@stratum-hq/control-plane 0.4.0 → 1.0.0

package/dist/middleware/authorize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../src/middleware/authorize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAwCvD,wBAAgB,yBAAyB,KAErC,SAAS,cAAc,EACvB,OAAO,YAAY,KAClB,OAAO,CAAC,IAAI,CAAC,CAsBjB"}
+{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../src/middleware/authorize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAwCvD,wBAAgB,yBAAyB,KAErC,SAAS,cAAc,EACvB,OAAO,YAAY,KAClB,OAAO,CAAC,IAAI,CAAC,CAwBjB"}

package/dist/middleware/authorize.js

@@ -48,7 +48,9 @@ function createAuthorizeMiddleware() {
         }
         const requiredScope = getRequiredScope(request.method, request.url);
         const scopes = request.apiKey.scopes ?? ["read"];
-        if (!scopes.includes(requiredScope)) {
+        // Hierarchical scopes: admin implies write implies read. A granted scope
+        // satisfies any required scope of equal-or-lower rank.
+        if (!(0, core_1.scopeSatisfies)(scopes, requiredScope)) {
             throw new core_1.ForbiddenError("Insufficient permissions for this operation");
         }
     };

package/dist/middleware/authorize.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorize.js","sourceRoot":"","sources":["../../src/middleware/authorize.ts"],"names":[],"mappings":";;AAwCA,8DA0BC;AAjED,2CAAqE;AAIrE,SAAS,aAAa,CAAC,MAAc;IACnC,QAAQ,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;QAC7B,KAAK,KAAK,CAAC;QACX,KAAK,MAAM,CAAC;QACZ,KAAK,SAAS;YACZ,OAAO,MAAM,CAAC;QAChB;YACE,OAAO,OAAO,CAAC;IACnB,CAAC;AACH,CAAC;AAED,0DAA0D;AAC1D,MAAM,YAAY,GAAG;IACnB,sBAAsB;IACtB,wBAAwB;IACxB,yBAAyB;IACzB,qBAAqB;IACrB,oCAAoC;IACpC,qCAAqC;IACrC,6CAA6C;IAC7C,sCAAsC;CACvC,CAAC;AAEF,SAAS,gBAAgB,CAAC,MAAc,EAAE,GAAW;IACnD,yEAAyE;IACzE,yDAAyD;IACzD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;QACnC,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,SAAgB,yBAAyB;IACvC,OAAO,KAAK,UAAU,mBAAmB,CACvC,OAAuB,EACvB,KAAmB;QAEnB,8CAA8C;QAC9C,IACE,OAAO,CAAC,GAAG,KAAK,gBAAgB;YAChC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,iBAAiB,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,EACnC,CAAC;YACD,OAAO;QACT,CAAC;QAED,mEAAmE;QACnE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,MAAM,IAAI,wBAAiB,CAAC,yBAAyB,CAAC,CAAC;QACzD,CAAC;QAED,MAAM,aAAa,GAAG,gBAAgB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC;QAEjD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,qBAAc,CAAC,6CAA6C,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"authorize.js","sourceRoot":"","sources":["../../src/middleware/authorize.ts"],"names":[],"mappings":";;AAwCA,8DA4BC;AAnED,2CAAqF;AAIrF,SAAS,aAAa,CAAC,MAAc;IACnC,QAAQ,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;QAC7B,KAAK,KAAK,CAAC;QACX,KAAK,MAAM,CAAC;QACZ,KAAK,SAAS;YACZ,OAAO,MAAM,CAAC;QAChB;YACE,OAAO,OAAO,CAAC;IACnB,CAAC;AACH,CAAC;AAED,0DAA0D;AAC1D,MAAM,YAAY,GAAG;IACnB,sBAAsB;IACtB,wBAAwB;IACxB,yBAAyB;IACzB,qBAAqB;IACrB,oCAAoC;IACpC,qCAAqC;IACrC,6CAA6C;IAC7C,sCAAsC;CACvC,CAAC;AAEF,SAAS,gBAAgB,CAAC,MAAc,EAAE,GAAW;IACnD,yEAAyE;IACzE,yDAAyD;IACzD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;QACnC,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,SAAgB,yBAAyB;IACvC,OAAO,KAAK,UAAU,mBAAmB,CACvC,OAAuB,EACvB,KAAmB;QAEnB,8CAA8C;QAC9C,IACE,OAAO,CAAC,GAAG,KAAK,gBAAgB;YAChC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,iBAAiB,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,EACnC,CAAC;YACD,OAAO;QACT,CAAC;QAED,mEAAmE;QACnE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,MAAM,IAAI,wBAAiB,CAAC,yBAAyB,CAAC,CAAC;QACzD,CAAC;QAED,MAAM,aAAa,GAAG,gBAAgB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC;QAEjD,yEAAyE;QACzE,uDAAuD;QACvD,IAAI,CAAC,IAAA,qBAAc,EAAC,MAAM,EAAE,aAAa,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,qBAAc,CAAC,6CAA6C,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stratum-hq/control-plane",
-  "version": "0.4.0",
+  "version": "1.0.0",
   "description": "Stratum control plane REST API server",
   "keywords": [
     "multi-tenancy",
@@ -17,6 +17,12 @@
   ],
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
   "files": [
     "dist",
     "README.md",
@@ -59,6 +65,13 @@
     "typescript": "^5.4.0",
     "vitest": "^1.6.0"
   },
+  "license": "MIT",
+  "author": "Christian Crank",
+  "homepage": "https://github.com/stratum-hq/Stratum/tree/main/packages/control-plane#readme",
+  "bugs": "https://github.com/stratum-hq/Stratum/issues",
+  "engines": {
+    "node": ">=20.0.0"
+  },
   "repository": {
     "type": "git",
     "url": "https://github.com/stratum-hq/Stratum.git",

package/dist/__tests__/admin-scope-query-string.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=admin-scope-query-string.test.d.ts.map

package/dist/__tests__/admin-scope-query-string.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"admin-scope-query-string.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/admin-scope-query-string.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/admin-scope-query-string.test.js

@@ -1,69 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-const vitest_1 = require("vitest");
-const test_helpers_js_1 = require("./test-helpers.js");
-/**
- * Admin-scope enforcement must depend on the resolved request PATH only, not on
- * the raw URL. A query string appended to an admin-only route must not change
- * which scope the route requires.
- */
-(0, vitest_1.describe)("admin scope is enforced independent of the query string", () => {
-    let app;
-    let stratum;
-    const id = test_helpers_js_1.SAMPLE_TENANT.id;
-    (0, vitest_1.beforeEach)(async () => {
-        stratum = (0, test_helpers_js_1.createMockStratum)();
-        stratum.getTenant.mockResolvedValue(test_helpers_js_1.SAMPLE_TENANT);
-        stratum.purgeTenant.mockResolvedValue(undefined);
-        // getTenantContext is not stubbed by the shared helper; add it locally.
-        stratum.getTenantContext = vitest_1.vi
-            .fn()
-            .mockResolvedValue({ tenant: test_helpers_js_1.SAMPLE_TENANT });
-        app = await (0, test_helpers_js_1.buildTestApp)(stratum);
-    });
-    (0, vitest_1.afterEach)(async () => {
-        await app.close();
-    });
-    (0, vitest_1.it)("write-scope key is refused on an admin route (baseline, no query string)", async () => {
-        (0, test_helpers_js_1.setupWriteApiKey)(stratum);
-        const res = await app.inject({
-            method: "POST",
-            url: `/api/v1/tenants/${id}/purge`,
-            headers: (0, test_helpers_js_1.authHeaders)(),
-        });
-        (0, vitest_1.expect)(res.statusCode).toBe(403);
-        (0, vitest_1.expect)(stratum.purgeTenant).not.toHaveBeenCalled();
-    });
-    (0, vitest_1.it)("write-scope key stays refused on an admin route carrying a query string", async () => {
-        (0, test_helpers_js_1.setupWriteApiKey)(stratum);
-        const res = await app.inject({
-            method: "POST",
-            url: `/api/v1/tenants/${id}/purge?probe=1`,
-            headers: (0, test_helpers_js_1.authHeaders)(),
-        });
-        (0, vitest_1.expect)(res.statusCode).toBe(403);
-        (0, vitest_1.expect)(stratum.purgeTenant).not.toHaveBeenCalled();
-    });
-    (0, vitest_1.it)("read-scope key stays refused on an admin GET route carrying a query string", async () => {
-        (0, test_helpers_js_1.setupReadOnlyApiKey)(stratum);
-        const res = await app.inject({
-            method: "GET",
-            url: `/api/v1/tenants/${id}/context?probe=1`,
-            headers: (0, test_helpers_js_1.authHeaders)(),
-        });
-        (0, vitest_1.expect)(res.statusCode).toBe(403);
-        (0, vitest_1.expect)(stratum
-            .getTenantContext).not.toHaveBeenCalled();
-    });
-    (0, vitest_1.it)("admin-scope key is still allowed on an admin route with a query string", async () => {
-        (0, test_helpers_js_1.setupAdminApiKey)(stratum);
-        const res = await app.inject({
-            method: "POST",
-            url: `/api/v1/tenants/${id}/purge?probe=1`,
-            headers: (0, test_helpers_js_1.authHeaders)(),
-        });
-        (0, vitest_1.expect)(res.statusCode).toBe(204);
-        (0, vitest_1.expect)(stratum.purgeTenant).toHaveBeenCalled();
-    });
-});
-//# sourceMappingURL=admin-scope-query-string.test.js.map

package/dist/__tests__/admin-scope-query-string.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"admin-scope-query-string.test.js","sourceRoot":"","sources":["../../src/__tests__/admin-scope-query-string.test.ts"],"names":[],"mappings":";;AAAA,mCAAyE;AAGzE,uDAQ2B;AAE3B;;;;GAIG;AACH,IAAA,iBAAQ,EAAC,yDAAyD,EAAE,GAAG,EAAE;IACvE,IAAI,GAAoB,CAAC;IACzB,IAAI,OAAgB,CAAC;IACrB,MAAM,EAAE,GAAG,+BAAa,CAAC,EAAE,CAAC;IAE5B,IAAA,mBAAU,EAAC,KAAK,IAAI,EAAE;QACpB,OAAO,GAAG,IAAA,mCAAiB,GAAE,CAAC;QAC7B,OAAO,CAAC,SAAsC,CAAC,iBAAiB,CAC/D,+BAAa,CACd,CAAC;QACD,OAAO,CAAC,WAAwC,CAAC,iBAAiB,CACjE,SAAS,CACV,CAAC;QACF,wEAAwE;QACvE,OAA8C,CAAC,gBAAgB,GAAG,WAAE;aAClE,EAAE,EAAE;aACJ,iBAAiB,CAAC,EAAE,MAAM,EAAE,+BAAa,EAAE,CAAC,CAAC;QAChD,GAAG,GAAG,MAAM,IAAA,8BAAY,EAAC,OAAO,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,IAAA,kBAAS,EAAC,KAAK,IAAI,EAAE;QACnB,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,IAAA,kCAAgB,EAAC,OAAO,CAAC,CAAC;QAE1B,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;YAC3B,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,mBAAmB,EAAE,QAAQ;YAClC,OAAO,EAAE,IAAA,6BAAW,GAAE;SACvB,CAAC,CAAC;QAEH,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,IAAA,kCAAgB,EAAC,OAAO,CAAC,CAAC;QAE1B,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;YAC3B,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,mBAAmB,EAAE,gBAAgB;YAC1C,OAAO,EAAE,IAAA,6BAAW,GAAE;SACvB,CAAC,CAAC;QAEH,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,4EAA4E,EAAE,KAAK,IAAI,EAAE;QAC1F,IAAA,qCAAmB,EAAC,OAAO,CAAC,CAAC;QAE7B,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;YAC3B,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,mBAAmB,EAAE,kBAAkB;YAC5C,OAAO,EAAE,IAAA,6BAAW,GAAE;SACvB,CAAC,CAAC;QAEH,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EACH,OAAqE;aACnE,gBAAgB,CACpB,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;QACtF,IAAA,kCAAgB,EAAC,OAAO,CAAC,CAAC;QAE1B,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;YAC3B,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,mBAAmB,EAAE,gBAAgB;YAC1C,OAAO,EAAE,IAAA,6BAAW,GAAE;SACvB,CAAC,CAAC;QAEH,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,WAAW,CAAC,CAAC,gBAAgB,EAAE,CAAC;IACjD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/api-keys.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=api-keys.test.d.ts.map

package/dist/__tests__/api-keys.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"api-keys.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/api-keys.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/api-keys.test.js

@@ -1,240 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-const vitest_1 = require("vitest");
-const test_helpers_js_1 = require("./test-helpers.js");
-(0, vitest_1.describe)("API Key Routes", () => {
-    let app;
-    let stratum;
-    (0, vitest_1.beforeEach)(async () => {
-        stratum = (0, test_helpers_js_1.createMockStratum)();
-        (0, test_helpers_js_1.setupAdminApiKey)(stratum);
-        app = await (0, test_helpers_js_1.buildTestApp)(stratum);
-    });
-    (0, vitest_1.afterEach)(async () => {
-        await app.close();
-    });
-    // ── POST /api/v1/api-keys ──────────────────────────────────────────
-    (0, vitest_1.describe)("POST /api/v1/api-keys", () => {
-        (0, vitest_1.it)("creates a key and returns plaintext once with 201", async () => {
-            const createdKey = {
-                id: "key-uuid-1",
-                tenant_id: "550e8400-e29b-41d4-a716-446655440000",
-                plaintext: "sk_test_abc123def456",
-                name: "My API Key",
-                created_at: new Date().toISOString(),
-            };
-            stratum.createApiKey.mockResolvedValue(createdKey);
-            const response = await app.inject({
-                method: "POST",
-                url: "/api/v1/api-keys",
-                headers: (0, test_helpers_js_1.authHeaders)(),
-                payload: { tenant_id: "550e8400-e29b-41d4-a716-446655440000", name: "My API Key" },
-            });
-            (0, vitest_1.expect)(response.statusCode).toBe(201);
-            const body = response.json();
-            (0, vitest_1.expect)(body.id).toBe("key-uuid-1");
-            (0, vitest_1.expect)(body.plaintext).toBe("sk_test_abc123def456");
-            (0, vitest_1.expect)(stratum.createApiKey).toHaveBeenCalledOnce();
-            (0, vitest_1.expect)(stratum.createApiKey.mock.calls[0][0]).toBe("550e8400-e29b-41d4-a716-446655440000");
-        });
-        (0, vitest_1.it)("returns 400 for missing tenant_id", async () => {
-            const response = await app.inject({
-                method: "POST",
-                url: "/api/v1/api-keys",
-                headers: (0, test_helpers_js_1.authHeaders)(),
-                payload: { name: "No Tenant" },
-            });
-            (0, vitest_1.expect)(response.statusCode).toBe(400);
-            const body = response.json();
-            (0, vitest_1.expect)(body.error.code).toBe("VALIDATION_ERROR");
-        });
-        (0, vitest_1.it)("returns 400 for invalid tenant_id (not UUID)", async () => {
-            const response = await app.inject({
-                method: "POST",
-                url: "/api/v1/api-keys",
-                headers: (0, test_helpers_js_1.authHeaders)(),
-                payload: { tenant_id: "not-a-uuid", name: "Bad ID" },
-            });
-            (0, vitest_1.expect)(response.statusCode).toBe(400);
-        });
-        (0, vitest_1.it)("creates a key with rate limit options", async () => {
-            const createdKey = {
-                id: "key-uuid-2",
-                tenant_id: "550e8400-e29b-41d4-a716-446655440000",
-                plaintext: "sk_test_rate_limited",
-                name: "Rate Limited Key",
-                created_at: new Date().toISOString(),
-            };
-            stratum.createApiKey.mockResolvedValue(createdKey);
-            const response = await app.inject({
-                method: "POST",
-                url: "/api/v1/api-keys",
-                headers: (0, test_helpers_js_1.authHeaders)(),
-                payload: {
-                    tenant_id: "550e8400-e29b-41d4-a716-446655440000",
-                    name: "Rate Limited Key",
-                    rate_limit_max: 500,
-                    rate_limit_window: "1 minute",
-                },
-            });
-            (0, vitest_1.expect)(response.statusCode).toBe(201);
-            (0, vitest_1.expect)(stratum.createApiKey).toHaveBeenCalledWith("550e8400-e29b-41d4-a716-446655440000", {
-                name: "Rate Limited Key",
-                rateLimitMax: 500,
-                rateLimitWindow: "1 minute",
-            });
-        });
-    });
-    // ── GET /api/v1/api-keys ───────────────────────────────────────────
-    (0, vitest_1.describe)("GET /api/v1/api-keys", () => {
-        (0, vitest_1.it)("lists keys without plaintext", async () => {
-            const keys = [
-                {
-                    id: "key-uuid-1",
-                    tenant_id: "550e8400-e29b-41d4-a716-446655440000",
-                    name: "Key 1",
-                    created_at: new Date().toISOString(),
-                    last_used_at: null,
-                    revoked_at: null,
-                    expires_at: null,
-                },
-                {
-                    id: "key-uuid-2",
-                    tenant_id: "550e8400-e29b-41d4-a716-446655440000",
-                    name: "Key 2",
-                    created_at: new Date().toISOString(),
-                    last_used_at: new Date().toISOString(),
-                    revoked_at: null,
-                    expires_at: null,
-                },
-            ];
-            stratum.listApiKeys.mockResolvedValue(keys);
-            const response = await app.inject({
-                method: "GET",
-                url: "/api/v1/api-keys",
-                headers: (0, test_helpers_js_1.authHeaders)(),
-            });
-            (0, vitest_1.expect)(response.statusCode).toBe(200);
-            const body = response.json();
-            (0, vitest_1.expect)(body).toHaveLength(2);
-            // Plaintext should never appear in list response
-            (0, vitest_1.expect)(body[0]).not.toHaveProperty("plaintext");
-            (0, vitest_1.expect)(body[1]).not.toHaveProperty("plaintext");
-            (0, vitest_1.expect)(body[0].id).toBe("key-uuid-1");
-        });
-        (0, vitest_1.it)("lists keys filtered by tenant_id query param", async () => {
-            stratum.listApiKeys.mockResolvedValue([]);
-            const response = await app.inject({
-                method: "GET",
-                url: "/api/v1/api-keys?tenant_id=550e8400-e29b-41d4-a716-446655440000",
-                headers: (0, test_helpers_js_1.authHeaders)(),
-            });
-            (0, vitest_1.expect)(response.statusCode).toBe(200);
-            // The tenant_id is passed through to listApiKeys
-            (0, vitest_1.expect)(stratum.listApiKeys).toHaveBeenCalled();
-        });
-    });
-    // ── DELETE /api/v1/api-keys/:id ────────────────────────────────────
-    (0, vitest_1.describe)("DELETE /api/v1/api-keys/:id", () => {
-        (0, vitest_1.it)("revokes a key and returns 204", async () => {
-            stratum.revokeApiKey.mockResolvedValue(true);
-            const response = await app.inject({
-                method: "DELETE",
-                url: "/api/v1/api-keys/key-uuid-1",
-                headers: (0, test_helpers_js_1.authHeaders)(),
-            });
-            (0, vitest_1.expect)(response.statusCode).toBe(204);
-            (0, vitest_1.expect)(response.body).toBe("");
-            (0, vitest_1.expect)(stratum.revokeApiKey).toHaveBeenCalledWith("key-uuid-1");
-        });
-        (0, vitest_1.it)("returns 404 when key does not exist", async () => {
-            stratum.revokeApiKey.mockResolvedValue(false);
-            const response = await app.inject({
-                method: "DELETE",
-                url: "/api/v1/api-keys/nonexistent-key",
-                headers: (0, test_helpers_js_1.authHeaders)(),
-            });
-            (0, vitest_1.expect)(response.statusCode).toBe(404);
-            const body = response.json();
-            (0, vitest_1.expect)(body.error.code).toBe("NOT_FOUND");
-        });
-    });
-    // ── POST /api/v1/api-keys/:id/rotate ──────────────────────────────
-    (0, vitest_1.describe)("POST /api/v1/api-keys/:id/rotate", () => {
-        (0, vitest_1.it)("rotates a key and returns new plaintext with 201", async () => {
-            const rotatedKey = {
-                id: "key-uuid-new",
-                tenant_id: "550e8400-e29b-41d4-a716-446655440000",
-                plaintext: "sk_test_rotated_xyz789",
-                name: "Rotated Key",
-                created_at: new Date().toISOString(),
-            };
-            stratum.rotateApiKey.mockResolvedValue(rotatedKey);
-            const response = await app.inject({
-                method: "POST",
-                url: "/api/v1/api-keys/key-uuid-1/rotate",
-                headers: (0, test_helpers_js_1.authHeaders)(),
-                payload: {},
-            });
-            (0, vitest_1.expect)(response.statusCode).toBe(201);
-            const body = response.json();
-            (0, vitest_1.expect)(body.plaintext).toBe("sk_test_rotated_xyz789");
-            (0, vitest_1.expect)(stratum.rotateApiKey).toHaveBeenCalledWith("key-uuid-1", undefined);
-        });
-        (0, vitest_1.it)("rotates a key with a new name", async () => {
-            const rotatedKey = {
-                id: "key-uuid-new",
-                tenant_id: "550e8400-e29b-41d4-a716-446655440000",
-                plaintext: "sk_test_rotated_abc",
-                name: "New Name",
-                created_at: new Date().toISOString(),
-            };
-            stratum.rotateApiKey.mockResolvedValue(rotatedKey);
-            const response = await app.inject({
-                method: "POST",
-                url: "/api/v1/api-keys/key-uuid-1/rotate",
-                headers: (0, test_helpers_js_1.authHeaders)(),
-                payload: { name: "New Name" },
-            });
-            (0, vitest_1.expect)(response.statusCode).toBe(201);
-            (0, vitest_1.expect)(response.json().name).toBe("New Name");
-            (0, vitest_1.expect)(stratum.rotateApiKey).toHaveBeenCalledWith("key-uuid-1", "New Name");
-        });
-    });
-    // ── Authorization ───────────────────────────────────────────────────
-    (0, vitest_1.describe)("Authorization", () => {
-        (0, vitest_1.it)("api-keys routes require admin scope", async () => {
-            (0, test_helpers_js_1.setupWriteApiKey)(stratum);
-            const getResponse = await app.inject({
-                method: "GET",
-                url: "/api/v1/api-keys",
-                headers: (0, test_helpers_js_1.authHeaders)(),
-            });
-            (0, vitest_1.expect)(getResponse.statusCode).toBe(403);
-            const postResponse = await app.inject({
-                method: "POST",
-                url: "/api/v1/api-keys",
-                headers: (0, test_helpers_js_1.authHeaders)(),
-                payload: { tenant_id: "550e8400-e29b-41d4-a716-446655440000" },
-            });
-            (0, vitest_1.expect)(postResponse.statusCode).toBe(403);
-        });
-        (0, vitest_1.it)("read-only key cannot access api-keys routes", async () => {
-            (0, test_helpers_js_1.setupReadOnlyApiKey)(stratum);
-            const response = await app.inject({
-                method: "GET",
-                url: "/api/v1/api-keys",
-                headers: (0, test_helpers_js_1.authHeaders)(),
-            });
-            (0, vitest_1.expect)(response.statusCode).toBe(403);
-        });
-        (0, vitest_1.it)("returns 401 without authentication", async () => {
-            const response = await app.inject({
-                method: "GET",
-                url: "/api/v1/api-keys",
-            });
-            (0, vitest_1.expect)(response.statusCode).toBe(401);
-        });
-    });
-});
-//# sourceMappingURL=api-keys.test.js.map

package/dist/__tests__/api-keys.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"api-keys.test.js","sourceRoot":"","sources":["../../src/__tests__/api-keys.test.ts"],"names":[],"mappings":";;AAAA,mCAAqE;AAErE,uDAO2B;AAG3B,IAAA,iBAAQ,EAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,IAAI,GAAoB,CAAC;IACzB,IAAI,OAAgB,CAAC;IAErB,IAAA,mBAAU,EAAC,KAAK,IAAI,EAAE;QACpB,OAAO,GAAG,IAAA,mCAAiB,GAAE,CAAC;QAC9B,IAAA,kCAAgB,EAAC,OAAO,CAAC,CAAC;QAC1B,GAAG,GAAG,MAAM,IAAA,8BAAY,EAAC,OAAO,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,IAAA,kBAAS,EAAC,KAAK,IAAI,EAAE;QACnB,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,sEAAsE;IAEtE,IAAA,iBAAQ,EAAC,uBAAuB,EAAE,GAAG,EAAE;QACrC,IAAA,WAAE,EAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;YACjE,MAAM,UAAU,GAAG;gBACjB,EAAE,EAAE,YAAY;gBAChB,SAAS,EAAE,sCAAsC;gBACjD,SAAS,EAAE,sBAAsB;gBACjC,IAAI,EAAE,YAAY;gBAClB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACrC,CAAC;YACD,OAAO,CAAC,YAAoB,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;YAE5D,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;gBAChC,MAAM,EAAE,MAAM;gBACd,GAAG,EAAE,kBAAkB;gBACvB,OAAO,EAAE,IAAA,6BAAW,GAAE;gBACtB,OAAO,EAAE,EAAE,SAAS,EAAE,sCAAsC,EAAE,IAAI,EAAE,YAAY,EAAE;aACnF,CAAC,CAAC;YAEH,IAAA,eAAM,EAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC7B,IAAA,eAAM,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACnC,IAAA,eAAM,EAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;YACpD,IAAA,eAAM,EAAC,OAAO,CAAC,YAAY,CAAC,CAAC,oBAAoB,EAAE,CAAC;YACpD,IAAA,eAAM,EAAE,OAAO,CAAC,YAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;QACtG,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;YACjD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;gBAChC,MAAM,EAAE,MAAM;gBACd,GAAG,EAAE,kBAAkB;gBACvB,OAAO,EAAE,IAAA,6BAAW,GAAE;gBACtB,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;aAC/B,CAAC,CAAC;YAEH,IAAA,eAAM,EAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC7B,IAAA,eAAM,EAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;YAC5D,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;gBAChC,MAAM,EAAE,MAAM;gBACd,GAAG,EAAE,kBAAkB;gBACvB,OAAO,EAAE,IAAA,6BAAW,GAAE;gBACtB,OAAO,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE;aACrD,CAAC,CAAC;YAEH,IAAA,eAAM,EAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;YACrD,MAAM,UAAU,GAAG;gBACjB,EAAE,EAAE,YAAY;gBAChB,SAAS,EAAE,sCAAsC;gBACjD,SAAS,EAAE,sBAAsB;gBACjC,IAAI,EAAE,kBAAkB;gBACxB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACrC,CAAC;YACD,OAAO,CAAC,YAAoB,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;YAE5D,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;gBAChC,MAAM,EAAE,MAAM;gBACd,GAAG,EAAE,kBAAkB;gBACvB,OAAO,EAAE,IAAA,6BAAW,GAAE;gBACtB,OAAO,EAAE;oBACP,SAAS,EAAE,sCAAsC;oBACjD,IAAI,EAAE,kBAAkB;oBACxB,cAAc,EAAE,GAAG;oBACnB,iBAAiB,EAAE,UAAU;iBAC9B;aACF,CAAC,CAAC;YAEH,IAAA,eAAM,EAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtC,IAAA,eAAM,EAAC,OAAO,CAAC,YAAY,CAAC,CAAC,oBAAoB,CAAC,sCAAsC,EAAE;gBACxF,IAAI,EAAE,kBAAkB;gBACxB,YAAY,EAAE,GAAG;gBACjB,eAAe,EAAE,UAAU;aAC5B,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,sEAAsE;IAEtE,IAAA,iBAAQ,EAAC,sBAAsB,EAAE,GAAG,EAAE;QACpC,IAAA,WAAE,EAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;YAC5C,MAAM,IAAI,GAAG;gBACX;oBACE,EAAE,EAAE,YAAY;oBAChB,SAAS,EAAE,sCAAsC;oBACjD,IAAI,EAAE,OAAO;oBACb,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBACpC,YAAY,EAAE,IAAI;oBAClB,UAAU,EAAE,IAAI;oBAChB,UAAU,EAAE,IAAI;iBACjB;gBACD;oBACE,EAAE,EAAE,YAAY;oBAChB,SAAS,EAAE,sCAAsC;oBACjD,IAAI,EAAE,OAAO;oBACb,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBACpC,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBACtC,UAAU,EAAE,IAAI;oBAChB,UAAU,EAAE,IAAI;iBACjB;aACF,CAAC;YACD,OAAO,CAAC,WAAmB,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;YAErD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;gBAChC,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,kBAAkB;gBACvB,OAAO,EAAE,IAAA,6BAAW,GAAE;aACvB,CAAC,CAAC;YAEH,IAAA,eAAM,EAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC7B,IAAA,eAAM,EAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YAC7B,iDAAiD;YACjD,IAAA,eAAM,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;YAChD,IAAA,eAAM,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;YAChD,IAAA,eAAM,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;YAC3D,OAAO,CAAC,WAAmB,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;YAEnD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;gBAChC,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,iEAAiE;gBACtE,OAAO,EAAE,IAAA,6BAAW,GAAE;aACvB,CAAC,CAAC;YAEH,IAAA,eAAM,EAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtC,iDAAiD;YACjD,IAAA,eAAM,EAAC,OAAO,CAAC,WAAW,CAAC,CAAC,gBAAgB,EAAE,CAAC;QACjD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,sEAAsE;IAEtE,IAAA,iBAAQ,EAAC,6BAA6B,EAAE,GAAG,EAAE;QAC3C,IAAA,WAAE,EAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;YAC5C,OAAO,CAAC,YAAoB,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;YAEtD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;gBAChC,MAAM,EAAE,QAAQ;gBAChB,GAAG,EAAE,6BAA6B;gBAClC,OAAO,EAAE,IAAA,6BAAW,GAAE;aACvB,CAAC,CAAC;YAEH,IAAA,eAAM,EAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtC,IAAA,eAAM,EAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC/B,IAAA,eAAM,EAAC,OAAO,CAAC,YAAY,CAAC,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;YAClD,OAAO,CAAC,YAAoB,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAEvD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;gBAChC,MAAM,EAAE,QAAQ;gBAChB,GAAG,EAAE,kCAAkC;gBACvC,OAAO,EAAE,IAAA,6BAAW,GAAE;aACvB,CAAC,CAAC;YAEH,IAAA,eAAM,EAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC7B,IAAA,eAAM,EAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,qEAAqE;IAErE,IAAA,iBAAQ,EAAC,kCAAkC,EAAE,GAAG,EAAE;QAChD,IAAA,WAAE,EAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;YAChE,MAAM,UAAU,GAAG;gBACjB,EAAE,EAAE,cAAc;gBAClB,SAAS,EAAE,sCAAsC;gBACjD,SAAS,EAAE,wBAAwB;gBACnC,IAAI,EAAE,aAAa;gBACnB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACrC,CAAC;YACD,OAAO,CAAC,YAAoB,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;YAE5D,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;gBAChC,MAAM,EAAE,MAAM;gBACd,GAAG,EAAE,oCAAoC;gBACzC,OAAO,EAAE,IAAA,6BAAW,GAAE;gBACtB,OAAO,EAAE,EAAE;aACZ,CAAC,CAAC;YAEH,IAAA,eAAM,EAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC7B,IAAA,eAAM,EAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;YACtD,IAAA,eAAM,EAAC,OAAO,CAAC,YAAY,CAAC,CAAC,oBAAoB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QAC7E,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;YAC7C,MAAM,UAAU,GAAG;gBACjB,EAAE,EAAE,cAAc;gBAClB,SAAS,EAAE,sCAAsC;gBACjD,SAAS,EAAE,qBAAqB;gBAChC,IAAI,EAAE,UAAU;gBAChB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACrC,CAAC;YACD,OAAO,CAAC,YAAoB,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;YAE5D,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;gBAChC,MAAM,EAAE,MAAM;gBACd,GAAG,EAAE,oCAAoC;gBACzC,OAAO,EAAE,IAAA,6BAAW,GAAE;gBACtB,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;aAC9B,CAAC,CAAC;YAEH,IAAA,eAAM,EAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtC,IAAA,eAAM,EAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC9C,IAAA,eAAM,EAAC,OAAO,CAAC,YAAY,CAAC,CAAC,oBAAoB,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QAC9E,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,uEAAuE;IAEvE,IAAA,iBAAQ,EAAC,eAAe,EAAE,GAAG,EAAE;QAC7B,IAAA,WAAE,EAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;YACnD,IAAA,kCAAgB,EAAC,OAAO,CAAC,CAAC;YAE1B,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;gBACnC,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,kBAAkB;gBACvB,OAAO,EAAE,IAAA,6BAAW,GAAE;aACvB,CAAC,CAAC;YACH,IAAA,eAAM,EAAC,WAAW,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAEzC,MAAM,YAAY,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;gBACpC,MAAM,EAAE,MAAM;gBACd,GAAG,EAAE,kBAAkB;gBACvB,OAAO,EAAE,IAAA,6BAAW,GAAE;gBACtB,OAAO,EAAE,EAAE,SAAS,EAAE,sCAAsC,EAAE;aAC/D,CAAC,CAAC;YACH,IAAA,eAAM,EAAC,YAAY,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;YAC3D,IAAA,qCAAmB,EAAC,OAAO,CAAC,CAAC;YAE7B,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;gBAChC,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,kBAAkB;gBACvB,OAAO,EAAE,IAAA,6BAAW,GAAE;aACvB,CAAC,CAAC;YAEH,IAAA,eAAM,EAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;YAClD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;gBAChC,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,kBAAkB;aACxB,CAAC,CAAC;YAEH,IAAA,eAAM,EAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/auth.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=auth.test.d.ts.map

package/dist/__tests__/auth.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/auth.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/auth.test.js

@@ -1,229 +0,0 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-const vitest_1 = require("vitest");
-const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
-const test_helpers_js_1 = require("./test-helpers.js");
-(0, vitest_1.describe)("Auth Middleware", () => {
-    let app;
-    let stratum;
-    (0, vitest_1.beforeEach)(async () => {
-        stratum = (0, test_helpers_js_1.createMockStratum)();
-        app = await (0, test_helpers_js_1.buildTestApp)(stratum);
-    });
-    (0, vitest_1.afterEach)(async () => {
-        await app.close();
-    });
-    // ── API Key Authentication ──────────────────────────────────────────
-    (0, vitest_1.describe)("API Key Authentication", () => {
-        (0, vitest_1.it)("valid API key authenticates successfully", async () => {
-            (0, test_helpers_js_1.setupAdminApiKey)(stratum);
-            stratum.getTenant.mockResolvedValue(test_helpers_js_1.SAMPLE_TENANT);
-            const response = await app.inject({
-                method: "GET",
-                url: `/api/v1/tenants/${test_helpers_js_1.SAMPLE_TENANT.id}`,
-                headers: (0, test_helpers_js_1.authHeaders)(),
-            });
-            (0, vitest_1.expect)(response.statusCode).toBe(200);
-            (0, vitest_1.expect)(stratum.validateApiKey).toHaveBeenCalledWith("sk_test_valid_key");
-        });
-        (0, vitest_1.it)("invalid API key returns 401", async () => {
-            stratum.validateApiKey.mockResolvedValue(null);
-            const response = await app.inject({
-                method: "GET",
-                url: `/api/v1/tenants/${test_helpers_js_1.SAMPLE_TENANT.id}`,
-                headers: { "x-api-key": "sk_test_bad_key" },
-            });
-            (0, vitest_1.expect)(response.statusCode).toBe(401);
-            const body = response.json();
-            (0, vitest_1.expect)(body.error.code).toBe("UNAUTHORIZED");
-            (0, vitest_1.expect)(body.error.message).toContain("Invalid or revoked");
-        });
-        (0, vitest_1.it)("expired API key returns 401 (validateApiKey returns null)", async () => {
-            // An expired key causes validateApiKey to return null
-            stratum.validateApiKey.mockResolvedValue(null);
-            const response = await app.inject({
-                method: "GET",
-                url: `/api/v1/tenants/${test_helpers_js_1.SAMPLE_TENANT.id}`,
-                headers: { "x-api-key": "sk_test_expired_key" },
-            });
-            (0, vitest_1.expect)(response.statusCode).toBe(401);
-        });
-    });
-    // ── JWT Authentication ──────────────────────────────────────────────
-    (0, vitest_1.describe)("JWT Authentication", () => {
-        (0, vitest_1.it)("valid JWT authenticates successfully", async () => {
-            stratum.getTenant.mockResolvedValue(test_helpers_js_1.SAMPLE_TENANT);
-            const response = await app.inject({
-                method: "GET",
-                url: `/api/v1/tenants/${test_helpers_js_1.SAMPLE_TENANT.id}`,
-                headers: (0, test_helpers_js_1.jwtHeaders)({ scopes: ["read", "write", "admin"] }),
-            });
-            (0, vitest_1.expect)(response.statusCode).toBe(200);
-            // validateApiKey should NOT be called for JWT auth
-            (0, vitest_1.expect)(stratum.validateApiKey).not.toHaveBeenCalled();
-        });
-        (0, vitest_1.it)("invalid JWT returns 401", async () => {
-            const response = await app.inject({
-                method: "GET",
-                url: `/api/v1/tenants/${test_helpers_js_1.SAMPLE_TENANT.id}`,
-                headers: { authorization: "Bearer invalid.token.here" },
-            });
-            (0, vitest_1.expect)(response.statusCode).toBe(401);
-            const body = response.json();
-            (0, vitest_1.expect)(body.error.code).toBe("UNAUTHORIZED");
-            (0, vitest_1.expect)(body.error.message).toContain("Invalid or expired");
-        });
-        (0, vitest_1.it)("expired JWT returns 401", async () => {
-            const expiredToken = jsonwebtoken_1.default.sign({ sub: "test-user", scopes: ["read"] }, test_helpers_js_1.TEST_JWT_SECRET, { algorithm: "HS256", expiresIn: "-1h" });
-            const response = await app.inject({
-                method: "GET",
-                url: `/api/v1/tenants/${test_helpers_js_1.SAMPLE_TENANT.id}`,
-                headers: { authorization: `Bearer ${expiredToken}` },
-            });
-            (0, vitest_1.expect)(response.statusCode).toBe(401);
-        });
-        (0, vitest_1.it)("JWT signed with wrong secret returns 401", async () => {
-            const response = await app.inject({
-                method: "GET",
-                url: `/api/v1/tenants/${test_helpers_js_1.SAMPLE_TENANT.id}`,
-                headers: (0, test_helpers_js_1.jwtHeaders)({}, "wrong-secret-key"),
-            });
-            (0, vitest_1.expect)(response.statusCode).toBe(401);
-        });
-    });
-    // ── No Auth ─────────────────────────────────────────────────────────
-    (0, vitest_1.describe)("No Auth", () => {
-        (0, vitest_1.it)("returns 401 when no auth header is provided", async () => {
-            const response = await app.inject({
-                method: "GET",
-                url: `/api/v1/tenants/${test_helpers_js_1.SAMPLE_TENANT.id}`,
-            });
-            (0, vitest_1.expect)(response.statusCode).toBe(401);
-            const body = response.json();
-            (0, vitest_1.expect)(body.error.code).toBe("UNAUTHORIZED");
-            (0, vitest_1.expect)(body.error.message).toContain("Authentication required");
-        });
-    });
-    // ── Exempt endpoints ────────────────────────────────────────────────
-    (0, vitest_1.describe)("Exempt endpoints", () => {
-        (0, vitest_1.it)("health endpoint skips auth", async () => {
-            const response = await app.inject({
-                method: "GET",
-                url: "/api/v1/health",
-            });
-            // Health endpoint tries to query the DB, which will fail in test,
-            // but it should NOT return 401
-            (0, vitest_1.expect)(response.statusCode).not.toBe(401);
-            // The response should be 200 (health route handles db errors gracefully)
-            (0, vitest_1.expect)(response.statusCode).toBe(200);
-            const body = response.json();
-            (0, vitest_1.expect)(body.status).toBe("ok");
-        });
-        (0, vitest_1.it)("swagger docs endpoint skips auth", async () => {
-            // We don't register swagger in tests, so the route won't exist,
-            // but the auth middleware should NOT fire for /api/docs paths.
-            // We can verify by testing that a 404 is returned (not a 401).
-            const response = await app.inject({
-                method: "GET",
-                url: "/api/docs/json",
-            });
-            // Should be 404 (not registered in test app) rather than 401
-            (0, vitest_1.expect)(response.statusCode).not.toBe(401);
-        });
-    });
-    // ── Authorization scope enforcement ─────────────────────────────────
-    (0, vitest_1.describe)("Scope enforcement", () => {
-        (0, vitest_1.it)("read-scope key cannot access write endpoints", async () => {
-            (0, test_helpers_js_1.setupReadOnlyApiKey)(stratum);
-            const response = await app.inject({
-                method: "POST",
-                url: "/api/v1/tenants",
-                headers: (0, test_helpers_js_1.authHeaders)(),
-                payload: { slug: "test", name: "Test" },
-            });
-            (0, vitest_1.expect)(response.statusCode).toBe(403);
-            (0, vitest_1.expect)(response.json().error.code).toBe("FORBIDDEN");
-        });
-        (0, vitest_1.it)("read-scope key cannot DELETE", async () => {
-            (0, test_helpers_js_1.setupReadOnlyApiKey)(stratum);
-            const response = await app.inject({
-                method: "DELETE",
-                url: `/api/v1/tenants/${test_helpers_js_1.SAMPLE_TENANT.id}`,
-                headers: (0, test_helpers_js_1.authHeaders)(),
-            });
-            (0, vitest_1.expect)(response.statusCode).toBe(403);
-        });
-        (0, vitest_1.it)("read-scope key cannot PATCH", async () => {
-            (0, test_helpers_js_1.setupReadOnlyApiKey)(stratum);
-            const response = await app.inject({
-                method: "PATCH",
-                url: `/api/v1/tenants/${test_helpers_js_1.SAMPLE_TENANT.id}`,
-                headers: (0, test_helpers_js_1.authHeaders)(),
-                payload: { name: "Updated" },
-            });
-            (0, vitest_1.expect)(response.statusCode).toBe(403);
-        });
-        (0, vitest_1.it)("admin-scope key can access all endpoints", async () => {
-            (0, test_helpers_js_1.setupAdminApiKey)(stratum);
-            stratum.createTenant.mockResolvedValue(test_helpers_js_1.SAMPLE_TENANT);
-            stratum.getTenant.mockResolvedValue(test_helpers_js_1.SAMPLE_TENANT);
-            stratum.listApiKeys.mockResolvedValue([]);
-            // Test write endpoint
-            const postResponse = await app.inject({
-                method: "POST",
-                url: "/api/v1/tenants",
-                headers: (0, test_helpers_js_1.authHeaders)(),
-                payload: { slug: "test", name: "Test" },
-            });
-            (0, vitest_1.expect)(postResponse.statusCode).toBe(201);
-            // Test read endpoint
-            const getResponse = await app.inject({
-                method: "GET",
-                url: `/api/v1/tenants/${test_helpers_js_1.SAMPLE_TENANT.id}`,
-                headers: (0, test_helpers_js_1.authHeaders)(),
-            });
-            (0, vitest_1.expect)(getResponse.statusCode).toBe(200);
-            // Test admin-only endpoint (api-keys)
-            const adminResponse = await app.inject({
-                method: "GET",
-                url: "/api/v1/api-keys",
-                headers: (0, test_helpers_js_1.authHeaders)(),
-            });
-            (0, vitest_1.expect)(adminResponse.statusCode).toBe(200);
-        });
-        (0, vitest_1.it)("write-scope key cannot access admin-only endpoints (api-keys)", async () => {
-            (0, test_helpers_js_1.setupWriteApiKey)(stratum);
-            const response = await app.inject({
-                method: "GET",
-                url: "/api/v1/api-keys",
-                headers: (0, test_helpers_js_1.authHeaders)(),
-            });
-            (0, vitest_1.expect)(response.statusCode).toBe(403);
-            (0, vitest_1.expect)(response.json().error.code).toBe("FORBIDDEN");
-        });
-        (0, vitest_1.it)("JWT with read-only scopes cannot POST", async () => {
-            stratum.getTenant.mockResolvedValue(test_helpers_js_1.SAMPLE_TENANT);
-            const response = await app.inject({
-                method: "POST",
-                url: "/api/v1/tenants",
-                headers: (0, test_helpers_js_1.jwtHeaders)({ scopes: ["read"] }),
-                payload: { slug: "test", name: "Test" },
-            });
-            (0, vitest_1.expect)(response.statusCode).toBe(403);
-        });
-        (0, vitest_1.it)("JWT with admin scopes can access admin-only endpoints", async () => {
-            stratum.getTenant.mockResolvedValue(test_helpers_js_1.SAMPLE_TENANT);
-            stratum.listApiKeys.mockResolvedValue([]);
-            const response = await app.inject({
-                method: "GET",
-                url: "/api/v1/api-keys",
-                headers: (0, test_helpers_js_1.jwtHeaders)({ scopes: ["read", "write", "admin"] }),
-            });
-            (0, vitest_1.expect)(response.statusCode).toBe(200);
-        });
-    });
-});
-//# sourceMappingURL=auth.test.js.map