC,MAAM,CAAC,MAAM,iBAAiB,GAAmC,CAAC,CAAC,YAAY,CAC7E;IACE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC7C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC1C,KAAK,EAAE,mBAAmB,CAAC,QAAQ,EAAE;CACtC,CACF,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAwC,CAAC,CAAC,MAAM,CAAC;IACxE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACzB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAwC,CAAC,CAAC,MAAM,CAAC;IAC5E,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACzB,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B,kHAAkH;AAClH,MAAM,CAAC,MAAM,iBAAiB,GAGzB,CAAC,CAAC,MAAM,CAAC;IACZ,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACjC,EAAE,EAAE,CAAC;SACF,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;SAC1E,QAAQ,EAAE;SACV,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CACnB,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CACzE;CACJ,CAAC,CAAC;AAEH,mGAAmG;AAEnG,MAAM,QAAQ,GAAG,GAAgB,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;AAE7E,MAAM,mBAAmB,GAA6B,CAAC;KACpD,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;KAClE,IAAI,CAAC;IACJ,GAAG,EAAE,sBAAsB;IAC3B,WAAW,EAAE,4CAA4C;CAC1D,CAAC,CAAC;AAEL,MAAM,eAAe,GAAyB,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACzE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACrD,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IAC7E,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;CAC9E,CAAC,CAAC;AAEH,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,KAAK,EAAE,mBAAmB;IAC1B,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACrE,CAAC,CAAC;AAEH,MAAM,sBAAsB,GAA6B,CAAC;KACvD,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,EAAE,CAAC;KAC7D,IAAI,CAAC;IACJ,GAAG,EAAE,iBAAiB;IACtB,WAAW,EACT,uEAAuE;CAC1E,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,qBAAqB,GAA+B,CAAC,CAAC,MAAM,CAAC;IACxE,MAAM,EAAE,CAAC;SACN,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;QACP,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;QACd,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,gBAAgB,EAAE,SAAS,CAAC,CAAC;QAC3D,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EAAE,mBAAmB,CAAC,QAAQ,EAAE;QAC3C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC;QACpC,MAAM,EAAE,CAAC,CAAC,aAAa,CAAC,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QACtE,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC;YAC3D,WAAW,EACT,kFAAkF;SACrF,CAAC;QACF,OAAO,EAAE,CAAC;aACP,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;aAC5D,QAAQ,EAAE;KACd,CAAC,CACH;SACA,IAAI,CAAC,EAAE,WAAW,EAAE,yCAAyC,EAAE,CAAC;IACnE,OAAO,EAAE,CAAC,CAAC,KAAK,CACd,CAAC,CAAC,MAAM,CAAC;QACP,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;QACd,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EAAE,mBAAmB,CAAC,QAAQ,EAAE;QAC3C,MAAM,EAAE,CAAC,CAAC,MAAM,CACd,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,MAAM,CAAC;YACP,KAAK,EAAE,mBAAmB;YAC1B,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE;SAC5C,CAAC,CACH;QACD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;KAC3C,CAAC,CACH;IACD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC;QACjD,WAAW,EACT,mFAAmF;KACtF,CAAC;IACF,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACtC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC;QACrC,WAAW,EAAE,kDAAkD;KAChE,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAA8B,CAAC,CAAC,MAAM,CAAC;IACtE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAA0B,CAAC;KACrD,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC;QAChC,WAAW,EAAE,mDAAmD;KACjE,CAAC;IACF,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,SAAS,EAAE,QAAQ,EAAE;IACrB,SAAS,EAAE,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAChC,UAAU,EAAE,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACjC,KAAK,EAAE,sBAAsB,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC;QAC5C,WAAW,EAAE,gDAAgD;KAC9D,CAAC;CACH,CAAC;KACD,IAAI,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC;AAE/B,MAAM,CAAC,MAAM,mBAAmB,GAA6B,CAAC;KAC3D,MAAM,CAAC;IACN,GAAG,EAAE,gBAAgB;IACrB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;QACtB,WAAW,EAAE,8CAA8C;KAC5D,CAAC;CACH,CAAC;KACD,IAAI,CAAC,EAAE,GAAG,EAAE,mBAAmB,EAAE,CAAC,CAAC;AAEtC,MAAM,CAAC,MAAM,eAAe,GAAiC,CAAC,CAAC,MAAM,CAAC;IACpE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;CACxB,CAAC,CAAC"}

package/dist/server/scoped-keys.d.ts

@@ -0,0 +1,116 @@
+/**
+ * Keys with scopes: creating, listing, rotating and revoking a user's keys, and recognizing the key behind a request.
+ * The caller authorizes who may manage whose keys; this service only ever acts on the user it is told.
+ */
+import { type Auth, type AuthSession } from '@nocobase/app-plugin-authentication/server';
+import type { Authorization, AuthorizationIdentity, KeyScope } from '@nocobase/authorization/core';
+import type { DatabaseConnection } from '@nocobase/db';
+import { type ApiKeyView, type CreatedApiKey, type KeyScopeInput, type KeyScopeObject, type KeyScopeOptions } from '../shared/scopes.js';
+import { type ApiKeyScopes } from './scopes.js';
+/** The expiry the editor proposes for a scoped key. */
+export declare const DEFAULT_SCOPED_KEY_DAYS = 90;
+/** `apiKeys` in the application's configuration. */
+export interface ApiKeysConfig {
+    /** The longest a scoped key may live, in days. Unset allows "never expires". */
+    readonly maxScopedKeyDays?: number | null;
+}
+/** A refused key operation: a status and a stable code. */
+export declare class ApiKeyRequestError extends Error {
+    readonly status: 400 | 403 | 404;
+    readonly code: string;
+    constructor(status: 400 | 403 | 404, code: string, message: string);
+}
+export interface ScopedApiKeysOptions {
+    readonly auth: Pick<Auth, 'pluginApi'>;
+    readonly connection: () => DatabaseConnection;
+    readonly scopes: ApiKeyScopes;
+    /** The application's authorization, to say what a user holds and to build their identity; optional. */
+    readonly authorization?: () => Authorization | undefined;
+    readonly config?: () => ApiKeysConfig | undefined;
+}
+/**
+ * Whether a user may create (and rotate) keys of their own, as an application decides it. Without one, everyone may.
+ * Listing and revoking one's keys stay open, so a person who loses the permission can still clean up.
+ */
+export type OwnKeyPolicy = (userId: string) => Promise<boolean>;
+/** A key's fields as `create` would issue it, checked but not yet issued (`ScopedApiKeys.check`). */
+export interface CheckedApiKey {
+    readonly name: string;
+    readonly description: string | null;
+    readonly scope: KeyScopeInput | null;
+    readonly expiresInDays: number | null;
+}
+/**
+ * Lets the hook on Better Auth's own `/api-key/create` ask `keys` whether a person may create a key of their own, as
+ * `/api/apiKeys` does. The plugin's provider calls it at boot; returns what disconnects it.
+ */
+export declare function connectOwnKeyPolicy(auth: Pick<Auth, 'administrationContext'>, keys: Pick<ScopedApiKeys, 'mayCreateOwn'>): Promise<() => void>;
+export declare class ScopedApiKeys {
+    private readonly options;
+    private readonly resolved;
+    private ownKeyPolicy;
+    constructor(options: ScopedApiKeysOptions);
+    /**
+     * Sets who may create keys of their own (`/api/apiKeys` and Better Auth's `/api-key/create`). Returns what removes
+     * it again.
+     */
+    setOwnKeyPolicy(policy: OwnKeyPolicy): () => void;
+    /** Whether `userId` may create keys of their own; true unless the application set a policy that says otherwise. */
+    mayCreateOwn(userId: string): Promise<boolean>;
+    /** Refuses with 403 `API_KEY_CREATION_FORBIDDEN` unless `userId` may create keys of their own. */
+    requireOwnCreation(userId: string): Promise<void>;
+    private get maxScopedKeyDays();
+    /** The identity a request of `userId` would carry, as the authorization plugin's middleware builds it. */
+    identityOf(userId: string): Promise<AuthorizationIdentity>;
+    /** What the editor offers for keys of `userId`, with what that user holds today. */
+    scopeOptions(userId: string): Promise<KeyScopeOptions>;
+    /** The records a group may be limited to, as `identity` may see them. */
+    scopeObjects(groupId: string, identity: AuthorizationIdentity, query?: {
+        readonly search?: string;
+        readonly ids?: readonly string[];
+    }): Promise<readonly KeyScopeObject[]>;
+    /** `userId`'s keys of the default configuration, newest first. */
+    list(userId: string): Promise<ApiKeyView[]>;
+    /**
+     * Creates a key for `userId`. `identity` is whoever chooses the records of a group limited to some: each must be
+     * one they may see.
+     */
+    create(userId: string, input: unknown, identity: AuthorizationIdentity): Promise<CreatedApiKey>;
+    /**
+     * Checks what `create` would issue — name, description, scope, the records it picks (`identity` must see each) and
+     * expiry — without issuing anything, so a caller can refuse before creating whatever the key belongs to.
+     */
+    check(input: unknown, identity: AuthorizationIdentity): Promise<CheckedApiKey>;
+    /** Issues a key `check` accepted. */
+    issueChecked(userId: string, input: CheckedApiKey): Promise<CreatedApiKey>;
+    /** One of `userId`'s keys. */
+    get(userId: string, keyId: string): Promise<ApiKeyView>;
+    /**
+     * Gives a key a new secret in place: the same key — id, name, description, scope and owner — with a new value, and
+     * an expiry renewed for the lifetime it had. The old value stops at once.
+     */
+    rotate(userId: string, keyId: string): Promise<CreatedApiKey>;
+    /**
+     * Replaces a key's scope. `identity` is whoever chooses it: each record a group is limited to must be one they may
+     * see. The caller decides who may change a key and whether the new scope is one they may give. A key without a scope
+     * cannot be given one this way, nor the reverse.
+     */
+    setScope(userId: string, keyId: string, input: unknown, identity: AuthorizationIdentity): Promise<ApiKeyView>;
+    /** Renames a key or changes its description; a field left out stays. */
+    update(userId: string, keyId: string, input: unknown): Promise<ApiKeyView>;
+    revoke(userId: string, keyId: string): Promise<void>;
+    /** Every key of `userId`, as when the account is deleted. */
+    revokeAll(userId: string): Promise<void>;
+    /**
+     * The scope of the key a request authenticated with: compiled from its stored scope, unbounded for a service
+     * account's unscoped key, and null for a session or a person's unscoped key. Read once per request.
+     */
+    resolve(session: NonNullable<AuthSession>, request: Request): Promise<KeyScope | null>;
+    private lookup;
+    private issue;
+    private remove;
+    private requireRow;
+    private checkObjects;
+    private expiryOf;
+}
+//# sourceMappingURL=scoped-keys.d.ts.map

package/dist/server/scoped-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scoped-keys.d.ts","sourceRoot":"","sources":["../../server/scoped-keys.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAEL,KAAK,IAAI,EACT,KAAK,WAAW,EACjB,MAAM,4CAA4C,CAAC;AACpD,OAAO,KAAK,EACV,aAAa,EACb,qBAAqB,EACrB,QAAQ,EACT,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,OAAO,EAKL,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,eAAe,EACrB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAoB,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAElE,uDAAuD;AACvD,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAE1C,oDAAoD;AACpD,MAAM,WAAW,aAAa;IAC5B,gFAAgF;IAChF,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3C;AAED,2DAA2D;AAC3D,qBAAa,kBAAmB,SAAQ,KAAK;IAEzC,QAAQ,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM;gBADZ,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,EACvB,IAAI,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM;CAKlB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACvC,QAAQ,CAAC,UAAU,EAAE,MAAM,kBAAkB,CAAC;IAC9C,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,uGAAuG;IACvG,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,aAAa,GAAG,SAAS,CAAC;IACzD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,aAAa,GAAG,SAAS,CAAC;CACnD;AAgBD;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhE,qGAAqG;AACrG,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CACvC;AAMD;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,uBAAuB,CAAC,EACzC,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,cAAc,CAAC,GACxC,OAAO,CAAC,MAAM,IAAI,CAAC,CAUrB;AAED,qBAAa,aAAa;IAIZ,OAAO,CAAC,QAAQ,CAAC,OAAO;IAHpC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoD;IAC7E,OAAO,CAAC,YAAY,CAA6B;gBAEpB,OAAO,EAAE,oBAAoB;IAE1D;;;OAGG;IACH,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,IAAI;IAOjD,mHAAmH;IAC7G,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIpD,kGAAkG;IAC5F,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASvD,OAAO,KAAK,gBAAgB,GAK3B;IAED,0GAA0G;IACpG,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAYhE,oFAAoF;IAC9E,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IA2D5D,yEAAyE;IACnE,YAAY,CAChB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,qBAAqB,EAC/B,KAAK,GAAE;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAO,GACzE,OAAO,CAAC,SAAS,cAAc,EAAE,CAAC;IAWrC,kEAAkE;IAC5D,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAajD;;;OAGG;IACG,MAAM,CACV,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,OAAO,EACd,QAAQ,EAAE,qBAAqB,GAC9B,OAAO,CAAC,aAAa,CAAC;IAIzB;;;OAGG;IACG,KAAK,CACT,KAAK,EAAE,OAAO,EACd,QAAQ,EAAE,qBAAqB,GAC9B,OAAO,CAAC,aAAa,CAAC;IAkBzB,qCAAqC;IACrC,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAI1E,8BAA8B;IACxB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAI7D;;;OAGG;IACG,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IA4DnE;;;;OAIG;IACG,QAAQ,CACZ,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,OAAO,EACd,QAAQ,EAAE,qBAAqB,GAC9B,OAAO,CAAC,UAAU,CAAC;IAmBtB,wEAAwE;IAClE,MAAM,CACV,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,UAAU,CAAC;IAuBhB,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK1D,6DAA6D;IACvD,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAS9C;;;OAGG;IACH,OAAO,CACL,OAAO,EAAE,WAAW,CAAC,WAAW,CAAC,EACjC,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;YAQb,MAAM;YAqBN,KAAK;YAiCL,MAAM;YAON,UAAU;YAcV,YAAY;IAsB1B,OAAO,CAAC,QAAQ;CAyBjB"}