@sudobility/shapeshyft_service 1.0.0

package/dist/lib/entity-helpers.d.ts

@@ -0,0 +1,90 @@
+/**
+ * @fileoverview Shared entity permission helpers
+ * @description Builds the entity helpers and the shared
+ * `getEntityWithPermission()` check for one product's database, plus the
+ * actor helpers every route uses.
+ */
+import { type Entity, type EntityPermissions } from "@sudobility/entity_service";
+import type { Context } from "hono";
+import type { ServiceDb } from "../contracts.js";
+import type { ServiceTables } from "../schema/tables.js";
+/** Successful permission check result */
+interface PermissionSuccess {
+    entity: Entity;
+    error?: never;
+    errorCode?: never;
+}
+/** Failed permission check result */
+interface PermissionFailure {
+    entity?: never;
+    error: string;
+    errorCode: string;
+}
+/** Discriminated union for permission check results */
+export type EntityPermissionResult = PermissionSuccess | PermissionFailure;
+/**
+ * Who is making a request.
+ *
+ * A Firebase token or a personal API key identifies a *user*, whose access is
+ * decided by their membership role. An entity API key identifies the *entity*
+ * itself -- it carries no membership, so it is authorised by matching the
+ * entity it was issued for.
+ */
+export type EntityActor = {
+    kind: "user";
+    userId: string;
+} | {
+    kind: "entity_api_key";
+    entityId: string;
+    keyId: string;
+};
+/** Build a user actor. Accepts a bare Firebase UID for brevity at call sites. */
+export declare function userActor(userId: string): EntityActor;
+/**
+ * Permissions granted to an entity API key over its own entity.
+ *
+ * Manager-level: it may manage projects, endpoints, provider keys, and storage,
+ * but never members or roles. Minting further API keys is blocked separately in
+ * the entity API key routes, so a leaked key cannot mint more of itself.
+ */
+export declare const ENTITY_API_KEY_PERMISSIONS: EntityPermissions;
+/**
+ * Entity helpers and the permission check, bound to one product's database.
+ * Routes read these from the service context rather than a module singleton.
+ */
+export declare function createEntityAccess(opts: {
+    db: ServiceDb;
+    tables: ServiceTables;
+    entityKeyPrefix: string;
+}): {
+    entityHelpers: {
+        entity: import("@sudobility/entity_service").EntityHelper;
+        members: import("@sudobility/entity_service").EntityMemberHelper;
+        invitations: import("@sudobility/entity_service").InvitationHelper;
+        permissions: import("@sudobility/entity_service").PermissionHelper;
+        apiKeys: import("@sudobility/entity_service").ApiKeyHelper | undefined;
+    };
+    getEntityWithPermission: (entitySlug: string, actor: string | EntityActor, requireEdit?: boolean | keyof EntityPermissions) => Promise<EntityPermissionResult>;
+    getActor: typeof getActor;
+    getPermissionErrorStatus: typeof getPermissionErrorStatus;
+};
+export type EntityAccess = ReturnType<typeof createEntityAccess>;
+/**
+ * Read the acting identity off a Hono context.
+ *
+ * Routes should pass this to `getEntityWithPermission` rather than a bare
+ * `userId`, so requests authenticated with an entity API key are authorised as
+ * the entity instead of being checked against a membership that does not exist.
+ *
+ * @param c - The Hono context, after `firebaseAuthMiddleware` has run
+ */
+export declare function getActor(c: Context): EntityActor;
+/**
+ * Determine the appropriate HTTP status code for a permission error.
+ *
+ * @param errorCode - The error code from `getEntityWithPermission()`
+ * @returns 404 for not-found, 403 for access/permission errors
+ */
+export declare function getPermissionErrorStatus(errorCode: string): 400 | 403 | 404;
+export {};
+//# sourceMappingURL=entity-helpers.d.ts.map

package/dist/lib/entity-helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity-helpers.d.ts","sourceRoot":"","sources":["../../src/lib/entity-helpers.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAKL,KAAK,MAAM,EACX,KAAK,iBAAiB,EACvB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAMzD,yCAAyC;AACzC,UAAU,iBAAiB;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,SAAS,CAAC,EAAE,KAAK,CAAC;CACnB;AAED,qCAAqC;AACrC,UAAU,iBAAiB;IACzB,MAAM,CAAC,EAAE,KAAK,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,uDAAuD;AACvD,MAAM,MAAM,sBAAsB,GAAG,iBAAiB,GAAG,iBAAiB,CAAC;AAM3E;;;;;;;GAOG;AACH,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAChC;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhE,iFAAiF;AACjF,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,WAAW,CAErD;AAED;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,EAAE,iBACpB,CAAC;AAMtB;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IACvC,EAAE,EAAE,SAAS,CAAC;IACd,MAAM,EAAE,aAAa,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;CACzB;;;;;;;;0CA2Be,MAAM,SACX,MAAM,GAAG,WAAW,gBACd,OAAO,GAAG,MAAM,iBAAiB,KAC7C,OAAO,CAAC,sBAAsB,CAAC;;;EA2DnC;AAED,MAAM,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEjE;;;;;;;;GAQG;AACH,wBAAgB,QAAQ,CAAC,CAAC,EAAE,OAAO,GAAG,WAAW,CAShD;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAU3E"}

package/dist/lib/entity-helpers.js

@@ -0,0 +1,136 @@
+/**
+ * @fileoverview Shared entity permission helpers
+ * @description Builds the entity helpers and the shared
+ * `getEntityWithPermission()` check for one product's database, plus the
+ * actor helpers every route uses.
+ */
+import { createEntityHelpers, MANAGER_PERMISSIONS, } from "@sudobility/entity_service";
+/** Build a user actor. Accepts a bare Firebase UID for brevity at call sites. */
+export function userActor(userId) {
+    return { kind: "user", userId };
+}
+/**
+ * Permissions granted to an entity API key over its own entity.
+ *
+ * Manager-level: it may manage projects, endpoints, provider keys, and storage,
+ * but never members or roles. Minting further API keys is blocked separately in
+ * the entity API key routes, so a leaked key cannot mint more of itself.
+ */
+export const ENTITY_API_KEY_PERMISSIONS = MANAGER_PERMISSIONS;
+// =============================================================================
+// Shared Permission Helper
+// =============================================================================
+/**
+ * Entity helpers and the permission check, bound to one product's database.
+ * Routes read these from the service context rather than a module singleton.
+ */
+export function createEntityAccess(opts) {
+    const config = {
+        db: opts.db,
+        entitiesTable: opts.tables.entities,
+        membersTable: opts.tables.entityMembers,
+        invitationsTable: opts.tables.entityInvitations,
+        apiKeysTable: opts.tables.entityApiKeys,
+        usersTable: opts.tables.users,
+        keyPrefix: opts.entityKeyPrefix,
+    };
+    const entityHelpers = createEntityHelpers(config);
+    /**
+     * Look up an entity by slug and verify the user has appropriate permissions.
+     *
+     * When `requireEdit` is false, checks view access. When it is `true`, checks
+     * if the user can create projects (i.e., has an admin/editor role). Pass a
+     * permission name instead to require that specific permission -- for example
+     * `"canManageApiKeys"` for routes that write credentials.
+     *
+     * @param entitySlug - The entity's URL-safe slug
+     * @param actor - The requesting actor: a Firebase UID, or an `EntityActor`
+     *   (use `getActor(c)` so entity API key requests are handled)
+     * @param requireEdit - `true` for `canCreateProjects`, or a permission name (default: false)
+     * @returns A discriminated union with either `{ entity }` or `{ error, errorCode }`
+     */
+    async function getEntityWithPermission(entitySlug, actor, requireEdit = false) {
+        const resolved = typeof actor === "string" ? userActor(actor) : actor;
+        const entity = await entityHelpers.entity.getEntityBySlug(entitySlug);
+        if (!entity) {
+            return { error: "Entity not found", errorCode: "ENTITY_NOT_FOUND" };
+        }
+        const required = requireEdit === true ? "canCreateProjects" : requireEdit;
+        // An entity API key authenticates as the entity, so there is no membership to
+        // consult: it is authorised exactly for the entity it was issued for.
+        if (resolved.kind === "entity_api_key") {
+            if (resolved.entityId !== entity.id) {
+                return {
+                    error: "API key does not grant access to this entity",
+                    errorCode: "ACCESS_DENIED",
+                };
+            }
+            if (required && !ENTITY_API_KEY_PERMISSIONS[required]) {
+                return {
+                    error: "Insufficient permissions",
+                    errorCode: "INSUFFICIENT_PERMISSIONS",
+                };
+            }
+            return { entity };
+        }
+        if (required) {
+            const permissions = await entityHelpers.permissions.getUserPermissions(entity.id, resolved.userId);
+            if (!permissions?.[required]) {
+                return {
+                    error: "Insufficient permissions",
+                    errorCode: "INSUFFICIENT_PERMISSIONS",
+                };
+            }
+        }
+        else {
+            const canView = await entityHelpers.permissions.canViewEntity(entity.id, resolved.userId);
+            if (!canView) {
+                return { error: "Access denied", errorCode: "ACCESS_DENIED" };
+            }
+        }
+        return { entity };
+    }
+    return {
+        entityHelpers,
+        getEntityWithPermission,
+        getActor,
+        getPermissionErrorStatus,
+    };
+}
+/**
+ * Read the acting identity off a Hono context.
+ *
+ * Routes should pass this to `getEntityWithPermission` rather than a bare
+ * `userId`, so requests authenticated with an entity API key are authorised as
+ * the entity instead of being checked against a membership that does not exist.
+ *
+ * @param c - The Hono context, after `firebaseAuthMiddleware` has run
+ */
+export function getActor(c) {
+    if (c.get("authMethod") === "entity_api_key") {
+        return {
+            kind: "entity_api_key",
+            entityId: c.get("entityApiKeyEntityId"),
+            keyId: c.get("entityApiKeyId"),
+        };
+    }
+    return userActor(c.get("userId"));
+}
+/**
+ * Determine the appropriate HTTP status code for a permission error.
+ *
+ * @param errorCode - The error code from `getEntityWithPermission()`
+ * @returns 404 for not-found, 403 for access/permission errors
+ */
+export function getPermissionErrorStatus(errorCode) {
+    switch (errorCode) {
+        case "ENTITY_NOT_FOUND":
+            return 404;
+        case "ACCESS_DENIED":
+        case "INSUFFICIENT_PERMISSIONS":
+            return 403;
+        default:
+            return 400;
+    }
+}
+//# sourceMappingURL=entity-helpers.js.map

package/dist/lib/entity-helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity-helpers.js","sourceRoot":"","sources":["../../src/lib/entity-helpers.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,mBAAmB,EACnB,mBAAmB,GAKpB,MAAM,4BAA4B,CAAC;AA0CpC,iFAAiF;AACjF,MAAM,UAAU,SAAS,CAAC,MAAc;IACtC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAClC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,0BAA0B,GACrC,mBAAmB,CAAC;AAEtB,gFAAgF;AAChF,2BAA2B;AAC3B,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAIlC;IACC,MAAM,MAAM,GAAgD;QAC1D,EAAE,EAAE,IAAI,CAAC,EAAS;QAClB,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;QACnC,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa;QACvC,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,iBAAiB;QAC/C,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa;QACvC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK;QAC7B,SAAS,EAAE,IAAI,CAAC,eAAe;KAChC,CAAC;IACF,MAAM,aAAa,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAElD;;;;;;;;;;;;;OAaG;IACH,KAAK,UAAU,uBAAuB,CACpC,UAAkB,EAClB,KAA2B,EAC3B,cAAiD,KAAK;QAEtD,MAAM,QAAQ,GACZ,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAEvD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC;QACtE,CAAC;QAED,MAAM,QAAQ,GAAG,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,WAAW,CAAC;QAE1E,8EAA8E;QAC9E,sEAAsE;QACtE,IAAI,QAAQ,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YACvC,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC;gBACpC,OAAO;oBACL,KAAK,EAAE,8CAA8C;oBACrD,SAAS,EAAE,eAAe;iBAC3B,CAAC;YACJ,CAAC;YACD,IAAI,QAAQ,IAAI,CAAC,0BAA0B,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACtD,OAAO;oBACL,KAAK,EAAE,0BAA0B;oBACjC,SAAS,EAAE,0BAA0B;iBACtC,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,CAAC;QACpB,CAAC;QAED,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,WAAW,GAAG,MAAM,aAAa,CAAC,WAAW,CAAC,kBAAkB,CACpE,MAAM,CAAC,EAAE,EACT,QAAQ,CAAC,MAAM,CAChB,CAAC;YACF,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC7B,OAAO;oBACL,KAAK,EAAE,0BAA0B;oBACjC,SAAS,EAAE,0BAA0B;iBACtC,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,WAAW,CAAC,aAAa,CAC3D,MAAM,CAAC,EAAE,EACT,QAAQ,CAAC,MAAM,CAChB,CAAC;YACF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC;YAChE,CAAC;QACH,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,CAAC;IACpB,CAAC;IAED,OAAO;QACL,aAAa;QACb,uBAAuB;QACvB,QAAQ;QACR,wBAAwB;KACzB,CAAC;AACJ,CAAC;AAID;;;;;;;;GAQG;AACH,MAAM,UAAU,QAAQ,CAAC,CAAU;IACjC,IAAI,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,gBAAgB,EAAE,CAAC;QAC7C,OAAO;YACL,IAAI,EAAE,gBAAgB;YACtB,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC;YACvC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC;SAC/B,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,SAAiB;IACxD,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,kBAAkB;YACrB,OAAO,GAAG,CAAC;QACb,KAAK,eAAe,CAAC;QACrB,KAAK,0BAA0B;YAC7B,OAAO,GAAG,CAAC;QACb;YACE,OAAO,GAAG,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/lib/money.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Convert a floating-point cent amount (what `estimateCost` returns) to integer
+ * micro-cents (10^-6 cent). Integer micro-cents are what billing hooks receive:
+ * exact to sum, and a sub-cent call is never rounded to nothing.
+ */
+export declare function toMicroCents(cents: number): bigint;
+//# sourceMappingURL=money.d.ts.map

package/dist/lib/money.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"money.d.ts","sourceRoot":"","sources":["../../src/lib/money.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAElD"}

package/dist/lib/money.js

@@ -0,0 +1,9 @@
+/**
+ * Convert a floating-point cent amount (what `estimateCost` returns) to integer
+ * micro-cents (10^-6 cent). Integer micro-cents are what billing hooks receive:
+ * exact to sum, and a sub-cent call is never rounded to nothing.
+ */
+export function toMicroCents(cents) {
+    return BigInt(Math.round(cents * 1_000_000));
+}
+//# sourceMappingURL=money.js.map

package/dist/lib/money.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"money.js","sourceRoot":"","sources":["../../src/lib/money.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC;AAC/C,CAAC"}

package/dist/lib/public-project.d.ts

@@ -0,0 +1,14 @@
+/**
+ * A project as a caller should see it.
+ *
+ * `db.select()` returns every column, which for a project includes the
+ * ENCRYPTED api key and its IV. Encrypted is not the same as safe to hand out:
+ * ciphertext plus IV is strictly more than a caller needs, and identifying a
+ * project is what `api_key_prefix` is for. The invocation path reads the real
+ * columns from its own query, so nothing depends on them being in a response.
+ *
+ * Its own module rather than the route file so it can be tested without
+ * importing the whole HTTP surface.
+ */
+export declare function publicProject<T extends Record<string, unknown>>(row: T): Omit<T, "encrypted_api_key" | "api_key_iv">;
+//# sourceMappingURL=public-project.d.ts.map

package/dist/lib/public-project.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-project.d.ts","sourceRoot":"","sources":["../../src/lib/public-project.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC,+CAGtE"}

package/dist/lib/public-project.js

@@ -0,0 +1,17 @@
+/**
+ * A project as a caller should see it.
+ *
+ * `db.select()` returns every column, which for a project includes the
+ * ENCRYPTED api key and its IV. Encrypted is not the same as safe to hand out:
+ * ciphertext plus IV is strictly more than a caller needs, and identifying a
+ * project is what `api_key_prefix` is for. The invocation path reads the real
+ * columns from its own query, so nothing depends on them being in a response.
+ *
+ * Its own module rather than the route file so it can be tested without
+ * importing the whole HTTP surface.
+ */
+export function publicProject(row) {
+    const { encrypted_api_key: _e, api_key_iv: _i, ...rest } = row;
+    return rest;
+}
+//# sourceMappingURL=public-project.js.map

package/dist/lib/public-project.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-project.js","sourceRoot":"","sources":["../../src/lib/public-project.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAAoC,GAAM;IACrE,MAAM,EAAE,iBAAiB,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,GAAG,CAAC;IAC/D,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/lib/user-api-key-cache.d.ts

@@ -0,0 +1,35 @@
+/**
+ * @fileoverview In-process cache for user API key lookups.
+ *
+ * Every request authenticated with a personal API key would otherwise pay a
+ * database round-trip before the handler does its own work. Keys change rarely,
+ * so the resolved identity is cached for a short window.
+ *
+ * Only SUCCESSFUL lookups are cached: an unknown key re-checks the database
+ * every time, so a key created moments ago works immediately and a bogus key can
+ * never be pinned in memory. The short TTL bounds how long a *revoked* key keeps
+ * working — deleting or deactivating a key takes effect within
+ * `KEY_CACHE_TTL_MS`, and `invalidateUserApiKeyCache` clears it immediately when
+ * the revocation goes through this API.
+ */
+import type { Logger, ServiceDb } from "../contracts.js";
+import type { ServiceTables } from "../schema/tables.js";
+export interface ResolvedApiKeyUser {
+    /** Firebase UID of the key's owner — used exactly like a token's uid */
+    userId: string;
+    /** Owner's email, or null when the user record has none */
+    userEmail: string | null;
+    /** UUID of the API key row itself */
+    keyId: string;
+}
+export declare function createUserApiKeyCache(opts: {
+    db: ServiceDb;
+    tables: Pick<ServiceTables, "userApiKeys" | "users">;
+    hashUserApiKey: (key: string) => string;
+    logger: Logger;
+}): {
+    resolveUserApiKey: (key: string) => Promise<ResolvedApiKeyUser | null>;
+    invalidateUserApiKeyCache: (keyHash?: string) => void;
+};
+export type UserApiKeyCache = ReturnType<typeof createUserApiKeyCache>;
+//# sourceMappingURL=user-api-key-cache.d.ts.map

package/dist/lib/user-api-key-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-api-key-cache.d.ts","sourceRoot":"","sources":["../../src/lib/user-api-key-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAOzD,MAAM,WAAW,kBAAkB;IACjC,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,qCAAqC;IACrC,KAAK,EAAE,MAAM,CAAC;CACf;AAOD,wBAAgB,qBAAqB,CAAC,IAAI,EAAE;IAC1C,EAAE,EAAE,SAAS,CAAC;IACd,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,aAAa,GAAG,OAAO,CAAC,CAAC;IACrD,cAAc,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC;IACxC,MAAM,EAAE,MAAM,CAAC;CAChB;6BAWQ,MAAM,KACV,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;0CA4EQ,MAAM,KAAG,IAAI;EAS3D;AAED,MAAM,MAAM,eAAe,GAAG,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAC"}

package/dist/lib/user-api-key-cache.js

@@ -0,0 +1,99 @@
+/**
+ * @fileoverview In-process cache for user API key lookups.
+ *
+ * Every request authenticated with a personal API key would otherwise pay a
+ * database round-trip before the handler does its own work. Keys change rarely,
+ * so the resolved identity is cached for a short window.
+ *
+ * Only SUCCESSFUL lookups are cached: an unknown key re-checks the database
+ * every time, so a key created moments ago works immediately and a bogus key can
+ * never be pinned in memory. The short TTL bounds how long a *revoked* key keeps
+ * working — deleting or deactivating a key takes effect within
+ * `KEY_CACHE_TTL_MS`, and `invalidateUserApiKeyCache` clears it immediately when
+ * the revocation goes through this API.
+ */
+import { eq, and } from "drizzle-orm";
+const KEY_CACHE_TTL_MS = 60_000;
+/** How stale `last_used_at` may get before we write it again. */
+const LAST_USED_WRITE_INTERVAL_MS = 5 * 60_000;
+export function createUserApiKeyCache(opts) {
+    const { db, hashUserApiKey, logger } = opts;
+    const { userApiKeys, users } = opts.tables;
+    const cache = new Map();
+    /**
+     * Resolve a plain text user API key to the identity it authenticates.
+     * @param key The personal key value from the request
+     * @returns The owner's identity, or null when the key is unknown or inactive
+     */
+    async function resolveUserApiKey(key) {
+        const now = Date.now();
+        const hash = hashUserApiKey(key);
+        const cached = cache.get(hash);
+        if (cached && cached.expiresAt > now) {
+            void touchLastUsed(hash, cached, now);
+            return {
+                userId: cached.userId,
+                userEmail: cached.userEmail,
+                keyId: cached.keyId,
+            };
+        }
+        const rows = await db
+            .select({
+            keyId: userApiKeys.uuid,
+            userId: userApiKeys.firebase_uid,
+            userEmail: users.email,
+        })
+            .from(userApiKeys)
+            .leftJoin(users, eq(users.firebase_uid, userApiKeys.firebase_uid))
+            .where(and(eq(userApiKeys.key_hash, hash), eq(userApiKeys.is_active, true)))
+            .limit(1);
+        const row = rows[0];
+        if (!row) {
+            cache.delete(hash);
+            return null;
+        }
+        const resolved = {
+            userId: row.userId,
+            userEmail: row.userEmail ?? null,
+            keyId: row.keyId,
+        };
+        cache.set(hash, {
+            ...resolved,
+            expiresAt: now + KEY_CACHE_TTL_MS,
+            lastUsedWrittenAt: 0,
+        });
+        void touchLastUsed(hash, cache.get(hash), now);
+        return resolved;
+    }
+    /**
+     * Record that a key was used, at most once per LAST_USED_WRITE_INTERVAL_MS.
+     * Fire-and-forget: a failed bookkeeping write must never fail the request.
+     */
+    async function touchLastUsed(hash, entry, now) {
+        if (now - entry.lastUsedWrittenAt < LAST_USED_WRITE_INTERVAL_MS)
+            return;
+        entry.lastUsedWrittenAt = now;
+        try {
+            await db
+                .update(userApiKeys)
+                .set({ last_used_at: new Date(now) })
+                .where(eq(userApiKeys.uuid, entry.keyId));
+        }
+        catch (error) {
+            logger.error("Failed to update user API key last_used_at:", error);
+        }
+    }
+    /**
+     * Drop a key from the cache so a revocation or rename takes effect at once.
+     * @param keyHash The stored SHA-256 hash, or undefined to clear everything
+     */
+    function invalidateUserApiKeyCache(keyHash) {
+        if (keyHash) {
+            cache.delete(keyHash);
+            return;
+        }
+        cache.clear();
+    }
+    return { resolveUserApiKey, invalidateUserApiKeyCache };
+}
+//# sourceMappingURL=user-api-key-cache.js.map

package/dist/lib/user-api-key-cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-api-key-cache.js","sourceRoot":"","sources":["../../src/lib/user-api-key-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAItC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEhC,iEAAiE;AACjE,MAAM,2BAA2B,GAAG,CAAC,GAAG,MAAM,CAAC;AAgB/C,MAAM,UAAU,qBAAqB,CAAC,IAKrC;IACC,MAAM,EAAE,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC5C,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IAE5C;;;;OAIG;IACH,KAAK,UAAU,iBAAiB,CAC9B,GAAW;QAEX,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QAEjC,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;YACrC,KAAK,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;YACtC,OAAO;gBACL,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;aACpB,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,MAAM,CAAC;YACN,KAAK,EAAE,WAAW,CAAC,IAAI;YACvB,MAAM,EAAE,WAAW,CAAC,YAAY;YAChC,SAAS,EAAE,KAAK,CAAC,KAAK;SACvB,CAAC;aACD,IAAI,CAAC,WAAW,CAAC;aACjB,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,WAAW,CAAC,YAAY,CAAC,CAAC;aACjE,KAAK,CACJ,GAAG,CAAC,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CACrE;aACA,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,QAAQ,GAAuB;YACnC,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI;YAChC,KAAK,EAAE,GAAG,CAAC,KAAK;SACjB,CAAC;QAEF,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE;YACd,GAAG,QAAQ;YACX,SAAS,EAAE,GAAG,GAAG,gBAAgB;YACjC,iBAAiB,EAAE,CAAC;SACrB,CAAC,CAAC;QAEH,KAAK,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAE,EAAE,GAAG,CAAC,CAAC;QAEhD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;OAGG;IACH,KAAK,UAAU,aAAa,CAC1B,IAAY,EACZ,KAAiB,EACjB,GAAW;QAEX,IAAI,GAAG,GAAG,KAAK,CAAC,iBAAiB,GAAG,2BAA2B;YAAE,OAAO;QACxE,KAAK,CAAC,iBAAiB,GAAG,GAAG,CAAC;QAE9B,IAAI,CAAC;YACH,MAAM,EAAE;iBACL,MAAM,CAAC,WAAW,CAAC;iBACnB,GAAG,CAAC,EAAE,YAAY,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;iBACpC,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,6CAA6C,EAAE,KAAK,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,SAAS,yBAAyB,CAAC,OAAgB;QACjD,IAAI,OAAO,EAAE,CAAC;YACZ,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACtB,OAAO;QACT,CAAC;QACD,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC;IAED,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,CAAC;AAC1D,CAAC"}

package/dist/lib/user-api-key.d.ts

@@ -0,0 +1,46 @@
+/**
+ * @fileoverview User API key management
+ * @description Generates, hashes, encrypts, and validates personal API keys.
+ *
+ * Keys use the format `<prefix><base64url-random>` (the prefix is configured
+ * per product, e.g. `shyft_`) and are stored three ways:
+ *   - `key_hash`   SHA-256 of the key, unique and indexed. Authentication looks
+ *                  the key up by hash, so no decryption is needed on the hot path.
+ *   - `encrypted_key` + `encryption_iv`  AES-256-CBC ciphertext, so the owner can
+ *                  reveal the key again from the dashboard (same treatment
+ *                  project API keys already get).
+ *   - `key_prefix` First 14 characters, for display in lists.
+ *
+ * Distinct from the project API key (`sk_live_...`), which authenticates callers
+ * of a published AI endpoint. A user API key authenticates the *owner* against
+ * the admin routes, exactly as a Firebase ID token does.
+ */
+import type { Encryption } from "./encryption.js";
+/**
+ * Hash a user API key for storage and lookup.
+ * SHA-256 is appropriate here (rather than a slow password hash) because the key
+ * is 256 bits of random data, not a guessable secret.
+ * @param key The plain text API key
+ * @returns Lowercase hex digest, 64 characters
+ */
+export declare function hashUserApiKey(key: string): string;
+export declare function createUserApiKeys(opts: {
+    prefix: string;
+    encryption: Encryption;
+}): {
+    prefix: string;
+    generateUserApiKey: () => {
+        key: string;
+        prefix: string;
+    };
+    hashUserApiKey: typeof hashUserApiKey;
+    encryptUserApiKey: (key: string) => {
+        encrypted: string;
+        iv: string;
+    };
+    decryptUserApiKey: (encrypted: string, iv: string) => string;
+    isUserApiKeyFormat: (value: string) => boolean;
+    extractUserApiKeyFromHeaders: (getHeader: (name: string) => string | undefined) => string | null;
+};
+export type UserApiKeys = ReturnType<typeof createUserApiKeys>;
+//# sourceMappingURL=user-api-key.d.ts.map

package/dist/lib/user-api-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-api-key.d.ts","sourceRoot":"","sources":["../../src/lib/user-api-key.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAQlD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAElD;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,UAAU,CAAC;CACxB;;8BAQgC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;;6BAa9B,MAAM,KAAG;QACvC,SAAS,EAAE,MAAM,CAAC;QAClB,EAAE,EAAE,MAAM,CAAC;KACZ;mCASqC,MAAM,MAAM,MAAM,KAAG,MAAM;gCAQ9B,MAAM,KAAG,OAAO;8CAkBtC,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,KAC9C,MAAM,GAAG,IAAI;EAsBjB;AAED,MAAM,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC"}

package/dist/lib/user-api-key.js

@@ -0,0 +1,102 @@
+/**
+ * @fileoverview User API key management
+ * @description Generates, hashes, encrypts, and validates personal API keys.
+ *
+ * Keys use the format `<prefix><base64url-random>` (the prefix is configured
+ * per product, e.g. `shyft_`) and are stored three ways:
+ *   - `key_hash`   SHA-256 of the key, unique and indexed. Authentication looks
+ *                  the key up by hash, so no decryption is needed on the hot path.
+ *   - `encrypted_key` + `encryption_iv`  AES-256-CBC ciphertext, so the owner can
+ *                  reveal the key again from the dashboard (same treatment
+ *                  project API keys already get).
+ *   - `key_prefix` First 14 characters, for display in lists.
+ *
+ * Distinct from the project API key (`sk_live_...`), which authenticates callers
+ * of a published AI endpoint. A user API key authenticates the *owner* against
+ * the admin routes, exactly as a Firebase ID token does.
+ */
+import { createHash, randomBytes } from "crypto";
+/** Random bytes of entropy (32 bytes = 256 bits). */
+const KEY_BYTES_LENGTH = 32;
+/** Characters shown in listings, e.g. "shyft_ab12cd". */
+const DISPLAY_PREFIX_LENGTH = 14;
+/**
+ * Hash a user API key for storage and lookup.
+ * SHA-256 is appropriate here (rather than a slow password hash) because the key
+ * is 256 bits of random data, not a guessable secret.
+ * @param key The plain text API key
+ * @returns Lowercase hex digest, 64 characters
+ */
+export function hashUserApiKey(key) {
+    return createHash("sha256").update(key, "utf8").digest("hex");
+}
+export function createUserApiKeys(opts) {
+    const USER_API_KEY_PREFIX = opts.prefix;
+    const { encryptApiKey, decryptApiKey } = opts.encryption;
+    /**
+     * Generate a new user API key.
+     * @returns The full key and the prefix stored for display
+     */
+    function generateUserApiKey() {
+        const randomPart = randomBytes(KEY_BYTES_LENGTH)
+            .toString("base64url")
+            .replace(/=/g, "");
+        const key = `${USER_API_KEY_PREFIX}${randomPart}`;
+        return { key, prefix: key.substring(0, DISPLAY_PREFIX_LENGTH) };
+    }
+    /**
+     * Encrypt a user API key for at-rest storage.
+     * @param key The plain text API key
+     */
+    function encryptUserApiKey(key) {
+        return encryptApiKey(key);
+    }
+    /**
+     * Decrypt a stored user API key so its owner can copy it again.
+     * @param encrypted Hex ciphertext
+     * @param iv Hex initialization vector
+     */
+    function decryptUserApiKey(encrypted, iv) {
+        return decryptApiKey(encrypted, iv);
+    }
+    /**
+     * Check whether a string looks like a user API key.
+     * Used to route an incoming credential to key auth instead of Firebase auth.
+     */
+    function isUserApiKeyFormat(value) {
+        return (value.startsWith(USER_API_KEY_PREFIX) &&
+            value.length > USER_API_KEY_PREFIX.length);
+    }
+    /**
+     * Extract a personal API key from request headers.
+     *
+     * Accepts `X-API-Key: <prefix>...` (preferred, unambiguous) and
+     * `Authorization: Bearer <prefix>...`. Anything without the prefix is left
+     * alone so it can be verified as a Firebase ID token instead.
+     *
+     * @param getHeader Reads a request header by name, case-insensitively
+     * @returns The key, or null when the request carries none
+     */
+    function extractUserApiKeyFromHeaders(getHeader) {
+        const headerKey = getHeader("X-API-Key");
+        if (headerKey && isUserApiKeyFormat(headerKey))
+            return headerKey;
+        const authHeader = getHeader("Authorization");
+        if (authHeader) {
+            const [type, token] = authHeader.split(" ");
+            if (type === "Bearer" && token && isUserApiKeyFormat(token))
+                return token;
+        }
+        return null;
+    }
+    return {
+        prefix: USER_API_KEY_PREFIX,
+        generateUserApiKey,
+        hashUserApiKey,
+        encryptUserApiKey,
+        decryptUserApiKey,
+        isUserApiKeyFormat,
+        extractUserApiKeyFromHeaders,
+    };
+}
+//# sourceMappingURL=user-api-key.js.map

package/dist/lib/user-api-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-api-key.js","sourceRoot":"","sources":["../../src/lib/user-api-key.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AAGjD,qDAAqD;AACrD,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAE5B,yDAAyD;AACzD,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAEjC;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAGjC;IACC,MAAM,mBAAmB,GAAG,IAAI,CAAC,MAAM,CAAC;IACxC,MAAM,EAAE,aAAa,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;IAEzD;;;OAGG;IACH,SAAS,kBAAkB;QACzB,MAAM,UAAU,GAAG,WAAW,CAAC,gBAAgB,CAAC;aAC7C,QAAQ,CAAC,WAAW,CAAC;aACrB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAErB,MAAM,GAAG,GAAG,GAAG,mBAAmB,GAAG,UAAU,EAAE,CAAC;QAClD,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,qBAAqB,CAAC,EAAE,CAAC;IAClE,CAAC;IAED;;;OAGG;IACH,SAAS,iBAAiB,CAAC,GAAW;QAIpC,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED;;;;OAIG;IACH,SAAS,iBAAiB,CAAC,SAAiB,EAAE,EAAU;QACtD,OAAO,aAAa,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACtC,CAAC;IAED;;;OAGG;IACH,SAAS,kBAAkB,CAAC,KAAa;QACvC,OAAO,CACL,KAAK,CAAC,UAAU,CAAC,mBAAmB,CAAC;YACrC,KAAK,CAAC,MAAM,GAAG,mBAAmB,CAAC,MAAM,CAC1C,CAAC;IACJ,CAAC;IAED;;;;;;;;;OASG;IACH,SAAS,4BAA4B,CACnC,SAA+C;QAE/C,MAAM,SAAS,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;QACzC,IAAI,SAAS,IAAI,kBAAkB,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QAEjE,MAAM,UAAU,GAAG,SAAS,CAAC,eAAe,CAAC,CAAC;QAC9C,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC5C,IAAI,IAAI,KAAK,QAAQ,IAAI,KAAK,IAAI,kBAAkB,CAAC,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;QAC5E,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,MAAM,EAAE,mBAAmB;QAC3B,kBAAkB;QAClB,cAAc;QACd,iBAAiB;QACjB,iBAAiB;QACjB,kBAAkB;QAClB,4BAA4B;KAC7B,CAAC;AACJ,CAAC"}

package/dist/middleware/firebaseAuth.d.ts

@@ -0,0 +1,34 @@
+/**
+ * @fileoverview Firebase authentication middleware
+ *
+ * Accepts a personal API key, an entity API key, or a Firebase ID token. Key
+ * prefixes, auth functions, and storage all come from the service context.
+ */
+import type { MiddlewareHandler } from "hono";
+import type { DecodedIdToken } from "firebase-admin/auth";
+import type { ServiceContext } from "../context.js";
+/**
+ * Augment Hono's ContextVariableMap for type-safe context access.
+ */
+declare module "hono" {
+    interface ContextVariableMap {
+        firebaseUser: DecodedIdToken;
+        userId: string;
+        userEmail: string | null;
+        siteAdmin: boolean;
+        /**
+         * How the caller authenticated. Neither key method has a firebaseUser.
+         * "api_key" is a personal key (acts as a user); "entity_api_key" is an
+         * entity key (acts as the entity itself).
+         */
+        authMethod: "firebase" | "api_key" | "entity_api_key";
+        /** UUID of the user API key used, when authMethod is "api_key" */
+        apiKeyId: string;
+        /** UUID of the entity API key used, when authMethod is "entity_api_key" */
+        entityApiKeyId: string;
+        /** Entity the request acts as, when authMethod is "entity_api_key" */
+        entityApiKeyEntityId: string;
+    }
+}
+export declare function createFirebaseAuthMiddleware(ctx: ServiceContext): MiddlewareHandler;
+//# sourceMappingURL=firebaseAuth.d.ts.map

package/dist/middleware/firebaseAuth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"firebaseAuth.d.ts","sourceRoot":"","sources":["../../src/middleware/firebaseAuth.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAW,iBAAiB,EAAQ,MAAM,MAAM,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAG1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD;;GAEG;AACH,OAAO,QAAQ,MAAM,CAAC;IACpB,UAAU,kBAAkB;QAC1B,YAAY,EAAE,cAAc,CAAC;QAC7B,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,SAAS,EAAE,OAAO,CAAC;QACnB;;;;WAIG;QACH,UAAU,EAAE,UAAU,GAAG,SAAS,GAAG,gBAAgB,CAAC;QACtD,kEAAkE;QAClE,QAAQ,EAAE,MAAM,CAAC;QACjB,2EAA2E;QAC3E,cAAc,EAAE,MAAM,CAAC;QACvB,sEAAsE;QACtE,oBAAoB,EAAE,MAAM,CAAC;KAC9B;CACF;AAYD,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,cAAc,GAClB,iBAAiB,CA8JnB"}