@rebasepro/server-core 0.6.1 → 0.8.0

package/src/auth/admin-users-route.ts

@@ -0,0 +1,302 @@
+/**
+ * Standalone admin endpoint for user management.
+ *
+ * Mounts:
+ *   GET /users
+ *   GET /users/:userId
+ *   POST /users
+ *   PUT /users/:userId
+ *   DELETE /users/:userId
+ *   POST /bootstrap
+ */
+
+import { Hono } from "hono";
+import { ApiError, errorHandler } from "../api/errors";
+import type { AuthRepository } from "./interfaces";
+import { createRequireAuth, requireAdmin } from "./middleware";
+import type { AuthHooks } from "./auth-hooks";
+import { resolveAuthHooks } from "./auth-hooks";
+import { prepareAdminUserValues, finalizeAdminUserCreation } from "./admin-user-ops";
+import type { EmailService, EmailConfig } from "../email";
+import type { HonoEnv } from "../api/types";
+import type { AdminUser, AuthCollectionConfig } from "@rebasepro/types";
+import { logger } from "../utils/logger";
+
+export interface AdminUsersRouteConfig {
+    authRepo: AuthRepository;
+    emailService?: EmailService;
+    emailConfig?: EmailConfig;
+    serviceKey?: string;
+    authHooks?: AuthHooks;
+    collectionAuthConfig?: AuthCollectionConfig;
+    isBootstrapCompleted?: () => Promise<boolean>;
+    setBootstrapCompleted?: () => Promise<void>;
+}
+
+export function createAdminUsersRoute(config: AdminUsersRouteConfig): Hono<HonoEnv> {
+    const router = new Hono<HonoEnv>();
+    const authRepo = config.authRepo;
+    const { emailService, emailConfig, collectionAuthConfig } = config;
+    const ops = resolveAuthHooks(config.authHooks);
+
+    function toAdminUser(
+        u: {
+            id: string;
+            email: string;
+            displayName?: string | null;
+            photoUrl?: string | null;
+            createdAt?: Date | string;
+            updatedAt?: Date | string;
+        },
+        roles: string[]
+    ): AdminUser {
+        return {
+            uid: u.id,
+            email: u.email,
+            displayName: u.displayName ?? null,
+            photoURL: u.photoUrl ?? null,
+            provider: "custom",
+            roles,
+            createdAt: u.createdAt instanceof Date ? u.createdAt.toISOString() : (u.createdAt ?? new Date().toISOString()),
+            updatedAt: u.updatedAt instanceof Date ? u.updatedAt.toISOString() : (u.updatedAt ?? new Date().toISOString())
+        };
+    }
+
+    router.onError(errorHandler);
+    router.use("/*", createRequireAuth({ serviceKey: config.serviceKey }));
+
+    router.post("/bootstrap", async (c) => {
+        const user = c.get("user");
+        if (!user || typeof user !== "object") {
+            throw ApiError.unauthorized("Not authenticated");
+        }
+
+        if (config.isBootstrapCompleted) {
+            const alreadyDone = await config.isBootstrapCompleted();
+            if (alreadyDone) {
+                throw ApiError.forbidden("Bootstrap has already been completed.", "BOOTSTRAP_COMPLETED");
+            }
+        }
+
+        const users = await authRepo.listUsers();
+        let hasAdmin = false;
+
+        for (const u of users) {
+            const roles = await authRepo.getUserRoleIds(u.id);
+            if (roles.includes("admin")) {
+                hasAdmin = true;
+                break;
+            }
+        }
+
+        if (hasAdmin) {
+            throw ApiError.forbidden("Admin users already exist. Bootstrap not allowed.", "BOOTSTRAP_COMPLETED");
+        }
+
+        const userId = "userId" in user ? (user as { userId: string }).userId : ("uid" in user ? (user as { uid: string }).uid : undefined);
+        if (!userId) {
+            throw ApiError.unauthorized("User ID not found in auth context");
+        }
+        const caller = await authRepo.getUserById(userId);
+        if (!caller) {
+            throw ApiError.notFound("Authenticated user does not exist in the database.", "USER_NOT_FOUND");
+        }
+        await authRepo.setUserRoles(userId, ["admin"]);
+
+        if (config.setBootstrapCompleted) {
+            await config.setBootstrapCompleted();
+        }
+
+        return c.json({
+            success: true,
+            message: "You are now an admin",
+            user: {
+                uid: userId,
+                roles: ["admin"]
+            }
+        });
+    });
+
+    router.get("/users", requireAdmin, async (c) => {
+        const limitParam = c.req.query("limit");
+        const offsetParam = c.req.query("offset");
+        const search = c.req.query("search");
+        const orderBy = c.req.query("orderBy");
+        const orderDir = c.req.query("orderDir") as "asc" | "desc" | undefined;
+
+        const limit = limitParam ? parseInt(limitParam, 10) : 25;
+        const offset = offsetParam ? parseInt(offsetParam, 10) : 0;
+
+        const result = await authRepo.listUsersPaginated({
+            limit,
+            offset,
+            search: search || undefined,
+            orderBy: orderBy || undefined,
+            orderDir: orderDir || undefined,
+            roleId: c.req.query("role") || undefined
+        });
+
+        const usersWithRoles = await Promise.all(
+            result.users.map(async (u) => {
+                const roles = await authRepo.getUserRoleIds(u.id);
+                return toAdminUser(u, roles);
+            })
+        );
+
+        return c.json({
+            users: usersWithRoles,
+            total: result.total,
+            limit: result.limit,
+            offset: result.offset
+        });
+    });
+
+    router.get("/users/:userId", requireAdmin, async (c) => {
+        const userId = c.req.param("userId");
+        const result = await authRepo.getUserWithRoles(userId);
+
+        if (!result) {
+            throw ApiError.notFound("User not found");
+        }
+
+        const adminUser = toAdminUser(result.user, result.roles.map((r) => r.id));
+        return c.json({ user: adminUser });
+    });
+
+    router.post("/users", requireAdmin, async (c) => {
+        const body = await c.req.json();
+        const { email, roles } = body;
+        if (!email) {
+            throw ApiError.badRequest("Email is required");
+        }
+
+        const existing = await authRepo.getUserByEmail(email.toLowerCase());
+        if (existing) {
+            throw ApiError.conflict("A user with this email already exists");
+        }
+
+        const prepResult = await prepareAdminUserValues(body, {
+            authRepo,
+            emailService,
+            emailConfig,
+            resolvedHooks: ops,
+            collectionAuthConfig
+        });
+
+        const user = await authRepo.createUser({
+            email: prepResult.values.email as string,
+            passwordHash: prepResult.values.passwordHash as string | undefined,
+            displayName: prepResult.values.displayName as string | undefined,
+            photoUrl: prepResult.values.photoUrl as string | undefined,
+            metadata: prepResult.values.metadata as Record<string, unknown> | undefined
+        });
+
+        if (roles && Array.isArray(roles)) {
+            await authRepo.setUserRoles(user.id, roles);
+        }
+
+        const finalizeResult = await finalizeAdminUserCreation(
+            { id: user.id, values: prepResult.values },
+            prepResult.clearPassword,
+            {
+                authRepo,
+                emailService,
+                emailConfig,
+                resolvedHooks: ops,
+                collectionAuthConfig
+            }
+        );
+
+        const userRoles = await authRepo.getUserRoleIds(user.id);
+        const adminUser = toAdminUser(user, userRoles);
+
+        return c.json(
+            {
+                user: adminUser,
+                invitationSent: finalizeResult.invitationSent,
+                ...(finalizeResult.temporaryPassword ? { temporaryPassword: finalizeResult.temporaryPassword } : {})
+            },
+            201
+        );
+    });
+
+    router.put("/users/:userId", requireAdmin, async (c) => {
+        const userId = c.req.param("userId");
+        const body = await c.req.json();
+        const { password, email, displayName, roles } = body;
+
+        const existing = await authRepo.getUserById(userId);
+        if (!existing) {
+            throw ApiError.notFound("User not found");
+        }
+
+        const updates: Record<string, unknown> = {};
+        if (email !== undefined) updates.email = email.toLowerCase();
+        if (displayName !== undefined) updates.displayName = displayName;
+
+        if (password) {
+            const validation = ops.validatePasswordStrength(password);
+            if (!validation.valid) {
+                throw ApiError.badRequest(`Password too weak: ${validation.errors.join(". ")}`);
+            }
+            updates.passwordHash = await ops.hashPassword(password);
+        }
+
+        if (Object.keys(updates).length > 0) {
+            await authRepo.updateUser(userId, updates);
+        }
+
+        if (roles !== undefined && Array.isArray(roles)) {
+            const currentRoles = await authRepo.getUserRoleIds(userId);
+            const wasAdmin = currentRoles.includes("admin");
+            const willBeAdmin = roles.includes("admin");
+
+            if (wasAdmin && !willBeAdmin) {
+                const adminUsers = await authRepo.listUsersPaginated({
+                    roleId: "admin",
+                    limit: 1
+                });
+                if (adminUsers.total <= 1) {
+                    throw ApiError.forbidden("Cannot demote the last administrator", "LAST_ADMIN");
+                }
+            }
+            await authRepo.setUserRoles(userId, roles);
+        }
+
+        const result = await authRepo.getUserWithRoles(userId);
+        const adminUser = toAdminUser(result!.user, result!.roles.map((r) => r.id));
+
+        return c.json({ user: adminUser });
+    });
+
+    router.delete("/users/:userId", requireAdmin, async (c) => {
+        const userId = c.req.param("userId");
+        const authUser = c.get("user") as { uid?: string; userId?: string } | undefined;
+        const currentUserId = authUser?.uid || authUser?.userId;
+
+        if (currentUserId === userId) {
+            throw ApiError.badRequest("Cannot delete your own account", "SELF_DELETE");
+        }
+
+        const existing = await authRepo.getUserById(userId);
+        if (!existing) {
+            throw ApiError.notFound("User not found");
+        }
+
+        const roles = await authRepo.getUserRoleIds(userId);
+        if (roles.includes("admin")) {
+            const adminUsers = await authRepo.listUsersPaginated({
+                roleId: "admin",
+                limit: 1
+            });
+            if (adminUsers.total <= 1) {
+                throw ApiError.forbidden("Cannot delete the last administrator", "LAST_ADMIN");
+            }
+        }
+
+        await authRepo.deleteUser(userId);
+        return c.json({ success: true });
+    });
+
+    return router;
+}

package/src/auth/api-keys/api-key-middleware.ts

@@ -88,8 +88,8 @@ code: "UNAUTHORIZED" }
 
     // Set user identity — API keys represent service accounts
     const userId = `api-key:${apiKey.id}`;
-    c.set("user", { userId,
-roles: [] });
+    const roles: string[] = apiKey.admin ? ["admin", "service"] : ["service"];
+    c.set("user", { userId, roles });
 
     // Expose masked key metadata for downstream permission checks
     const masked: ApiKeyMasked = {
@@ -97,6 +97,7 @@ roles: [] });
         name: apiKey.name,
         key_prefix: apiKey.key_prefix,
         permissions: apiKey.permissions,
+        admin: apiKey.admin,
         rate_limit: apiKey.rate_limit,
         created_by: apiKey.created_by,
         created_at: apiKey.created_at,
@@ -112,7 +113,7 @@ roles: [] });
     try {
         const scopedDriver = await scopeDataDriver(driver, {
             uid: userId,
-            roles: ["service"]
+            roles
         });
         c.set("driver", scopedDriver);
     } catch (error) {

package/src/auth/api-keys/api-key-routes.ts

@@ -59,7 +59,7 @@ export function createApiKeyRoutes(options: ApiKeyRouteOptions): Hono<HonoEnv> {
     // POST / — Create a new API key
     router.post("/", async (c) => {
         const body = await c.req.json() as Record<string, unknown>;
-        const { name, permissions, rate_limit, expires_at } = body;
+        const { name, permissions, admin, rate_limit, expires_at } = body;
 
         if (!name || typeof name !== "string" || name.trim().length === 0) {
             throw ApiError.badRequest("Name is required", "INVALID_INPUT");
@@ -72,6 +72,10 @@ export function createApiKeyRoutes(options: ApiKeyRouteOptions): Hono<HonoEnv> {
             );
         }
 
+        if (admin !== undefined && typeof admin !== "boolean") {
+            throw ApiError.badRequest("admin must be a boolean", "INVALID_INPUT");
+        }
+
         if (rate_limit !== undefined && rate_limit !== null) {
             if (typeof rate_limit !== "number" || rate_limit < 1 || !Number.isInteger(rate_limit)) {
                 throw ApiError.badRequest("rate_limit must be a positive integer or null", "INVALID_INPUT");
@@ -96,6 +100,7 @@ export function createApiKeyRoutes(options: ApiKeyRouteOptions): Hono<HonoEnv> {
         const request: CreateApiKeyRequest = {
             name: name.trim(),
             permissions: permissions as ApiKeyPermission[],
+            admin: (admin as boolean) ?? false,
             rate_limit: (rate_limit as number | null) ?? null,
             expires_at: (expires_at as string | null) ?? null
         };
@@ -121,7 +126,7 @@ export function createApiKeyRoutes(options: ApiKeyRouteOptions): Hono<HonoEnv> {
     router.put("/:id", async (c) => {
         const id = c.req.param("id");
         const body = await c.req.json() as Record<string, unknown>;
-        const { name, permissions, rate_limit, expires_at } = body;
+        const { name, permissions, admin, rate_limit, expires_at } = body;
 
         // Validate fields if provided
         if (name !== undefined) {
@@ -139,6 +144,10 @@ export function createApiKeyRoutes(options: ApiKeyRouteOptions): Hono<HonoEnv> {
             }
         }
 
+        if (admin !== undefined && typeof admin !== "boolean") {
+            throw ApiError.badRequest("admin must be a boolean", "INVALID_INPUT");
+        }
+
         if (rate_limit !== undefined && rate_limit !== null) {
             if (typeof rate_limit !== "number" || rate_limit < 1 || !Number.isInteger(rate_limit)) {
                 throw ApiError.badRequest("rate_limit must be a positive integer or null", "INVALID_INPUT");
@@ -155,6 +164,7 @@ export function createApiKeyRoutes(options: ApiKeyRouteOptions): Hono<HonoEnv> {
         const updates: UpdateApiKeyRequest = {};
         if (name !== undefined) updates.name = (name as string).trim();
         if (permissions !== undefined) updates.permissions = permissions as ApiKeyPermission[];
+        if (admin !== undefined) updates.admin = admin as boolean;
         if (rate_limit !== undefined) updates.rate_limit = rate_limit as number | null;
         if (expires_at !== undefined) updates.expires_at = expires_at as string | null;
 

package/src/auth/api-keys/api-key-store.ts

@@ -59,6 +59,7 @@ function toMasked(row: ApiKey): ApiKeyMasked {
         name: row.name,
         key_prefix: row.key_prefix,
         permissions: row.permissions,
+        admin: row.admin,
         rate_limit: row.rate_limit,
         created_by: row.created_by,
         created_at: row.created_at,
@@ -88,6 +89,7 @@ function rowToApiKey(row: Record<string, unknown>): ApiKey {
         key_prefix: row.key_prefix as string,
         key_hash: row.key_hash as string,
         permissions,
+        admin: Boolean(row.admin),
         rate_limit: row.rate_limit !== null && row.rate_limit !== undefined
             ? Number(row.rate_limit)
             : null,
@@ -100,13 +102,6 @@ function rowToApiKey(row: Record<string, unknown>): ApiKey {
     };
 }
 
-/**
- * Escape a string for safe inline SQL usage.
- */
-function esc(value: string): string {
-    return value.replace(/'/g, "''");
-}
-
 // ─── Public API ──────────────────────────────────────────────────────
 
 export interface ApiKeyStore {
@@ -147,7 +142,8 @@ export function createApiKeyStore(driver: DataDriver): ApiKeyStore | undefined {
         return undefined;
     }
 
-    const exec = admin.executeSql.bind(admin);
+    const exec = (sqlText: string, options?: { params?: unknown[] }) =>
+        admin.executeSql(sqlText, options?.params ? { params: options.params } : undefined);
 
     return {
         // ── Schema bootstrap ────────────────────────────────────────
@@ -161,6 +157,7 @@ export function createApiKeyStore(driver: DataDriver): ApiKeyStore | undefined {
                         key_prefix TEXT NOT NULL,
                         key_hash TEXT NOT NULL UNIQUE,
                         permissions JSONB NOT NULL DEFAULT '[]'::jsonb,
+                        admin BOOLEAN NOT NULL DEFAULT FALSE,
                         rate_limit INTEGER,
                         created_by TEXT NOT NULL,
                         created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
@@ -181,6 +178,12 @@ export function createApiKeyStore(driver: DataDriver): ApiKeyStore | undefined {
                     ON ${TABLE}(key_prefix)
                 `);
 
+                // Migration: add admin column to existing tables
+                await exec(`
+                    ALTER TABLE ${TABLE}
+                    ADD COLUMN IF NOT EXISTS admin BOOLEAN NOT NULL DEFAULT FALSE
+                `);
+
                 logger.info("✅ API keys table ready");
             } catch (err) {
                 logger.error("❌ Failed to create API keys table", { error: err });
@@ -194,26 +197,22 @@ export function createApiKeyStore(driver: DataDriver): ApiKeyStore | undefined {
             const hash = hashKey(plaintext);
             const prefix = keyPrefix(plaintext);
             const permissionsJson = JSON.stringify(request.permissions);
-            const rateLimitSql = request.rate_limit !== null && request.rate_limit !== undefined
-                ? String(request.rate_limit)
-                : "NULL";
-            const expiresAtSql = request.expires_at
-                ? `'${esc(request.expires_at)}'`
-                : "NULL";
 
-            const rows = await exec(`
-                INSERT INTO ${TABLE} (name, key_prefix, key_hash, permissions, rate_limit, created_by, expires_at)
-                VALUES (
-                    '${esc(request.name)}',
-                    '${esc(prefix)}',
-                    '${esc(hash)}',
-                    '${esc(permissionsJson)}'::jsonb,
-                    ${rateLimitSql},
-                    '${esc(createdBy)}',
-                    ${expiresAtSql}
-                )
-                RETURNING *
-            `);
+            const rows = await exec(
+                `INSERT INTO ${TABLE} (name, key_prefix, key_hash, permissions, admin, rate_limit, created_by, expires_at)
+                 VALUES ($1, $2, $3, $4::jsonb, $5, $6, $7, $8)
+                 RETURNING *`,
+                { params: [
+                    request.name,
+                    prefix,
+                    hash,
+                    permissionsJson,
+                    request.admin ?? false,
+                    request.rate_limit ?? null,
+                    createdBy,
+                    request.expires_at ?? null
+                ]}
+            );
 
             const apiKey = rowToApiKey(rows[0]);
             return {
@@ -224,11 +223,12 @@ export function createApiKeyStore(driver: DataDriver): ApiKeyStore | undefined {
 
         // ── Lookup by hash ──────────────────────────────────────────
         async findByKeyHash(hash: string): Promise<ApiKey | null> {
-            const rows = await exec(`
-                SELECT * FROM ${TABLE}
-                WHERE key_hash = '${esc(hash)}'
-                LIMIT 1
-            `);
+            const rows = await exec(
+                `SELECT * FROM ${TABLE}
+                 WHERE key_hash = $1
+                 LIMIT 1`,
+                { params: [hash] }
+            );
             if (rows.length === 0) return null;
             return rowToApiKey(rows[0]);
         },
@@ -244,11 +244,12 @@ export function createApiKeyStore(driver: DataDriver): ApiKeyStore | undefined {
 
         // ── Get by ID (masked) ──────────────────────────────────────
         async getApiKeyById(id: string): Promise<ApiKeyMasked | null> {
-            const rows = await exec(`
-                SELECT * FROM ${TABLE}
-                WHERE id = '${esc(id)}'
-                LIMIT 1
-            `);
+            const rows = await exec(
+                `SELECT * FROM ${TABLE}
+                 WHERE id = $1
+                 LIMIT 1`,
+                { params: [id] }
+            );
             if (rows.length === 0) return null;
             return toMasked(rowToApiKey(rows[0]));
         },
@@ -256,26 +257,36 @@ export function createApiKeyStore(driver: DataDriver): ApiKeyStore | undefined {
         // ── Update ──────────────────────────────────────────────────
         async updateApiKey(id: string, updates: UpdateApiKeyRequest): Promise<ApiKeyMasked | null> {
             const setClauses: string[] = [];
+            const params: unknown[] = [];
+            let paramIdx = 1;
 
             if (updates.name !== undefined) {
-                setClauses.push(`name = '${esc(updates.name)}'`);
+                setClauses.push(`name = $${paramIdx++}`);
+                params.push(updates.name);
             }
             if (updates.permissions !== undefined) {
-                setClauses.push(`permissions = '${esc(JSON.stringify(updates.permissions))}'::jsonb`);
+                setClauses.push(`permissions = $${paramIdx++}::jsonb`);
+                params.push(JSON.stringify(updates.permissions));
+            }
+            if (updates.admin !== undefined) {
+                setClauses.push(`admin = $${paramIdx++}`);
+                params.push(updates.admin);
             }
             if (updates.rate_limit !== undefined) {
-                setClauses.push(
-                    updates.rate_limit !== null
-                        ? `rate_limit = ${updates.rate_limit}`
-                        : "rate_limit = NULL"
-                );
+                if (updates.rate_limit !== null) {
+                    setClauses.push(`rate_limit = $${paramIdx++}`);
+                    params.push(updates.rate_limit);
+                } else {
+                    setClauses.push("rate_limit = NULL");
+                }
             }
             if (updates.expires_at !== undefined) {
-                setClauses.push(
-                    updates.expires_at !== null
-                        ? `expires_at = '${esc(updates.expires_at)}'`
-                        : "expires_at = NULL"
-                );
+                if (updates.expires_at !== null) {
+                    setClauses.push(`expires_at = $${paramIdx++}`);
+                    params.push(updates.expires_at);
+                } else {
+                    setClauses.push("expires_at = NULL");
+                }
             }
 
             if (setClauses.length === 0) {
@@ -284,12 +295,16 @@ export function createApiKeyStore(driver: DataDriver): ApiKeyStore | undefined {
 
             setClauses.push("updated_at = NOW()");
 
-            const rows = await exec(`
-                UPDATE ${TABLE}
-                SET ${setClauses.join(", ")}
-                WHERE id = '${esc(id)}'
-                RETURNING *
-            `);
+            // The WHERE id = $N uses the next available param index
+            params.push(id);
+
+            const rows = await exec(
+                `UPDATE ${TABLE}
+                 SET ${setClauses.join(", ")}
+                 WHERE id = $${paramIdx}
+                 RETURNING *`,
+                { params }
+            );
 
             if (rows.length === 0) return null;
             return toMasked(rowToApiKey(rows[0]));
@@ -297,23 +312,25 @@ export function createApiKeyStore(driver: DataDriver): ApiKeyStore | undefined {
 
         // ── Revoke (soft-delete) ────────────────────────────────────
         async revokeApiKey(id: string): Promise<boolean> {
-            const rows = await exec(`
-                UPDATE ${TABLE}
-                SET revoked_at = NOW(), updated_at = NOW()
-                WHERE id = '${esc(id)}' AND revoked_at IS NULL
-                RETURNING id
-            `);
+            const rows = await exec(
+                `UPDATE ${TABLE}
+                 SET revoked_at = NOW(), updated_at = NOW()
+                 WHERE id = $1 AND revoked_at IS NULL
+                 RETURNING id`,
+                { params: [id] }
+            );
             return rows.length > 0;
         },
 
         // ── Touch last_used_at ──────────────────────────────────────
         async updateLastUsed(id: string): Promise<void> {
             try {
-                await exec(`
-                    UPDATE ${TABLE}
-                    SET last_used_at = NOW()
-                    WHERE id = '${esc(id)}'
-                `);
+                await exec(
+                    `UPDATE ${TABLE}
+                     SET last_used_at = NOW()
+                     WHERE id = $1`,
+                    { params: [id] }
+                );
             } catch (err) {
                 // Non-blocking — don't fail requests because of a usage timestamp update
                 logger.error("[api-key-store] Failed to update last_used_at", { error: err });

package/src/auth/api-keys/api-key-types.ts

@@ -32,6 +32,8 @@ export interface ApiKey {
     /** SHA-256 hash of the full plaintext key. */
     key_hash: string;
     permissions: ApiKeyPermission[];
+    /** When true, the key is granted the `admin` role (access to admin routes). */
+    admin: boolean;
     /** Requests per 15-minute window. `null` means unlimited. */
     rate_limit: number | null;
     created_by: string;
@@ -51,6 +53,8 @@ export interface ApiKeyMasked {
     name: string;
     key_prefix: string;
     permissions: ApiKeyPermission[];
+    /** When true, the key is granted the `admin` role (access to admin routes). */
+    admin: boolean;
     rate_limit: number | null;
     created_by: string;
     created_at: string;
@@ -66,6 +70,8 @@ export interface ApiKeyMasked {
 export interface CreateApiKeyRequest {
     name: string;
     permissions: ApiKeyPermission[];
+    /** When true, grants the `admin` role — allows access to admin routes. */
+    admin?: boolean;
     /** Requests per 15-minute window. Omit or `null` for unlimited. */
     rate_limit?: number | null;
     /** ISO-8601 expiration timestamp. Omit for no expiration. */
@@ -79,6 +85,8 @@ export interface CreateApiKeyRequest {
 export interface UpdateApiKeyRequest {
     name?: string;
     permissions?: ApiKeyPermission[];
+    /** When true, grants the `admin` role — allows access to admin routes. */
+    admin?: boolean;
     rate_limit?: number | null;
     expires_at?: string | null;
 }

package/src/auth/apple-oauth.ts

@@ -110,7 +110,8 @@ export function createAppleProvider(config: {
                     providerId: decoded.sub,
                     email,
                     displayName,
-                    photoUrl: null // Apple does not provide a profile photo
+                    photoUrl: null, // Apple does not provide a profile photo
+                    emailVerified: decoded.email_verified === true || decoded.email_verified === "true"
                 };
             } catch (error) {
                 logger.error("Apple OAuth error", { error: error });