@solidxai/core 0.1.13-beta.2 → 0.1.13-beta.21

package/dist/seeders/seed-data/solid-core-metadata.json

@@ -1808,6 +1808,8 @@
                         "index": true,
                         "private": false,
                         "encrypt": false,
+                        "regexPattern": "^[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,}$",
+                        "regexPatternNotMatchingErrorMsg": "Please enter a valid email address.",
                         "isSystem": true,
                         "enableAuditTracking": true
                     },
@@ -2358,6 +2360,164 @@
                     }
                 ]
             },
+            {
+                "singularName": "userDeviceCredential",
+                "tableName": "ss_user_device_credential",
+                "pluralName": "userDeviceCredentials",
+                "displayName": "User Device Credential",
+                "description": "Per-device MPIN credentials",
+                "dataSource": "default",
+                "dataSourceType": "postgres",
+                "userKeyFieldUserKey": "credentialKey",
+                "isSystem": true,
+                "fields": [
+                    {
+                        "name": "credentialKey",
+                        "displayName": "Credential Key",
+                        "description": "Natural key: <username>-<deviceId>. Populated by MpinService, not by the computed-field pipeline.",
+                        "type": "shortText",
+                        "length": 512,
+                        "required": true,
+                        "unique": true,
+                        "index": true,
+                        "private": false,
+                        "encrypt": false,
+                        "isUserKey": true,
+                        "isSystem": true
+                    },
+                    {
+                        "name": "hashedCredentialRef",
+                        "displayName": "Hashed Credential Ref",
+                        "type": "shortText",
+                        "length": 512,
+                        "required": true,
+                        "unique": true,
+                        "index": true,
+                        "private": true,
+                        "encrypt": false,
+                        "isSystem": true
+                    },
+                    {
+                        "name": "hashedMpin",
+                        "displayName": "Hashed MPIN",
+                        "type": "shortText",
+                        "length": 512,
+                        "required": true,
+                        "unique": false,
+                        "index": false,
+                        "private": true,
+                        "encrypt": false,
+                        "isSystem": true
+                    },
+                    {
+                        "name": "mpinScheme",
+                        "displayName": "MPIN Scheme",
+                        "type": "selectionStatic",
+                        "required": true,
+                        "private": false,
+                        "encrypt": false,
+                        "isSystem": true,
+                        "selectionStaticValues": [
+                            "bcrypt:bcrypt"
+                        ]
+                    },
+                    {
+                        "name": "mpinSchemeVersion",
+                        "displayName": "MPIN Scheme Version",
+                        "type": "int",
+                        "required": true,
+                        "private": false,
+                        "encrypt": false,
+                        "defaultValue": "1",
+                        "isSystem": true
+                    },
+                    {
+                        "name": "deviceId",
+                        "displayName": "Device Id",
+                        "type": "shortText",
+                        "length": 512,
+                        "required": true,
+                        "unique": false,
+                        "index": true,
+                        "private": false,
+                        "encrypt": false,
+                        "isSystem": true
+                    },
+                    {
+                        "name": "deviceName",
+                        "displayName": "Device Name",
+                        "type": "shortText",
+                        "length": 512,
+                        "required": false,
+                        "unique": false,
+                        "index": false,
+                        "private": false,
+                        "encrypt": false,
+                        "isSystem": true
+                    },
+                    {
+                        "name": "platform",
+                        "displayName": "Platform",
+                        "type": "shortText",
+                        "length": 512,
+                        "required": false,
+                        "unique": false,
+                        "index": false,
+                        "private": false,
+                        "encrypt": false,
+                        "isSystem": true
+                    },
+                    {
+                        "name": "isActive",
+                        "displayName": "Is Active",
+                        "type": "boolean",
+                        "required": true,
+                        "unique": false,
+                        "index": false,
+                        "private": false,
+                        "encrypt": false,
+                        "defaultValue": "true",
+                        "isSystem": true
+                    },
+                    {
+                        "name": "failedAttempts",
+                        "displayName": "Failed Attempts",
+                        "type": "int",
+                        "required": true,
+                        "private": false,
+                        "encrypt": false,
+                        "defaultValue": "0",
+                        "isSystem": true
+                    },
+                    {
+                        "name": "lockedUntil",
+                        "displayName": "Locked Until",
+                        "type": "datetime",
+                        "required": false,
+                        "private": false,
+                        "encrypt": false,
+                        "isSystem": true
+                    },
+                    {
+                        "name": "lastUsedAt",
+                        "displayName": "Last Used At",
+                        "type": "datetime",
+                        "required": false,
+                        "private": false,
+                        "encrypt": false,
+                        "isSystem": true
+                    },
+                    {
+                        "name": "user",
+                        "displayName": "User",
+                        "type": "relation",
+                        "required": true,
+                        "private": false,
+                        "encrypt": false,
+                        "isSystem": true
+                    }
+                ]
+            },
             {
                 "singularName": "userActivityHistory",
                 "tableName": "ss_user_activity_history",
@@ -6141,7 +6301,7 @@
                         "type": "int",
                         "ormType": "integer",
                         "isSystem": false,
-                        "defaultValue": 1,
+                        "defaultValue": "1",
                         "min": null,
                         "max": null,
                         "required": true,
@@ -6162,7 +6322,7 @@
                         "type": "int",
                         "ormType": "integer",
                         "isSystem": false,
-                        "defaultValue": 0,
+                        "defaultValue": "0",
                         "min": null,
                         "max": null,
                         "required": false,
@@ -7367,7 +7527,7 @@
                         "type": "boolean",
                         "ormType": "boolean",
                         "isSystem": false,
-                        "defaultValue": false,
+                        "defaultValue": "false",
                         "required": false,
                         "unique": false,
                         "index": true,
@@ -7850,6 +8010,8 @@
                 "FieldMetadataController.getSelectionDynamicValues",
                 "FieldMetadataController.getSelectionDynamicValue",
                 "FieldMetadataController.findFieldDefaultMetaData",
+                "MediaController.create",
+                "MediaController.upload",
                 "MediaController.findMany",
                 "MediaController.findOne",
                 "MediaController.download",
@@ -7868,6 +8030,7 @@
                 "ChatterMessageController.findMany",
                 "ChatterMessageController.markCompleted",
                 "ChatterMessageController.updateCustomNoteMessage",
+                "ChatterMessageController.getMentionableUsers",
                 "ListOfValuesController.findMany",
                 "ListOfValuesController.findOne",
                 "SettingController.getAllSettings",
@@ -8089,6 +8252,19 @@
             "moduleUserKey": "solid-core",
             "modelUserKey": "media"
         },
+        {
+            "displayName": "Media Upload Action",
+            "name": "media-upload-action",
+            "type": "custom",
+            "domain": "",
+            "context": "",
+            "customComponent": "/admin/core/solid-core/media/upload",
+            "customIsModal": false,
+            "serverEndpoint": "",
+            "viewUserKey": "media-list-view",
+            "moduleUserKey": "solid-core",
+            "modelUserKey": "media"
+        },
         {
             "displayName": "Solid Media Storage Provider Model List Action",
             "name": "mediaStorageProviderMetadata-list-action",
@@ -8681,16 +8857,42 @@
         {
             "displayName": "Workflow Definitions",
             "name": "workflowDefinition-list-action",
-            "type": "custom",
+            "type": "solid",
             "domain": "",
             "context": "",
-            "customComponent": "/admin/core/solid-core/workflow-definition/list",
+            "customComponent": "",
             "customIsModal": true,
             "serverEndpoint": "",
             "viewUserKey": "workflowDefinition-list-view",
             "moduleUserKey": "solid-core",
             "modelUserKey": "workflowDefinition"
         },
+        {
+            "displayName": "New Workflow Definition",
+            "name": "workflowDefinition-create-action",
+            "type": "custom",
+            "domain": "",
+            "context": "{}",
+            "customComponent": "/admin/core/solid-core/workflow-definition/editor/new",
+            "customIsModal": false,
+            "serverEndpoint": "",
+            "viewUserKey": "workflowDefinition-list-view",
+            "moduleUserKey": "solid-core",
+            "modelUserKey": "workflowDefinition"
+        },
+        {
+            "displayName": "Workflow Definition Editor",
+            "name": "workflowDefinition-editor-action",
+            "type": "custom",
+            "domain": "",
+            "context": "{}",
+            "customComponent": "/admin/core/solid-core/workflow-definition/editor",
+            "customIsModal": false,
+            "serverEndpoint": "",
+            "viewUserKey": "workflowDefinition-list-view",
+            "moduleUserKey": "solid-core",
+            "modelUserKey": "workflowDefinition"
+        },
         {
             "displayName": "Workflow Execution List Action",
             "name": "workflowExecution-list-action",
@@ -10407,7 +10609,8 @@
                         "attrs": {
                             "name": "user",
                             "isSearchable": true,
-                            "searchField": "user.fullName"
+                            "searchField": "user.fullName",
+                            "coModelFieldToDisplay": "fullName"
                         }
                     }
                 ]
@@ -10491,7 +10694,8 @@
                                                     {
                                                         "type": "field",
                                                         "attrs": {
-                                                            "name": "user"
+                                                            "name": "user",
+                                                            "coModelFieldToDisplay": "fullName"
                                                         }
                                                     },
                                                     {
@@ -11536,7 +11740,8 @@
                         50
                     ],
                     "enableGlobalSearch": true,
-                    "create": false,
+                    "create": true,
+                    "createAction": "media-upload-action",
                     "edit": false,
                     "delete": true,
                     "allowedViews": [
@@ -11574,6 +11779,15 @@
                             "sortable": false
                         }
                     },
+                    {
+                        "type": "field",
+                        "attrs": {
+                            "name": "relativeUri",
+                            "viewWidget": "MediaRelativeUriListWidget",
+                            "isSearchable": true,
+                            "sortable": false
+                        }
+                    },
                     {
                         "type": "field",
                         "attrs": {
@@ -11586,7 +11800,8 @@
                         "type": "field",
                         "attrs": {
                             "name": "fileSize",
-                            "sortable": true
+                            "sortable": true,
+                            "viewWidget": "MediaFileSizeListWidget"
                         }
                     }
                 ]
@@ -11730,7 +11945,8 @@
                                     {
                                         "type": "field",
                                         "attrs": {
-                                            "name": "relativeUri"
+                                            "name": "relativeUri",
+                                            "viewWidget": "MediaRelativeUriFormViewWidget"
                                         }
                                     },
                                     {
@@ -11750,6 +11966,13 @@
                                         "attrs": {
                                             "name": "fieldMetadata"
                                         }
+                                    },
+                                    {
+                                        "type": "field",
+                                        "attrs": {
+                                            "name": "fileSize",
+                                            "viewWidget": "MediaFileSizeFormViewWidget"
+                                        }
                                     }
                                 ]
                             }
@@ -12526,7 +12749,7 @@
                         50
                     ],
                     "enableGlobalSearch": true,
-                    "create": true,
+                    "create": false,
                     "edit": true,
                     "delete": true,
                     "import": true,
@@ -14829,7 +15052,8 @@
                             "name": "user",
                             "label": "User",
                             "isSearchable": true,
-                            "searchField": "user.fullName"
+                            "searchField": "user.fullName",
+                            "coModelFieldToDisplay": "fullName"
                         }
                     },
                     {
@@ -17051,7 +17275,8 @@
                             "name": "user",
                             "label": "User",
                             "isSearchable": true,
-                            "searchField": "user.fullName"
+                            "searchField": "user.fullName",
+                            "coModelFieldToDisplay": "fullName"
                         }
                     }
                 ]
@@ -17260,97 +17485,71 @@
                     ],
                     "enableGlobalSearch": true,
                     "create": true,
+                    "createAction": "workflowDefinition-create-action",
                     "edit": true,
+                    "editAction": "workflowDefinition-editor-action",
                     "delete": true,
-                    "headerButtons": [
-                        {
-                            "attrs": {
-                                "label": "Open Workflow Editor",
-                                "action": "openWorkflowDefinitionEditorHeaderAction",
-                                "actionInContextMenu": false,
-                                "openInPopup": false,
-                                "icon": "si-sparkles"
-                            }
-                        }
-                    ],
-                    "rowButtons": [
-                        {
-                            "attrs": {
-                                "className": "p-button-text",
-                                "icon": "si-pencil",
-                                "label": "Open Editor",
-                                "action": "openWorkflowDefinitionEditorRowAction",
-                                "openInPopup": false,
-                                "actionInContextMenu": true
-                            }
-                        }
-                    ]
+                    "showRowActionsAsIconOnly": true,
+                    "showRowActionsInContextMenu": false
                 },
                 "children": [
                     {
                         "type": "field",
                         "attrs": {
-                            "name": "id"
-                        }
-                    },
-                    {
-                        "type": "field",
-                        "attrs": {
-                            "name": "key"
-                        }
-                    },
-                    {
-                        "type": "field",
-                        "attrs": {
-                            "name": "moduleMetadata"
-                        }
-                    },
-                    {
-                        "type": "field",
-                        "attrs": {
-                            "name": "displayName"
-                        }
-                    },
-                    {
-                        "type": "field",
-                        "attrs": {
-                            "name": "namespace"
-                        }
-                    },
-                    {
-                        "type": "field",
-                        "attrs": {
-                            "name": "description"
+                            "name": "key",
+                            "className": "font-bold",
+                            "sortable": true,
+                            "isSearchable": true,
+                            "truncateAfter": 28
                         }
                     },
                     {
                         "type": "field",
                         "attrs": {
-                            "name": "status"
+                            "name": "displayName",
+                            "className": "font-bold",
+                            "sortable": true,
+                            "isSearchable": true,
+                            "truncateAfter": 32
                         }
                     },
                     {
                         "type": "field",
                         "attrs": {
-                            "name": "definitionVersion"
+                            "name": "namespace",
+                            "sortable": true,
+                            "isSearchable": true,
+                            "truncateAfter": 28
                         }
                     },
                     {
                         "type": "field",
                         "attrs": {
-                            "name": "definitionChecksum"
+                            "name": "description",
+                            "isSearchable": true,
+                            "truncateAfter": 56
                         }
                     },
                     {
                         "type": "field",
                         "attrs": {
-                            "name": "definitionYaml"
+                            "name": "status",
+                            "sortable": true,
+                            "viewWidget": "PillWidget",
+                            "pillColorMap": {
+                                "draft": "#e5e7eb",
+                                "active": "#dcfce7",
+                                "inactive": "#fef3c7",
+                                "archived": "#ede9fe",
+                                "default": "#e5e7eb"
+                            }
                         }
                     },
                     {
                         "type": "field",
                         "attrs": {
-                            "name": "tags"
+                            "name": "definitionVersion",
+                            "sortable": true
                         }
                     }
                 ]
@@ -17518,7 +17717,7 @@
                         50
                     ],
                     "enableGlobalSearch": true,
-                    "create": true,
+                    "create": false,
                     "edit": true,
                     "editAction": "workflowExecution-detail-action",
                     "delete": true,
@@ -17539,8 +17738,10 @@
                         "type": "field",
                         "attrs": {
                             "name": "executionIdentifier",
+                            "className": "font-bold",
                             "sortable": true,
-                            "isSearchable": true
+                            "isSearchable": true,
+                            "truncateAfter": 28
                         }
                     },
                     {
@@ -17549,7 +17750,8 @@
                             "name": "workflowDefinition",
                             "sortable": true,
                             "isSearchable": true,
-                            "searchField": "workflowDefinition.displayName"
+                            "searchField": "workflowDefinition.displayName",
+                            "truncateAfter": 30
                         }
                     },
                     {
@@ -17558,7 +17760,8 @@
                             "name": "workflowDisplayName",
                             "className": "font-bold",
                             "sortable": true,
-                            "isSearchable": true
+                            "isSearchable": true,
+                            "truncateAfter": 32
                         }
                     },
                     {
@@ -17583,7 +17786,15 @@
                         "attrs": {
                             "name": "triggerType",
                             "sortable": true,
-                            "isSearchable": true
+                            "isSearchable": true,
+                            "viewWidget": "PillWidget",
+                            "pillColorMap": {
+                                "manual": "#ede9fe",
+                                "schedule": "#e0f2fe",
+                                "webhook": "#ccfbf1",
+                                "api": "#dbeafe",
+                                "default": "#e5e7eb"
+                            }
                         }
                     },
                     {
@@ -17611,7 +17822,8 @@
                         "type": "field",
                         "attrs": {
                             "name": "errorSummary",
-                            "isSearchable": true
+                            "isSearchable": true,
+                            "truncateAfter": 56
                         }
                     }
                 ]

package/dist/services/api-key.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-key.service.d.ts","sourceRoot":"","sources":["../../src/services/api-key.service.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAE9D,OAAO,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAC9E,OAAO,EAAE,yBAAyB,EAAE,MAAM,0CAA0C,CAAC;AACrF,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAEhE,qBACa,aAAa;IAIlB,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,yBAAyB;IAC1C,OAAO,CAAC,QAAQ,CAAC,qBAAqB;IACtC,OAAO,CAAC,QAAQ,CAAC,cAAc;IANnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkC;gBAGpC,gBAAgB,EAAE,oBAAoB,EACtC,yBAAyB,EAAE,yBAAyB,EACpD,qBAAqB,EAAE,qBAAqB,EAC5C,cAAc,EAAE,cAAc;IAG7C,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,UAAU,CAAA;KAAE,CAAC;IA+B/F,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAkCjD,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IAkB1E,QAAQ,CAAC,MAAM,EAAE,MAAM;;;;;;;;;;;;IAoC7B,OAAO,CAAC,IAAI;CAGf"}
+{"version":3,"file":"api-key.service.d.ts","sourceRoot":"","sources":["../../src/services/api-key.service.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAE9D,OAAO,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAC9E,OAAO,EAAE,yBAAyB,EAAE,MAAM,0CAA0C,CAAC;AACrF,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAEhE,qBACa,aAAa;IAIlB,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,yBAAyB;IAC1C,OAAO,CAAC,QAAQ,CAAC,qBAAqB;IACtC,OAAO,CAAC,QAAQ,CAAC,cAAc;IANnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkC;gBAGpC,gBAAgB,EAAE,oBAAoB,EACtC,yBAAyB,EAAE,yBAAyB,EACpD,qBAAqB,EAAE,qBAAqB,EAC5C,cAAc,EAAE,cAAc;IAG7C,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,UAAU,CAAA;KAAE,CAAC;IA+B/F,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAkCjD,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IAkB1E,QAAQ,CAAC,MAAM,EAAE,MAAM;;;;;;;;;;;;IAgD7B,OAAO,CAAC,IAAI;CAGf"}

package/dist/services/api-key.service.js

@@ -106,7 +106,7 @@ let ApiKeyService = ApiKeyService_1 = class ApiKeyService {
             throw new common_1.UnauthorizedException(error_messages_1.ERROR_MESSAGES.INVALID_CREDENTIALS);
         }
         const user = apiKeyRecord.user;
-        const tokens = await this.authenticationService.generateTokens(user);
+        const tokens = await this.authenticationService.generateTokens(user, `apikey-${apiKeyRecord.id}`);
         return {
             user: {
                 email: user.email,

package/dist/services/api-key.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-key.service.js","sourceRoot":"","sources":["../../src/services/api-key.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAMwB;AACxB,mCAAiD;AACjD,gEAA8D;AAG9D,yEAA8D;AAC9D,yDAAgD;AAEhD,mFAA8E;AAC9E,+EAAqF;AACrF,qEAAiE;AACjE,mEAAgE;AAGzD,IAAM,aAAa,qBAAnB,MAAM,aAAa;IAGtB,YACqB,gBAAsC,EACtC,yBAAoD,EACpD,qBAA4C,EAC5C,cAA8B;QAH9B,qBAAgB,GAAhB,gBAAgB,CAAsB;QACtC,8BAAyB,GAAzB,yBAAyB,CAA2B;QACpD,0BAAqB,GAArB,qBAAqB,CAAuB;QAC5C,mBAAc,GAAd,cAAc,CAAgB;QANlC,WAAM,GAAG,IAAI,eAAM,CAAC,eAAa,CAAC,IAAI,CAAC,CAAC;IAOrD,CAAC;IAEL,KAAK,CAAC,QAAQ,CAAC,MAAc,EAAE,GAAoB;QAC/C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,kBAAI,EAAE;YAC3D,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;YACrB,MAAM,EAAE,CAAC,IAAI,EAAE,4BAA4B,CAAC;SAC/C,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,EAAE,0BAA0B,EAAE,CAAC;YACpC,MAAM,IAAI,2BAAkB,CAAC,0CAA0C,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACzD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,SAAS,GAAG,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAEjD,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC;YACxC,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,SAAS;YACT,SAAS;YACT,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI;YACzD,IAAI;SACP,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAGzC,OAAQ,MAAc,CAAC,SAAS,CAAC;QAEjC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,MAAc;QACzB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAGpC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC;YAClD,KAAK,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE;YACpC,SAAS,EAAE,CAAC,MAAM,EAAE,YAAY,CAAC;SACpC,CAAC,CAAC;QAEH,IAAI,CAAC,SAAS,EAAE,CAAC;YACb,MAAM,IAAI,8BAAqB,EAAE,CAAC;QACtC,CAAC;QAED,IAAI,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YAC1D,MAAM,IAAI,8BAAqB,CAAC,iBAAiB,CAAC,CAAC;QACvD,CAAC;QAGD,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACjF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uCAAuC,SAAS,CAAC,EAAE,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5F,CAAC,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC9D,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAElF,OAAO;YACH,GAAG,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE;YACtB,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,QAAQ;YACjC,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC,KAAK;YAC3B,KAAK;YACL,WAAW,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SAC9C,CAAC;IACN,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,EAAU,EAAE,MAAc,EAAE,GAAoB;QAC5D,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC;YAClD,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE;SACtC,CAAC,CAAC;QAEH,IAAI,CAAC,SAAS,EAAE,CAAC;YACb,MAAM,IAAI,0BAAiB,CAAC,mBAAmB,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO;aAC9B,kBAAkB,EAAE;aACpB,MAAM,CAAC,gCAAU,CAAC;aAClB,GAAG,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;aAC/B,KAAK,CAAC,UAAU,EAAE,EAAE,EAAE,EAAE,CAAC;aACzB,OAAO,EAAE,CAAC;IACnB,CAAC;IAGD,KAAK,CAAC,QAAQ,CAAC,MAAc;QAEzB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC;YACrD,KAAK,EAAE;gBACH,SAAS,EAAE,QAAQ;aACtB;YACD,SAAS,EAAE;gBACP,IAAI,EAAE;oBACF,KAAK,EAAE,IAAI;iBACd;aACJ;SACJ,CAAC,CAAC;QAEH,IAAI,CAAC,YAAY,EAAE,CAAC;YAChB,MAAM,IAAI,8BAAqB,CAAC,+BAAc,CAAC,mBAAmB,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC;QAE/B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAGrE,OAAO;YACH,IAAI,EAAE;gBACF,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;gBAC7C,EAAE,EAAE,IAAI,CAAC,EAAE;gBACX,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;aAC7C;YACD,GAAG,MAAM;SACZ,CAAA;IACL,CAAC;IAEO,IAAI,CAAC,MAAc;QACvB,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7D,CAAC;CACJ,CAAA;AApIY,sCAAa;wBAAb,aAAa;IADzB,IAAA,mBAAU,GAAE;qCAK8B,8CAAoB;QACX,uDAAyB;QAC7B,8CAAqB;QAC5B,gCAAc;GAP1C,aAAa,CAoIzB","sourcesContent":["import {\n    ForbiddenException,\n    Injectable,\n    Logger,\n    NotFoundException,\n    UnauthorizedException,\n} from '@nestjs/common';\nimport { createHash, randomBytes } from 'crypto';\nimport { ERROR_MESSAGES } from 'src/constants/error-messages';\nimport { CreateApiKeyDto } from 'src/dtos/create-api-key.dto';\nimport { UpdateApiKeyDto } from 'src/dtos/update-api-key.dto';\nimport { UserApiKey } from 'src/entities/user-api-key.entity';\nimport { User } from 'src/entities/user.entity';\nimport { ActiveUserData } from 'src/interfaces/active-user-data.interface';\nimport { UserApiKeyRepository } from 'src/repository/user-api-key.repository';\nimport { PermissionMetadataService } from 'src/services/permission-metadata.service';\nimport { AuthenticationService } from './authentication.service';\nimport { UserRepository } from 'src/repository/user.repository';\n\n@Injectable()\nexport class ApiKeyService {\n    private readonly logger = new Logger(ApiKeyService.name);\n\n    constructor(\n        private readonly apiKeyRepository: UserApiKeyRepository,\n        private readonly permissionMetadataService: PermissionMetadataService,\n        private readonly authenticationService: AuthenticationService,\n        private readonly userRepository: UserRepository,\n    ) { }\n\n    async generate(userId: number, dto: CreateApiKeyDto): Promise<{ apiKey: string; record: UserApiKey }> {\n        const user = await this.apiKeyRepository.manager.findOne(User, {\n            where: { id: userId },\n            select: ['id', 'isAllowedToGenerateApiKeys'],\n        });\n\n        if (!user?.isAllowedToGenerateApiKeys) {\n            throw new ForbiddenException('You are not allowed to generate API keys');\n        }\n\n        const rawKey = 'sldx_' + randomBytes(32).toString('hex');\n        const hashedKey = this.hash(rawKey);\n        const maskedKey = 'sldx_****' + rawKey.slice(-4);\n\n        const record = this.apiKeyRepository.create({\n            name: dto.name,\n            hashedKey,\n            maskedKey,\n            isActive: true,\n            expiresAt: dto.expiresAt ? new Date(dto.expiresAt) : null,\n            user,\n        });\n\n        await this.apiKeyRepository.save(record);\n\n        // Strip hashedKey from the returned record — maskedKey is all the UI needs\n        delete (record as any).hashedKey;\n\n        return { apiKey: rawKey, record };\n    }\n\n    async validate(rawKey: string): Promise<ActiveUserData> {\n        const hashedKey = this.hash(rawKey);\n\n        // Bypass security rules for auth validation — must find the key regardless of caller context\n        const keyRecord = await this.apiKeyRepository.findOne({\n            where: { hashedKey, isActive: true },\n            relations: ['user', 'user.roles'],\n        });\n\n        if (!keyRecord) {\n            throw new UnauthorizedException();\n        }\n\n        if (keyRecord.expiresAt && keyRecord.expiresAt < new Date()) {\n            throw new UnauthorizedException('API key expired');\n        }\n\n        // Fire-and-forget — does not need security rule context\n        this.apiKeyRepository.update(keyRecord.id, { lastUsedAt: new Date() }).catch((err) => {\n            this.logger.warn(`Failed to update lastUsedAt for key ${keyRecord.id}: ${err.message}`);\n        });\n\n        const roles = (keyRecord.user.roles ?? []).map((r) => r.name);\n        const permissions = await this.permissionMetadataService.findAllUsingRoles(roles);\n\n        return {\n            sub: keyRecord.user.id,\n            username: keyRecord.user.username,\n            email: keyRecord.user.email,\n            roles,\n            permissions: permissions.map((p) => p.name),\n        };\n    }\n\n    async updateKey(id: number, userId: number, dto: UpdateApiKeyDto): Promise<void> {\n        const keyRecord = await this.apiKeyRepository.findOne({\n            where: { id, user: { id: userId } },\n        });\n\n        if (!keyRecord) {\n            throw new NotFoundException('API key not found');\n        }\n\n        await this.apiKeyRepository.manager\n            .createQueryBuilder()\n            .update(UserApiKey)\n            .set({ isActive: dto.isActive })\n            .where('id = :id', { id })\n            .execute();\n    }\n\n\n    async apiKeyMe(apiKey: string) {\n\n        const hasedKey = this.hash(apiKey);\n        const apiKeyRecord = await this.apiKeyRepository.findOne({\n            where: {\n                hashedKey: hasedKey,\n            },\n            relations: {\n                user: {\n                    roles: true\n                }\n            }\n        });\n\n        if (!apiKeyRecord) {\n            throw new UnauthorizedException(ERROR_MESSAGES.INVALID_CREDENTIALS);\n        }\n\n        const user = apiKeyRecord.user;\n\n        const tokens = await this.authenticationService.generateTokens(user);\n\n\n        return {\n            user: {\n                email: user.email,\n                mobile: user.mobile,\n                username: user.username,\n                forcePasswordChange: user.forcePasswordChange,\n                id: user.id,\n                roles: user.roles.map((role) => role.name)\n            },\n            ...tokens\n        }\n    }\n\n    private hash(rawKey: string): string {\n        return createHash('sha256').update(rawKey).digest('hex');\n    }\n}\n"]}
+{"version":3,"file":"api-key.service.js","sourceRoot":"","sources":["../../src/services/api-key.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAMwB;AACxB,mCAAiD;AACjD,gEAA8D;AAG9D,yEAA8D;AAC9D,yDAAgD;AAEhD,mFAA8E;AAC9E,+EAAqF;AACrF,qEAAiE;AACjE,mEAAgE;AAGzD,IAAM,aAAa,qBAAnB,MAAM,aAAa;IAGtB,YACqB,gBAAsC,EACtC,yBAAoD,EACpD,qBAA4C,EAC5C,cAA8B;QAH9B,qBAAgB,GAAhB,gBAAgB,CAAsB;QACtC,8BAAyB,GAAzB,yBAAyB,CAA2B;QACpD,0BAAqB,GAArB,qBAAqB,CAAuB;QAC5C,mBAAc,GAAd,cAAc,CAAgB;QANlC,WAAM,GAAG,IAAI,eAAM,CAAC,eAAa,CAAC,IAAI,CAAC,CAAC;IAOrD,CAAC;IAEL,KAAK,CAAC,QAAQ,CAAC,MAAc,EAAE,GAAoB;QAC/C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,kBAAI,EAAE;YAC3D,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;YACrB,MAAM,EAAE,CAAC,IAAI,EAAE,4BAA4B,CAAC;SAC/C,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,EAAE,0BAA0B,EAAE,CAAC;YACpC,MAAM,IAAI,2BAAkB,CAAC,0CAA0C,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACzD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,SAAS,GAAG,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAEjD,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC;YACxC,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,SAAS;YACT,SAAS;YACT,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI;YACzD,IAAI;SACP,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAGzC,OAAQ,MAAc,CAAC,SAAS,CAAC;QAEjC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,MAAc;QACzB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAGpC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC;YAClD,KAAK,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE;YACpC,SAAS,EAAE,CAAC,MAAM,EAAE,YAAY,CAAC;SACpC,CAAC,CAAC;QAEH,IAAI,CAAC,SAAS,EAAE,CAAC;YACb,MAAM,IAAI,8BAAqB,EAAE,CAAC;QACtC,CAAC;QAED,IAAI,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YAC1D,MAAM,IAAI,8BAAqB,CAAC,iBAAiB,CAAC,CAAC;QACvD,CAAC;QAGD,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACjF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uCAAuC,SAAS,CAAC,EAAE,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5F,CAAC,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC9D,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAElF,OAAO;YACH,GAAG,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE;YACtB,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,QAAQ;YACjC,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC,KAAK;YAC3B,KAAK;YACL,WAAW,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SAC9C,CAAC;IACN,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,EAAU,EAAE,MAAc,EAAE,GAAoB;QAC5D,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC;YAClD,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE;SACtC,CAAC,CAAC;QAEH,IAAI,CAAC,SAAS,EAAE,CAAC;YACb,MAAM,IAAI,0BAAiB,CAAC,mBAAmB,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO;aAC9B,kBAAkB,EAAE;aACpB,MAAM,CAAC,gCAAU,CAAC;aAClB,GAAG,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;aAC/B,KAAK,CAAC,UAAU,EAAE,EAAE,EAAE,EAAE,CAAC;aACzB,OAAO,EAAE,CAAC;IACnB,CAAC;IAGD,KAAK,CAAC,QAAQ,CAAC,MAAc;QAEzB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC;YACrD,KAAK,EAAE;gBACH,SAAS,EAAE,QAAQ;aACtB;YACD,SAAS,EAAE;gBACP,IAAI,EAAE;oBACF,KAAK,EAAE,IAAI;iBACd;aACJ;SACJ,CAAC,CAAC;QAEH,IAAI,CAAC,YAAY,EAAE,CAAC;YAChB,MAAM,IAAI,8BAAqB,CAAC,+BAAc,CAAC,mBAAmB,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC;QAW/B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,cAAc,CAC1D,IAAI,EACJ,UAAU,YAAY,CAAC,EAAE,EAAE,CAC9B,CAAC;QAGF,OAAO;YACH,IAAI,EAAE;gBACF,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;gBAC7C,EAAE,EAAE,IAAI,CAAC,EAAE;gBACX,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;aAC7C;YACD,GAAG,MAAM;SACZ,CAAA;IACL,CAAC;IAEO,IAAI,CAAC,MAAc;QACvB,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7D,CAAC;CACJ,CAAA;AAhJY,sCAAa;wBAAb,aAAa;IADzB,IAAA,mBAAU,GAAE;qCAK8B,8CAAoB;QACX,uDAAyB;QAC7B,8CAAqB;QAC5B,gCAAc;GAP1C,aAAa,CAgJzB","sourcesContent":["import {\n    ForbiddenException,\n    Injectable,\n    Logger,\n    NotFoundException,\n    UnauthorizedException,\n} from '@nestjs/common';\nimport { createHash, randomBytes } from 'crypto';\nimport { ERROR_MESSAGES } from 'src/constants/error-messages';\nimport { CreateApiKeyDto } from 'src/dtos/create-api-key.dto';\nimport { UpdateApiKeyDto } from 'src/dtos/update-api-key.dto';\nimport { UserApiKey } from 'src/entities/user-api-key.entity';\nimport { User } from 'src/entities/user.entity';\nimport { ActiveUserData } from 'src/interfaces/active-user-data.interface';\nimport { UserApiKeyRepository } from 'src/repository/user-api-key.repository';\nimport { PermissionMetadataService } from 'src/services/permission-metadata.service';\nimport { AuthenticationService } from './authentication.service';\nimport { UserRepository } from 'src/repository/user.repository';\n\n@Injectable()\nexport class ApiKeyService {\n    private readonly logger = new Logger(ApiKeyService.name);\n\n    constructor(\n        private readonly apiKeyRepository: UserApiKeyRepository,\n        private readonly permissionMetadataService: PermissionMetadataService,\n        private readonly authenticationService: AuthenticationService,\n        private readonly userRepository: UserRepository,\n    ) { }\n\n    async generate(userId: number, dto: CreateApiKeyDto): Promise<{ apiKey: string; record: UserApiKey }> {\n        const user = await this.apiKeyRepository.manager.findOne(User, {\n            where: { id: userId },\n            select: ['id', 'isAllowedToGenerateApiKeys'],\n        });\n\n        if (!user?.isAllowedToGenerateApiKeys) {\n            throw new ForbiddenException('You are not allowed to generate API keys');\n        }\n\n        const rawKey = 'sldx_' + randomBytes(32).toString('hex');\n        const hashedKey = this.hash(rawKey);\n        const maskedKey = 'sldx_****' + rawKey.slice(-4);\n\n        const record = this.apiKeyRepository.create({\n            name: dto.name,\n            hashedKey,\n            maskedKey,\n            isActive: true,\n            expiresAt: dto.expiresAt ? new Date(dto.expiresAt) : null,\n            user,\n        });\n\n        await this.apiKeyRepository.save(record);\n\n        // Strip hashedKey from the returned record — maskedKey is all the UI needs\n        delete (record as any).hashedKey;\n\n        return { apiKey: rawKey, record };\n    }\n\n    async validate(rawKey: string): Promise<ActiveUserData> {\n        const hashedKey = this.hash(rawKey);\n\n        // Bypass security rules for auth validation — must find the key regardless of caller context\n        const keyRecord = await this.apiKeyRepository.findOne({\n            where: { hashedKey, isActive: true },\n            relations: ['user', 'user.roles'],\n        });\n\n        if (!keyRecord) {\n            throw new UnauthorizedException();\n        }\n\n        if (keyRecord.expiresAt && keyRecord.expiresAt < new Date()) {\n            throw new UnauthorizedException('API key expired');\n        }\n\n        // Fire-and-forget — does not need security rule context\n        this.apiKeyRepository.update(keyRecord.id, { lastUsedAt: new Date() }).catch((err) => {\n            this.logger.warn(`Failed to update lastUsedAt for key ${keyRecord.id}: ${err.message}`);\n        });\n\n        const roles = (keyRecord.user.roles ?? []).map((r) => r.name);\n        const permissions = await this.permissionMetadataService.findAllUsingRoles(roles);\n\n        return {\n            sub: keyRecord.user.id,\n            username: keyRecord.user.username,\n            email: keyRecord.user.email,\n            roles,\n            permissions: permissions.map((p) => p.name),\n        };\n    }\n\n    async updateKey(id: number, userId: number, dto: UpdateApiKeyDto): Promise<void> {\n        const keyRecord = await this.apiKeyRepository.findOne({\n            where: { id, user: { id: userId } },\n        });\n\n        if (!keyRecord) {\n            throw new NotFoundException('API key not found');\n        }\n\n        await this.apiKeyRepository.manager\n            .createQueryBuilder()\n            .update(UserApiKey)\n            .set({ isActive: dto.isActive })\n            .where('id = :id', { id })\n            .execute();\n    }\n\n\n    async apiKeyMe(apiKey: string) {\n\n        const hasedKey = this.hash(apiKey);\n        const apiKeyRecord = await this.apiKeyRepository.findOne({\n            where: {\n                hashedKey: hasedKey,\n            },\n            relations: {\n                user: {\n                    roles: true\n                }\n            }\n        });\n\n        if (!apiKeyRecord) {\n            throw new UnauthorizedException(ERROR_MESSAGES.INVALID_CREDENTIALS);\n        }\n\n        const user = apiKeyRecord.user;\n\n        // Keyed on the API key record so every call for this key reuses one\n        // refresh-token bucket. Without it each call mints a fresh key and\n        // therefore a new bucket with a refreshTokenTtl lifetime - a client\n        // polling this endpoint would accumulate them without bound.\n        //\n        // The consequence is that replicas sharing one API key share one\n        // bucket and invalidate each other, which is exactly the behaviour\n        // before per-device sessions existed, and is benign here: an API key\n        // is a permanent credential, so a failed refresh just re-mints.\n        const tokens = await this.authenticationService.generateTokens(\n            user,\n            `apikey-${apiKeyRecord.id}`,\n        );\n\n\n        return {\n            user: {\n                email: user.email,\n                mobile: user.mobile,\n                username: user.username,\n                forcePasswordChange: user.forcePasswordChange,\n                id: user.id,\n                roles: user.roles.map((role) => role.name)\n            },\n            ...tokens\n        }\n    }\n\n    private hash(rawKey: string): string {\n        return createHash('sha256').update(rawKey).digest('hex');\n    }\n}\n"]}