@qwickapps/server 1.5.2 → 1.6.1

package/dist/plugins/api-keys/middleware/bearer-token-auth.js

@@ -0,0 +1,201 @@
+/**
+ * Bearer Token Authentication Middleware
+ *
+ * Middleware for authenticating API requests using Bearer tokens (API keys).
+ * Verifies the token, checks expiration and active status, and attaches
+ * the authenticated key info to the request.
+ *
+ * Copyright (c) 2025 QwickApps.com. All rights reserved.
+ */
+import { getApiKeysStore } from '../api-keys-plugin.js';
+import { incrementLimit, isLimited } from '../../rate-limit/rate-limit-service.js';
+/**
+ * Extract Bearer token from Authorization header
+ *
+ * @param req Express request
+ * @returns Bearer token or null if not found
+ */
+function extractBearerToken(req) {
+    const authHeader = req.headers.authorization;
+    if (!authHeader) {
+        return null;
+    }
+    // Check for "Bearer <token>" format
+    const parts = authHeader.split(' ');
+    if (parts.length !== 2 || parts[0] !== 'Bearer') {
+        return null;
+    }
+    return parts[1];
+}
+/**
+ * Check if API key has all required scopes
+ *
+ * @param keyScopes Scopes granted to the API key
+ * @param requiredScopes Scopes required for the endpoint
+ * @returns True if key has all required scopes
+ */
+function hasRequiredScopes(keyScopes, requiredScopes) {
+    return requiredScopes.every(required => keyScopes.includes(required));
+}
+/**
+ * Default unauthorized handler
+ */
+function defaultUnauthorizedHandler(req, res, reason) {
+    res.status(401).json({
+        error: 'Unauthorized',
+        message: reason,
+    });
+}
+/**
+ * Get rate limit identifier for API key authentication
+ * Uses IP address as the identifier
+ */
+function getRateLimitIdentifier(req) {
+    const ip = req.ip ||
+        req.headers['x-forwarded-for']?.toString().split(',')[0].trim() ||
+        req.socket?.remoteAddress ||
+        'unknown';
+    return `api-key-auth:${ip}`;
+}
+/**
+ * Check if rate limit has been exceeded
+ * Uses the existing rate-limit plugin with specific limits for API key auth
+ */
+async function checkRateLimit(identifier) {
+    try {
+        // Check rate limit: 100 requests per 15 minutes
+        return await isLimited(identifier, {
+            maxRequests: 100,
+            windowMs: 15 * 60 * 1000, // 15 minutes
+            strategy: 'sliding-window',
+        });
+    }
+    catch (error) {
+        // If rate limit service not available, allow the request
+        // (fail open - let other security measures handle it)
+        console.warn('[bearerTokenAuth] Rate limit service unavailable:', error);
+        return false;
+    }
+}
+/**
+ * Record a failed authentication attempt
+ * Increments the rate limit counter
+ */
+async function recordFailedAttempt(identifier) {
+    try {
+        await incrementLimit(identifier, {
+            maxRequests: 100,
+            windowMs: 15 * 60 * 1000, // 15 minutes
+            strategy: 'sliding-window',
+        });
+    }
+    catch (error) {
+        // Non-critical - log and continue
+        console.warn('[bearerTokenAuth] Failed to record attempt:', error);
+    }
+}
+/**
+ * Bearer Token Authentication Middleware
+ *
+ * Validates API keys sent as Bearer tokens in the Authorization header.
+ * Attaches authenticated key info to the request for downstream handlers.
+ *
+ * @param options Configuration options
+ * @returns Express middleware function
+ *
+ * @example
+ * ```ts
+ * import { bearerTokenAuth } from '@qwickapps/server';
+ *
+ * // Require authentication
+ * app.get('/api/data', bearerTokenAuth(), (req, res) => {
+ *   const { apiKey } = req as ApiKeyAuthenticatedRequest;
+ *   res.json({ user_id: apiKey?.user_id });
+ * });
+ *
+ * // Require specific scopes
+ * app.post('/api/data', bearerTokenAuth({
+ *   requiredScopes: ['write'],
+ * }), (req, res) => {
+ *   // Handler code
+ * });
+ *
+ * // Allow only M2M keys
+ * app.post('/api/admin', bearerTokenAuth({
+ *   allowedKeyTypes: ['m2m'],
+ *   requiredScopes: ['admin'],
+ * }), (req, res) => {
+ *   // Handler code
+ * });
+ * ```
+ */
+export function bearerTokenAuth(options = {}) {
+    const { requiredScopes = [], allowedKeyTypes, onUnauthorized = defaultUnauthorizedHandler, } = options;
+    return async (req, res, next) => {
+        try {
+            // Check rate limit first
+            const rateLimitId = getRateLimitIdentifier(req);
+            if (await checkRateLimit(rateLimitId)) {
+                res.status(429).json({
+                    error: 'Too Many Requests',
+                    message: 'Too many authentication attempts. Please try again later.',
+                });
+                return;
+            }
+            // Extract token from Authorization header
+            const token = extractBearerToken(req);
+            if (!token) {
+                recordFailedAttempt(rateLimitId);
+                onUnauthorized(req, res, 'Missing or invalid Authorization header');
+                return;
+            }
+            // Get store instance
+            const store = getApiKeysStore();
+            if (!store) {
+                console.error('[bearerTokenAuth] API Keys plugin not initialized');
+                res.status(500).json({ error: 'Authentication service unavailable' });
+                return;
+            }
+            // Verify the token
+            const apiKey = await store.verify(token);
+            if (!apiKey) {
+                recordFailedAttempt(rateLimitId);
+                onUnauthorized(req, res, 'Invalid, expired, or inactive API key');
+                return;
+            }
+            // Check key type if restrictions apply
+            if (allowedKeyTypes && !allowedKeyTypes.includes(apiKey.key_type)) {
+                onUnauthorized(req, res, `This endpoint requires ${allowedKeyTypes.join(' or ')} keys`);
+                return;
+            }
+            // Check scopes if required
+            if (requiredScopes.length > 0 && !hasRequiredScopes(apiKey.scopes, requiredScopes)) {
+                onUnauthorized(req, res, `Insufficient scopes. Required: ${requiredScopes.join(', ')}`);
+                return;
+            }
+            // Record usage (non-blocking)
+            store.recordUsage(apiKey.id).catch(err => {
+                console.error('[bearerTokenAuth] Failed to record key usage:', err);
+            });
+            // Attach authenticated key info to request
+            req.apiKey = {
+                id: apiKey.id,
+                user_id: apiKey.user_id,
+                scopes: apiKey.scopes,
+                key_type: apiKey.key_type,
+            };
+            next();
+        }
+        catch (error) {
+            console.error('[bearerTokenAuth] Authentication error:', error);
+            res.status(500).json({ error: 'Authentication failed' });
+        }
+    };
+}
+/**
+ * Helper type guard for API key authenticated requests
+ */
+export function isApiKeyAuthenticated(req) {
+    return 'apiKey' in req && req.apiKey !== undefined;
+}
+//# sourceMappingURL=bearer-token-auth.js.map

package/dist/plugins/api-keys/middleware/bearer-token-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bearer-token-auth.js","sourceRoot":"","sources":["../../../../src/plugins/api-keys/middleware/bearer-token-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,wCAAwC,CAAC;AA0BnF;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,GAAY;IACtC,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IAE7C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,oCAAoC;IACpC,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,iBAAiB,CAAC,SAAwB,EAAE,cAA6B;IAChF,OAAO,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AACxE,CAAC;AAED;;GAEG;AACH,SAAS,0BAA0B,CAAC,GAAY,EAAE,GAAa,EAAE,MAAc;IAC7E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;QACnB,KAAK,EAAE,cAAc;QACrB,OAAO,EAAE,MAAM;KAChB,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,SAAS,sBAAsB,CAAC,GAAY;IAC1C,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE;QACf,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;QAC/D,GAAG,CAAC,MAAM,EAAE,aAAa;QACzB,SAAS,CAAC;IACZ,OAAO,gBAAgB,EAAE,EAAE,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,cAAc,CAAC,UAAkB;IAC9C,IAAI,CAAC;QACH,gDAAgD;QAChD,OAAO,MAAM,SAAS,CAAC,UAAU,EAAE;YACjC,WAAW,EAAE,GAAG;YAChB,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,aAAa;YACvC,QAAQ,EAAE,gBAAgB;SAC3B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,yDAAyD;QACzD,sDAAsD;QACtD,OAAO,CAAC,IAAI,CAAC,mDAAmD,EAAE,KAAK,CAAC,CAAC;QACzE,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,mBAAmB,CAAC,UAAkB;IACnD,IAAI,CAAC;QACH,MAAM,cAAc,CAAC,UAAU,EAAE;YAC/B,WAAW,EAAE,GAAG;YAChB,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,aAAa;YACvC,QAAQ,EAAE,gBAAgB;SAC3B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,kCAAkC;QAClC,OAAO,CAAC,IAAI,CAAC,6CAA6C,EAAE,KAAK,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,UAAU,eAAe,CAAC,UAAkC,EAAE;IAClE,MAAM,EACJ,cAAc,GAAG,EAAE,EACnB,eAAe,EACf,cAAc,GAAG,0BAA0B,GAC5C,GAAG,OAAO,CAAC;IAEZ,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAiB,EAAE;QAC9E,IAAI,CAAC;YACH,yBAAyB;YACzB,MAAM,WAAW,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;YAChD,IAAI,MAAM,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC;gBACtC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,mBAAmB;oBAC1B,OAAO,EAAE,2DAA2D;iBACrE,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,0CAA0C;YAC1C,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;YAEtC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,mBAAmB,CAAC,WAAW,CAAC,CAAC;gBACjC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,yCAAyC,CAAC,CAAC;gBACpE,OAAO;YACT,CAAC;YAED,qBAAqB;YACrB,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;YAChC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC;gBACnE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;gBACtE,OAAO;YACT,CAAC;YAED,mBAAmB;YACnB,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAEzC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,mBAAmB,CAAC,WAAW,CAAC,CAAC;gBACjC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,uCAAuC,CAAC,CAAC;gBAClE,OAAO;YACT,CAAC;YAED,uCAAuC;YACvC,IAAI,eAAe,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAClE,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,0BAA0B,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBACxF,OAAO;YACT,CAAC;YAED,2BAA2B;YAC3B,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,CAAC;gBACnF,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,kCAAkC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACxF,OAAO;YACT,CAAC;YAED,8BAA8B;YAC9B,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;gBACvC,OAAO,CAAC,KAAK,CAAC,+CAA+C,EAAE,GAAG,CAAC,CAAC;YACtE,CAAC,CAAC,CAAC;YAEH,2CAA2C;YAC1C,GAAkC,CAAC,MAAM,GAAG;gBAC3C,EAAE,EAAE,MAAM,CAAC,EAAE;gBACb,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B,CAAC;YAEF,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,yCAAyC,EAAE,KAAK,CAAC,CAAC;YAChE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAY;IAChD,OAAO,QAAQ,IAAI,GAAG,IAAK,GAAkC,CAAC,MAAM,KAAK,SAAS,CAAC;AACrF,CAAC"}

package/dist/plugins/api-keys/middleware/index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * API Keys Middleware Index
+ *
+ * Copyright (c) 2025 QwickApps.com. All rights reserved.
+ */
+export { bearerTokenAuth, isApiKeyAuthenticated, type ApiKeyAuthenticatedRequest, type BearerTokenAuthOptions, } from './bearer-token-auth.js';
+export { createUsageLoggingMiddleware, } from './usage-logging.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/plugins/api-keys/middleware/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/plugins/api-keys/middleware/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,KAAK,0BAA0B,EAC/B,KAAK,sBAAsB,GAC5B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,4BAA4B,GAC7B,MAAM,oBAAoB,CAAC"}

package/dist/plugins/api-keys/middleware/index.js

@@ -0,0 +1,8 @@
+/**
+ * API Keys Middleware Index
+ *
+ * Copyright (c) 2025 QwickApps.com. All rights reserved.
+ */
+export { bearerTokenAuth, isApiKeyAuthenticated, } from './bearer-token-auth.js';
+export { createUsageLoggingMiddleware, } from './usage-logging.js';
+//# sourceMappingURL=index.js.map

package/dist/plugins/api-keys/middleware/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/plugins/api-keys/middleware/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,eAAe,EACf,qBAAqB,GAGtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,4BAA4B,GAC7B,MAAM,oBAAoB,CAAC"}

package/dist/plugins/api-keys/middleware/usage-logging.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Usage Logging Middleware
+ *
+ * Logs all API key requests for audit trails and usage analytics.
+ * Logging is asynchronous and non-blocking to avoid performance impact.
+ *
+ * Copyright (c) 2025 QwickApps.com. All rights reserved.
+ */
+import type { RequestHandler } from 'express';
+import type { UsageLogStore } from '../stores/usage-log-store.js';
+/**
+ * Create usage logging middleware
+ *
+ * Logs all requests made with API key authentication to the usage log store.
+ * Logging happens asynchronously after the response is sent to avoid latency.
+ *
+ * @param store Usage log storage backend
+ * @returns Express middleware
+ */
+export declare function createUsageLoggingMiddleware(store: UsageLogStore): RequestHandler;
+//# sourceMappingURL=usage-logging.d.ts.map

package/dist/plugins/api-keys/middleware/usage-logging.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"usage-logging.d.ts","sourceRoot":"","sources":["../../../../src/plugins/api-keys/middleware/usage-logging.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAmC,cAAc,EAAE,MAAM,SAAS,CAAC;AAC/E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAclE;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,aAAa,GAAG,cAAc,CA4CjF"}

package/dist/plugins/api-keys/middleware/usage-logging.js

@@ -0,0 +1,57 @@
+/**
+ * Usage Logging Middleware
+ *
+ * Logs all API key requests for audit trails and usage analytics.
+ * Logging is asynchronous and non-blocking to avoid performance impact.
+ *
+ * Copyright (c) 2025 QwickApps.com. All rights reserved.
+ */
+/**
+ * Create usage logging middleware
+ *
+ * Logs all requests made with API key authentication to the usage log store.
+ * Logging happens asynchronously after the response is sent to avoid latency.
+ *
+ * @param store Usage log storage backend
+ * @returns Express middleware
+ */
+export function createUsageLoggingMiddleware(store) {
+    return (req, res, next) => {
+        const apiKeyReq = req;
+        // Skip if not API key authentication
+        if (!apiKeyReq.apiKey) {
+            return next();
+        }
+        // Capture request details
+        const keyId = apiKeyReq.apiKey.id;
+        const endpoint = req.path;
+        const method = req.method;
+        const ipAddress = (req.ip ||
+            req.headers['x-forwarded-for']?.split(',')[0].trim() ||
+            req.socket?.remoteAddress);
+        const userAgent = req.get('user-agent');
+        // Intercept response to capture status code
+        const originalSend = res.send;
+        res.send = function (data) {
+            const statusCode = res.statusCode;
+            // Log asynchronously after response is sent (non-blocking)
+            setImmediate(() => {
+                store.log({
+                    key_id: keyId,
+                    endpoint,
+                    method,
+                    status_code: statusCode,
+                    ip_address: ipAddress,
+                    user_agent: userAgent,
+                }).catch((error) => {
+                    // Log error but don't fail the request
+                    console.error('[UsageLogging] Failed to log API key usage:', error);
+                });
+            });
+            // Call original send
+            return originalSend.call(this, data);
+        };
+        next();
+    };
+}
+//# sourceMappingURL=usage-logging.js.map

package/dist/plugins/api-keys/middleware/usage-logging.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"usage-logging.js","sourceRoot":"","sources":["../../../../src/plugins/api-keys/middleware/usage-logging.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAiBH;;;;;;;;GAQG;AACH,MAAM,UAAU,4BAA4B,CAAC,KAAoB;IAC/D,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAQ,EAAE;QAC/D,MAAM,SAAS,GAAG,GAAoB,CAAC;QAEvC,qCAAqC;QACrC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;YACtB,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,0BAA0B;QAC1B,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC;QAC1B,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QAC1B,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,EAAE;YACtB,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAY,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;YAChE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAuB,CAAC;QACnD,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAExC,4CAA4C;QAC5C,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC;QAC9B,GAAG,CAAC,IAAI,GAAG,UAAU,IAAc;YACjC,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC;YAElC,2DAA2D;YAC3D,YAAY,CAAC,GAAG,EAAE;gBAChB,KAAK,CAAC,GAAG,CAAC;oBACR,MAAM,EAAE,KAAK;oBACb,QAAQ;oBACR,MAAM;oBACN,WAAW,EAAE,UAAU;oBACvB,UAAU,EAAE,SAAS;oBACrB,UAAU,EAAE,SAAS;iBACtB,CAAC,CAAC,KAAK,CAAC,CAAC,KAAY,EAAE,EAAE;oBACxB,uCAAuC;oBACvC,OAAO,CAAC,KAAK,CAAC,6CAA6C,EAAE,KAAK,CAAC,CAAC;gBACtE,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,qBAAqB;YACrB,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACvC,CAAC,CAAC;QAEF,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}

package/dist/plugins/api-keys/stores/index.d.ts

@@ -0,0 +1,9 @@
+/**
+ * API Keys Stores Index
+ *
+ * Copyright (c) 2025 QwickApps.com. All rights reserved.
+ */
+export { postgresApiKeyStore } from './postgres-store.js';
+export { createPostgresPluginScopeStore, type PluginScope, type PluginScopeStore, type PostgresPluginScopeStoreConfig, } from './plugin-scope-store.js';
+export { createPostgresUsageLogStore, type UsageLogEntry, type UsageLogQueryOptions, type UsageLogStats, type UsageLogStore, type PostgresUsageLogStoreConfig, } from './usage-log-store.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/plugins/api-keys/stores/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/plugins/api-keys/stores/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EACL,8BAA8B,EAC9B,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,8BAA8B,GACpC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,2BAA2B,EAC3B,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,2BAA2B,GACjC,MAAM,sBAAsB,CAAC"}

package/dist/plugins/api-keys/stores/index.js

@@ -0,0 +1,9 @@
+/**
+ * API Keys Stores Index
+ *
+ * Copyright (c) 2025 QwickApps.com. All rights reserved.
+ */
+export { postgresApiKeyStore } from './postgres-store.js';
+export { createPostgresPluginScopeStore, } from './plugin-scope-store.js';
+export { createPostgresUsageLogStore, } from './usage-log-store.js';
+//# sourceMappingURL=index.js.map

package/dist/plugins/api-keys/stores/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/plugins/api-keys/stores/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EACL,8BAA8B,GAI/B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,2BAA2B,GAM5B,MAAM,sBAAsB,CAAC"}

package/dist/plugins/api-keys/stores/plugin-scope-store.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Plugin Scope Store - PostgreSQL Implementation
+ *
+ * Manages plugin-declared scopes for fine-grained API key authorization.
+ * Plugins register their scopes during initialization, which are then available
+ * for selection during API key creation.
+ *
+ * Copyright (c) 2025 QwickApps.com. All rights reserved.
+ */
+import type { Pool } from 'pg';
+/**
+ * Plugin scope definition
+ */
+export interface PluginScope {
+    /** Scope name in format 'plugin-id:action' (e.g., 'qwickbrain:execute') */
+    name: string;
+    /** Plugin ID that declares this scope */
+    plugin_id: string;
+    /** Human-readable description for UI */
+    description: string;
+    /** Optional category for grouping (read, write, admin) */
+    category?: 'read' | 'write' | 'admin';
+    /** When scope was registered */
+    created_at?: Date;
+    /** When scope was last updated */
+    updated_at?: Date;
+}
+/**
+ * Plugin scope store interface
+ */
+export interface PluginScopeStore {
+    /** Store name */
+    name: string;
+    /**
+     * Initialize the store (create tables, indexes, etc.)
+     */
+    initialize(): Promise<void>;
+    /**
+     * Register scopes for a plugin (upsert operation)
+     * Existing scopes are updated, new scopes are inserted, removed scopes are deleted
+     */
+    registerScopes(pluginId: string, scopes: Omit<PluginScope, 'plugin_id' | 'created_at' | 'updated_at'>[]): Promise<void>;
+    /**
+     * Get all scopes for a specific plugin
+     */
+    getPluginScopes(pluginId: string): Promise<PluginScope[]>;
+    /**
+     * Get all available scopes across all plugins
+     */
+    getAllScopes(): Promise<PluginScope[]>;
+    /**
+     * Verify a scope exists
+     */
+    isValidScope(scopeName: string): Promise<boolean>;
+    /**
+     * Delete all scopes for a plugin
+     */
+    deletePluginScopes(pluginId: string): Promise<void>;
+    /**
+     * Shutdown the store
+     */
+    shutdown(): Promise<void>;
+}
+/**
+ * PostgreSQL plugin scope store configuration
+ */
+export interface PostgresPluginScopeStoreConfig {
+    /** PostgreSQL pool instance or a function that returns one (for lazy initialization) */
+    pool: Pool | (() => Pool);
+    /** Table name (default: 'plugin_scopes') */
+    tableName?: string;
+    /** Schema name (default: 'public') */
+    schema?: string;
+    /** Auto-create tables on init (default: true) */
+    autoCreateTables?: boolean;
+}
+/**
+ * PostgreSQL implementation of PluginScopeStore
+ */
+export declare function createPostgresPluginScopeStore(config: PostgresPluginScopeStoreConfig): PluginScopeStore;
+//# sourceMappingURL=plugin-scope-store.d.ts.map

package/dist/plugins/api-keys/stores/plugin-scope-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-scope-store.d.ts","sourceRoot":"","sources":["../../../../src/plugins/api-keys/stores/plugin-scope-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAE/B;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,yCAAyC;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,wCAAwC;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC;IACtC,gCAAgC;IAChC,UAAU,CAAC,EAAE,IAAI,CAAC;IAClB,kCAAkC;IAClC,UAAU,CAAC,EAAE,IAAI,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,iBAAiB;IACjB,IAAI,EAAE,MAAM,CAAC;IAEb;;OAEG;IACH,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5B;;;OAGG;IACH,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,YAAY,GAAG,YAAY,CAAC,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAExH;;OAEG;IACH,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAE1D;;OAEG;IACH,YAAY,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAEvC;;OAEG;IACH,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAElD;;OAEG;IACH,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEpD;;OAEG;IACH,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC7C,wFAAwF;IACxF,IAAI,EAAE,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;IAC1B,4CAA4C;IAC5C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sCAAsC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iDAAiD;IACjD,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED;;GAEG;AACH,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,8BAA8B,GACrC,gBAAgB,CA0LlB"}

package/dist/plugins/api-keys/stores/plugin-scope-store.js

@@ -0,0 +1,155 @@
+/**
+ * Plugin Scope Store - PostgreSQL Implementation
+ *
+ * Manages plugin-declared scopes for fine-grained API key authorization.
+ * Plugins register their scopes during initialization, which are then available
+ * for selection during API key creation.
+ *
+ * Copyright (c) 2025 QwickApps.com. All rights reserved.
+ */
+/**
+ * PostgreSQL implementation of PluginScopeStore
+ */
+export function createPostgresPluginScopeStore(config) {
+    const tableName = config.tableName || 'plugin_scopes';
+    const schema = config.schema || 'public';
+    const tableFullName = `"${schema}"."${tableName}"`;
+    const autoCreateTables = config.autoCreateTables !== false;
+    // In-memory cache for fast validation
+    const scopeCache = new Set();
+    let cacheInitialized = false;
+    /**
+     * Get PostgreSQL pool (lazy initialization support)
+     */
+    function getPool() {
+        if (typeof config.pool === 'function') {
+            return config.pool();
+        }
+        return config.pool;
+    }
+    /**
+     * Initialize scope cache
+     */
+    async function initializeCache() {
+        if (cacheInitialized)
+            return;
+        const pool = getPool();
+        const result = await pool.query(`SELECT name FROM ${tableFullName}`);
+        scopeCache.clear();
+        result.rows.forEach(row => scopeCache.add(row.name));
+        cacheInitialized = true;
+    }
+    /**
+     * Refresh cache after modifications
+     */
+    async function refreshCache() {
+        cacheInitialized = false;
+        await initializeCache();
+    }
+    return {
+        name: 'postgres',
+        async initialize() {
+            if (!autoCreateTables)
+                return;
+            const pool = getPool();
+            // Create plugin_scopes table
+            await pool.query(`
+        CREATE TABLE IF NOT EXISTS ${tableFullName} (
+          id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+          plugin_id VARCHAR(255) NOT NULL,
+          name VARCHAR(255) NOT NULL UNIQUE,
+          description TEXT NOT NULL,
+          category VARCHAR(50),
+          created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+          updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+
+          -- Enforce naming convention: plugin-id:action
+          CONSTRAINT scope_name_format CHECK (name ~ '^[a-z0-9-]+:[a-z0-9-]+$')
+        );
+
+        -- Indexes for performance
+        CREATE INDEX IF NOT EXISTS idx_${tableName}_plugin_id ON ${tableFullName}(plugin_id);
+        CREATE INDEX IF NOT EXISTS idx_${tableName}_category ON ${tableFullName}(category);
+        CREATE INDEX IF NOT EXISTS idx_${tableName}_name ON ${tableFullName}(name);
+      `);
+            // Insert system scopes for backwards compatibility
+            await pool.query(`
+        INSERT INTO ${tableFullName} (plugin_id, name, description, category)
+        VALUES
+          ('system', 'system:read', 'Read access to system resources', 'read'),
+          ('system', 'system:write', 'Write access to system resources', 'write'),
+          ('system', 'system:admin', 'Administrative access to system resources', 'admin')
+        ON CONFLICT (name) DO NOTHING;
+      `);
+            // Initialize cache
+            await initializeCache();
+        },
+        async registerScopes(pluginId, scopes) {
+            const pool = getPool();
+            // Start transaction for atomic upsert
+            const client = await pool.connect();
+            try {
+                await client.query('BEGIN');
+                // Get existing scopes for this plugin
+                const existingResult = await client.query(`SELECT name FROM ${tableFullName} WHERE plugin_id = $1`, [pluginId]);
+                const existingScopes = new Set(existingResult.rows.map(r => r.name));
+                const newScopes = new Set(scopes.map(s => s.name));
+                // Delete scopes that are no longer declared
+                const scopesToDelete = [...existingScopes].filter(name => !newScopes.has(name));
+                if (scopesToDelete.length > 0) {
+                    await client.query(`DELETE FROM ${tableFullName} WHERE plugin_id = $1 AND name = ANY($2)`, [pluginId, scopesToDelete]);
+                }
+                // Upsert scopes (insert new, update existing)
+                for (const scope of scopes) {
+                    await client.query(`INSERT INTO ${tableFullName} (plugin_id, name, description, category)
+             VALUES ($1, $2, $3, $4)
+             ON CONFLICT (name) DO UPDATE SET
+               description = EXCLUDED.description,
+               category = EXCLUDED.category,
+               updated_at = NOW()`, [pluginId, scope.name, scope.description, scope.category || null]);
+                }
+                await client.query('COMMIT');
+                // Refresh cache
+                await refreshCache();
+            }
+            catch (error) {
+                await client.query('ROLLBACK');
+                throw error;
+            }
+            finally {
+                client.release();
+            }
+        },
+        async getPluginScopes(pluginId) {
+            const pool = getPool();
+            const result = await pool.query(`SELECT plugin_id, name, description, category, created_at, updated_at
+         FROM ${tableFullName}
+         WHERE plugin_id = $1
+         ORDER BY name`, [pluginId]);
+            return result.rows;
+        },
+        async getAllScopes() {
+            const pool = getPool();
+            const result = await pool.query(`SELECT plugin_id, name, description, category, created_at, updated_at
+         FROM ${tableFullName}
+         ORDER BY plugin_id, name`);
+            return result.rows;
+        },
+        async isValidScope(scopeName) {
+            // Use cache for fast validation
+            await initializeCache();
+            return scopeCache.has(scopeName);
+        },
+        async deletePluginScopes(pluginId) {
+            const pool = getPool();
+            await pool.query(`DELETE FROM ${tableFullName} WHERE plugin_id = $1`, [pluginId]);
+            // Refresh cache
+            await refreshCache();
+        },
+        async shutdown() {
+            scopeCache.clear();
+            cacheInitialized = false;
+        },
+    };
+}
+//# sourceMappingURL=plugin-scope-store.js.map

package/dist/plugins/api-keys/stores/plugin-scope-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-scope-store.js","sourceRoot":"","sources":["../../../../src/plugins/api-keys/stores/plugin-scope-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAgFH;;GAEG;AACH,MAAM,UAAU,8BAA8B,CAC5C,MAAsC;IAEtC,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,eAAe,CAAC;IACtD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,QAAQ,CAAC;IACzC,MAAM,aAAa,GAAG,IAAI,MAAM,MAAM,SAAS,GAAG,CAAC;IACnD,MAAM,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,KAAK,KAAK,CAAC;IAE3D,sCAAsC;IACtC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,IAAI,gBAAgB,GAAG,KAAK,CAAC;IAE7B;;OAEG;IACH,SAAS,OAAO;QACd,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACtC,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;QACvB,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,KAAK,UAAU,eAAe;QAC5B,IAAI,gBAAgB;YAAE,OAAO;QAE7B,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,oBAAoB,aAAa,EAAE,CACpC,CAAC;QAEF,UAAU,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QACrD,gBAAgB,GAAG,IAAI,CAAC;IAC1B,CAAC;IAED;;OAEG;IACH,KAAK,UAAU,YAAY;QACzB,gBAAgB,GAAG,KAAK,CAAC;QACzB,MAAM,eAAe,EAAE,CAAC;IAC1B,CAAC;IAED,OAAO;QACL,IAAI,EAAE,UAAU;QAEhB,KAAK,CAAC,UAAU;YACd,IAAI,CAAC,gBAAgB;gBAAE,OAAO;YAE9B,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;YAEvB,6BAA6B;YAC7B,MAAM,IAAI,CAAC,KAAK,CAAC;qCACc,aAAa;;;;;;;;;;;;;;yCAcT,SAAS,iBAAiB,aAAa;yCACvC,SAAS,gBAAgB,aAAa;yCACtC,SAAS,YAAY,aAAa;OACpE,CAAC,CAAC;YAEH,mDAAmD;YACnD,MAAM,IAAI,CAAC,KAAK,CAAC;sBACD,aAAa;;;;;;OAM5B,CAAC,CAAC;YAEH,mBAAmB;YACnB,MAAM,eAAe,EAAE,CAAC;QAC1B,CAAC;QAED,KAAK,CAAC,cAAc,CAClB,QAAgB,EAChB,MAAsE;YAEtE,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;YAEvB,sCAAsC;YACtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACpC,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAE5B,sCAAsC;gBACtC,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,KAAK,CACvC,oBAAoB,aAAa,uBAAuB,EACxD,CAAC,QAAQ,CAAC,CACX,CAAC;gBACF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;gBACrE,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;gBAEnD,4CAA4C;gBAC5C,MAAM,cAAc,GAAG,CAAC,GAAG,cAAc,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;gBAChF,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC9B,MAAM,MAAM,CAAC,KAAK,CAChB,eAAe,aAAa,0CAA0C,EACtE,CAAC,QAAQ,EAAE,cAAc,CAAC,CAC3B,CAAC;gBACJ,CAAC;gBAED,8CAA8C;gBAC9C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;oBAC3B,MAAM,MAAM,CAAC,KAAK,CAChB,eAAe,aAAa;;;;;kCAKN,EACtB,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,CAClE,CAAC;gBACJ,CAAC;gBAED,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAE7B,gBAAgB;gBAChB,MAAM,YAAY,EAAE,CAAC;YACvB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBAC/B,MAAM,KAAK,CAAC;YACd,CAAC;oBAAS,CAAC;gBACT,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,CAAC;QACH,CAAC;QAED,KAAK,CAAC,eAAe,CAAC,QAAgB;YACpC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;gBACQ,aAAa;;uBAEN,EACf,CAAC,QAAQ,CAAC,CACX,CAAC;YAEF,OAAO,MAAM,CAAC,IAAI,CAAC;QACrB,CAAC;QAED,KAAK,CAAC,YAAY;YAChB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;gBACQ,aAAa;kCACK,CAC3B,CAAC;YAEF,OAAO,MAAM,CAAC,IAAI,CAAC;QACrB,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,SAAiB;YAClC,gCAAgC;YAChC,MAAM,eAAe,EAAE,CAAC;YACxB,OAAO,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACnC,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,QAAgB;YACvC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,KAAK,CACd,eAAe,aAAa,uBAAuB,EACnD,CAAC,QAAQ,CAAC,CACX,CAAC;YAEF,gBAAgB;YAChB,MAAM,YAAY,EAAE,CAAC;QACvB,CAAC;QAED,KAAK,CAAC,QAAQ;YACZ,UAAU,CAAC,KAAK,EAAE,CAAC;YACnB,gBAAgB,GAAG,KAAK,CAAC;QAC3B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/plugins/api-keys/stores/postgres-store.d.ts

@@ -0,0 +1,34 @@
+/**
+ * PostgreSQL API Keys Store
+ *
+ * API key storage implementation using PostgreSQL with Row-Level Security (RLS).
+ * Uses SHA-256 for token hashing (high-entropy keys don't need bcrypt's slowness).
+ *
+ * RLS Context Pattern:
+ * Each operation uses an explicit transaction and sets `app.current_user_id`
+ * as a transaction-local configuration variable. The RLS policy checks this
+ * variable to enforce that users can only access their own API keys.
+ *
+ * Copyright (c) 2025 QwickApps.com. All rights reserved.
+ */
+import type { ApiKeyStore, PostgresApiKeyStoreConfig } from '../types.js';
+/**
+ * Create a PostgreSQL API keys store with RLS
+ *
+ * @param config Configuration including a pg Pool instance
+ * @returns ApiKeyStore implementation
+ *
+ * @example
+ * ```ts
+ * import { Pool } from 'pg';
+ * import { postgresApiKeyStore } from '@qwickapps/server';
+ *
+ * const pool = new Pool({ connectionString: process.env.DATABASE_URL });
+ * const store = postgresApiKeyStore({ pool });
+ *
+ * // Or with lazy initialization:
+ * const store = postgresApiKeyStore({ pool: () => getPostgres().getPool() });
+ * ```
+ */
+export declare function postgresApiKeyStore(config: PostgresApiKeyStoreConfig): ApiKeyStore;
+//# sourceMappingURL=postgres-store.d.ts.map

package/dist/plugins/api-keys/stores/postgres-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgres-store.d.ts","sourceRoot":"","sources":["../../../../src/plugins/api-keys/stores/postgres-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,KAAK,EACV,WAAW,EACX,yBAAyB,EAK1B,MAAM,aAAa,CAAC;AAuKrB;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,yBAAyB,GAAG,WAAW,CAsRlF"}