@oktis-works/database 0.5.8 → 0.7.0

package/dist/rls/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/rls/index.ts"],"names":[],"mappings":"AAIA,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQtE;AAED,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CAGxD;AAED,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAMjE;AAED,wBAAsB,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CA+B/C"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/rls/index.ts"],"names":[],"mappings":"AAIA,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQtE;AAED,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CAGxD;AAED,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAMjE;AAED,wBAAsB,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAiC/C"}

package/dist/rls/index.js

@@ -51,5 +51,7 @@ export async function enableRLS() {
     await sql `ALTER TABLE migrations ENABLE ROW LEVEL SECURITY`;
     await sql `ALTER TABLE sessions ENABLE ROW LEVEL SECURITY`;
     await sql `ALTER TABLE webhooks ENABLE ROW LEVEL SECURITY`;
+    await sql `ALTER TABLE api_keys ENABLE ROW LEVEL SECURITY`;
+    await sql `ALTER TABLE api_keys FORCE ROW LEVEL SECURITY`;
 }
 //# sourceMappingURL=index.js.map

package/dist/rls/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/rls/index.ts"],"names":[],"mappings":"AAAA,6CAA6C;AAE7C,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,QAAgB;IACrD,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,4EAA4E;IAC5E,yEAAyE;IACzE,gEAAgE;IAChE,0EAA0E;IAC1E,gCAAgC;IAChC,MAAM,GAAG,CAAA,8CAA8C,QAAQ,UAAU,CAAC;AAC5E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,MAAM,GAAG,CAAA,6BAA6B,CAAC;AACzC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,MAAM,GAAG,CAA4C;;GAEnE,CAAC;IACF,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,qBAAqB,IAAI,IAAI,CAAC;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS;IAC7B,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,MAAM,GAAG,CAAA,+CAA+C,CAAC;IACzD,MAAM,GAAG,CAAA,8CAA8C,CAAC;IACxD,MAAM,GAAG,CAAA,6CAA6C,CAAC;IACvD,MAAM,GAAG,CAAA,4CAA4C,CAAC;IACtD,MAAM,GAAG,CAAA,kDAAkD,CAAC;IAC5D,MAAM,GAAG,CAAA,4CAA4C,CAAC;IACtD,MAAM,GAAG,CAAA,6CAA6C,CAAC;IACvD,MAAM,GAAG,CAAA,4CAA4C,CAAC;IACtD,MAAM,GAAG,CAAA,gDAAgD,CAAC;IAC1D,MAAM,GAAG,CAAA,+CAA+C,CAAC;IACzD,MAAM,GAAG,CAAA,+CAA+C,CAAC;IACzD,MAAM,GAAG,CAAA,8CAA8C,CAAC;IACxD,MAAM,GAAG,CAAA,sDAAsD,CAAC;IAChE,MAAM,GAAG,CAAA,qDAAqD,CAAC;IAC/D,MAAM,GAAG,CAAA,kDAAkD,CAAC;IAC5D,MAAM,GAAG,CAAA,iDAAiD,CAAC;IAC3D,MAAM,GAAG,CAAA,sDAAsD,CAAC;IAChE,MAAM,GAAG,CAAA,qDAAqD,CAAC;IAC/D,MAAM,GAAG,CAAA,8DAA8D,CAAC;IACxE,MAAM,GAAG,CAAA,6DAA6D,CAAC;IACvE,MAAM,GAAG,CAAA,8CAA8C,CAAC;IACxD,MAAM,GAAG,CAAA,6CAA6C,CAAC;IACvD,MAAM,GAAG,CAAA,8CAA8C,CAAC;IACxD,MAAM,GAAG,CAAA,mDAAmD,CAAC;IAC7D,MAAM,GAAG,CAAA,8CAA8C,CAAC;IACxD,MAAM,GAAG,CAAA,kDAAkD,CAAC;IAC5D,MAAM,GAAG,CAAA,kDAAkD,CAAC;IAC5D,MAAM,GAAG,CAAA,gDAAgD,CAAC;IAC1D,MAAM,GAAG,CAAA,gDAAgD,CAAC;AAC5D,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/rls/index.ts"],"names":[],"mappings":"AAAA,6CAA6C;AAE7C,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,QAAgB;IACrD,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,4EAA4E;IAC5E,yEAAyE;IACzE,gEAAgE;IAChE,0EAA0E;IAC1E,gCAAgC;IAChC,MAAM,GAAG,CAAA,8CAA8C,QAAQ,UAAU,CAAC;AAC5E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,MAAM,GAAG,CAAA,6BAA6B,CAAC;AACzC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,MAAM,GAAG,CAA4C;;GAEnE,CAAC;IACF,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,qBAAqB,IAAI,IAAI,CAAC;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS;IAC7B,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,MAAM,GAAG,CAAA,+CAA+C,CAAC;IACzD,MAAM,GAAG,CAAA,8CAA8C,CAAC;IACxD,MAAM,GAAG,CAAA,6CAA6C,CAAC;IACvD,MAAM,GAAG,CAAA,4CAA4C,CAAC;IACtD,MAAM,GAAG,CAAA,kDAAkD,CAAC;IAC5D,MAAM,GAAG,CAAA,4CAA4C,CAAC;IACtD,MAAM,GAAG,CAAA,6CAA6C,CAAC;IACvD,MAAM,GAAG,CAAA,4CAA4C,CAAC;IACtD,MAAM,GAAG,CAAA,gDAAgD,CAAC;IAC1D,MAAM,GAAG,CAAA,+CAA+C,CAAC;IACzD,MAAM,GAAG,CAAA,+CAA+C,CAAC;IACzD,MAAM,GAAG,CAAA,8CAA8C,CAAC;IACxD,MAAM,GAAG,CAAA,sDAAsD,CAAC;IAChE,MAAM,GAAG,CAAA,qDAAqD,CAAC;IAC/D,MAAM,GAAG,CAAA,kDAAkD,CAAC;IAC5D,MAAM,GAAG,CAAA,iDAAiD,CAAC;IAC3D,MAAM,GAAG,CAAA,sDAAsD,CAAC;IAChE,MAAM,GAAG,CAAA,qDAAqD,CAAC;IAC/D,MAAM,GAAG,CAAA,8DAA8D,CAAC;IACxE,MAAM,GAAG,CAAA,6DAA6D,CAAC;IACvE,MAAM,GAAG,CAAA,8CAA8C,CAAC;IACxD,MAAM,GAAG,CAAA,6CAA6C,CAAC;IACvD,MAAM,GAAG,CAAA,8CAA8C,CAAC;IACxD,MAAM,GAAG,CAAA,mDAAmD,CAAC;IAC7D,MAAM,GAAG,CAAA,8CAA8C,CAAC;IACxD,MAAM,GAAG,CAAA,kDAAkD,CAAC;IAC5D,MAAM,GAAG,CAAA,kDAAkD,CAAC;IAC5D,MAAM,GAAG,CAAA,gDAAgD,CAAC;IAC1D,MAAM,GAAG,CAAA,gDAAgD,CAAC;IAC1D,MAAM,GAAG,CAAA,gDAAgD,CAAC;IAC1D,MAAM,GAAG,CAAA,+CAA+C,CAAC;AAC3D,CAAC"}

package/dist/schema/schema.sql

@@ -568,6 +568,31 @@ CREATE INDEX IF NOT EXISTS idx_sessions_expires ON sessions(expires_at);
 CREATE INDEX IF NOT EXISTS idx_sessions_refresh_hash ON sessions(refresh_token_hash);
 CREATE INDEX IF NOT EXISTS idx_sessions_refresh_family ON sessions(refresh_family_id);
 
+-- ============================================================
+-- API Keys (login via API para clientes API-first)
+-- A key NUNCA autoriza requests: troca por access JWT + refresh token em
+-- POST /api/v1/auth/api-key-login. Guardamos só o hash sha256.
+-- ============================================================
+CREATE TABLE IF NOT EXISTS api_keys (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id UUID NOT NULL REFERENCES tenants(id) ON DELETE CASCADE,
+  user_id UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  name VARCHAR(255) NOT NULL,
+  key_prefix VARCHAR(32) NOT NULL,
+  key_hash VARCHAR(128) NOT NULL,
+  one_time BOOLEAN NOT NULL DEFAULT false,
+  expires_at TIMESTAMP WITH TIME ZONE,
+  last_used_at TIMESTAMP WITH TIME ZONE,
+  use_count INTEGER NOT NULL DEFAULT 0,
+  revoked_at TIMESTAMP WITH TIME ZONE,
+  created_by UUID REFERENCES users(id) ON DELETE SET NULL,
+  created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW()
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_api_keys_prefix ON api_keys(tenant_id, key_prefix);
+CREATE INDEX IF NOT EXISTS idx_api_keys_tenant ON api_keys(tenant_id);
+CREATE INDEX IF NOT EXISTS idx_api_keys_user ON api_keys(user_id);
+
 -- ============================================================
 -- Custom Taxonomies (SDD ENTI-025)
 -- ============================================================
@@ -981,6 +1006,36 @@ BEGIN
   END IF;
 END $$;
 
+-- Lookup da API key acontece ANTES do contexto de tenant do access token
+-- existir (é o próprio login). O app seta este hash transacional somente na
+-- operação de auth, então o RLS ainda permite exatamente UM lookup por
+-- prefixo sem expor a tabela a requisições de outro tenant.
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_policies
+    WHERE policyname = 'api_key_prefix_lookup' AND tablename = 'api_keys'
+  ) THEN
+    CREATE POLICY api_key_prefix_lookup ON api_keys
+      USING (
+        key_prefix = NULLIF(current_setting('app.current_api_key_prefix', true), '')
+      )
+      WITH CHECK (
+        tenant_id = current_setting('app.current_tenant_id', true)::uuid
+      );
+  END IF;
+END $$;
+
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_policies
+    WHERE policyname = 'tenant_isolation_api_keys' AND tablename = 'api_keys'
+  ) THEN
+    CREATE POLICY tenant_isolation_api_keys ON api_keys USING (tenant_id = current_setting('app.current_tenant_id', true)::uuid);
+  END IF;
+END $$;
+
 -- ============================================================
 -- Delta de dados (idempotente, best-effort): valor neutro para a
 -- posição do field group em bancos já existentes. Falhas viram

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oktis-works/database",
-  "version": "0.5.8",
+  "version": "0.7.0",
   "private": false,
   "type": "module",
   "main": "./dist/index.js",
@@ -19,8 +19,8 @@
     "db:rollback": "node --loader ts-node/esm src/migrations/runner.ts rollback"
   },
   "dependencies": {
-    "@oktis-works/types": "^0.5.5",
-    "@oktis-works/config": "^0.6.0",
+    "@oktis-works/types": "^0.7.0",
+    "@oktis-works/config": "^0.6.2",
     "postgres": "3.4.0"
   },
   "devDependencies": {