@oktis-works/cms 0.9.3 → 0.9.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -0,0 +1,49 @@
|
|
|
1
|
+
-- +migrate Up
|
|
2
|
+
-- API Keys para clientes API-first (content API).
|
|
3
|
+
--
|
|
4
|
+
-- Segurança do design: a API key NUNCA autoriza requests diretamente. Ela é
|
|
5
|
+
-- usada UMA vez em POST /api/v1/auth/api-key-login para obter access JWT +
|
|
6
|
+
-- refresh token; a partir daí o cliente opera com Bearer + /auth/refresh
|
|
7
|
+
-- (com rotação e reuse-detection herdados de sessions). Guardamos apenas o
|
|
8
|
+
-- hash sha256 da key; o valor claro existe só na criação.
|
|
9
|
+
|
|
10
|
+
CREATE TABLE IF NOT EXISTS api_keys (
|
|
11
|
+
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
|
12
|
+
tenant_id UUID NOT NULL REFERENCES tenants(id) ON DELETE CASCADE,
|
|
13
|
+
-- Identidade que o login via API key assume (papéis vêm do vínculo em tenant_users).
|
|
14
|
+
user_id UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
|
|
15
|
+
name VARCHAR(255) NOT NULL,
|
|
16
|
+
-- Trecho em claro usado para localizar a row (não é segredo).
|
|
17
|
+
key_prefix VARCHAR(32) NOT NULL,
|
|
18
|
+
-- sha256 do valor completo — nunca o valor claro.
|
|
19
|
+
key_hash VARCHAR(128) NOT NULL,
|
|
20
|
+
-- Revoga a key após o primeiro uso no endpoint de login.
|
|
21
|
+
one_time BOOLEAN NOT NULL DEFAULT false,
|
|
22
|
+
expires_at TIMESTAMP WITH TIME ZONE,
|
|
23
|
+
last_used_at TIMESTAMP WITH TIME ZONE,
|
|
24
|
+
use_count INTEGER NOT NULL DEFAULT 0,
|
|
25
|
+
revoked_at TIMESTAMP WITH TIME ZONE,
|
|
26
|
+
created_by UUID REFERENCES users(id) ON DELETE SET NULL,
|
|
27
|
+
created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW()
|
|
28
|
+
);
|
|
29
|
+
|
|
30
|
+
CREATE UNIQUE INDEX IF NOT EXISTS idx_api_keys_prefix ON api_keys(tenant_id, key_prefix);
|
|
31
|
+
CREATE INDEX IF NOT EXISTS idx_api_keys_tenant ON api_keys(tenant_id);
|
|
32
|
+
CREATE INDEX IF NOT EXISTS idx_api_keys_user ON api_keys(user_id);
|
|
33
|
+
|
|
34
|
+
ALTER TABLE api_keys ENABLE ROW LEVEL SECURITY;
|
|
35
|
+
ALTER TABLE api_keys FORCE ROW LEVEL SECURITY;
|
|
36
|
+
|
|
37
|
+
DO $$
|
|
38
|
+
BEGIN
|
|
39
|
+
IF NOT EXISTS (
|
|
40
|
+
SELECT 1 FROM pg_policies
|
|
41
|
+
WHERE policyname = 'tenant_isolation_api_keys' AND tablename = 'api_keys'
|
|
42
|
+
) THEN
|
|
43
|
+
CREATE POLICY tenant_isolation_api_keys ON api_keys
|
|
44
|
+
USING (tenant_id = current_setting('app.current_tenant_id', true)::uuid);
|
|
45
|
+
END IF;
|
|
46
|
+
END $$;
|
|
47
|
+
|
|
48
|
+
-- +migrate Down
|
|
49
|
+
DROP TABLE IF EXISTS api_keys;
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@oktis-works/cms",
|
|
3
|
-
"version": "0.9.
|
|
3
|
+
"version": "0.9.4",
|
|
4
4
|
"private": false,
|
|
5
5
|
"type": "module",
|
|
6
6
|
"main": "./dist/index.js",
|
|
@@ -20,12 +20,12 @@
|
|
|
20
20
|
"clean": "rm -rf dist migrations tsconfig.tsbuildinfo"
|
|
21
21
|
},
|
|
22
22
|
"dependencies": {
|
|
23
|
-
"@oktis-works/auth": "^0.
|
|
24
|
-
"@oktis-works/config": "^0.6.
|
|
25
|
-
"@oktis-works/core": "^0.5.
|
|
26
|
-
"@oktis-works/database": "^0.
|
|
23
|
+
"@oktis-works/auth": "^0.6.0",
|
|
24
|
+
"@oktis-works/config": "^0.6.1",
|
|
25
|
+
"@oktis-works/core": "^0.5.14",
|
|
26
|
+
"@oktis-works/database": "^0.6.0",
|
|
27
27
|
"@oktis-works/validation": "^0.6.0",
|
|
28
|
-
"@oktis-works/theme-runtime": "^0.6.
|
|
28
|
+
"@oktis-works/theme-runtime": "^0.6.1"
|
|
29
29
|
},
|
|
30
30
|
"devDependencies": {
|
|
31
31
|
"typescript": "5.7.3"
|