@vertesia/common 1.5.0-dev.20260725.083715Z → 1.5.0-dev.20260806.125520Z

package/src/apikey.ts

@@ -1,8 +1,26 @@
+import type { z } from 'zod';
 import type { PropertyConditions } from './access-control.js';
+import type {
+    ApiKeyArraySchema,
+    ApiKeyListQuerySchema,
+    ApiKeyReadQuerySchema,
+    ApiKeyReadResponseSchema,
+    ApiKeySchema,
+    ApiKeyWithValueSchema,
+    AuthTokenResponseSchema,
+    CreateApiKeyPayloadSchema,
+    UpdateApiKeyPayloadSchema,
+} from './api-schemas/apikey.js';
 import type { UserGroupRef } from './group.js';
 import type { ProjectRef, SystemRoles } from './project.js';
 import type { AccountRef } from './user.js';
 
+/**
+ * `ApiKeyTypes` lives in `./apikey-values.js` so the API schemas can read it without importing this
+ * module back. Re-exported here so every existing import path keeps working.
+ */
+export * from './apikey-values.js';
+
 /**
  * Per-scope, per-verb property-condition arrays that narrow content visibility
  * at query time. Each value array uses $or semantics — any matching condition
@@ -28,35 +46,28 @@ export interface ContentSecurity {
     [scopedKey: string]: PropertyConditions[] | undefined;
 }
 
-export enum ApiKeyTypes {
-    secret = 'sk',
-}
-export interface ApiKey {
-    id: string;
-    name: string;
-    type: ApiKeyTypes;
-    role: SystemRoles;
-    maskedValue?: string; //masked value
-    can_retrieve_value?: boolean;
-    account: string; // the account id
-    project: ProjectRef; // the project id if any
-    enabled: boolean;
-    created_by: string;
-    updated_by: string;
-    created_at: Date;
-    updated_at: Date;
-    expires_at?: Date; // in case of public key only
-}
-
-export interface CreateOrUpdateApiKeyPayload extends Partial<ApiKey> {}
-
-export interface ApiKeyWithValue extends ApiKey {
-    value: string;
-}
-
-export interface ApiKeyReadResponse extends ApiKey {
-    value?: string;
-}
+/**
+ * The API key wire types, inferred from the schemas in `./api-schemas/apikey.js` — what OpenAPI
+ * publishes and AJV compiles.
+ *
+ * NOTE the timestamps are `string`, not `Date`. The document has always published them as
+ * `format: date-time` strings and JSON has no date type, so the previous `Date` declaration
+ * described the Mongoose document rather than the response a client parses.
+ */
+export type ApiKey = z.infer<typeof ApiKeySchema>;
+export type ApiKeyArray = z.infer<typeof ApiKeyArraySchema>;
+/**
+ * Create and update take DIFFERENT payloads, and did not before.
+ *
+ * `CreateOrUpdateApiKeyPayload` was `Partial<ApiKey>` shared by both, which meant the type permitted
+ * a create with no `role` (rejected by Mongoose inside the handler) and an update that omitted
+ * `role` (which unset a required path). Splitting it is source-breaking for the SDK and is announced
+ * as a release operation; the two names say which operation they belong to.
+ */
+export type CreateApiKeyPayload = z.infer<typeof CreateApiKeyPayloadSchema>;
+export type UpdateApiKeyPayload = z.infer<typeof UpdateApiKeyPayloadSchema>;
+export type ApiKeyWithValue = z.infer<typeof ApiKeyWithValueSchema>;
+export type ApiKeyReadResponse = z.infer<typeof ApiKeyReadResponseSchema>;
 
 export interface CreatePublicKeyPayload {
     name?: string;
@@ -64,17 +75,9 @@ export interface CreatePublicKeyPayload {
     ttl?: number;
 }
 
-export interface AuthTokenResponse {
-    token: string;
-}
-
-export interface ApiKeyListQuery {
-    level?: 'account' | 'project';
-}
-
-export interface ApiKeyReadQuery {
-    withValue?: boolean;
-}
+export type AuthTokenResponse = z.infer<typeof AuthTokenResponseSchema>;
+export type ApiKeyListQuery = z.infer<typeof ApiKeyListQuerySchema>;
+export type ApiKeyReadQuery = z.infer<typeof ApiKeyReadQuerySchema>;
 
 export interface AuthTokenPayload {
     sub: string;
@@ -173,6 +176,12 @@ export interface AuthTokenPayload {
         onBehalfOf?: AuthTokenPayload;
         [key: string]: unknown;
     };
+
+    /**
+     * Set only by STS for tokens minted by an attested internal workflow-launching service.
+     * API servers use this claim before accepting a caller-supplied logical request identity.
+     */
+    trusted_request_identity?: boolean;
 }
 
 export enum PrincipalType {

package/src/apps.test.ts

@@ -1,4 +1,9 @@
 import { describe, expect, it } from 'vitest';
+import {
+    AppEventHookPayloadSchema,
+    AppEventSubscriptionDefinitionSchema,
+    AppPackageHooksSchema,
+} from './api-schemas/app-runtime.js';
 import { APP_ARTIFACT_TYPES, APP_CAPABILITIES, APP_PACKAGE_SCOPES, effectiveAppAccessControl } from './apps.js';
 
 describe('app capability contracts', () => {
@@ -6,6 +11,83 @@ describe('app capability contracts', () => {
         expect(APP_CAPABILITIES).toContain('views');
         expect(APP_PACKAGE_SCOPES).toContain('views');
         expect(APP_ARTIFACT_TYPES).toContain('view');
+        expect(APP_ARTIFACT_TYPES).toContain('hook');
+        expect(APP_ARTIFACT_TYPES).toContain('subscription');
+    });
+
+    it('exposes app hooks as a package query scope', () => {
+        expect(APP_PACKAGE_SCOPES).toContain('hooks');
+        expect(APP_PACKAGE_SCOPES).toContain('subscriptions');
+    });
+
+    it('accepts app-owned subscriptions without a deployment-specific target', () => {
+        expect(
+            AppEventSubscriptionDefinitionSchema.parse({
+                id: 'content-updated',
+                name: 'Content updated',
+                hook: 'content-updated',
+                filter: { action: ['update'], resource_type: ['content_object'] },
+                run_as_role: 'automation',
+            }),
+        ).toEqual({
+            id: 'content-updated',
+            name: 'Content updated',
+            hook: 'content-updated',
+            filter: { action: ['update'], resource_type: ['content_object'] },
+            run_as_role: 'automation',
+        });
+    });
+
+    it('validates the canonical app event-hook envelope', () => {
+        const payload = {
+            event: {
+                event_id: 'event-1',
+                root_event_id: 'event-1',
+                hop_count: 0,
+                event_category: 'content',
+                action: 'update',
+                resource_type: 'content_object',
+                resource_id: 'object-1',
+                account_id: 'account-1',
+                project_id: 'project-1',
+                tenant_id: 'account-1_project-1',
+                timestamp: '2026-08-05T10:00:00.000Z',
+                source: 'zeno-server',
+                details: { changed: ['title'] },
+            },
+            delivery: {
+                id: 'delivery-1',
+                subscription_id: 'subscription-1',
+                attempt: 1,
+            },
+        };
+
+        expect(AppEventHookPayloadSchema.parse(payload)).toEqual(payload);
+        expect(() => AppEventHookPayloadSchema.parse({ event: payload.event })).toThrow();
+    });
+
+    it('accepts lifecycle and event hook package metadata', () => {
+        expect(
+            AppPackageHooksSchema.parse({
+                install: '/api/hooks/install',
+                events: [
+                    {
+                        name: 'content-updated',
+                        path: '/api/hooks/content-updated',
+                        description: 'Processes updated content.',
+                    },
+                ],
+            }),
+        ).toEqual({
+            install: '/api/hooks/install',
+            events: [
+                {
+                    name: 'content-updated',
+                    path: '/api/hooks/content-updated',
+                    description: 'Processes updated content.',
+                },
+            ],
+        });
     });
 });