@open-mercato/core 0.8.1-develop.7296.1.2111d779db → 0.9.0

package/dist/modules/api_keys/api/keys/route.js

@@ -4,13 +4,11 @@ import { Role } from "@open-mercato/core/modules/auth/data/entities";
 import { Organization } from "@open-mercato/core/modules/directory/data/entities";
 import { ApiKey } from "../../data/entities.js";
 import { createApiKeySchema } from "../../data/validators.js";
-import { generateApiKeySecret, hashApiKey } from "../../services/apiKeyService.js";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { enforceTenantSelection, resolveIsSuperAdmin } from "@open-mercato/core/modules/auth/lib/tenantAccess";
 import { escapeLikePattern } from "@open-mercato/shared/lib/db/escapeLikePattern";
 import { assertActorCanGrantRoles } from "@open-mercato/core/modules/auth/lib/grantChecks";
 import { isOrganizationAccessAllowed } from "@open-mercato/shared/lib/auth/organizationAccess";
-import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
 const listQuerySchema = z.object({
   page: z.string().optional(),
   pageSize: z.string().optional(),
@@ -60,6 +58,69 @@ function json(payload, init = { status: 200 }) {
     headers: { "content-type": "application/json", ...init.headers || {} }
   });
 }
+async function prepareCreateCommandInput(input, ctx) {
+  const auth = ctx.auth;
+  const { translate } = await resolveTranslations();
+  if (!auth?.tenantId) {
+    throw json({ error: translate("api_keys.errors.tenantRequired", "Tenant context required") }, { status: 400 });
+  }
+  const requestedTenant = Object.prototype.hasOwnProperty.call(input, "tenantId") ? input.tenantId : auth.tenantId;
+  const targetTenantId = await enforceTenantSelection(ctx, requestedTenant);
+  const em = ctx.container.resolve("em");
+  const roleTokens = input.roles.filter((value) => value.trim().length > 0);
+  const roleEntities = [];
+  for (const token of roleTokens) {
+    const value = token.trim();
+    const effectiveTenantId = targetTenantId ?? auth.tenantId;
+    const normalizedEffectiveTenantId = effectiveTenantId.toLowerCase();
+    let role = null;
+    if (/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value)) {
+      role = await em.findOne(Role, { id: value, deletedAt: null });
+    }
+    if (!role) {
+      const candidates = await em.find(Role, {
+        name: value,
+        deletedAt: null,
+        $or: [{ tenantId: effectiveTenantId }, { tenantId: null }]
+      }, { limit: 5 });
+      role = candidates.find((candidate) => candidate.tenantId !== null && String(candidate.tenantId).toLowerCase() === normalizedEffectiveTenantId) ?? candidates.find((candidate) => candidate.tenantId === null) ?? null;
+    }
+    if (!role) {
+      throw json({ error: translate("api_keys.errors.roleNotFound", `Role ${value} not found`, { identifier: value }) }, { status: 400 });
+    }
+    const roleTenantId = role.tenantId ? String(role.tenantId).toLowerCase() : null;
+    if (roleTenantId && roleTenantId !== normalizedEffectiveTenantId) {
+      throw json({ error: translate("api_keys.errors.roleWrongTenant", `Role ${role.name} belongs to another tenant`, { role: role.name ?? value }) }, { status: 400 });
+    }
+    roleEntities.push(role);
+  }
+  await assertActorCanGrantRoles({
+    em,
+    rbacService: ctx.container.resolve("rbacService"),
+    actorUserId: auth.sub,
+    tenantId: targetTenantId,
+    organizationId: auth.orgId ?? null,
+    roles: roleEntities
+  });
+  const allowedIds = ctx.organizationScope?.allowedIds ?? null;
+  const organizationId = Object.prototype.hasOwnProperty.call(input, "organizationId") ? input.organizationId ?? null : ctx.selectedOrganizationId ?? auth.orgId ?? null;
+  const isSuperAdmin = await resolveIsSuperAdmin(ctx);
+  if (!isOrganizationAccessAllowed({
+    isSuperAdmin,
+    allowedOrganizationIds: allowedIds,
+    targetOrganizationId: organizationId
+  })) {
+    throw json({ error: translate("api_keys.errors.organizationOutOfScope", "Organization out of scope") }, { status: 403 });
+  }
+  return {
+    name: input.name,
+    description: input.description ?? null,
+    tenantId: targetTenantId,
+    organizationId,
+    roleIds: roleEntities.map((role) => String(role.id)),
+    expiresAt: input.expiresAt ?? null
+  };
+}
 const crud = makeCrudRoute({
   metadata: {
     GET: { requireAuth: true, requireFeatures: ["api_keys.view"] },
@@ -68,44 +129,20 @@ const crud = makeCrudRoute({
   },
   orm: { entity: ApiKey, orgField: null },
   list: { schema: listQuerySchema },
-  create: {
-    schema: createApiKeySchema,
-    mapToEntity: (input, ctx) => {
-      const scopedCtx = ctx;
-      const secretData = scopedCtx.__apiKeySecret;
-      const keyHash = scopedCtx.__apiKeyHash;
-      if (!secretData || !keyHash) throw new Error("API key secret not prepared");
-      const roleIds = Array.isArray(scopedCtx.__apiKeyRoleIds) ? scopedCtx.__apiKeyRoleIds : [];
-      const organizationId = scopedCtx.__apiKeyOrganizationId ?? null;
-      const tenantId = scopedCtx.__apiKeyTenantId ?? null;
-      return {
-        name: input.name,
-        description: input.description ?? null,
-        tenantId,
-        organizationId,
-        keyHash,
-        keyPrefix: secretData.prefix,
-        rolesJson: roleIds,
-        createdBy: ctx.auth?.sub ?? null,
-        expiresAt: input.expiresAt ?? null
-      };
+  del: { idFrom: "query" },
+  actions: {
+    create: {
+      commandId: "api_keys.keys.create",
+      schema: createApiKeySchema,
+      mapInput: ({ parsed, ctx }) => prepareCreateCommandInput(parsed, ctx),
+      response: ({ result }) => result
     },
-    response: (entity) => {
-      const meta = entity;
-      const secret = meta.__apiKeySecret;
-      const roles = meta.__apiKeyRoles;
-      return {
-        id: String(entity.id),
-        name: entity.name,
-        keyPrefix: entity.keyPrefix,
-        secret,
-        tenantId: entity.tenantId ?? null,
-        organizationId: entity.organizationId ?? null,
-        roles: Array.isArray(roles) ? roles.map((role) => ({ id: String(role.id), name: role.name ?? null })) : Array.isArray(entity.rolesJson) ? entity.rolesJson.map((id) => ({ id, name: null })) : []
-      };
+    delete: {
+      commandId: "api_keys.keys.delete",
+      mapInput: ({ raw }) => ({ id: String(raw.query?.id ?? "") }),
+      response: () => ({ success: true })
     }
   },
-  del: { idFrom: "query" },
   hooks: {
     beforeList: async (query, ctx) => {
       const auth = ctx.auth;
@@ -179,138 +216,6 @@ const crud = makeCrudRoute({
         totalPages: Math.ceil(total / pageSize)
       };
       throw json(payload);
-    },
-    beforeCreate: async (input, ctx) => {
-      const auth = ctx.auth;
-      const { translate } = await resolveTranslations();
-      if (!auth?.tenantId) throw json({ error: translate("api_keys.errors.tenantRequired", "Tenant context required") }, { status: 400 });
-      const requestedTenant = Object.prototype.hasOwnProperty.call(input, "tenantId") ? input.tenantId : auth.tenantId;
-      const scopedCtx = ctx;
-      const targetTenantId = await enforceTenantSelection(scopedCtx, requestedTenant);
-      scopedCtx.__apiKeyTenantId = targetTenantId;
-      const secretData = generateApiKeySecret();
-      scopedCtx.__apiKeySecret = secretData;
-      scopedCtx.__apiKeyHash = await hashApiKey(secretData.secret);
-      const em = ctx.container.resolve("em");
-      const roleTokens = Array.isArray(input.roles) ? input.roles.filter((value) => typeof value === "string" && value.trim().length > 0) : [];
-      const roleEntities = [];
-      const roleIds = [];
-      for (const token of roleTokens) {
-        const value = token.trim();
-        const rawTenantId = targetTenantId ?? auth.tenantId ?? null;
-        const effectiveTenantId = typeof rawTenantId === "string" && rawTenantId.trim().length > 0 ? rawTenantId.trim() : null;
-        const normalizedEffectiveTenantId = effectiveTenantId ? effectiveTenantId.toLowerCase() : null;
-        let role = null;
-        if (/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value)) {
-          role = await em.findOne(Role, { id: value, deletedAt: null });
-        }
-        if (!role) {
-          const nameFilter = { name: value, deletedAt: null };
-          if (normalizedEffectiveTenantId) {
-            nameFilter.$or = [
-              { tenantId: effectiveTenantId },
-              { tenantId: null }
-            ];
-          } else {
-            nameFilter.tenantId = null;
-          }
-          const candidates = await em.find(Role, nameFilter, { limit: 5 });
-          if (normalizedEffectiveTenantId) {
-            role = candidates.find((candidate) => {
-              if (!candidate.tenantId) return false;
-              return String(candidate.tenantId).toLowerCase() === normalizedEffectiveTenantId;
-            }) ?? candidates.find((candidate) => candidate.tenantId === null) ?? null;
-          } else {
-            role = candidates.find((candidate) => candidate.tenantId === null) ?? null;
-          }
-          if (!role) {
-            role = candidates[0] ?? null;
-          }
-        }
-        if (!role) {
-          throw json({ error: translate("api_keys.errors.roleNotFound", `Role ${value} not found`, { identifier: value }) }, { status: 400 });
-        }
-        const roleTenantId = role.tenantId ? String(role.tenantId) : null;
-        const normalizedRoleTenantId = roleTenantId ? roleTenantId.toLowerCase() : null;
-        if (normalizedRoleTenantId && normalizedEffectiveTenantId && normalizedRoleTenantId !== normalizedEffectiveTenantId) {
-          throw json({ error: translate("api_keys.errors.roleWrongTenant", `Role ${role.name} belongs to another tenant`, { role: role.name ?? value }) }, { status: 400 });
-        }
-        roleEntities.push(role);
-        roleIds.push(String(role.id));
-      }
-      await assertActorCanGrantRoles({
-        em,
-        rbacService: ctx.container.resolve("rbacService"),
-        actorUserId: auth.sub,
-        tenantId: targetTenantId,
-        organizationId: auth.orgId ?? null,
-        roles: roleEntities
-      });
-      scopedCtx.__apiKeyRoles = roleEntities;
-      scopedCtx.__apiKeyRoleIds = roleIds;
-      const allowedIds = ctx.organizationScope?.allowedIds ?? null;
-      const organizationId = Object.prototype.hasOwnProperty.call(input, "organizationId") ? input.organizationId ?? null : ctx.selectedOrganizationId ?? auth.orgId ?? null;
-      const isSuperAdmin = await resolveIsSuperAdmin(scopedCtx);
-      if (!isOrganizationAccessAllowed({
-        isSuperAdmin,
-        allowedOrganizationIds: allowedIds,
-        targetOrganizationId: organizationId
-      })) {
-        throw json({ error: translate("api_keys.errors.organizationOutOfScope", "Organization out of scope") }, { status: 403 });
-      }
-      scopedCtx.__apiKeyOrganizationId = organizationId ?? null;
-      return { ...input, organizationId };
-    },
-    afterCreate: async (entity, ctx) => {
-      const scopedCtx = ctx;
-      const secretData = scopedCtx.__apiKeySecret;
-      const roles = scopedCtx.__apiKeyRoles;
-      if (secretData) entity.__apiKeySecret = secretData.secret;
-      if (roles) entity.__apiKeyRoles = roles;
-      try {
-        const rbac = ctx.container.resolve("rbacService");
-        await rbac.invalidateUserCache(`api_key:${entity.id}`);
-      } catch {
-      }
-    },
-    beforeDelete: async (id, ctx) => {
-      const auth = ctx.auth;
-      const { translate } = await resolveTranslations();
-      if (!auth?.tenantId) throw json({ error: translate("api_keys.errors.tenantRequired", "Tenant context required") }, { status: 400 });
-      const em = ctx.container.resolve("em");
-      const scopedCtx = ctx;
-      const isSuperAdmin = await resolveIsSuperAdmin(scopedCtx);
-      const allowedIds = ctx.organizationScope?.allowedIds ?? null;
-      const recordFilter = {
-        id,
-        tenantId: auth.tenantId,
-        deletedAt: null
-      };
-      if (!isSuperAdmin && Array.isArray(allowedIds)) {
-        recordFilter.organizationId = { $in: allowedIds };
-      }
-      const record = await findOneWithDecryption(
-        em,
-        ApiKey,
-        recordFilter,
-        void 0,
-        { tenantId: auth.tenantId, organizationId: null }
-      );
-      if (!record || record.tenantId !== auth.tenantId || !isOrganizationAccessAllowed({
-        isSuperAdmin,
-        allowedOrganizationIds: allowedIds,
-        targetOrganizationId: record.organizationId ?? null
-      })) {
-        throw json({ error: translate("api_keys.errors.notFound", "Not found") }, { status: 404 });
-      }
-      scopedCtx.__apiKeyOrganizationId = record.organizationId ?? null;
-    },
-    afterDelete: async (id, ctx) => {
-      try {
-        const rbac = ctx.container.resolve("rbacService");
-        await rbac.invalidateUserCache(`api_key:${id}`);
-      } catch {
-      }
     }
   }
 });

package/dist/modules/api_keys/api/keys/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/api_keys/api/keys/route.ts"],
-  "sourcesContent": ["import { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'\nimport { makeCrudRoute } from '@open-mercato/shared/lib/crud/factory'\nimport type { CrudCtx } from '@open-mercato/shared/lib/crud/factory'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { Role } from '@open-mercato/core/modules/auth/data/entities'\nimport { Organization } from '@open-mercato/core/modules/directory/data/entities'\nimport { ApiKey } from '../../data/entities'\nimport { createApiKeySchema } from '../../data/validators'\nimport { generateApiKeySecret, hashApiKey } from '../../services/apiKeyService'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { enforceTenantSelection, resolveIsSuperAdmin } from '@open-mercato/core/modules/auth/lib/tenantAccess'\nimport { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'\nimport { assertActorCanGrantRoles } from '@open-mercato/core/modules/auth/lib/grantChecks'\nimport { isOrganizationAccessAllowed } from '@open-mercato/shared/lib/auth/organizationAccess'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\n\ntype ApiKeyCrudCtx = CrudCtx & {\n  __apiKeySecret?: { secret: string; prefix: string }\n  __apiKeyHash?: string\n  __apiKeyRoleIds?: string[]\n  __apiKeyRoles?: Role[]\n  __apiKeyOrganizationId?: string | null\n  __apiKeyTenantId?: string | null\n}\n\ntype ApiKeyEntityWithMeta = ApiKey & {\n  __apiKeySecret?: string\n  __apiKeyRoles?: Role[]\n}\n\nconst listQuerySchema = z.object({\n  page: z.string().optional(),\n  pageSize: z.string().optional(),\n  search: z.string().optional(),\n})\n\nconst apiKeyRoleSchema = z.object({\n  id: z.string().describe('Role identifier or alias assigned to the key'),\n  name: z.string().nullable().describe('Display name of the mapped role, if available'),\n})\n\nconst apiKeyListItemSchema = z.object({\n  id: z.string().describe('API key identifier'),\n  name: z.string().describe('Friendly label used to identify the key'),\n  description: z.string().nullable().describe('Optional free-form description'),\n  keyPrefix: z.string().describe('Public prefix exposed to clients'),\n  organizationId: z.string().uuid().nullable().describe('Organization scope of the key'),\n  organizationName: z.string().nullable().describe('Resolved organization display name'),\n  createdAt: z.string().describe('Creation timestamp (ISO 8601)'),\n  lastUsedAt: z.string().nullable().describe('Last time the key was observed in use (ISO 8601)'),\n  expiresAt: z.string().nullable().describe('When the key expires (ISO 8601)'),\n  roles: z.array(apiKeyRoleSchema).describe('Effective roles applied when this key authenticates'),\n})\n\nconst apiKeyCollectionResponseSchema = z.object({\n  items: z.array(apiKeyListItemSchema),\n  total: z.number().int().nonnegative(),\n  page: z.number().int().positive(),\n  pageSize: z.number().int().positive(),\n  totalPages: z.number().int().nonnegative(),\n})\n\nconst apiKeyCreateResponseSchema = z.object({\n  id: z.string().describe('Newly created API key identifier'),\n  name: z.string(),\n  keyPrefix: z.string(),\n  secret: z.string().describe('Full API key value. Shown once for secure persistence.').optional(),\n  tenantId: z.string().uuid().nullable(),\n  organizationId: z.string().uuid().nullable(),\n  roles: z.array(apiKeyRoleSchema),\n})\n\nconst deleteResponseSchema = z.object({\n  success: z.literal(true),\n})\n\nconst errorSchema = z.object({\n  error: z.string(),\n})\n\nfunction json(payload: unknown, init: ResponseInit = { status: 200 }) {\n  return new Response(JSON.stringify(payload), {\n    ...init,\n    headers: { 'content-type': 'application/json', ...(init.headers || {}) },\n  })\n}\n\nconst crud = makeCrudRoute<\n  z.infer<typeof createApiKeySchema>,\n  never,\n  z.infer<typeof listQuerySchema>\n>({\n  metadata: {\n    GET: { requireAuth: true, requireFeatures: ['api_keys.view'] },\n    POST: { requireAuth: true, requireFeatures: ['api_keys.create'] },\n    DELETE: { requireAuth: true, requireFeatures: ['api_keys.delete'] },\n  },\n  orm: { entity: ApiKey, orgField: null },\n  list: { schema: listQuerySchema },\n  create: {\n    schema: createApiKeySchema,\n    mapToEntity: (input, ctx) => {\n      const scopedCtx = ctx as ApiKeyCrudCtx\n      const secretData = scopedCtx.__apiKeySecret\n      const keyHash = scopedCtx.__apiKeyHash\n      if (!secretData || !keyHash) throw new Error('API key secret not prepared')\n      const roleIds = Array.isArray(scopedCtx.__apiKeyRoleIds) ? scopedCtx.__apiKeyRoleIds : []\n      const organizationId = scopedCtx.__apiKeyOrganizationId ?? null\n      const tenantId = scopedCtx.__apiKeyTenantId ?? null\n      return {\n        name: input.name,\n        description: input.description ?? null,\n        tenantId,\n        organizationId,\n        keyHash,\n        keyPrefix: secretData.prefix,\n        rolesJson: roleIds,\n        createdBy: ctx.auth?.sub ?? null,\n        expiresAt: input.expiresAt ?? null,\n      }\n    },\n    response: (entity) => {\n      const meta = entity as ApiKeyEntityWithMeta\n      const secret = meta.__apiKeySecret\n      const roles = meta.__apiKeyRoles\n      return {\n        id: String(entity.id),\n        name: entity.name,\n        keyPrefix: entity.keyPrefix,\n        secret,\n        tenantId: entity.tenantId ?? null,\n        organizationId: entity.organizationId ?? null,\n        roles: Array.isArray(roles)\n          ? roles.map((role) => ({ id: String(role.id), name: role.name ?? null }))\n          : (Array.isArray(entity.rolesJson) ? entity.rolesJson.map((id: string) => ({ id, name: null })) : []),\n      }\n    },\n  },\n  del: { idFrom: 'query' },\n  hooks: {\n    beforeList: async (query, ctx) => {\n      const auth = ctx.auth\n      const { translate } = await resolveTranslations()\n      if (!auth?.tenantId) throw json({ error: translate('api_keys.errors.tenantRequired', 'Tenant context required') }, { status: 400 })\n      const page = Math.max(parseInt(query.page ?? '1', 10) || 1, 1)\n      const pageSize = Math.min(Math.max(parseInt(query.pageSize ?? '20', 10) || 20, 1), 200)\n      const search = (query.search ?? '').trim().toLowerCase()\n\n      const organizationIds = Array.isArray(ctx.organizationIds) ? ctx.organizationIds : null\n      if (organizationIds && organizationIds.length === 0) {\n        throw json({ items: [], total: 0, page, pageSize, totalPages: 0 })\n      }\n\n      const em = (ctx.container.resolve('em') as EntityManager)\n      const qb = em.createQueryBuilder(ApiKey, 'k')\n      qb.where({ deletedAt: null })\n      qb.andWhere({ tenantId: auth.tenantId })\n      if (organizationIds && organizationIds.length > 0) {\n        qb.andWhere({ organizationId: { $in: organizationIds } })\n      } else if (auth.orgId) {\n        qb.andWhere({ organizationId: auth.orgId })\n      }\n      if (search) {\n        const pattern = `%${escapeLikePattern(search)}%`\n        qb.andWhere({\n          $or: [\n            { name: { $ilike: pattern } },\n            { keyPrefix: { $ilike: pattern } },\n          ],\n        })\n      }\n      qb.orderBy({ createdAt: 'desc' })\n      qb.limit(pageSize).offset((page - 1) * pageSize)\n      const [items, total] = await qb.getResultAndCount()\n\n      if (!items.length) {\n        throw json({ items: [], total, page, pageSize, totalPages: Math.ceil(total / pageSize) })\n      }\n\n      const roleIdSet = new Set<string>()\n      const orgIdSet = new Set<string>()\n      for (const item of items) {\n        if (Array.isArray(item.rolesJson)) {\n          for (const roleId of item.rolesJson) roleIdSet.add(String(roleId))\n        }\n        if (item.organizationId) orgIdSet.add(String(item.organizationId))\n      }\n\n      const roleIdArray = Array.from(roleIdSet)\n      const organizationIdArray = Array.from(orgIdSet)\n      const roleFilter: FilterQuery<Role> = { id: { $in: roleIdArray } }\n      const organizationFilter: FilterQuery<Organization> = { id: { $in: organizationIdArray } }\n      const [roles, organizations] = await Promise.all([\n        roleIdArray.length ? em.find(Role, roleFilter) : [],\n        organizationIdArray.length ? em.find(Organization, organizationFilter) : [],\n      ])\n      const roleMap = new Map(roles.map((role) => [String(role.id), role.name ?? null]))\n      const orgMap = new Map(organizations.map((org) => [String(org.id), org.name ?? null]))\n\n      const payload = {\n        items: items.map((item) => ({\n          id: item.id,\n          name: item.name,\n          description: item.description ?? null,\n          keyPrefix: item.keyPrefix,\n          organizationId: item.organizationId ?? null,\n          organizationName: item.organizationId ? orgMap.get(String(item.organizationId)) ?? null : null,\n          createdAt: item.createdAt,\n          lastUsedAt: item.lastUsedAt ?? null,\n          expiresAt: item.expiresAt ?? null,\n          roles: Array.isArray(item.rolesJson)\n            ? item.rolesJson.map((id) => ({ id, name: roleMap.get(String(id)) ?? null }))\n            : [],\n        })),\n        total,\n        page,\n        pageSize,\n        totalPages: Math.ceil(total / pageSize),\n      }\n\n      throw json(payload)\n    },\n    beforeCreate: async (input, ctx) => {\n      const auth = ctx.auth\n      const { translate } = await resolveTranslations()\n      if (!auth?.tenantId) throw json({ error: translate('api_keys.errors.tenantRequired', 'Tenant context required') }, { status: 400 })\n\n      const requestedTenant = Object.prototype.hasOwnProperty.call(input, 'tenantId') ? input.tenantId : auth.tenantId\n      const scopedCtx = ctx as ApiKeyCrudCtx\n      const targetTenantId = await enforceTenantSelection(scopedCtx, requestedTenant)\n      scopedCtx.__apiKeyTenantId = targetTenantId\n\n      const secretData = generateApiKeySecret()\n      scopedCtx.__apiKeySecret = secretData\n      scopedCtx.__apiKeyHash = await hashApiKey(secretData.secret)\n\n      const em = (ctx.container.resolve('em') as EntityManager)\n      const roleTokens = Array.isArray(input.roles) ? input.roles.filter((value) => typeof value === 'string' && value.trim().length > 0) : []\n      const roleEntities: Role[] = []\n      const roleIds: string[] = []\n      for (const token of roleTokens) {\n        const value = token.trim()\n        const rawTenantId = targetTenantId ?? auth.tenantId ?? null\n        const effectiveTenantId = typeof rawTenantId === 'string' && rawTenantId.trim().length > 0 ? rawTenantId.trim() : null\n        const normalizedEffectiveTenantId = effectiveTenantId ? effectiveTenantId.toLowerCase() : null\n        let role: Role | null = null\n        if (/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value)) {\n          role = await em.findOne(Role, { id: value, deletedAt: null })\n        }\n        if (!role) {\n          const nameFilter: FilterQuery<Role> = { name: value, deletedAt: null }\n          if (normalizedEffectiveTenantId) {\n            nameFilter.$or = [\n              { tenantId: effectiveTenantId },\n              { tenantId: null },\n            ]\n          } else {\n            nameFilter.tenantId = null\n          }\n          const candidates = await em.find(Role, nameFilter, { limit: 5 })\n          if (normalizedEffectiveTenantId) {\n            role =\n              candidates.find((candidate) => {\n                if (!candidate.tenantId) return false\n                return String(candidate.tenantId).toLowerCase() === normalizedEffectiveTenantId\n              }) ??\n              candidates.find((candidate) => candidate.tenantId === null) ??\n              null\n          } else {\n            role = candidates.find((candidate) => candidate.tenantId === null) ?? null\n          }\n          if (!role) {\n            role = candidates[0] ?? null\n          }\n        }\n        if (!role) {\n          throw json({ error: translate('api_keys.errors.roleNotFound', `Role ${value} not found`, { identifier: value }) }, { status: 400 })\n        }\n        const roleTenantId = role.tenantId ? String(role.tenantId) : null\n        const normalizedRoleTenantId = roleTenantId ? roleTenantId.toLowerCase() : null\n        if (normalizedRoleTenantId && normalizedEffectiveTenantId && normalizedRoleTenantId !== normalizedEffectiveTenantId) {\n          throw json({ error: translate('api_keys.errors.roleWrongTenant', `Role ${role.name} belongs to another tenant`, { role: role.name ?? value }) }, { status: 400 })\n        }\n        roleEntities.push(role)\n        roleIds.push(String(role.id))\n      }\n      await assertActorCanGrantRoles({\n        em,\n        rbacService: ctx.container.resolve('rbacService') as RbacService,\n        actorUserId: auth.sub,\n        tenantId: targetTenantId,\n        organizationId: auth.orgId ?? null,\n        roles: roleEntities,\n      })\n      scopedCtx.__apiKeyRoles = roleEntities\n      scopedCtx.__apiKeyRoleIds = roleIds\n\n      const allowedIds = ctx.organizationScope?.allowedIds ?? null\n      const organizationId = Object.prototype.hasOwnProperty.call(input, 'organizationId')\n        ? input.organizationId ?? null\n        : ctx.selectedOrganizationId ?? auth.orgId ?? null\n      const isSuperAdmin = await resolveIsSuperAdmin(scopedCtx)\n      if (\n        !isOrganizationAccessAllowed({\n          isSuperAdmin,\n          allowedOrganizationIds: allowedIds,\n          targetOrganizationId: organizationId,\n        })\n      ) {\n        throw json({ error: translate('api_keys.errors.organizationOutOfScope', 'Organization out of scope') }, { status: 403 })\n      }\n      scopedCtx.__apiKeyOrganizationId = organizationId ?? null\n\n      return { ...input, organizationId }\n    },\n    afterCreate: async (entity, ctx) => {\n      const scopedCtx = ctx as ApiKeyCrudCtx\n      const secretData = scopedCtx.__apiKeySecret\n      const roles = scopedCtx.__apiKeyRoles\n      if (secretData) (entity as ApiKeyEntityWithMeta).__apiKeySecret = secretData.secret\n      if (roles) (entity as ApiKeyEntityWithMeta).__apiKeyRoles = roles\n      try {\n        const rbac = (ctx.container.resolve('rbacService') as RbacService)\n        await rbac.invalidateUserCache(`api_key:${entity.id}`)\n      } catch {}\n    },\n    beforeDelete: async (id, ctx) => {\n      const auth = ctx.auth\n      const { translate } = await resolveTranslations()\n      if (!auth?.tenantId) throw json({ error: translate('api_keys.errors.tenantRequired', 'Tenant context required') }, { status: 400 })\n      const em = (ctx.container.resolve('em') as EntityManager)\n      const scopedCtx = ctx as ApiKeyCrudCtx\n      const isSuperAdmin = await resolveIsSuperAdmin(scopedCtx)\n      const allowedIds = ctx.organizationScope?.allowedIds ?? null\n      const recordFilter: FilterQuery<ApiKey> = {\n        id,\n        tenantId: auth.tenantId,\n        deletedAt: null,\n      }\n      if (!isSuperAdmin && Array.isArray(allowedIds)) {\n        recordFilter.organizationId = { $in: allowedIds }\n      }\n      const record = await findOneWithDecryption(\n        em,\n        ApiKey,\n        recordFilter,\n        undefined,\n        { tenantId: auth.tenantId, organizationId: null },\n      )\n      if (\n        !record ||\n        record.tenantId !== auth.tenantId ||\n        !isOrganizationAccessAllowed({\n          isSuperAdmin,\n          allowedOrganizationIds: allowedIds,\n          targetOrganizationId: record.organizationId ?? null,\n        })\n      ) {\n        throw json({ error: translate('api_keys.errors.notFound', 'Not found') }, { status: 404 })\n      }\n      scopedCtx.__apiKeyOrganizationId = record.organizationId ?? null\n    },\n    afterDelete: async (id, ctx) => {\n      try {\n        const rbac = (ctx.container.resolve('rbacService') as RbacService)\n        await rbac.invalidateUserCache(`api_key:${id}`)\n      } catch {}\n    },\n  },\n})\n\nexport const metadata = crud.metadata\nexport const GET = crud.GET\nexport const POST = crud.POST\nexport const DELETE = crud.DELETE\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Manage API keys',\n  description:\n    'Provides list, creation, and deletion capabilities for API keys scoped to the authenticated tenant and organization.',\n  methods: {\n    GET: {\n      summary: 'List API keys',\n      description:\n        'Returns paginated API keys visible to the current user, including per-key role assignments and organization context.',\n      query: listQuerySchema,\n      responses: [\n        {\n          status: 200,\n          description: 'Collection of API keys',\n          schema: apiKeyCollectionResponseSchema,\n        },\n      ],\n      errors: [\n        { status: 400, description: 'Tenant context missing', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 403, description: 'Forbidden by organization scope', schema: errorSchema },\n      ],\n    },\n    POST: {\n      summary: 'Create API key',\n      description:\n        'Creates a new API key, returning the one-time secret value together with the generated key prefix and scope details.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: createApiKeySchema,\n        description: 'API key definition including optional scope and role assignments.',\n      },\n      responses: [\n        {\n          status: 201,\n          description: 'API key created successfully',\n          schema: apiKeyCreateResponseSchema,\n        },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid payload or missing tenant context', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 403, description: 'Organization outside allowed scope', schema: errorSchema },\n      ],\n    },\n    DELETE: {\n      summary: 'Delete API key',\n      description:\n        'Removes an API key by identifier. The key must belong to the current tenant and fall within the requester organization scope.',\n      query: z.object({\n        id: z.string().uuid().describe('API key identifier to delete'),\n      }),\n      responses: [\n        { status: 200, description: 'Key deleted successfully', schema: deleteResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Missing or invalid identifier', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 403, description: 'Organization outside allowed scope', schema: errorSchema },\n        { status: 404, description: 'Key not found within scope', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,SAAS;AAGlB,SAAS,qBAAqB;AAG9B,SAAS,YAAY;AACrB,SAAS,oBAAoB;AAC7B,SAAS,cAAc;AACvB,SAAS,0BAA0B;AACnC,SAAS,sBAAsB,kBAAkB;AACjD,SAAS,2BAA2B;AACpC,SAAS,wBAAwB,2BAA2B;AAC5D,SAAS,yBAAyB;AAClC,SAAS,gCAAgC;AACzC,SAAS,mCAAmC;AAC5C,SAAS,6BAA6B;AAgBtC,MAAM,kBAAkB,EAAE,OAAO;AAAA,EAC/B,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,QAAQ,EAAE,OAAO,EAAE,SAAS;AAC9B,CAAC;AAED,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,IAAI,EAAE,OAAO,EAAE,SAAS,8CAA8C;AAAA,EACtE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,+CAA+C;AACtF,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,IAAI,EAAE,OAAO,EAAE,SAAS,oBAAoB;AAAA,EAC5C,MAAM,EAAE,OAAO,EAAE,SAAS,yCAAyC;AAAA,EACnE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,gCAAgC;AAAA,EAC5E,WAAW,EAAE,OAAO,EAAE,SAAS,kCAAkC;AAAA,EACjE,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,+BAA+B;AAAA,EACrF,kBAAkB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,oCAAoC;AAAA,EACrF,WAAW,EAAE,OAAO,EAAE,SAAS,+BAA+B;AAAA,EAC9D,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,kDAAkD;AAAA,EAC7F,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,iCAAiC;AAAA,EAC3E,OAAO,EAAE,MAAM,gBAAgB,EAAE,SAAS,qDAAqD;AACjG,CAAC;AAED,MAAM,iCAAiC,EAAE,OAAO;AAAA,EAC9C,OAAO,EAAE,MAAM,oBAAoB;AAAA,EACnC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACpC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAChC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACpC,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAC3C,CAAC;AAED,MAAM,6BAA6B,EAAE,OAAO;AAAA,EAC1C,IAAI,EAAE,OAAO,EAAE,SAAS,kCAAkC;AAAA,EAC1D,MAAM,EAAE,OAAO;AAAA,EACf,WAAW,EAAE,OAAO;AAAA,EACpB,QAAQ,EAAE,OAAO,EAAE,SAAS,wDAAwD,EAAE,SAAS;AAAA,EAC/F,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACrC,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC3C,OAAO,EAAE,MAAM,gBAAgB;AACjC,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,SAAS,EAAE,QAAQ,IAAI;AACzB,CAAC;AAED,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,SAAS,KAAK,SAAkB,OAAqB,EAAE,QAAQ,IAAI,GAAG;AACpE,SAAO,IAAI,SAAS,KAAK,UAAU,OAAO,GAAG;AAAA,IAC3C,GAAG;AAAA,IACH,SAAS,EAAE,gBAAgB,oBAAoB,GAAI,KAAK,WAAW,CAAC,EAAG;AAAA,EACzE,CAAC;AACH;AAEA,MAAM,OAAO,cAIX;AAAA,EACA,UAAU;AAAA,IACR,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,eAAe,EAAE;AAAA,IAC7D,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;AAAA,IAChE,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;AAAA,EACpE;AAAA,EACA,KAAK,EAAE,QAAQ,QAAQ,UAAU,KAAK;AAAA,EACtC,MAAM,EAAE,QAAQ,gBAAgB;AAAA,EAChC,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,aAAa,CAAC,OAAO,QAAQ;AAC3B,YAAM,YAAY;AAClB,YAAM,aAAa,UAAU;AAC7B,YAAM,UAAU,UAAU;AAC1B,UAAI,CAAC,cAAc,CAAC,QAAS,OAAM,IAAI,MAAM,6BAA6B;AAC1E,YAAM,UAAU,MAAM,QAAQ,UAAU,eAAe,IAAI,UAAU,kBAAkB,CAAC;AACxF,YAAM,iBAAiB,UAAU,0BAA0B;AAC3D,YAAM,WAAW,UAAU,oBAAoB;AAC/C,aAAO;AAAA,QACL,MAAM,MAAM;AAAA,QACZ,aAAa,MAAM,eAAe;AAAA,QAClC;AAAA,QACA;AAAA,QACA;AAAA,QACA,WAAW,WAAW;AAAA,QACtB,WAAW;AAAA,QACX,WAAW,IAAI,MAAM,OAAO;AAAA,QAC5B,WAAW,MAAM,aAAa;AAAA,MAChC;AAAA,IACF;AAAA,IACA,UAAU,CAAC,WAAW;AACpB,YAAM,OAAO;AACb,YAAM,SAAS,KAAK;AACpB,YAAM,QAAQ,KAAK;AACnB,aAAO;AAAA,QACL,IAAI,OAAO,OAAO,EAAE;AAAA,QACpB,MAAM,OAAO;AAAA,QACb,WAAW,OAAO;AAAA,QAClB;AAAA,QACA,UAAU,OAAO,YAAY;AAAA,QAC7B,gBAAgB,OAAO,kBAAkB;AAAA,QACzC,OAAO,MAAM,QAAQ,KAAK,IACtB,MAAM,IAAI,CAAC,UAAU,EAAE,IAAI,OAAO,KAAK,EAAE,GAAG,MAAM,KAAK,QAAQ,KAAK,EAAE,IACrE,MAAM,QAAQ,OAAO,SAAS,IAAI,OAAO,UAAU,IAAI,CAAC,QAAgB,EAAE,IAAI,MAAM,KAAK,EAAE,IAAI,CAAC;AAAA,MACvG;AAAA,IACF;AAAA,EACF;AAAA,EACA,KAAK,EAAE,QAAQ,QAAQ;AAAA,EACvB,OAAO;AAAA,IACL,YAAY,OAAO,OAAO,QAAQ;AAChC,YAAM,OAAO,IAAI;AACjB,YAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAI,CAAC,MAAM,SAAU,OAAM,KAAK,EAAE,OAAO,UAAU,kCAAkC,yBAAyB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAClI,YAAM,OAAO,KAAK,IAAI,SAAS,MAAM,QAAQ,KAAK,EAAE,KAAK,GAAG,CAAC;AAC7D,YAAM,WAAW,KAAK,IAAI,KAAK,IAAI,SAAS,MAAM,YAAY,MAAM,EAAE,KAAK,IAAI,CAAC,GAAG,GAAG;AACtF,YAAM,UAAU,MAAM,UAAU,IAAI,KAAK,EAAE,YAAY;AAEvD,YAAM,kBAAkB,MAAM,QAAQ,IAAI,eAAe,IAAI,IAAI,kBAAkB;AACnF,UAAI,mBAAmB,gBAAgB,WAAW,GAAG;AACnD,cAAM,KAAK,EAAE,OAAO,CAAC,GAAG,OAAO,GAAG,MAAM,UAAU,YAAY,EAAE,CAAC;AAAA,MACnE;AAEA,YAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,YAAM,KAAK,GAAG,mBAAmB,QAAQ,GAAG;AAC5C,SAAG,MAAM,EAAE,WAAW,KAAK,CAAC;AAC5B,SAAG,SAAS,EAAE,UAAU,KAAK,SAAS,CAAC;AACvC,UAAI,mBAAmB,gBAAgB,SAAS,GAAG;AACjD,WAAG,SAAS,EAAE,gBAAgB,EAAE,KAAK,gBAAgB,EAAE,CAAC;AAAA,MAC1D,WAAW,KAAK,OAAO;AACrB,WAAG,SAAS,EAAE,gBAAgB,KAAK,MAAM,CAAC;AAAA,MAC5C;AACA,UAAI,QAAQ;AACV,cAAM,UAAU,IAAI,kBAAkB,MAAM,CAAC;AAC7C,WAAG,SAAS;AAAA,UACV,KAAK;AAAA,YACH,EAAE,MAAM,EAAE,QAAQ,QAAQ,EAAE;AAAA,YAC5B,EAAE,WAAW,EAAE,QAAQ,QAAQ,EAAE;AAAA,UACnC;AAAA,QACF,CAAC;AAAA,MACH;AACA,SAAG,QAAQ,EAAE,WAAW,OAAO,CAAC;AAChC,SAAG,MAAM,QAAQ,EAAE,QAAQ,OAAO,KAAK,QAAQ;AAC/C,YAAM,CAAC,OAAO,KAAK,IAAI,MAAM,GAAG,kBAAkB;AAElD,UAAI,CAAC,MAAM,QAAQ;AACjB,cAAM,KAAK,EAAE,OAAO,CAAC,GAAG,OAAO,MAAM,UAAU,YAAY,KAAK,KAAK,QAAQ,QAAQ,EAAE,CAAC;AAAA,MAC1F;AAEA,YAAM,YAAY,oBAAI,IAAY;AAClC,YAAM,WAAW,oBAAI,IAAY;AACjC,iBAAW,QAAQ,OAAO;AACxB,YAAI,MAAM,QAAQ,KAAK,SAAS,GAAG;AACjC,qBAAW,UAAU,KAAK,UAAW,WAAU,IAAI,OAAO,MAAM,CAAC;AAAA,QACnE;AACA,YAAI,KAAK,eAAgB,UAAS,IAAI,OAAO,KAAK,cAAc,CAAC;AAAA,MACnE;AAEA,YAAM,cAAc,MAAM,KAAK,SAAS;AACxC,YAAM,sBAAsB,MAAM,KAAK,QAAQ;AAC/C,YAAM,aAAgC,EAAE,IAAI,EAAE,KAAK,YAAY,EAAE;AACjE,YAAM,qBAAgD,EAAE,IAAI,EAAE,KAAK,oBAAoB,EAAE;AACzF,YAAM,CAAC,OAAO,aAAa,IAAI,MAAM,QAAQ,IAAI;AAAA,QAC/C,YAAY,SAAS,GAAG,KAAK,MAAM,UAAU,IAAI,CAAC;AAAA,QAClD,oBAAoB,SAAS,GAAG,KAAK,cAAc,kBAAkB,IAAI,CAAC;AAAA,MAC5E,CAAC;AACD,YAAM,UAAU,IAAI,IAAI,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,KAAK,EAAE,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC;AACjF,YAAM,SAAS,IAAI,IAAI,cAAc,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,GAAG,IAAI,QAAQ,IAAI,CAAC,CAAC;AAErF,YAAM,UAAU;AAAA,QACd,OAAO,MAAM,IAAI,CAAC,UAAU;AAAA,UAC1B,IAAI,KAAK;AAAA,UACT,MAAM,KAAK;AAAA,UACX,aAAa,KAAK,eAAe;AAAA,UACjC,WAAW,KAAK;AAAA,UAChB,gBAAgB,KAAK,kBAAkB;AAAA,UACvC,kBAAkB,KAAK,iBAAiB,OAAO,IAAI,OAAO,KAAK,cAAc,CAAC,KAAK,OAAO;AAAA,UAC1F,WAAW,KAAK;AAAA,UAChB,YAAY,KAAK,cAAc;AAAA,UAC/B,WAAW,KAAK,aAAa;AAAA,UAC7B,OAAO,MAAM,QAAQ,KAAK,SAAS,IAC/B,KAAK,UAAU,IAAI,CAAC,QAAQ,EAAE,IAAI,MAAM,QAAQ,IAAI,OAAO,EAAE,CAAC,KAAK,KAAK,EAAE,IAC1E,CAAC;AAAA,QACP,EAAE;AAAA,QACF;AAAA,QACA;AAAA,QACA;AAAA,QACA,YAAY,KAAK,KAAK,QAAQ,QAAQ;AAAA,MACxC;AAEA,YAAM,KAAK,OAAO;AAAA,IACpB;AAAA,IACA,cAAc,OAAO,OAAO,QAAQ;AAClC,YAAM,OAAO,IAAI;AACjB,YAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAI,CAAC,MAAM,SAAU,OAAM,KAAK,EAAE,OAAO,UAAU,kCAAkC,yBAAyB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAElI,YAAM,kBAAkB,OAAO,UAAU,eAAe,KAAK,OAAO,UAAU,IAAI,MAAM,WAAW,KAAK;AACxG,YAAM,YAAY;AAClB,YAAM,iBAAiB,MAAM,uBAAuB,WAAW,eAAe;AAC9E,gBAAU,mBAAmB;AAE7B,YAAM,aAAa,qBAAqB;AACxC,gBAAU,iBAAiB;AAC3B,gBAAU,eAAe,MAAM,WAAW,WAAW,MAAM;AAE3D,YAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,YAAM,aAAa,MAAM,QAAQ,MAAM,KAAK,IAAI,MAAM,MAAM,OAAO,CAAC,UAAU,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC;AACvI,YAAM,eAAuB,CAAC;AAC9B,YAAM,UAAoB,CAAC;AAC3B,iBAAW,SAAS,YAAY;AAC9B,cAAM,QAAQ,MAAM,KAAK;AACzB,cAAM,cAAc,kBAAkB,KAAK,YAAY;AACvD,cAAM,oBAAoB,OAAO,gBAAgB,YAAY,YAAY,KAAK,EAAE,SAAS,IAAI,YAAY,KAAK,IAAI;AAClH,cAAM,8BAA8B,oBAAoB,kBAAkB,YAAY,IAAI;AAC1F,YAAI,OAAoB;AACxB,YAAI,6EAA6E,KAAK,KAAK,GAAG;AAC5F,iBAAO,MAAM,GAAG,QAAQ,MAAM,EAAE,IAAI,OAAO,WAAW,KAAK,CAAC;AAAA,QAC9D;AACA,YAAI,CAAC,MAAM;AACT,gBAAM,aAAgC,EAAE,MAAM,OAAO,WAAW,KAAK;AACrE,cAAI,6BAA6B;AAC/B,uBAAW,MAAM;AAAA,cACf,EAAE,UAAU,kBAAkB;AAAA,cAC9B,EAAE,UAAU,KAAK;AAAA,YACnB;AAAA,UACF,OAAO;AACL,uBAAW,WAAW;AAAA,UACxB;AACA,gBAAM,aAAa,MAAM,GAAG,KAAK,MAAM,YAAY,EAAE,OAAO,EAAE,CAAC;AAC/D,cAAI,6BAA6B;AAC/B,mBACE,WAAW,KAAK,CAAC,cAAc;AAC7B,kBAAI,CAAC,UAAU,SAAU,QAAO;AAChC,qBAAO,OAAO,UAAU,QAAQ,EAAE,YAAY,MAAM;AAAA,YACtD,CAAC,KACD,WAAW,KAAK,CAAC,cAAc,UAAU,aAAa,IAAI,KAC1D;AAAA,UACJ,OAAO;AACL,mBAAO,WAAW,KAAK,CAAC,cAAc,UAAU,aAAa,IAAI,KAAK;AAAA,UACxE;AACA,cAAI,CAAC,MAAM;AACT,mBAAO,WAAW,CAAC,KAAK;AAAA,UAC1B;AAAA,QACF;AACA,YAAI,CAAC,MAAM;AACT,gBAAM,KAAK,EAAE,OAAO,UAAU,gCAAgC,QAAQ,KAAK,cAAc,EAAE,YAAY,MAAM,CAAC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,QACpI;AACA,cAAM,eAAe,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI;AAC7D,cAAM,yBAAyB,eAAe,aAAa,YAAY,IAAI;AAC3E,YAAI,0BAA0B,+BAA+B,2BAA2B,6BAA6B;AACnH,gBAAM,KAAK,EAAE,OAAO,UAAU,mCAAmC,QAAQ,KAAK,IAAI,8BAA8B,EAAE,MAAM,KAAK,QAAQ,MAAM,CAAC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,QAClK;AACA,qBAAa,KAAK,IAAI;AACtB,gBAAQ,KAAK,OAAO,KAAK,EAAE,CAAC;AAAA,MAC9B;AACA,YAAM,yBAAyB;AAAA,QAC7B;AAAA,QACA,aAAa,IAAI,UAAU,QAAQ,aAAa;AAAA,QAChD,aAAa,KAAK;AAAA,QAClB,UAAU;AAAA,QACV,gBAAgB,KAAK,SAAS;AAAA,QAC9B,OAAO;AAAA,MACT,CAAC;AACD,gBAAU,gBAAgB;AAC1B,gBAAU,kBAAkB;AAE5B,YAAM,aAAa,IAAI,mBAAmB,cAAc;AACxD,YAAM,iBAAiB,OAAO,UAAU,eAAe,KAAK,OAAO,gBAAgB,IAC/E,MAAM,kBAAkB,OACxB,IAAI,0BAA0B,KAAK,SAAS;AAChD,YAAM,eAAe,MAAM,oBAAoB,SAAS;AACxD,UACE,CAAC,4BAA4B;AAAA,QAC3B;AAAA,QACA,wBAAwB;AAAA,QACxB,sBAAsB;AAAA,MACxB,CAAC,GACD;AACA,cAAM,KAAK,EAAE,OAAO,UAAU,0CAA0C,2BAA2B,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACzH;AACA,gBAAU,yBAAyB,kBAAkB;AAErD,aAAO,EAAE,GAAG,OAAO,eAAe;AAAA,IACpC;AAAA,IACA,aAAa,OAAO,QAAQ,QAAQ;AAClC,YAAM,YAAY;AAClB,YAAM,aAAa,UAAU;AAC7B,YAAM,QAAQ,UAAU;AACxB,UAAI,WAAY,CAAC,OAAgC,iBAAiB,WAAW;AAC7E,UAAI,MAAO,CAAC,OAAgC,gBAAgB;AAC5D,UAAI;AACF,cAAM,OAAQ,IAAI,UAAU,QAAQ,aAAa;AACjD,cAAM,KAAK,oBAAoB,WAAW,OAAO,EAAE,EAAE;AAAA,MACvD,QAAQ;AAAA,MAAC;AAAA,IACX;AAAA,IACA,cAAc,OAAO,IAAI,QAAQ;AAC/B,YAAM,OAAO,IAAI;AACjB,YAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAI,CAAC,MAAM,SAAU,OAAM,KAAK,EAAE,OAAO,UAAU,kCAAkC,yBAAyB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAClI,YAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,YAAM,YAAY;AAClB,YAAM,eAAe,MAAM,oBAAoB,SAAS;AACxD,YAAM,aAAa,IAAI,mBAAmB,cAAc;AACxD,YAAM,eAAoC;AAAA,QACxC;AAAA,QACA,UAAU,KAAK;AAAA,QACf,WAAW;AAAA,MACb;AACA,UAAI,CAAC,gBAAgB,MAAM,QAAQ,UAAU,GAAG;AAC9C,qBAAa,iBAAiB,EAAE,KAAK,WAAW;AAAA,MAClD;AACA,YAAM,SAAS,MAAM;AAAA,QACnB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK;AAAA,MAClD;AACA,UACE,CAAC,UACD,OAAO,aAAa,KAAK,YACzB,CAAC,4BAA4B;AAAA,QAC3B;AAAA,QACA,wBAAwB;AAAA,QACxB,sBAAsB,OAAO,kBAAkB;AAAA,MACjD,CAAC,GACD;AACA,cAAM,KAAK,EAAE,OAAO,UAAU,4BAA4B,WAAW,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MAC3F;AACA,gBAAU,yBAAyB,OAAO,kBAAkB;AAAA,IAC9D;AAAA,IACA,aAAa,OAAO,IAAI,QAAQ;AAC9B,UAAI;AACF,cAAM,OAAQ,IAAI,UAAU,QAAQ,aAAa;AACjD,cAAM,KAAK,oBAAoB,WAAW,EAAE,EAAE;AAAA,MAChD,QAAQ;AAAA,MAAC;AAAA,IACX;AAAA,EACF;AACF,CAAC;AAEM,MAAM,WAAW,KAAK;AACtB,MAAM,MAAM,KAAK;AACjB,MAAM,OAAO,KAAK;AAClB,MAAM,SAAS,KAAK;AAEpB,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,aACE;AAAA,EACF,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,OAAO;AAAA,MACP,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,YAAY;AAAA,QAC1E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,mCAAmC,QAAQ,YAAY;AAAA,MACrF;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,QACR,aAAa;AAAA,MACf;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,6CAA6C,QAAQ,YAAY;AAAA,QAC7F,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,sCAAsC,QAAQ,YAAY;AAAA,MACxF;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aACE;AAAA,MACF,OAAO,EAAE,OAAO;AAAA,QACd,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,8BAA8B;AAAA,MAC/D,CAAC;AAAA,MACD,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,qBAAqB;AAAA,MACvF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iCAAiC,QAAQ,YAAY;AAAA,QACjF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,sCAAsC,QAAQ,YAAY;AAAA,QACtF,EAAE,QAAQ,KAAK,aAAa,8BAA8B,QAAQ,YAAY;AAAA,MAChF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'\nimport { makeCrudRoute } from '@open-mercato/shared/lib/crud/factory'\nimport type { CrudCtx } from '@open-mercato/shared/lib/crud/factory'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { Role } from '@open-mercato/core/modules/auth/data/entities'\nimport { Organization } from '@open-mercato/core/modules/directory/data/entities'\nimport { ApiKey } from '../../data/entities'\nimport { createApiKeySchema } from '../../data/validators'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { enforceTenantSelection, resolveIsSuperAdmin } from '@open-mercato/core/modules/auth/lib/tenantAccess'\nimport { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'\nimport { assertActorCanGrantRoles } from '@open-mercato/core/modules/auth/lib/grantChecks'\nimport { isOrganizationAccessAllowed } from '@open-mercato/shared/lib/auth/organizationAccess'\nimport type { CreateApiKeyCommandInput } from '../../commands/keys'\n\nconst listQuerySchema = z.object({\n  page: z.string().optional(),\n  pageSize: z.string().optional(),\n  search: z.string().optional(),\n})\n\nconst apiKeyRoleSchema = z.object({\n  id: z.string().describe('Role identifier or alias assigned to the key'),\n  name: z.string().nullable().describe('Display name of the mapped role, if available'),\n})\n\nconst apiKeyListItemSchema = z.object({\n  id: z.string().describe('API key identifier'),\n  name: z.string().describe('Friendly label used to identify the key'),\n  description: z.string().nullable().describe('Optional free-form description'),\n  keyPrefix: z.string().describe('Public prefix exposed to clients'),\n  organizationId: z.string().uuid().nullable().describe('Organization scope of the key'),\n  organizationName: z.string().nullable().describe('Resolved organization display name'),\n  createdAt: z.string().describe('Creation timestamp (ISO 8601)'),\n  lastUsedAt: z.string().nullable().describe('Last time the key was observed in use (ISO 8601)'),\n  expiresAt: z.string().nullable().describe('When the key expires (ISO 8601)'),\n  roles: z.array(apiKeyRoleSchema).describe('Effective roles applied when this key authenticates'),\n})\n\nconst apiKeyCollectionResponseSchema = z.object({\n  items: z.array(apiKeyListItemSchema),\n  total: z.number().int().nonnegative(),\n  page: z.number().int().positive(),\n  pageSize: z.number().int().positive(),\n  totalPages: z.number().int().nonnegative(),\n})\n\nconst apiKeyCreateResponseSchema = z.object({\n  id: z.string().describe('Newly created API key identifier'),\n  name: z.string(),\n  keyPrefix: z.string(),\n  secret: z.string().describe('Full API key value. Shown once for secure persistence.').optional(),\n  tenantId: z.string().uuid().nullable(),\n  organizationId: z.string().uuid().nullable(),\n  roles: z.array(apiKeyRoleSchema),\n})\n\nconst deleteResponseSchema = z.object({\n  success: z.literal(true),\n})\n\nconst errorSchema = z.object({\n  error: z.string(),\n})\n\nfunction json(payload: unknown, init: ResponseInit = { status: 200 }) {\n  return new Response(JSON.stringify(payload), {\n    ...init,\n    headers: { 'content-type': 'application/json', ...(init.headers || {}) },\n  })\n}\n\nasync function prepareCreateCommandInput(\n  input: z.infer<typeof createApiKeySchema>,\n  ctx: CrudCtx,\n): Promise<CreateApiKeyCommandInput> {\n  const auth = ctx.auth\n  const { translate } = await resolveTranslations()\n  if (!auth?.tenantId) {\n    throw json({ error: translate('api_keys.errors.tenantRequired', 'Tenant context required') }, { status: 400 })\n  }\n\n  const requestedTenant = Object.prototype.hasOwnProperty.call(input, 'tenantId')\n    ? input.tenantId\n    : auth.tenantId\n  const targetTenantId = await enforceTenantSelection(ctx, requestedTenant)\n  const em = ctx.container.resolve('em') as EntityManager\n  const roleTokens = input.roles.filter((value) => value.trim().length > 0)\n  const roleEntities: Role[] = []\n  for (const token of roleTokens) {\n    const value = token.trim()\n    const effectiveTenantId = targetTenantId ?? auth.tenantId\n    const normalizedEffectiveTenantId = effectiveTenantId.toLowerCase()\n    let role: Role | null = null\n    if (/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value)) {\n      role = await em.findOne(Role, { id: value, deletedAt: null })\n    }\n    if (!role) {\n      const candidates = await em.find(Role, {\n        name: value,\n        deletedAt: null,\n        $or: [{ tenantId: effectiveTenantId }, { tenantId: null }],\n      } as FilterQuery<Role>, { limit: 5 })\n      role = candidates.find((candidate) => (\n        candidate.tenantId !== null\n        && String(candidate.tenantId).toLowerCase() === normalizedEffectiveTenantId\n      )) ?? candidates.find((candidate) => candidate.tenantId === null) ?? null\n    }\n    if (!role) {\n      throw json({ error: translate('api_keys.errors.roleNotFound', `Role ${value} not found`, { identifier: value }) }, { status: 400 })\n    }\n    const roleTenantId = role.tenantId ? String(role.tenantId).toLowerCase() : null\n    if (roleTenantId && roleTenantId !== normalizedEffectiveTenantId) {\n      throw json({ error: translate('api_keys.errors.roleWrongTenant', `Role ${role.name} belongs to another tenant`, { role: role.name ?? value }) }, { status: 400 })\n    }\n    roleEntities.push(role)\n  }\n  await assertActorCanGrantRoles({\n    em,\n    rbacService: ctx.container.resolve('rbacService') as RbacService,\n    actorUserId: auth.sub,\n    tenantId: targetTenantId,\n    organizationId: auth.orgId ?? null,\n    roles: roleEntities,\n  })\n\n  const allowedIds = ctx.organizationScope?.allowedIds ?? null\n  const organizationId = Object.prototype.hasOwnProperty.call(input, 'organizationId')\n    ? input.organizationId ?? null\n    : ctx.selectedOrganizationId ?? auth.orgId ?? null\n  const isSuperAdmin = await resolveIsSuperAdmin(ctx)\n  if (!isOrganizationAccessAllowed({\n    isSuperAdmin,\n    allowedOrganizationIds: allowedIds,\n    targetOrganizationId: organizationId,\n  })) {\n    throw json({ error: translate('api_keys.errors.organizationOutOfScope', 'Organization out of scope') }, { status: 403 })\n  }\n\n  return {\n    name: input.name,\n    description: input.description ?? null,\n    tenantId: targetTenantId,\n    organizationId,\n    roleIds: roleEntities.map((role) => String(role.id)),\n    expiresAt: input.expiresAt ?? null,\n  }\n}\n\nconst crud = makeCrudRoute<\n  z.infer<typeof createApiKeySchema>,\n  never,\n  z.infer<typeof listQuerySchema>\n>({\n  metadata: {\n    GET: { requireAuth: true, requireFeatures: ['api_keys.view'] },\n    POST: { requireAuth: true, requireFeatures: ['api_keys.create'] },\n    DELETE: { requireAuth: true, requireFeatures: ['api_keys.delete'] },\n  },\n  orm: { entity: ApiKey, orgField: null },\n  list: { schema: listQuerySchema },\n  del: { idFrom: 'query' },\n  actions: {\n    create: {\n      commandId: 'api_keys.keys.create',\n      schema: createApiKeySchema,\n      mapInput: ({ parsed, ctx }) => prepareCreateCommandInput(parsed, ctx),\n      response: ({ result }) => result,\n    },\n    delete: {\n      commandId: 'api_keys.keys.delete',\n      mapInput: ({ raw }) => ({ id: String(raw.query?.id ?? '') }),\n      response: () => ({ success: true }),\n    },\n  },\n  hooks: {\n    beforeList: async (query, ctx) => {\n      const auth = ctx.auth\n      const { translate } = await resolveTranslations()\n      if (!auth?.tenantId) throw json({ error: translate('api_keys.errors.tenantRequired', 'Tenant context required') }, { status: 400 })\n      const page = Math.max(parseInt(query.page ?? '1', 10) || 1, 1)\n      const pageSize = Math.min(Math.max(parseInt(query.pageSize ?? '20', 10) || 20, 1), 200)\n      const search = (query.search ?? '').trim().toLowerCase()\n\n      const organizationIds = Array.isArray(ctx.organizationIds) ? ctx.organizationIds : null\n      if (organizationIds && organizationIds.length === 0) {\n        throw json({ items: [], total: 0, page, pageSize, totalPages: 0 })\n      }\n\n      const em = (ctx.container.resolve('em') as EntityManager)\n      const qb = em.createQueryBuilder(ApiKey, 'k')\n      qb.where({ deletedAt: null })\n      qb.andWhere({ tenantId: auth.tenantId })\n      if (organizationIds && organizationIds.length > 0) {\n        qb.andWhere({ organizationId: { $in: organizationIds } })\n      } else if (auth.orgId) {\n        qb.andWhere({ organizationId: auth.orgId })\n      }\n      if (search) {\n        const pattern = `%${escapeLikePattern(search)}%`\n        qb.andWhere({\n          $or: [\n            { name: { $ilike: pattern } },\n            { keyPrefix: { $ilike: pattern } },\n          ],\n        })\n      }\n      qb.orderBy({ createdAt: 'desc' })\n      qb.limit(pageSize).offset((page - 1) * pageSize)\n      const [items, total] = await qb.getResultAndCount()\n\n      if (!items.length) {\n        throw json({ items: [], total, page, pageSize, totalPages: Math.ceil(total / pageSize) })\n      }\n\n      const roleIdSet = new Set<string>()\n      const orgIdSet = new Set<string>()\n      for (const item of items) {\n        if (Array.isArray(item.rolesJson)) {\n          for (const roleId of item.rolesJson) roleIdSet.add(String(roleId))\n        }\n        if (item.organizationId) orgIdSet.add(String(item.organizationId))\n      }\n\n      const roleIdArray = Array.from(roleIdSet)\n      const organizationIdArray = Array.from(orgIdSet)\n      const roleFilter: FilterQuery<Role> = { id: { $in: roleIdArray } }\n      const organizationFilter: FilterQuery<Organization> = { id: { $in: organizationIdArray } }\n      const [roles, organizations] = await Promise.all([\n        roleIdArray.length ? em.find(Role, roleFilter) : [],\n        organizationIdArray.length ? em.find(Organization, organizationFilter) : [],\n      ])\n      const roleMap = new Map(roles.map((role) => [String(role.id), role.name ?? null]))\n      const orgMap = new Map(organizations.map((org) => [String(org.id), org.name ?? null]))\n\n      const payload = {\n        items: items.map((item) => ({\n          id: item.id,\n          name: item.name,\n          description: item.description ?? null,\n          keyPrefix: item.keyPrefix,\n          organizationId: item.organizationId ?? null,\n          organizationName: item.organizationId ? orgMap.get(String(item.organizationId)) ?? null : null,\n          createdAt: item.createdAt,\n          lastUsedAt: item.lastUsedAt ?? null,\n          expiresAt: item.expiresAt ?? null,\n          roles: Array.isArray(item.rolesJson)\n            ? item.rolesJson.map((id) => ({ id, name: roleMap.get(String(id)) ?? null }))\n            : [],\n        })),\n        total,\n        page,\n        pageSize,\n        totalPages: Math.ceil(total / pageSize),\n      }\n\n      throw json(payload)\n    },\n  },\n})\n\nexport const metadata = crud.metadata\nexport const GET = crud.GET\nexport const POST = crud.POST\nexport const DELETE = crud.DELETE\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Manage API keys',\n  description:\n    'Provides list, creation, and deletion capabilities for API keys scoped to the authenticated tenant and organization.',\n  methods: {\n    GET: {\n      summary: 'List API keys',\n      description:\n        'Returns paginated API keys visible to the current user, including per-key role assignments and organization context.',\n      query: listQuerySchema,\n      responses: [\n        {\n          status: 200,\n          description: 'Collection of API keys',\n          schema: apiKeyCollectionResponseSchema,\n        },\n      ],\n      errors: [\n        { status: 400, description: 'Tenant context missing', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 403, description: 'Forbidden by organization scope', schema: errorSchema },\n      ],\n    },\n    POST: {\n      summary: 'Create API key',\n      description:\n        'Creates a new API key, returning the one-time secret value together with the generated key prefix and scope details.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: createApiKeySchema,\n        description: 'API key definition including optional scope and role assignments.',\n      },\n      responses: [\n        {\n          status: 201,\n          description: 'API key created successfully',\n          schema: apiKeyCreateResponseSchema,\n        },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid payload or missing tenant context', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 403, description: 'Organization outside allowed scope', schema: errorSchema },\n      ],\n    },\n    DELETE: {\n      summary: 'Delete API key',\n      description:\n        'Removes an API key by identifier. The key must belong to the current tenant and fall within the requester organization scope.',\n      query: z.object({\n        id: z.string().uuid().describe('API key identifier to delete'),\n      }),\n      responses: [\n        { status: 200, description: 'Key deleted successfully', schema: deleteResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Missing or invalid identifier', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 403, description: 'Organization outside allowed scope', schema: errorSchema },\n        { status: 404, description: 'Key not found within scope', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAGlB,SAAS,qBAAqB;AAG9B,SAAS,YAAY;AACrB,SAAS,oBAAoB;AAC7B,SAAS,cAAc;AACvB,SAAS,0BAA0B;AACnC,SAAS,2BAA2B;AACpC,SAAS,wBAAwB,2BAA2B;AAC5D,SAAS,yBAAyB;AAClC,SAAS,gCAAgC;AACzC,SAAS,mCAAmC;AAG5C,MAAM,kBAAkB,EAAE,OAAO;AAAA,EAC/B,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,QAAQ,EAAE,OAAO,EAAE,SAAS;AAC9B,CAAC;AAED,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,IAAI,EAAE,OAAO,EAAE,SAAS,8CAA8C;AAAA,EACtE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,+CAA+C;AACtF,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,IAAI,EAAE,OAAO,EAAE,SAAS,oBAAoB;AAAA,EAC5C,MAAM,EAAE,OAAO,EAAE,SAAS,yCAAyC;AAAA,EACnE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,gCAAgC;AAAA,EAC5E,WAAW,EAAE,OAAO,EAAE,SAAS,kCAAkC;AAAA,EACjE,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,+BAA+B;AAAA,EACrF,kBAAkB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,oCAAoC;AAAA,EACrF,WAAW,EAAE,OAAO,EAAE,SAAS,+BAA+B;AAAA,EAC9D,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,kDAAkD;AAAA,EAC7F,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,iCAAiC;AAAA,EAC3E,OAAO,EAAE,MAAM,gBAAgB,EAAE,SAAS,qDAAqD;AACjG,CAAC;AAED,MAAM,iCAAiC,EAAE,OAAO;AAAA,EAC9C,OAAO,EAAE,MAAM,oBAAoB;AAAA,EACnC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACpC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAChC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACpC,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAC3C,CAAC;AAED,MAAM,6BAA6B,EAAE,OAAO;AAAA,EAC1C,IAAI,EAAE,OAAO,EAAE,SAAS,kCAAkC;AAAA,EAC1D,MAAM,EAAE,OAAO;AAAA,EACf,WAAW,EAAE,OAAO;AAAA,EACpB,QAAQ,EAAE,OAAO,EAAE,SAAS,wDAAwD,EAAE,SAAS;AAAA,EAC/F,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACrC,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC3C,OAAO,EAAE,MAAM,gBAAgB;AACjC,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,SAAS,EAAE,QAAQ,IAAI;AACzB,CAAC;AAED,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,SAAS,KAAK,SAAkB,OAAqB,EAAE,QAAQ,IAAI,GAAG;AACpE,SAAO,IAAI,SAAS,KAAK,UAAU,OAAO,GAAG;AAAA,IAC3C,GAAG;AAAA,IACH,SAAS,EAAE,gBAAgB,oBAAoB,GAAI,KAAK,WAAW,CAAC,EAAG;AAAA,EACzE,CAAC;AACH;AAEA,eAAe,0BACb,OACA,KACmC;AACnC,QAAM,OAAO,IAAI;AACjB,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,MAAM,UAAU;AACnB,UAAM,KAAK,EAAE,OAAO,UAAU,kCAAkC,yBAAyB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/G;AAEA,QAAM,kBAAkB,OAAO,UAAU,eAAe,KAAK,OAAO,UAAU,IAC1E,MAAM,WACN,KAAK;AACT,QAAM,iBAAiB,MAAM,uBAAuB,KAAK,eAAe;AACxE,QAAM,KAAK,IAAI,UAAU,QAAQ,IAAI;AACrC,QAAM,aAAa,MAAM,MAAM,OAAO,CAAC,UAAU,MAAM,KAAK,EAAE,SAAS,CAAC;AACxE,QAAM,eAAuB,CAAC;AAC9B,aAAW,SAAS,YAAY;AAC9B,UAAM,QAAQ,MAAM,KAAK;AACzB,UAAM,oBAAoB,kBAAkB,KAAK;AACjD,UAAM,8BAA8B,kBAAkB,YAAY;AAClE,QAAI,OAAoB;AACxB,QAAI,6EAA6E,KAAK,KAAK,GAAG;AAC5F,aAAO,MAAM,GAAG,QAAQ,MAAM,EAAE,IAAI,OAAO,WAAW,KAAK,CAAC;AAAA,IAC9D;AACA,QAAI,CAAC,MAAM;AACT,YAAM,aAAa,MAAM,GAAG,KAAK,MAAM;AAAA,QACrC,MAAM;AAAA,QACN,WAAW;AAAA,QACX,KAAK,CAAC,EAAE,UAAU,kBAAkB,GAAG,EAAE,UAAU,KAAK,CAAC;AAAA,MAC3D,GAAwB,EAAE,OAAO,EAAE,CAAC;AACpC,aAAO,WAAW,KAAK,CAAC,cACtB,UAAU,aAAa,QACpB,OAAO,UAAU,QAAQ,EAAE,YAAY,MAAM,2BACjD,KAAK,WAAW,KAAK,CAAC,cAAc,UAAU,aAAa,IAAI,KAAK;AAAA,IACvE;AACA,QAAI,CAAC,MAAM;AACT,YAAM,KAAK,EAAE,OAAO,UAAU,gCAAgC,QAAQ,KAAK,cAAc,EAAE,YAAY,MAAM,CAAC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACpI;AACA,UAAM,eAAe,KAAK,WAAW,OAAO,KAAK,QAAQ,EAAE,YAAY,IAAI;AAC3E,QAAI,gBAAgB,iBAAiB,6BAA6B;AAChE,YAAM,KAAK,EAAE,OAAO,UAAU,mCAAmC,QAAQ,KAAK,IAAI,8BAA8B,EAAE,MAAM,KAAK,QAAQ,MAAM,CAAC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAClK;AACA,iBAAa,KAAK,IAAI;AAAA,EACxB;AACA,QAAM,yBAAyB;AAAA,IAC7B;AAAA,IACA,aAAa,IAAI,UAAU,QAAQ,aAAa;AAAA,IAChD,aAAa,KAAK;AAAA,IAClB,UAAU;AAAA,IACV,gBAAgB,KAAK,SAAS;AAAA,IAC9B,OAAO;AAAA,EACT,CAAC;AAED,QAAM,aAAa,IAAI,mBAAmB,cAAc;AACxD,QAAM,iBAAiB,OAAO,UAAU,eAAe,KAAK,OAAO,gBAAgB,IAC/E,MAAM,kBAAkB,OACxB,IAAI,0BAA0B,KAAK,SAAS;AAChD,QAAM,eAAe,MAAM,oBAAoB,GAAG;AAClD,MAAI,CAAC,4BAA4B;AAAA,IAC/B;AAAA,IACA,wBAAwB;AAAA,IACxB,sBAAsB;AAAA,EACxB,CAAC,GAAG;AACF,UAAM,KAAK,EAAE,OAAO,UAAU,0CAA0C,2BAA2B,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzH;AAEA,SAAO;AAAA,IACL,MAAM,MAAM;AAAA,IACZ,aAAa,MAAM,eAAe;AAAA,IAClC,UAAU;AAAA,IACV;AAAA,IACA,SAAS,aAAa,IAAI,CAAC,SAAS,OAAO,KAAK,EAAE,CAAC;AAAA,IACnD,WAAW,MAAM,aAAa;AAAA,EAChC;AACF;AAEA,MAAM,OAAO,cAIX;AAAA,EACA,UAAU;AAAA,IACR,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,eAAe,EAAE;AAAA,IAC7D,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;AAAA,IAChE,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;AAAA,EACpE;AAAA,EACA,KAAK,EAAE,QAAQ,QAAQ,UAAU,KAAK;AAAA,EACtC,MAAM,EAAE,QAAQ,gBAAgB;AAAA,EAChC,KAAK,EAAE,QAAQ,QAAQ;AAAA,EACvB,SAAS;AAAA,IACP,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,CAAC,EAAE,QAAQ,IAAI,MAAM,0BAA0B,QAAQ,GAAG;AAAA,MACpE,UAAU,CAAC,EAAE,OAAO,MAAM;AAAA,IAC5B;AAAA,IACA,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,UAAU,CAAC,EAAE,IAAI,OAAO,EAAE,IAAI,OAAO,IAAI,OAAO,MAAM,EAAE,EAAE;AAAA,MAC1D,UAAU,OAAO,EAAE,SAAS,KAAK;AAAA,IACnC;AAAA,EACF;AAAA,EACA,OAAO;AAAA,IACL,YAAY,OAAO,OAAO,QAAQ;AAChC,YAAM,OAAO,IAAI;AACjB,YAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAI,CAAC,MAAM,SAAU,OAAM,KAAK,EAAE,OAAO,UAAU,kCAAkC,yBAAyB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAClI,YAAM,OAAO,KAAK,IAAI,SAAS,MAAM,QAAQ,KAAK,EAAE,KAAK,GAAG,CAAC;AAC7D,YAAM,WAAW,KAAK,IAAI,KAAK,IAAI,SAAS,MAAM,YAAY,MAAM,EAAE,KAAK,IAAI,CAAC,GAAG,GAAG;AACtF,YAAM,UAAU,MAAM,UAAU,IAAI,KAAK,EAAE,YAAY;AAEvD,YAAM,kBAAkB,MAAM,QAAQ,IAAI,eAAe,IAAI,IAAI,kBAAkB;AACnF,UAAI,mBAAmB,gBAAgB,WAAW,GAAG;AACnD,cAAM,KAAK,EAAE,OAAO,CAAC,GAAG,OAAO,GAAG,MAAM,UAAU,YAAY,EAAE,CAAC;AAAA,MACnE;AAEA,YAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,YAAM,KAAK,GAAG,mBAAmB,QAAQ,GAAG;AAC5C,SAAG,MAAM,EAAE,WAAW,KAAK,CAAC;AAC5B,SAAG,SAAS,EAAE,UAAU,KAAK,SAAS,CAAC;AACvC,UAAI,mBAAmB,gBAAgB,SAAS,GAAG;AACjD,WAAG,SAAS,EAAE,gBAAgB,EAAE,KAAK,gBAAgB,EAAE,CAAC;AAAA,MAC1D,WAAW,KAAK,OAAO;AACrB,WAAG,SAAS,EAAE,gBAAgB,KAAK,MAAM,CAAC;AAAA,MAC5C;AACA,UAAI,QAAQ;AACV,cAAM,UAAU,IAAI,kBAAkB,MAAM,CAAC;AAC7C,WAAG,SAAS;AAAA,UACV,KAAK;AAAA,YACH,EAAE,MAAM,EAAE,QAAQ,QAAQ,EAAE;AAAA,YAC5B,EAAE,WAAW,EAAE,QAAQ,QAAQ,EAAE;AAAA,UACnC;AAAA,QACF,CAAC;AAAA,MACH;AACA,SAAG,QAAQ,EAAE,WAAW,OAAO,CAAC;AAChC,SAAG,MAAM,QAAQ,EAAE,QAAQ,OAAO,KAAK,QAAQ;AAC/C,YAAM,CAAC,OAAO,KAAK,IAAI,MAAM,GAAG,kBAAkB;AAElD,UAAI,CAAC,MAAM,QAAQ;AACjB,cAAM,KAAK,EAAE,OAAO,CAAC,GAAG,OAAO,MAAM,UAAU,YAAY,KAAK,KAAK,QAAQ,QAAQ,EAAE,CAAC;AAAA,MAC1F;AAEA,YAAM,YAAY,oBAAI,IAAY;AAClC,YAAM,WAAW,oBAAI,IAAY;AACjC,iBAAW,QAAQ,OAAO;AACxB,YAAI,MAAM,QAAQ,KAAK,SAAS,GAAG;AACjC,qBAAW,UAAU,KAAK,UAAW,WAAU,IAAI,OAAO,MAAM,CAAC;AAAA,QACnE;AACA,YAAI,KAAK,eAAgB,UAAS,IAAI,OAAO,KAAK,cAAc,CAAC;AAAA,MACnE;AAEA,YAAM,cAAc,MAAM,KAAK,SAAS;AACxC,YAAM,sBAAsB,MAAM,KAAK,QAAQ;AAC/C,YAAM,aAAgC,EAAE,IAAI,EAAE,KAAK,YAAY,EAAE;AACjE,YAAM,qBAAgD,EAAE,IAAI,EAAE,KAAK,oBAAoB,EAAE;AACzF,YAAM,CAAC,OAAO,aAAa,IAAI,MAAM,QAAQ,IAAI;AAAA,QAC/C,YAAY,SAAS,GAAG,KAAK,MAAM,UAAU,IAAI,CAAC;AAAA,QAClD,oBAAoB,SAAS,GAAG,KAAK,cAAc,kBAAkB,IAAI,CAAC;AAAA,MAC5E,CAAC;AACD,YAAM,UAAU,IAAI,IAAI,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,KAAK,EAAE,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC;AACjF,YAAM,SAAS,IAAI,IAAI,cAAc,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,GAAG,IAAI,QAAQ,IAAI,CAAC,CAAC;AAErF,YAAM,UAAU;AAAA,QACd,OAAO,MAAM,IAAI,CAAC,UAAU;AAAA,UAC1B,IAAI,KAAK;AAAA,UACT,MAAM,KAAK;AAAA,UACX,aAAa,KAAK,eAAe;AAAA,UACjC,WAAW,KAAK;AAAA,UAChB,gBAAgB,KAAK,kBAAkB;AAAA,UACvC,kBAAkB,KAAK,iBAAiB,OAAO,IAAI,OAAO,KAAK,cAAc,CAAC,KAAK,OAAO;AAAA,UAC1F,WAAW,KAAK;AAAA,UAChB,YAAY,KAAK,cAAc;AAAA,UAC/B,WAAW,KAAK,aAAa;AAAA,UAC7B,OAAO,MAAM,QAAQ,KAAK,SAAS,IAC/B,KAAK,UAAU,IAAI,CAAC,QAAQ,EAAE,IAAI,MAAM,QAAQ,IAAI,OAAO,EAAE,CAAC,KAAK,KAAK,EAAE,IAC1E,CAAC;AAAA,QACP,EAAE;AAAA,QACF;AAAA,QACA;AAAA,QACA;AAAA,QACA,YAAY,KAAK,KAAK,QAAQ,QAAQ;AAAA,MACxC;AAEA,YAAM,KAAK,OAAO;AAAA,IACpB;AAAA,EACF;AACF,CAAC;AAEM,MAAM,WAAW,KAAK;AACtB,MAAM,MAAM,KAAK;AACjB,MAAM,OAAO,KAAK;AAClB,MAAM,SAAS,KAAK;AAEpB,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,aACE;AAAA,EACF,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,OAAO;AAAA,MACP,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,YAAY;AAAA,QAC1E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,mCAAmC,QAAQ,YAAY;AAAA,MACrF;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,QACR,aAAa;AAAA,MACf;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,6CAA6C,QAAQ,YAAY;AAAA,QAC7F,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,sCAAsC,QAAQ,YAAY;AAAA,MACxF;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aACE;AAAA,MACF,OAAO,EAAE,OAAO;AAAA,QACd,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,8BAA8B;AAAA,MAC/D,CAAC;AAAA,MACD,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,qBAAqB;AAAA,MACvF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iCAAiC,QAAQ,YAAY;AAAA,QACjF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,sCAAsC,QAAQ,YAAY;AAAA,QACtF,EAAE,QAAQ,KAAK,aAAa,8BAA8B,QAAQ,YAAY;AAAA,MAChF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/api_keys/backend/api-keys/create/page.js

@@ -129,7 +129,7 @@ function CreateApiKeyPage() {
         const payload = {
           name: values.name,
           description: values.description || null,
-          organizationId: values.organizationId || null,
+          ...values.organizationId ? { organizationId: values.organizationId } : {},
           roles: Array.isArray(values.roles) ? values.roles : [],
           expiresAt: values.expiresAt || null
         };

package/dist/modules/api_keys/backend/api-keys/create/page.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/api_keys/backend/api-keys/create/page.tsx"],
-  "sourcesContent": ["\"use client\"\nimport * as React from 'react'\nimport { Page, PageBody } from '@open-mercato/ui/backend/Page'\nimport { CrudForm, type CrudField, type CrudFormGroup } from '@open-mercato/ui/backend/CrudForm'\nimport { apiCall } from '@open-mercato/ui/backend/utils/apiCall'\nimport { createCrud } from '@open-mercato/ui/backend/utils/crud'\nimport { createCrudFormError } from '@open-mercato/ui/backend/utils/serverErrors'\nimport { OrganizationSelect } from '@open-mercato/core/modules/directory/components/OrganizationSelect'\nimport { fetchRoleOptions } from '@open-mercato/core/modules/auth/backend/users/roleOptions'\nimport { flash } from '@open-mercato/ui/backend/FlashMessages'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { useRouter } from 'next/navigation'\nimport { useOrganizationScopeDetail, useOrganizationScopeVersion } from '@open-mercato/shared/lib/frontend/useOrganizationScope'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\n\ntype FormValues = {\n  name: string\n  description: string | null\n  organizationId: string | null\n  expiresAt: string | null\n  roles: string[]\n}\n\nexport default function CreateApiKeyPage() {\n  const [createdSecret, setCreatedSecret] = React.useState<{ secret: string; keyPrefix: string } | null>(null)\n  const [actorIsSuperAdmin, setActorIsSuperAdmin] = React.useState(false)\n  const [actorResolved, setActorResolved] = React.useState(false)\n  const [selectedTenantId, setSelectedTenantId] = React.useState<string | null>(null)\n  const router = useRouter()\n  const scopeDetail = useOrganizationScopeDetail()\n  const scopeVersion = useOrganizationScopeVersion()\n  const t = useT()\n\n  React.useEffect(() => {\n    let cancelled = false\n    async function loadInitialScope() {\n      try {\n        const { ok, result } = await apiCall<{ tenantId?: string; isSuperAdmin?: boolean }>(\n          '/api/directory/organization-switcher',\n        )\n        if (!ok || cancelled) {\n          if (!ok && !cancelled) setActorIsSuperAdmin(false)\n          return\n        }\n        const rawTenant = typeof result?.tenantId === 'string' ? result.tenantId : null\n        const normalizedTenant = rawTenant && rawTenant.trim().length > 0 ? rawTenant.trim() : null\n        setSelectedTenantId(normalizedTenant)\n        setActorIsSuperAdmin(Boolean(result?.isSuperAdmin))\n      } catch {\n        if (!cancelled) setActorIsSuperAdmin(false)\n      } finally {\n        if (!cancelled) setActorResolved(true)\n      }\n    }\n    loadInitialScope()\n    return () => { cancelled = true }\n  }, [])\n\n  React.useEffect(() => {\n    if (scopeVersion === 0) return\n    const rawTenant = scopeDetail.tenantId\n    const normalizedTenant = typeof rawTenant === 'string' && rawTenant.trim().length > 0 ? rawTenant.trim() : null\n    setSelectedTenantId((prev) => {\n      if ((prev ?? null) === (normalizedTenant ?? null)) return prev\n      return normalizedTenant\n    })\n  }, [scopeDetail.tenantId, scopeVersion])\n\n  // Block role loading until we know whether the actor is a super admin. Without this guard the\n  // initial (non-super-admin) branch fires before the flag resolves and the server returns roles\n  // from other tenants because the real caller is a super admin without tenantId scoping.\n  const loadRoleOptions = React.useCallback(async (query?: string) => {\n    if (!actorResolved) return []\n    if (actorIsSuperAdmin) {\n      const tenant = typeof selectedTenantId === 'string' && selectedTenantId.trim().length > 0 ? selectedTenantId.trim() : null\n      if (!tenant) return []\n      return fetchRoleOptions(query, { tenantId: tenant })\n    }\n    return fetchRoleOptions(query)\n  }, [actorIsSuperAdmin, actorResolved, selectedTenantId])\n\n  const fields = React.useMemo<CrudField[]>(() => [\n    { id: 'name', label: t('api_keys.form.name'), type: 'text', required: true },\n    { id: 'description', label: t('api_keys.form.description'), type: 'textarea', description: t('api_keys.form.descriptionHint') },\n    {\n      id: 'organizationId',\n      label: t('api_keys.form.organization'),\n      required: false,\n      type: 'custom',\n      component: ({ id, value, setValue }) => (\n        <OrganizationSelect\n          id={id}\n          value={typeof value === 'string' ? value : null}\n          onChange={(next) => setValue(next ?? null)}\n          includeEmptyOption\n          emptyOptionLabel={t('api_keys.form.organizationPlaceholder')}\n          className=\"w-full h-9 rounded border px-2 text-sm\"\n        />\n      ),\n    },\n    {\n      id: 'roles',\n      label: t('api_keys.form.roles'),\n      type: 'tags',\n      loadOptions: loadRoleOptions,\n      description: t('api_keys.form.rolesHint'),\n    },\n    { id: 'expiresAt', label: t('api_keys.form.expiresAt'), type: 'date', description: t('api_keys.form.expiresHint') },\n  ], [loadRoleOptions, t])\n\n  const groups = React.useMemo<CrudFormGroup[]>(() => ([\n    { id: 'details', title: t('api_keys.form.details'), column: 1, fields: ['name', 'description', 'organizationId', 'roles', 'expiresAt'] },\n  ]), [t])\n\n  if (createdSecret) {\n    return (\n      <Page>\n        <PageBody>\n          <div className=\"flex items-center justify-center\">\n            <div className=\"w-full max-w-2xl rounded-xl border bg-card shadow-sm\">\n              <div className=\"border-b p-6\">\n                <h1 className=\"text-lg font-semibold leading-7\">{t('api_keys.copy.title')}</h1>\n                <p className=\"mt-2 text-sm text-muted-foreground\">\n                  {t('api_keys.copy.subtitle')}\n                </p>\n              </div>\n              <div className=\"space-y-4 p-6\">\n                <div className=\"rounded-md border bg-muted/50 p-4 font-mono text-sm break-all\">\n                  {createdSecret.secret}\n                </div>\n                <div className=\"flex items-center justify-between text-xs text-muted-foreground\">\n                  <span className=\"inline-flex items-center rounded-full border px-2 py-1 font-medium\">\n                    {t('api_keys.copy.prefix', { prefix: createdSecret.keyPrefix })}\n                  </span>\n                  <span>{t('api_keys.copy.warning')}</span>\n                </div>\n                <div className=\"flex justify-end\">\n                  <Button onClick={() => router.push('/backend/api-keys')}>\n                    {t('common.close')}\n                  </Button>\n                </div>\n              </div>\n            </div>\n          </div>\n      </PageBody>\n    </Page>\n    )\n  }\n\n  return (\n    <Page>\n      <PageBody>\n        <div className=\"space-y-6\">\n          <CrudForm<FormValues>\n            title={t('api_keys.form.title')}\n            titleHeadingLevel={1}\n            backHref=\"/backend/api-keys\"\n            fields={fields}\n            groups={groups}\n            initialValues={{ name: '', description: null, organizationId: null, roles: [], expiresAt: null }}\n            submitLabel={t('common.create')}\n            cancelHref=\"/backend/api-keys\"\n            onSubmit={async (values) => {\n              const payload: {\n                name: string\n                description: string | null\n                organizationId: string | null\n                roles: string[]\n                expiresAt: string | null\n                tenantId?: string | null\n              } = {\n                name: values.name,\n                description: values.description || null,\n                organizationId: values.organizationId || null,\n                roles: Array.isArray(values.roles) ? values.roles : [],\n                expiresAt: values.expiresAt || null,\n              }\n              if (actorIsSuperAdmin) {\n                const tenant = typeof selectedTenantId === 'string' && selectedTenantId.trim().length > 0 ? selectedTenantId.trim() : null\n                if (!tenant) {\n                  const message = t('api_keys.errors.tenantRequired')\n                  throw createCrudFormError(message, { tenantId: message })\n                }\n                payload.tenantId = tenant\n              }\n              const { result } = await createCrud<{ secret?: string; keyPrefix?: string | null }>(\n                'api_keys/keys',\n                payload,\n              )\n              const created = result\n              if (!created || typeof created.secret !== 'string') {\n                throw createCrudFormError(t('api_keys.form.error.secretMissing'))\n              }\n              const keyPrefix = typeof created.keyPrefix === 'string' ? created.keyPrefix : ''\n              setCreatedSecret({ secret: created.secret, keyPrefix })\n              flash(t('api_keys.form.success'), 'success')\n            }}\n          />\n        </div>\n      </PageBody>\n    </Page>\n  )\n}\n"],
-  "mappings": ";AA0FQ,cA8BM,YA9BN;AAzFR,YAAY,WAAW;AACvB,SAAS,MAAM,gBAAgB;AAC/B,SAAS,gBAAoD;AAC7D,SAAS,eAAe;AACxB,SAAS,kBAAkB;AAC3B,SAAS,2BAA2B;AACpC,SAAS,0BAA0B;AACnC,SAAS,wBAAwB;AACjC,SAAS,aAAa;AACtB,SAAS,cAAc;AACvB,SAAS,iBAAiB;AAC1B,SAAS,4BAA4B,mCAAmC;AACxE,SAAS,YAAY;AAUN,SAAR,mBAAoC;AACzC,QAAM,CAAC,eAAe,gBAAgB,IAAI,MAAM,SAAuD,IAAI;AAC3G,QAAM,CAAC,mBAAmB,oBAAoB,IAAI,MAAM,SAAS,KAAK;AACtE,QAAM,CAAC,eAAe,gBAAgB,IAAI,MAAM,SAAS,KAAK;AAC9D,QAAM,CAAC,kBAAkB,mBAAmB,IAAI,MAAM,SAAwB,IAAI;AAClF,QAAM,SAAS,UAAU;AACzB,QAAM,cAAc,2BAA2B;AAC/C,QAAM,eAAe,4BAA4B;AACjD,QAAM,IAAI,KAAK;AAEf,QAAM,UAAU,MAAM;AACpB,QAAI,YAAY;AAChB,mBAAe,mBAAmB;AAChC,UAAI;AACF,cAAM,EAAE,IAAI,OAAO,IAAI,MAAM;AAAA,UAC3B;AAAA,QACF;AACA,YAAI,CAAC,MAAM,WAAW;AACpB,cAAI,CAAC,MAAM,CAAC,UAAW,sBAAqB,KAAK;AACjD;AAAA,QACF;AACA,cAAM,YAAY,OAAO,QAAQ,aAAa,WAAW,OAAO,WAAW;AAC3E,cAAM,mBAAmB,aAAa,UAAU,KAAK,EAAE,SAAS,IAAI,UAAU,KAAK,IAAI;AACvF,4BAAoB,gBAAgB;AACpC,6BAAqB,QAAQ,QAAQ,YAAY,CAAC;AAAA,MACpD,QAAQ;AACN,YAAI,CAAC,UAAW,sBAAqB,KAAK;AAAA,MAC5C,UAAE;AACA,YAAI,CAAC,UAAW,kBAAiB,IAAI;AAAA,MACvC;AAAA,IACF;AACA,qBAAiB;AACjB,WAAO,MAAM;AAAE,kBAAY;AAAA,IAAK;AAAA,EAClC,GAAG,CAAC,CAAC;AAEL,QAAM,UAAU,MAAM;AACpB,QAAI,iBAAiB,EAAG;AACxB,UAAM,YAAY,YAAY;AAC9B,UAAM,mBAAmB,OAAO,cAAc,YAAY,UAAU,KAAK,EAAE,SAAS,IAAI,UAAU,KAAK,IAAI;AAC3G,wBAAoB,CAAC,SAAS;AAC5B,WAAK,QAAQ,WAAW,oBAAoB,MAAO,QAAO;AAC1D,aAAO;AAAA,IACT,CAAC;AAAA,EACH,GAAG,CAAC,YAAY,UAAU,YAAY,CAAC;AAKvC,QAAM,kBAAkB,MAAM,YAAY,OAAO,UAAmB;AAClE,QAAI,CAAC,cAAe,QAAO,CAAC;AAC5B,QAAI,mBAAmB;AACrB,YAAM,SAAS,OAAO,qBAAqB,YAAY,iBAAiB,KAAK,EAAE,SAAS,IAAI,iBAAiB,KAAK,IAAI;AACtH,UAAI,CAAC,OAAQ,QAAO,CAAC;AACrB,aAAO,iBAAiB,OAAO,EAAE,UAAU,OAAO,CAAC;AAAA,IACrD;AACA,WAAO,iBAAiB,KAAK;AAAA,EAC/B,GAAG,CAAC,mBAAmB,eAAe,gBAAgB,CAAC;AAEvD,QAAM,SAAS,MAAM,QAAqB,MAAM;AAAA,IAC9C,EAAE,IAAI,QAAQ,OAAO,EAAE,oBAAoB,GAAG,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC3E,EAAE,IAAI,eAAe,OAAO,EAAE,2BAA2B,GAAG,MAAM,YAAY,aAAa,EAAE,+BAA+B,EAAE;AAAA,IAC9H;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,4BAA4B;AAAA,MACrC,UAAU;AAAA,MACV,MAAM;AAAA,MACN,WAAW,CAAC,EAAE,IAAI,OAAO,SAAS,MAChC;AAAA,QAAC;AAAA;AAAA,UACC;AAAA,UACA,OAAO,OAAO,UAAU,WAAW,QAAQ;AAAA,UAC3C,UAAU,CAAC,SAAS,SAAS,QAAQ,IAAI;AAAA,UACzC,oBAAkB;AAAA,UAClB,kBAAkB,EAAE,uCAAuC;AAAA,UAC3D,WAAU;AAAA;AAAA,MACZ;AAAA,IAEJ;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,qBAAqB;AAAA,MAC9B,MAAM;AAAA,MACN,aAAa;AAAA,MACb,aAAa,EAAE,yBAAyB;AAAA,IAC1C;AAAA,IACA,EAAE,IAAI,aAAa,OAAO,EAAE,yBAAyB,GAAG,MAAM,QAAQ,aAAa,EAAE,2BAA2B,EAAE;AAAA,EACpH,GAAG,CAAC,iBAAiB,CAAC,CAAC;AAEvB,QAAM,SAAS,MAAM,QAAyB,MAAO;AAAA,IACnD,EAAE,IAAI,WAAW,OAAO,EAAE,uBAAuB,GAAG,QAAQ,GAAG,QAAQ,CAAC,QAAQ,eAAe,kBAAkB,SAAS,WAAW,EAAE;AAAA,EACzI,GAAI,CAAC,CAAC,CAAC;AAEP,MAAI,eAAe;AACjB,WACE,oBAAC,QACC,8BAAC,YACC,8BAAC,SAAI,WAAU,oCACb,+BAAC,SAAI,WAAU,wDACb;AAAA,2BAAC,SAAI,WAAU,gBACb;AAAA,4BAAC,QAAG,WAAU,mCAAmC,YAAE,qBAAqB,GAAE;AAAA,QAC1E,oBAAC,OAAE,WAAU,sCACV,YAAE,wBAAwB,GAC7B;AAAA,SACF;AAAA,MACA,qBAAC,SAAI,WAAU,iBACb;AAAA,4BAAC,SAAI,WAAU,iEACZ,wBAAc,QACjB;AAAA,QACA,qBAAC,SAAI,WAAU,mEACb;AAAA,8BAAC,UAAK,WAAU,sEACb,YAAE,wBAAwB,EAAE,QAAQ,cAAc,UAAU,CAAC,GAChE;AAAA,UACA,oBAAC,UAAM,YAAE,uBAAuB,GAAE;AAAA,WACpC;AAAA,QACA,oBAAC,SAAI,WAAU,oBACb,8BAAC,UAAO,SAAS,MAAM,OAAO,KAAK,mBAAmB,GACnD,YAAE,cAAc,GACnB,GACF;AAAA,SACF;AAAA,OACF,GACF,GACJ,GACF;AAAA,EAEF;AAEA,SACE,oBAAC,QACC,8BAAC,YACC,8BAAC,SAAI,WAAU,aACb;AAAA,IAAC;AAAA;AAAA,MACC,OAAO,EAAE,qBAAqB;AAAA,MAC9B,mBAAmB;AAAA,MACnB,UAAS;AAAA,MACT;AAAA,MACA;AAAA,MACA,eAAe,EAAE,MAAM,IAAI,aAAa,MAAM,gBAAgB,MAAM,OAAO,CAAC,GAAG,WAAW,KAAK;AAAA,MAC/F,aAAa,EAAE,eAAe;AAAA,MAC9B,YAAW;AAAA,MACX,UAAU,OAAO,WAAW;AAC1B,cAAM,UAOF;AAAA,UACF,MAAM,OAAO;AAAA,UACb,aAAa,OAAO,eAAe;AAAA,UACnC,gBAAgB,OAAO,kBAAkB;AAAA,UACzC,OAAO,MAAM,QAAQ,OAAO,KAAK,IAAI,OAAO,QAAQ,CAAC;AAAA,UACrD,WAAW,OAAO,aAAa;AAAA,QACjC;AACA,YAAI,mBAAmB;AACrB,gBAAM,SAAS,OAAO,qBAAqB,YAAY,iBAAiB,KAAK,EAAE,SAAS,IAAI,iBAAiB,KAAK,IAAI;AACtH,cAAI,CAAC,QAAQ;AACX,kBAAM,UAAU,EAAE,gCAAgC;AAClD,kBAAM,oBAAoB,SAAS,EAAE,UAAU,QAAQ,CAAC;AAAA,UAC1D;AACA,kBAAQ,WAAW;AAAA,QACrB;AACA,cAAM,EAAE,OAAO,IAAI,MAAM;AAAA,UACvB;AAAA,UACA;AAAA,QACF;AACA,cAAM,UAAU;AAChB,YAAI,CAAC,WAAW,OAAO,QAAQ,WAAW,UAAU;AAClD,gBAAM,oBAAoB,EAAE,mCAAmC,CAAC;AAAA,QAClE;AACA,cAAM,YAAY,OAAO,QAAQ,cAAc,WAAW,QAAQ,YAAY;AAC9E,yBAAiB,EAAE,QAAQ,QAAQ,QAAQ,UAAU,CAAC;AACtD,cAAM,EAAE,uBAAuB,GAAG,SAAS;AAAA,MAC7C;AAAA;AAAA,EACF,GACF,GACF,GACF;AAEJ;",
+  "sourcesContent": ["\"use client\"\nimport * as React from 'react'\nimport { Page, PageBody } from '@open-mercato/ui/backend/Page'\nimport { CrudForm, type CrudField, type CrudFormGroup } from '@open-mercato/ui/backend/CrudForm'\nimport { apiCall } from '@open-mercato/ui/backend/utils/apiCall'\nimport { createCrud } from '@open-mercato/ui/backend/utils/crud'\nimport { createCrudFormError } from '@open-mercato/ui/backend/utils/serverErrors'\nimport { OrganizationSelect } from '@open-mercato/core/modules/directory/components/OrganizationSelect'\nimport { fetchRoleOptions } from '@open-mercato/core/modules/auth/backend/users/roleOptions'\nimport { flash } from '@open-mercato/ui/backend/FlashMessages'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { useRouter } from 'next/navigation'\nimport { useOrganizationScopeDetail, useOrganizationScopeVersion } from '@open-mercato/shared/lib/frontend/useOrganizationScope'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\n\ntype FormValues = {\n  name: string\n  description: string | null\n  organizationId: string | null\n  expiresAt: string | null\n  roles: string[]\n}\n\nexport default function CreateApiKeyPage() {\n  const [createdSecret, setCreatedSecret] = React.useState<{ secret: string; keyPrefix: string } | null>(null)\n  const [actorIsSuperAdmin, setActorIsSuperAdmin] = React.useState(false)\n  const [actorResolved, setActorResolved] = React.useState(false)\n  const [selectedTenantId, setSelectedTenantId] = React.useState<string | null>(null)\n  const router = useRouter()\n  const scopeDetail = useOrganizationScopeDetail()\n  const scopeVersion = useOrganizationScopeVersion()\n  const t = useT()\n\n  React.useEffect(() => {\n    let cancelled = false\n    async function loadInitialScope() {\n      try {\n        const { ok, result } = await apiCall<{ tenantId?: string; isSuperAdmin?: boolean }>(\n          '/api/directory/organization-switcher',\n        )\n        if (!ok || cancelled) {\n          if (!ok && !cancelled) setActorIsSuperAdmin(false)\n          return\n        }\n        const rawTenant = typeof result?.tenantId === 'string' ? result.tenantId : null\n        const normalizedTenant = rawTenant && rawTenant.trim().length > 0 ? rawTenant.trim() : null\n        setSelectedTenantId(normalizedTenant)\n        setActorIsSuperAdmin(Boolean(result?.isSuperAdmin))\n      } catch {\n        if (!cancelled) setActorIsSuperAdmin(false)\n      } finally {\n        if (!cancelled) setActorResolved(true)\n      }\n    }\n    loadInitialScope()\n    return () => { cancelled = true }\n  }, [])\n\n  React.useEffect(() => {\n    if (scopeVersion === 0) return\n    const rawTenant = scopeDetail.tenantId\n    const normalizedTenant = typeof rawTenant === 'string' && rawTenant.trim().length > 0 ? rawTenant.trim() : null\n    setSelectedTenantId((prev) => {\n      if ((prev ?? null) === (normalizedTenant ?? null)) return prev\n      return normalizedTenant\n    })\n  }, [scopeDetail.tenantId, scopeVersion])\n\n  // Block role loading until we know whether the actor is a super admin. Without this guard the\n  // initial (non-super-admin) branch fires before the flag resolves and the server returns roles\n  // from other tenants because the real caller is a super admin without tenantId scoping.\n  const loadRoleOptions = React.useCallback(async (query?: string) => {\n    if (!actorResolved) return []\n    if (actorIsSuperAdmin) {\n      const tenant = typeof selectedTenantId === 'string' && selectedTenantId.trim().length > 0 ? selectedTenantId.trim() : null\n      if (!tenant) return []\n      return fetchRoleOptions(query, { tenantId: tenant })\n    }\n    return fetchRoleOptions(query)\n  }, [actorIsSuperAdmin, actorResolved, selectedTenantId])\n\n  const fields = React.useMemo<CrudField[]>(() => [\n    { id: 'name', label: t('api_keys.form.name'), type: 'text', required: true },\n    { id: 'description', label: t('api_keys.form.description'), type: 'textarea', description: t('api_keys.form.descriptionHint') },\n    {\n      id: 'organizationId',\n      label: t('api_keys.form.organization'),\n      required: false,\n      type: 'custom',\n      component: ({ id, value, setValue }) => (\n        <OrganizationSelect\n          id={id}\n          value={typeof value === 'string' ? value : null}\n          onChange={(next) => setValue(next ?? null)}\n          includeEmptyOption\n          emptyOptionLabel={t('api_keys.form.organizationPlaceholder')}\n          className=\"w-full h-9 rounded border px-2 text-sm\"\n        />\n      ),\n    },\n    {\n      id: 'roles',\n      label: t('api_keys.form.roles'),\n      type: 'tags',\n      loadOptions: loadRoleOptions,\n      description: t('api_keys.form.rolesHint'),\n    },\n    { id: 'expiresAt', label: t('api_keys.form.expiresAt'), type: 'date', description: t('api_keys.form.expiresHint') },\n  ], [loadRoleOptions, t])\n\n  const groups = React.useMemo<CrudFormGroup[]>(() => ([\n    { id: 'details', title: t('api_keys.form.details'), column: 1, fields: ['name', 'description', 'organizationId', 'roles', 'expiresAt'] },\n  ]), [t])\n\n  if (createdSecret) {\n    return (\n      <Page>\n        <PageBody>\n          <div className=\"flex items-center justify-center\">\n            <div className=\"w-full max-w-2xl rounded-xl border bg-card shadow-sm\">\n              <div className=\"border-b p-6\">\n                <h1 className=\"text-lg font-semibold leading-7\">{t('api_keys.copy.title')}</h1>\n                <p className=\"mt-2 text-sm text-muted-foreground\">\n                  {t('api_keys.copy.subtitle')}\n                </p>\n              </div>\n              <div className=\"space-y-4 p-6\">\n                <div className=\"rounded-md border bg-muted/50 p-4 font-mono text-sm break-all\">\n                  {createdSecret.secret}\n                </div>\n                <div className=\"flex items-center justify-between text-xs text-muted-foreground\">\n                  <span className=\"inline-flex items-center rounded-full border px-2 py-1 font-medium\">\n                    {t('api_keys.copy.prefix', { prefix: createdSecret.keyPrefix })}\n                  </span>\n                  <span>{t('api_keys.copy.warning')}</span>\n                </div>\n                <div className=\"flex justify-end\">\n                  <Button onClick={() => router.push('/backend/api-keys')}>\n                    {t('common.close')}\n                  </Button>\n                </div>\n              </div>\n            </div>\n          </div>\n      </PageBody>\n    </Page>\n    )\n  }\n\n  return (\n    <Page>\n      <PageBody>\n        <div className=\"space-y-6\">\n          <CrudForm<FormValues>\n            title={t('api_keys.form.title')}\n            titleHeadingLevel={1}\n            backHref=\"/backend/api-keys\"\n            fields={fields}\n            groups={groups}\n            initialValues={{ name: '', description: null, organizationId: null, roles: [], expiresAt: null }}\n            submitLabel={t('common.create')}\n            cancelHref=\"/backend/api-keys\"\n            onSubmit={async (values) => {\n              const payload: {\n                name: string\n                description: string | null\n                organizationId?: string\n                roles: string[]\n                expiresAt: string | null\n                tenantId?: string | null\n              } = {\n                name: values.name,\n                description: values.description || null,\n                ...(values.organizationId ? { organizationId: values.organizationId } : {}),\n                roles: Array.isArray(values.roles) ? values.roles : [],\n                expiresAt: values.expiresAt || null,\n              }\n              if (actorIsSuperAdmin) {\n                const tenant = typeof selectedTenantId === 'string' && selectedTenantId.trim().length > 0 ? selectedTenantId.trim() : null\n                if (!tenant) {\n                  const message = t('api_keys.errors.tenantRequired')\n                  throw createCrudFormError(message, { tenantId: message })\n                }\n                payload.tenantId = tenant\n              }\n              const { result } = await createCrud<{ secret?: string; keyPrefix?: string | null }>(\n                'api_keys/keys',\n                payload,\n              )\n              const created = result\n              if (!created || typeof created.secret !== 'string') {\n                throw createCrudFormError(t('api_keys.form.error.secretMissing'))\n              }\n              const keyPrefix = typeof created.keyPrefix === 'string' ? created.keyPrefix : ''\n              setCreatedSecret({ secret: created.secret, keyPrefix })\n              flash(t('api_keys.form.success'), 'success')\n            }}\n          />\n        </div>\n      </PageBody>\n    </Page>\n  )\n}\n"],
+  "mappings": ";AA0FQ,cA8BM,YA9BN;AAzFR,YAAY,WAAW;AACvB,SAAS,MAAM,gBAAgB;AAC/B,SAAS,gBAAoD;AAC7D,SAAS,eAAe;AACxB,SAAS,kBAAkB;AAC3B,SAAS,2BAA2B;AACpC,SAAS,0BAA0B;AACnC,SAAS,wBAAwB;AACjC,SAAS,aAAa;AACtB,SAAS,cAAc;AACvB,SAAS,iBAAiB;AAC1B,SAAS,4BAA4B,mCAAmC;AACxE,SAAS,YAAY;AAUN,SAAR,mBAAoC;AACzC,QAAM,CAAC,eAAe,gBAAgB,IAAI,MAAM,SAAuD,IAAI;AAC3G,QAAM,CAAC,mBAAmB,oBAAoB,IAAI,MAAM,SAAS,KAAK;AACtE,QAAM,CAAC,eAAe,gBAAgB,IAAI,MAAM,SAAS,KAAK;AAC9D,QAAM,CAAC,kBAAkB,mBAAmB,IAAI,MAAM,SAAwB,IAAI;AAClF,QAAM,SAAS,UAAU;AACzB,QAAM,cAAc,2BAA2B;AAC/C,QAAM,eAAe,4BAA4B;AACjD,QAAM,IAAI,KAAK;AAEf,QAAM,UAAU,MAAM;AACpB,QAAI,YAAY;AAChB,mBAAe,mBAAmB;AAChC,UAAI;AACF,cAAM,EAAE,IAAI,OAAO,IAAI,MAAM;AAAA,UAC3B;AAAA,QACF;AACA,YAAI,CAAC,MAAM,WAAW;AACpB,cAAI,CAAC,MAAM,CAAC,UAAW,sBAAqB,KAAK;AACjD;AAAA,QACF;AACA,cAAM,YAAY,OAAO,QAAQ,aAAa,WAAW,OAAO,WAAW;AAC3E,cAAM,mBAAmB,aAAa,UAAU,KAAK,EAAE,SAAS,IAAI,UAAU,KAAK,IAAI;AACvF,4BAAoB,gBAAgB;AACpC,6BAAqB,QAAQ,QAAQ,YAAY,CAAC;AAAA,MACpD,QAAQ;AACN,YAAI,CAAC,UAAW,sBAAqB,KAAK;AAAA,MAC5C,UAAE;AACA,YAAI,CAAC,UAAW,kBAAiB,IAAI;AAAA,MACvC;AAAA,IACF;AACA,qBAAiB;AACjB,WAAO,MAAM;AAAE,kBAAY;AAAA,IAAK;AAAA,EAClC,GAAG,CAAC,CAAC;AAEL,QAAM,UAAU,MAAM;AACpB,QAAI,iBAAiB,EAAG;AACxB,UAAM,YAAY,YAAY;AAC9B,UAAM,mBAAmB,OAAO,cAAc,YAAY,UAAU,KAAK,EAAE,SAAS,IAAI,UAAU,KAAK,IAAI;AAC3G,wBAAoB,CAAC,SAAS;AAC5B,WAAK,QAAQ,WAAW,oBAAoB,MAAO,QAAO;AAC1D,aAAO;AAAA,IACT,CAAC;AAAA,EACH,GAAG,CAAC,YAAY,UAAU,YAAY,CAAC;AAKvC,QAAM,kBAAkB,MAAM,YAAY,OAAO,UAAmB;AAClE,QAAI,CAAC,cAAe,QAAO,CAAC;AAC5B,QAAI,mBAAmB;AACrB,YAAM,SAAS,OAAO,qBAAqB,YAAY,iBAAiB,KAAK,EAAE,SAAS,IAAI,iBAAiB,KAAK,IAAI;AACtH,UAAI,CAAC,OAAQ,QAAO,CAAC;AACrB,aAAO,iBAAiB,OAAO,EAAE,UAAU,OAAO,CAAC;AAAA,IACrD;AACA,WAAO,iBAAiB,KAAK;AAAA,EAC/B,GAAG,CAAC,mBAAmB,eAAe,gBAAgB,CAAC;AAEvD,QAAM,SAAS,MAAM,QAAqB,MAAM;AAAA,IAC9C,EAAE,IAAI,QAAQ,OAAO,EAAE,oBAAoB,GAAG,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC3E,EAAE,IAAI,eAAe,OAAO,EAAE,2BAA2B,GAAG,MAAM,YAAY,aAAa,EAAE,+BAA+B,EAAE;AAAA,IAC9H;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,4BAA4B;AAAA,MACrC,UAAU;AAAA,MACV,MAAM;AAAA,MACN,WAAW,CAAC,EAAE,IAAI,OAAO,SAAS,MAChC;AAAA,QAAC;AAAA;AAAA,UACC;AAAA,UACA,OAAO,OAAO,UAAU,WAAW,QAAQ;AAAA,UAC3C,UAAU,CAAC,SAAS,SAAS,QAAQ,IAAI;AAAA,UACzC,oBAAkB;AAAA,UAClB,kBAAkB,EAAE,uCAAuC;AAAA,UAC3D,WAAU;AAAA;AAAA,MACZ;AAAA,IAEJ;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,qBAAqB;AAAA,MAC9B,MAAM;AAAA,MACN,aAAa;AAAA,MACb,aAAa,EAAE,yBAAyB;AAAA,IAC1C;AAAA,IACA,EAAE,IAAI,aAAa,OAAO,EAAE,yBAAyB,GAAG,MAAM,QAAQ,aAAa,EAAE,2BAA2B,EAAE;AAAA,EACpH,GAAG,CAAC,iBAAiB,CAAC,CAAC;AAEvB,QAAM,SAAS,MAAM,QAAyB,MAAO;AAAA,IACnD,EAAE,IAAI,WAAW,OAAO,EAAE,uBAAuB,GAAG,QAAQ,GAAG,QAAQ,CAAC,QAAQ,eAAe,kBAAkB,SAAS,WAAW,EAAE;AAAA,EACzI,GAAI,CAAC,CAAC,CAAC;AAEP,MAAI,eAAe;AACjB,WACE,oBAAC,QACC,8BAAC,YACC,8BAAC,SAAI,WAAU,oCACb,+BAAC,SAAI,WAAU,wDACb;AAAA,2BAAC,SAAI,WAAU,gBACb;AAAA,4BAAC,QAAG,WAAU,mCAAmC,YAAE,qBAAqB,GAAE;AAAA,QAC1E,oBAAC,OAAE,WAAU,sCACV,YAAE,wBAAwB,GAC7B;AAAA,SACF;AAAA,MACA,qBAAC,SAAI,WAAU,iBACb;AAAA,4BAAC,SAAI,WAAU,iEACZ,wBAAc,QACjB;AAAA,QACA,qBAAC,SAAI,WAAU,mEACb;AAAA,8BAAC,UAAK,WAAU,sEACb,YAAE,wBAAwB,EAAE,QAAQ,cAAc,UAAU,CAAC,GAChE;AAAA,UACA,oBAAC,UAAM,YAAE,uBAAuB,GAAE;AAAA,WACpC;AAAA,QACA,oBAAC,SAAI,WAAU,oBACb,8BAAC,UAAO,SAAS,MAAM,OAAO,KAAK,mBAAmB,GACnD,YAAE,cAAc,GACnB,GACF;AAAA,SACF;AAAA,OACF,GACF,GACJ,GACF;AAAA,EAEF;AAEA,SACE,oBAAC,QACC,8BAAC,YACC,8BAAC,SAAI,WAAU,aACb;AAAA,IAAC;AAAA;AAAA,MACC,OAAO,EAAE,qBAAqB;AAAA,MAC9B,mBAAmB;AAAA,MACnB,UAAS;AAAA,MACT;AAAA,MACA;AAAA,MACA,eAAe,EAAE,MAAM,IAAI,aAAa,MAAM,gBAAgB,MAAM,OAAO,CAAC,GAAG,WAAW,KAAK;AAAA,MAC/F,aAAa,EAAE,eAAe;AAAA,MAC9B,YAAW;AAAA,MACX,UAAU,OAAO,WAAW;AAC1B,cAAM,UAOF;AAAA,UACF,MAAM,OAAO;AAAA,UACb,aAAa,OAAO,eAAe;AAAA,UACnC,GAAI,OAAO,iBAAiB,EAAE,gBAAgB,OAAO,eAAe,IAAI,CAAC;AAAA,UACzE,OAAO,MAAM,QAAQ,OAAO,KAAK,IAAI,OAAO,QAAQ,CAAC;AAAA,UACrD,WAAW,OAAO,aAAa;AAAA,QACjC;AACA,YAAI,mBAAmB;AACrB,gBAAM,SAAS,OAAO,qBAAqB,YAAY,iBAAiB,KAAK,EAAE,SAAS,IAAI,iBAAiB,KAAK,IAAI;AACtH,cAAI,CAAC,QAAQ;AACX,kBAAM,UAAU,EAAE,gCAAgC;AAClD,kBAAM,oBAAoB,SAAS,EAAE,UAAU,QAAQ,CAAC;AAAA,UAC1D;AACA,kBAAQ,WAAW;AAAA,QACrB;AACA,cAAM,EAAE,OAAO,IAAI,MAAM;AAAA,UACvB;AAAA,UACA;AAAA,QACF;AACA,cAAM,UAAU;AAChB,YAAI,CAAC,WAAW,OAAO,QAAQ,WAAW,UAAU;AAClD,gBAAM,oBAAoB,EAAE,mCAAmC,CAAC;AAAA,QAClE;AACA,cAAM,YAAY,OAAO,QAAQ,cAAc,WAAW,QAAQ,YAAY;AAC9E,yBAAiB,EAAE,QAAQ,QAAQ,QAAQ,UAAU,CAAC;AACtD,cAAM,EAAE,uBAAuB,GAAG,SAAS;AAAA,MAC7C;AAAA;AAAA,EACF,GACF,GACF,GACF;AAEJ;",
   "names": []
 }

package/dist/modules/api_keys/commands/keys.js

@@ -0,0 +1,140 @@
+import { registerCommand } from "@open-mercato/shared/lib/commands";
+import { createApiKey, deleteApiKey } from "@open-mercato/core/modules/api_keys/services/apiKeyService";
+import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
+import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { resolveIsSuperAdmin } from "@open-mercato/core/modules/auth/lib/tenantAccess";
+import { isOrganizationAccessAllowed } from "@open-mercato/shared/lib/auth/organizationAccess";
+import { Role } from "@open-mercato/core/modules/auth/data/entities";
+import { findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { assertActorCanGrantRoles } from "@open-mercato/core/modules/auth/lib/grantChecks";
+const createApiKeyCommand = {
+  id: "api_keys.keys.create",
+  isUndoable: false,
+  async execute(input, ctx) {
+    const { translate } = await resolveTranslations();
+    const em = ctx.transactionalEm ?? ctx.container.resolve("em");
+    const rbacService = ctx.container.resolve("rbacService");
+    let lockedRoles = [];
+    const { record, secret } = await createApiKey(em, {
+      name: input.name,
+      description: input.description ?? null,
+      tenantId: input.tenantId,
+      organizationId: input.organizationId,
+      roles: input.roleIds,
+      expiresAt: input.expiresAt ?? null,
+      createdBy: ctx.auth?.sub ?? null
+    }, {
+      rbac: rbacService,
+      authorizeRoles: async (roleIds) => {
+        const roleTenantId = input.tenantId ?? ctx.auth?.tenantId ?? null;
+        lockedRoles = roleIds.length ? await findWithDecryption(
+          em,
+          Role,
+          { id: { $in: [...roleIds] }, deletedAt: null },
+          { orderBy: { id: "ASC" }, refresh: true },
+          { tenantId: roleTenantId, organizationId: null }
+        ) : [];
+        if (lockedRoles.length !== roleIds.length) {
+          throw new CrudHttpError(400, {
+            error: translate("api_keys.errors.roleNotFound", "Role {identifier} not found", {
+              identifier: roleIds.join(", ")
+            })
+          });
+        }
+        const wrongTenantRole = lockedRoles.find((role) => role.tenantId !== null && String(role.tenantId) !== roleTenantId);
+        if (wrongTenantRole) {
+          throw new CrudHttpError(400, {
+            error: translate("api_keys.errors.roleWrongTenant", "Role {role} belongs to another tenant", {
+              role: wrongTenantRole.name ?? String(wrongTenantRole.id)
+            })
+          });
+        }
+        await assertActorCanGrantRoles({
+          em,
+          rbacService,
+          actorUserId: ctx.auth?.sub,
+          tenantId: roleTenantId,
+          organizationId: ctx.auth?.orgId ?? null,
+          roles: lockedRoles
+        });
+      }
+    });
+    return {
+      id: String(record.id),
+      name: record.name,
+      keyPrefix: record.keyPrefix,
+      secret,
+      tenantId: record.tenantId ?? null,
+      organizationId: record.organizationId ?? null,
+      roles: lockedRoles.map((role) => ({ id: String(role.id), name: role.name ?? null }))
+    };
+  },
+  buildLog: async ({ input, ctx }) => {
+    const { translate } = await resolveTranslations();
+    return {
+      actionLabel: translate("api_keys.list.success.created", "API key created"),
+      resourceKind: "api_keys.key",
+      tenantId: input.tenantId ?? ctx.auth?.tenantId ?? null,
+      organizationId: input.organizationId
+    };
+  }
+};
+const deleteApiKeyCommand = {
+  id: "api_keys.keys.delete",
+  isUndoable: false,
+  async execute(input, ctx) {
+    const { translate } = await resolveTranslations();
+    const tenantId = ctx.auth?.tenantId ?? null;
+    if (!tenantId) {
+      throw new CrudHttpError(400, {
+        error: translate("api_keys.errors.tenantRequired", "Tenant context required")
+      });
+    }
+    const em = ctx.transactionalEm ?? ctx.container.resolve("em");
+    const isSuperAdmin = await resolveIsSuperAdmin(ctx);
+    const allowedOrganizationIds = ctx.organizationScope?.allowedIds ?? null;
+    let rbac;
+    try {
+      rbac = ctx.container.resolve("rbacService");
+    } catch {
+      rbac = void 0;
+    }
+    const deleted = await deleteApiKey(em, input.id, {
+      rbac,
+      authorize: (record) => {
+        if (record.tenantId !== tenantId || !isOrganizationAccessAllowed({
+          isSuperAdmin,
+          allowedOrganizationIds,
+          targetOrganizationId: record.organizationId ?? null
+        })) {
+          throw new CrudHttpError(404, {
+            error: translate("api_keys.errors.notFound", "Not found")
+          });
+        }
+      }
+    });
+    if (!deleted) {
+      throw new CrudHttpError(404, {
+        error: translate("api_keys.errors.notFound", "Not found")
+      });
+    }
+    return { id: input.id };
+  },
+  buildLog: async ({ input, ctx }) => {
+    const { translate } = await resolveTranslations();
+    return {
+      actionLabel: translate("api_keys.list.success.deleted", "API key deleted"),
+      resourceKind: "api_keys.key",
+      resourceId: input.id,
+      tenantId: ctx.auth?.tenantId ?? null,
+      organizationId: ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null
+    };
+  }
+};
+registerCommand(createApiKeyCommand);
+registerCommand(deleteApiKeyCommand);
+export {
+  createApiKeyCommand,
+  deleteApiKeyCommand
+};
+//# sourceMappingURL=keys.js.map