@velora-cms/server 0.11.0

package/dist/app.js

@@ -0,0 +1,252 @@
+import Fastify from "fastify";
+import fastifyCookie from "@fastify/cookie";
+import fastifyJwt from "@fastify/jwt";
+import fastifyMultipart from "@fastify/multipart";
+import fastifySwagger from "@fastify/swagger";
+import fastifySwaggerUi from "@fastify/swagger-ui";
+import { createJsonSchemaTransform, serializerCompiler, validatorCompiler, } from "fastify-type-provider-zod";
+import { ensureApiContentAuthor } from "./auth/api-content-author.js";
+import { isHeadlessEnabled } from "./config/headless.js";
+import { getMarketplaceBaseUrl } from "./config/marketplace.js";
+import { isPublicDocsEnabled } from "./config/public-docs.js";
+import { trustProxyFromEnv } from "./config/trust-proxy.js";
+import { connectContentDb } from "./db/content-db.js";
+import { prisma, resolvePrismaDialect } from "./db/prisma.js";
+import { resolveClientDir } from "./db/resolve-client-dir.js";
+import { filterPublicApiSpec } from "./docs/filter-public-api-spec.js";
+import { startLicenseRevalidation } from "./marketplace/license-revalidation-job.js";
+import { MediaService, mediaStorageConfigFromEnv } from "./media/media-service.js";
+import { bootInstalledPlugins } from "./plugins/boot-plugin-loader.js";
+import { createHookDispatcher } from "./plugins/hook-dispatcher.js";
+import { PluginRegistryService } from "./plugins/plugin-registry-service.js";
+import { SimpleStorageAPI } from "./plugins/simple-storage-api.js";
+import { StructuredStorageAPI } from "./plugins/structured-storage-api.js";
+import { StructuredSnapshotService } from "./plugins/structured-snapshot-service.js";
+import { apiKeyRoutes } from "./routes/api-keys.js";
+import { apiPlaygroundRoutes } from "./routes/api-playground.js";
+import { authRoutes } from "./routes/auth.js";
+import { contentRoutes } from "./routes/content.js";
+import { documentTypeRoutes } from "./routes/document-types.js";
+import { adminStaticRoutes } from "./routes/admin-static.js";
+import { docsStaticRoutes } from "./routes/docs-static.js";
+import { createFrameworkErrorHandler, registerHeadlessBridge } from "./routes/headless-bridge.js";
+import { healthRoutes } from "./routes/health.js";
+import { marketplaceProxyRoutes } from "./routes/marketplace-proxy.js";
+import { mediaRoutes } from "./routes/media.js";
+import { dataTypeRoutes } from "./routes/data-types.js";
+import { pluginRoutes } from "./routes/plugins.js";
+import { themeRoutes } from "./routes/themes.js";
+import { pluginApiRoutes } from "./routes/plugin-api-routes.js";
+import { pluginAssetsRoutes } from "./routes/plugin-assets.js";
+import { pluginManagementRoutes } from "./routes/plugin-management.js";
+import { pluginStorageRoutes } from "./routes/plugin-storage.js";
+import { publicApiRoutes } from "./routes/public-api.js";
+import { snapshotRoutes } from "./routes/snapshots.js";
+import { setupRoutes } from "./routes/setup.js";
+import { usersRoutes } from "./routes/users.js";
+import { templateRoutes } from "./routes/templates.js";
+export async function buildApp() {
+    // frameworkErrors (S156): the only hook into find-my-way's own
+    // pre-routing FST_ERR_BAD_URL/FST_ERR_ASYNC_CONSTRAINT responses — it's
+    // constructor-time-only, so it can't be registered later alongside
+    // registerHeadlessBridge below. See headless-bridge.ts's
+    // createFrameworkErrorHandler doc comment for why setNotFoundHandler /
+    // setErrorHandler can't reach this case.
+    //
+    // trustProxy (S160 final-fix, finding 1): constructor-time-only, same as
+    // frameworkErrors above — it configures Fastify's own request.ip/hostname
+    // resolution, not something that can be layered on via a hook afterward.
+    // trustProxyFromEnv() returns `undefined` when VELORA_TRUST_PROXY is
+    // unset, and the key is omitted from the options object entirely in that
+    // case (not passed as `trustProxy: undefined`) so today's behaviour — no
+    // trust, request.ip is always the socket's remote address — is preserved
+    // byte-for-byte for every deployment that hasn't opted in.
+    const trustProxy = trustProxyFromEnv();
+    const app = Fastify({
+        logger: true,
+        frameworkErrors: createFrameworkErrorHandler(),
+        ...(trustProxy !== undefined ? { trustProxy } : {}),
+    }).withTypeProvider();
+    app.setValidatorCompiler(validatorCompiler);
+    app.setSerializerCompiler(serializerCompiler);
+    const jwtSecret = process.env.JWT_SECRET;
+    if (!jwtSecret) {
+        throw new Error("JWT_SECRET must be set — see .env.example");
+    }
+    await app.register(fastifyJwt, { secret: jwtSecret });
+    await app.register(fastifyCookie);
+    await app.register(fastifyMultipart, {
+        // Media uploads only — 50 MiB covers images/documents; revisit when
+        // video needs streaming multipart instead of toBuffer().
+        limits: { fileSize: 50 * 1024 * 1024 },
+    });
+    await app.register(fastifySwagger, {
+        openapi: {
+            openapi: "3.1.0",
+            info: {
+                title: "Velora API",
+                version: "0.1.0",
+            },
+        },
+        // jsonSchemaTransform (the package's zero-config default) assumes
+        // EVERY route.schema it sees came from a zod object and unconditionally
+        // looks it up in zod's global registry — it throws, not skips, on a
+        // route carrying a plain JSON-schema object. mercurius (Session 113,
+        // Task 2) sets exactly that on its own /api/v1/graphql routes (request
+        // envelope validation it owns itself), so the one skip here keeps
+        // those out of zodSchemaToJson's path. GraphQL's shape (arbitrary
+        // query/variables JSON) isn't OpenAPI-expressible anyway — same reason
+        // this surface gets a GraphiQL page instead of a Swagger entry.
+        transform: createJsonSchemaTransform({ skipList: ["/api/v1/graphql"] }),
+    });
+    await app.register(fastifySwaggerUi, {
+        routePrefix: "/api/docs",
+    });
+    // Public API docs (Month 9, Session 109) — a SECOND Swagger UI serving
+    // ONLY the /api/v1 surface, via transformSpecification filtering the one
+    // generated spec. Registered only when headless is on (the /api/v1 API
+    // exists) AND the public-docs flag is enabled (off = hardening: the docs
+    // URL 404s, the API keeps answering). The internal /api/docs above is
+    // untouched.
+    //
+    // @fastify/swagger-ui's plugin is wrapped with fastify-plugin, so it
+    // always decorates whatever instance it's registered on (fastify-plugin
+    // deliberately breaks encapsulation). Registering it a second time
+    // directly on `app` collides with the /api/docs registration above on
+    // the `swaggerCSP` decorator ("already been added"). Registering it
+    // inside a plain (non-fp) async plugin function first forces avvio to
+    // create a genuinely new encapsulated child instance, so the second
+    // swagger-ui's decorator lands on that child instead of colliding with
+    // the parent's.
+    if (isHeadlessEnabled() && isPublicDocsEnabled()) {
+        await app.register(async (publicDocsApp) => {
+            await publicDocsApp.register(fastifySwaggerUi, {
+                routePrefix: "/api/v1/docs",
+                transformSpecification: (swaggerObject) => filterPublicApiSpec(swaggerObject),
+                // The transformed object is already the final public spec — no
+                // per-request cloning needed beyond filterPublicApiSpec's own copy.
+                transformSpecificationClone: false,
+            });
+        });
+    }
+    const contentDb = await connectContentDb();
+    app.addHook("onClose", async () => {
+        await contentDb.adapter.disconnect();
+    });
+    const mediaService = new MediaService(prisma, mediaStorageConfigFromEnv(), 
+    // Routed through resolveClientDir() rather than reading
+    // VELORA_PRISMA_CLIENT_DIR directly, so there's one channel deciding
+    // "which generated client dir" instead of two (db/prisma.ts's own
+    // `prisma` export already goes through this same helper). Behaviour is
+    // unchanged for every existing case: velora-dev's sandbox value has no
+    // dialect-named suffix and passes through resolveClientDir's explicit
+    // branch untouched, so resolvePrismaDialect still falls through to the
+    // DATABASE_URL-scheme branch for it exactly as before.
+    resolvePrismaDialect(resolveClientDir(), process.env.DATABASE_URL));
+    await mediaService.ensureBucket();
+    // The registry's dialect gate follows the content database's resolved
+    // dialect — contentDb.dialect is the resolved postgresql|mysql|sqlite
+    // union (Session 122), so 'mock' is excluded by construction and no
+    // cast is needed.
+    const structuredSnapshotService = new StructuredSnapshotService(contentDb.adapter, prisma);
+    const pluginRegistry = new PluginRegistryService(prisma, contentDb.adapter, {
+        activeDialect: contentDb.dialect,
+        structuredDataLifecycle: {
+            snapshot: (pluginId) => structuredSnapshotService.snapshotPluginTables(pluginId, "uninstall"),
+            cleanup: (pluginId) => structuredSnapshotService.dropPluginTables(pluginId),
+        },
+    });
+    const simpleStorageAPI = new SimpleStorageAPI(contentDb.adapter, pluginRegistry);
+    const structuredStorageAPI = new StructuredStorageAPI(contentDb.adapter, pluginRegistry, prisma);
+    // S159: the hook engine — content lifecycle events reach active plugins'
+    // hook handlers. Wired post-construction (contentDb exists before the
+    // registry does); dispatch is fire-and-forget by construction.
+    contentDb.contentService.setOnContentEvent(createHookDispatcher({
+        registry: pluginRegistry,
+        structuredStorageAPI,
+        contentService: contentDb.contentService,
+        adapter: contentDb.adapter,
+        log: app.log,
+    }));
+    // Exposes the exact PluginRegistryService instance the routes below
+    // close over. A freshly-constructed PluginRegistryService in a test or
+    // script still has its own private, empty manifests Map, disjoint from
+    // this one (see plugin-registry-service.ts's attachManifest doc
+    // comment) — that part of the old caveat still holds. What's changed
+    // since Session 122: manifests now re-attach at every app build via
+    // bootInstalledPlugins below, reading from the managed package store,
+    // so a fresh buildApp() DOES see plugins installed in a previous
+    // process (the S89 no-boot-loader gap is closed). Installing or
+    // activating a plugin MID-PROCESS, though, must still go through THIS
+    // instance, not a separately `new`-ed one — that's what
+    // pluginApiRoutes's dispatcher below closes over.
+    app.decorate("pluginRegistry", pluginRegistry);
+    // Session 122: re-attach every installed plugin's manifest from the
+    // managed package store before the server answers requests — the
+    // post-restart bridge that closes the S89 no-boot-loader gap.
+    await bootInstalledPlugins(prisma, pluginRegistry, { info: (m) => app.log.info(m), warn: (m) => app.log.warn(m) });
+    await app.register(setupRoutes, { setupRequired: false, databaseConfigured: true });
+    await app.register(healthRoutes);
+    await app.register(docsStaticRoutes);
+    // The admin SPA at /velora (S184). Registered unconditionally, exactly
+    // like docsStaticRoutes above: the VELORA_ADMIN=off switch lives INSIDE
+    // the module so a disabled instance still answers /velora/* with a 404
+    // that names the flag (the design doc's verification calls for a
+    // 404-with-cause there, not a bare unmatched-route 404), while leaving
+    // GET / on its pre-S184 headless-bridge behaviour.
+    await app.register(adminStaticRoutes);
+    await app.register(pluginAssetsRoutes);
+    await app.register(authRoutes);
+    await app.register(usersRoutes);
+    await app.register(apiPlaygroundRoutes);
+    await app.register(apiKeyRoutes);
+    await app.register(pluginRoutes);
+    await app.register(themeRoutes);
+    await app.register(pluginManagementRoutes, { adapter: contentDb.adapter, structuredSnapshotService });
+    // In-CMS marketplace browse/detail proxy (Session 137). Session 180:
+    // getMarketplaceBaseUrl() now defaults to the hosted marketplace when
+    // VELORA_MARKETPLACE_URL is unset, so these routes register by default
+    // on a fresh install — only an explicit `off` (or a blank value) leaves
+    // them structurally absent, same precedent as isHeadlessEnabled below:
+    // a disabled instance gets no dead endpoints, not a 404 from an
+    // always-registered handler.
+    const marketplaceBaseUrl = getMarketplaceBaseUrl();
+    if (marketplaceBaseUrl) {
+        await app.register(marketplaceProxyRoutes, {
+            marketplaceBaseUrl,
+            activeDialect: contentDb.dialect,
+            adapter: contentDb.adapter,
+        });
+        // The first background timer in apps/server (Session 139). unref()'d
+        // internally so it can never hold the process open, and stopped here
+        // on close — every integration test that builds and closes an app via
+        // this same gate would otherwise leak a live interval.
+        const stopLicenseRevalidation = startLicenseRevalidation({ prisma, registry: pluginRegistry, marketplaceBaseUrl });
+        app.addHook("onClose", async () => {
+            await stopLicenseRevalidation();
+        });
+    }
+    await app.register(contentRoutes, contentDb);
+    await app.register(snapshotRoutes, contentDb);
+    await app.register(documentTypeRoutes, contentDb);
+    await app.register(dataTypeRoutes, contentDb);
+    await app.register(templateRoutes, contentDb);
+    await app.register(mediaRoutes, { mediaService });
+    await app.register(pluginStorageRoutes, { adapter: contentDb.adapter, simpleStorageAPI });
+    await app.register(pluginApiRoutes, {
+        registry: pluginRegistry,
+        structuredStorageAPI,
+        contentService: contentDb.contentService,
+        adapter: contentDb.adapter,
+    });
+    // Public Content API (Month 9) — only exists when the deploy-time
+    // headless flag is on. Off means structurally absent (404), not 403.
+    if (isHeadlessEnabled()) {
+        const apiContentAuthorId = await ensureApiContentAuthor(prisma);
+        await app.register(publicApiRoutes, { ...contentDb, mediaService, apiContentAuthorId });
+    }
+    // S156: the app-wide not-found handler — registered last, after every
+    // route mount, so it only ever sees genuinely unmatched URLs.
+    registerHeadlessBridge(app, { adapter: contentDb.adapter });
+    return app;
+}

package/dist/auth/api-content-author.d.ts

@@ -0,0 +1,2 @@
+import type { PrismaClient } from "@prisma/client";
+export declare function ensureApiContentAuthor(prisma: PrismaClient): Promise<string>;

package/dist/auth/api-content-author.js

@@ -0,0 +1,27 @@
+import { randomBytes } from "node:crypto";
+import { hashPassword } from "./tokens.js";
+// The public Content API (Month 9) is key-gated — an API key carries no
+// user id, but ContentService.createContent requires a createdBy UUID that
+// lands in ContentVersion.createdBy (serialized back as a strict uuid by
+// PublicContentWriteResponseSchema/ContentValidationErrorSchema's callers).
+// Rather than inventing a fake uuid or loosening the uuid contract, every
+// public-API write is attributed to one fixed, idempotent system user —
+// resolved once at startup (buildApp) and reused for the life of the
+// process. This is a non-login account: passwordHash is a random bcrypt
+// hash nobody knows the plaintext for, so it can never authenticate via
+// the normal login route.
+const API_CONTENT_AUTHOR_EMAIL = "api-author@velora.internal";
+export async function ensureApiContentAuthor(prisma) {
+    const nonLoginPasswordHash = await hashPassword(randomBytes(32).toString("hex"));
+    const user = await prisma.user.upsert({
+        where: { email: API_CONTENT_AUTHOR_EMAIL },
+        update: {},
+        create: {
+            email: API_CONTENT_AUTHOR_EMAIL,
+            passwordHash: nonLoginPasswordHash,
+            name: "Public API",
+            role: "editor",
+        },
+    });
+    return user.id;
+}

package/dist/auth/api-keys.d.ts

@@ -0,0 +1,7 @@
+import type { FastifyReply, FastifyRequest } from "fastify";
+import type { ApiKeyScope } from "@velora-cms/api-schemas";
+export declare function generateApiKey(): string;
+export declare function hashApiKey(key: string): string;
+export declare function isApiKeyHashValid(hash: string): Promise<boolean>;
+export declare function requireApiKey(request: FastifyRequest, reply: FastifyReply): Promise<void>;
+export declare function requireApiKeyScope(required: ApiKeyScope): (request: FastifyRequest, reply: FastifyReply) => Promise<void>;

package/dist/auth/api-keys.js

@@ -0,0 +1,85 @@
+import { createHash, randomBytes } from "node:crypto";
+import { prisma } from "../db/prisma.js";
+// Public Content API keys (Month 9, Session 101). A deliberately separate
+// code path from the admin JWT/cookie session (api-design.md: never
+// conflate headless consumers with logged-in admin sessions).
+const KEY_PREFIX = "vk_";
+// High-entropy random secret, so sha256 (fast) is the right hash — same
+// reasoning as hashRefreshToken in tokens.ts, NOT bcrypt like passwords.
+export function generateApiKey() {
+    return KEY_PREFIX + randomBytes(32).toString("hex");
+}
+export function hashApiKey(key) {
+    return createHash("sha256").update(key).digest("hex");
+}
+// One uniform 401 for every failure mode — missing header, malformed,
+// unknown, revoked. Distinguishing them would let a caller probe which
+// keys exist. Never echo the presented key back.
+const UNAUTHORIZED_MESSAGE = "A valid API key is required";
+// Deliberately distinct from UNAUTHORIZED_MESSAGE and a 403, not a 401:
+// the key authenticated fine, it simply is not allowed to write. Telling
+// the caller that costs nothing (they already hold the key) and is the
+// only way they can know to mint a write key instead.
+const READ_ONLY_MESSAGE = "This API key is read-only";
+// Shared with rate-limit.ts (Session 160, Task 1 fix round 3): the rate
+// limiter's keyGenerator has to resolve a presented vk_ token to a real,
+// non-revoked key BEFORE this function ever runs (it runs as an onRequest
+// hook ahead of the route dispatch that eventually calls requireApiKey),
+// so both need the exact same "is this hash a live key" query — a second,
+// slightly-different query shape here would be a second place for that
+// definition to drift. Returns the record (not just a boolean) so
+// requireApiKey can still reach its id for the lastUsedAt write below.
+async function findLiveApiKeyByHash(hash) {
+    const record = await prisma.apiKey.findUnique({ where: { keyHash: hash } });
+    return record && record.revokedAt === null ? record : null;
+}
+// rate-limit.ts's only use of this module: resolve a presented token to
+// "is this a real, non-revoked key" without needing the full record or
+// triggering requireApiKey's lastUsedAt write (that write belongs to an
+// actual authenticated request, not a rate-limit bucket lookup that may
+// run against routes this key was never even destined to authenticate).
+export async function isApiKeyHashValid(hash) {
+    return (await findLiveApiKeyByHash(hash)) !== null;
+}
+// onRequest, not preHandler, for the same reason as require-auth.ts:
+// body validation runs before preHandler, so unauthenticated requests
+// would get validation 400s instead of a 401.
+export async function requireApiKey(request, reply) {
+    const header = request.headers.authorization;
+    if (!header?.startsWith("Bearer ")) {
+        await reply.code(401).send({ message: UNAUTHORIZED_MESSAGE });
+        return;
+    }
+    const key = header.slice("Bearer ".length).trim();
+    if (!key.startsWith(KEY_PREFIX)) {
+        await reply.code(401).send({ message: UNAUTHORIZED_MESSAGE });
+        return;
+    }
+    const record = await findLiveApiKeyByHash(hashApiKey(key));
+    if (!record) {
+        await reply.code(401).send({ message: UNAUTHORIZED_MESSAGE });
+        return;
+    }
+    // Everything downstream (requireApiKeyScope, and any future per-key
+    // policy) reads the key off the request rather than re-querying.
+    request.apiKey = { id: record.id, scope: record.scope };
+    // Awaited, per-request write: fine at current scale, and it makes
+    // lastUsedAt trustworthy for Session 102's key-management UI. Revisit
+    // (throttle/fire-and-forget) with Session 108's rate limiting if it
+    // ever shows up in profiles.
+    await prisma.apiKey.update({
+        where: { id: record.id },
+        data: { lastUsedAt: new Date() },
+    });
+}
+// Runs AFTER requireApiKey in a route's onRequest array, so request.apiKey
+// is already populated. "write" implies read, so only write-scoped routes
+// ever call this with "write" — read routes need no scope hook at all.
+export function requireApiKeyScope(required) {
+    return async (request, reply) => {
+        const scope = request.apiKey?.scope;
+        if (required === "write" && scope !== "write") {
+            await reply.code(403).send({ message: READ_ONLY_MESSAGE });
+        }
+    };
+}

package/dist/auth/jwt-payload.d.ts

@@ -0,0 +1,16 @@
+import "@fastify/jwt";
+import type { UserRole } from "@velora-cms/api-schemas";
+declare module "@fastify/jwt" {
+    interface FastifyJWT {
+        payload: {
+            sub: string;
+            email: string;
+            role: UserRole;
+        };
+        user: {
+            sub: string;
+            email: string;
+            role: UserRole;
+        };
+    }
+}

package/dist/auth/jwt-payload.js

@@ -0,0 +1 @@
+import "@fastify/jwt";

package/dist/auth/preview-tokens.d.ts

@@ -0,0 +1,7 @@
+export declare function mintPreviewToken(contentId: string, nowMs?: number): {
+    token: string;
+    expiresAt: string;
+};
+export declare function verifyPreviewToken(token: string, nowMs?: number): {
+    contentId: string;
+} | null;

package/dist/auth/preview-tokens.js

@@ -0,0 +1,76 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+import { previewTokenTtlSeconds } from "../config/preview.js";
+// Stateless preview tokens (Session 116, Task 1). A deliberately separate
+// code path from the admin JWT session (api-design.md: never conflate
+// headless/short-lived tokens with logged-in admin sessions) — this is a
+// signed-but-not-a-JWT format so it can never be replayed against a route
+// that expects an admin JWT, or vice versa:
+//
+//   base64url(JSON{contentId, exp}) + "." + base64url(hmacSignature)
+//
+// Exactly ONE dot. A real JWT is header.payload.signature (two dots) —
+// splitting on "." and requiring exactly 2 segments rejects any JWT
+// outright, by construction, with no explicit JWT-detection code needed.
+//
+// The signing key is derived per call from JWT_SECRET, never cached: tests
+// toggle JWT_SECRET via process.env across calls in the same run, and
+// caching would silently keep signing/verifying with a stale key.
+const DERIVATION_LABEL = "velora-preview-token";
+function derivedKey() {
+    const secret = process.env.JWT_SECRET;
+    if (!secret) {
+        throw new Error("JWT_SECRET must be set — see .env.example");
+    }
+    return createHmac("sha256", secret).update(DERIVATION_LABEL).digest();
+}
+function sign(payloadB64) {
+    return createHmac("sha256", derivedKey()).update(payloadB64).digest("base64url");
+}
+export function mintPreviewToken(contentId, nowMs = Date.now()) {
+    const exp = Math.floor(nowMs / 1000) + previewTokenTtlSeconds();
+    const payload = { contentId, exp };
+    const payloadB64 = Buffer.from(JSON.stringify(payload)).toString("base64url");
+    const signatureB64 = sign(payloadB64);
+    return {
+        token: `${payloadB64}.${signatureB64}`,
+        expiresAt: new Date(exp * 1000).toISOString(),
+    };
+}
+// Returns null for EVERY failure mode — malformed shape, bad signature,
+// expired — with no distinction between them. Distinguishing would let a
+// caller probe whether a guessed token is "close" (right shape, wrong sig)
+// vs. garbage, which is exactly the kind of oracle a token verifier must
+// not provide.
+export function verifyPreviewToken(token, nowMs = Date.now()) {
+    const parts = token.split(".");
+    if (parts.length !== 2) {
+        return null;
+    }
+    const [payloadB64, signatureB64] = parts;
+    if (!payloadB64 || !signatureB64) {
+        return null;
+    }
+    const expectedSignatureB64 = sign(payloadB64);
+    const presented = Buffer.from(signatureB64, "base64url");
+    const expected = Buffer.from(expectedSignatureB64, "base64url");
+    // Length-check before timingSafeEqual: it throws on mismatched buffer
+    // lengths rather than returning false, and skipping this check would
+    // itself be a length side-channel.
+    if (presented.length !== expected.length || !timingSafeEqual(presented, expected)) {
+        return null;
+    }
+    let payload;
+    try {
+        payload = JSON.parse(Buffer.from(payloadB64, "base64url").toString());
+    }
+    catch {
+        return null;
+    }
+    if (typeof payload?.contentId !== "string" || typeof payload?.exp !== "number") {
+        return null;
+    }
+    if (nowMs >= payload.exp * 1000) {
+        return null;
+    }
+    return { contentId: payload.contentId };
+}

package/dist/auth/rate-limit.d.ts

@@ -0,0 +1,16 @@
+import type { FastifyRequest } from "fastify";
+export declare function apiKeyValidityCacheSizeForTests(): number;
+export declare function rateLimitKey(request: FastifyRequest): Promise<string>;
+export declare function resolveGlobalTimeWindow(value: string | undefined): string;
+export declare const rateLimitConfig: {
+    max: (_req: FastifyRequest, key: string) => number;
+    timeWindow: string;
+    keyGenerator: typeof rateLimitKey;
+    errorResponseBuilder: (_request: FastifyRequest, context: {
+        after: string;
+        statusCode: number;
+    }) => {
+        statusCode: number;
+        message: string;
+    };
+};