@wopr-network/platform-core 0.1.0

package/dist/security/key-injection.test.js

@@ -0,0 +1,97 @@
+import { readFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { decrypt, generateInstanceKey } from "./encryption.js";
+import { forwardSecretsToInstance, writeEncryptedSeed } from "./key-injection.js";
+describe("key-injection", () => {
+    describe("writeEncryptedSeed", () => {
+        let tmpDir;
+        const key = generateInstanceKey();
+        beforeEach(async () => {
+            const { mkdtemp } = await import("node:fs/promises");
+            tmpDir = await mkdtemp(path.join(os.tmpdir(), "wopr-test-"));
+        });
+        afterEach(async () => {
+            const { rm } = await import("node:fs/promises");
+            await rm(tmpDir, { recursive: true, force: true });
+        });
+        it("writes secrets.enc to the woprHome directory", async () => {
+            const woprHome = path.join(tmpDir, "instance-1");
+            const secrets = { ANTHROPIC_API_KEY: "sk-ant-test123" };
+            await writeEncryptedSeed(woprHome, secrets, key);
+            const seedPath = path.join(woprHome, "secrets.enc");
+            const content = await readFile(seedPath, "utf-8");
+            const payload = JSON.parse(content);
+            expect(payload).toHaveProperty("iv");
+            expect(payload).toHaveProperty("authTag");
+            expect(payload).toHaveProperty("ciphertext");
+        });
+        it("encrypted seed can be decrypted back to original secrets", async () => {
+            const woprHome = path.join(tmpDir, "instance-2");
+            const secrets = { DISCORD_TOKEN: "token123", OPENAI_KEY: "sk-openai" };
+            await writeEncryptedSeed(woprHome, secrets, key);
+            const seedPath = path.join(woprHome, "secrets.enc");
+            const content = await readFile(seedPath, "utf-8");
+            const payload = JSON.parse(content);
+            const decrypted = JSON.parse(decrypt(payload, key));
+            expect(decrypted).toEqual(secrets);
+        });
+        it("creates directories recursively", async () => {
+            const woprHome = path.join(tmpDir, "deep", "nested", "dir");
+            await writeEncryptedSeed(woprHome, { KEY: "val" }, key);
+            const content = await readFile(path.join(woprHome, "secrets.enc"), "utf-8");
+            expect(JSON.parse(content)).toHaveProperty("ciphertext");
+        });
+        it("seed file does NOT contain plaintext key values", async () => {
+            const woprHome = path.join(tmpDir, "instance-3");
+            const secrets = { ANTHROPIC_API_KEY: "sk-ant-api0xxxxxxxxxxxxxxxxxxxx" };
+            await writeEncryptedSeed(woprHome, secrets, key);
+            const content = await readFile(path.join(woprHome, "secrets.enc"), "utf-8");
+            expect(content).not.toContain("sk-ant-api0xxxxxxxxxxxxxxxxxxxx");
+        });
+    });
+    describe("forwardSecretsToInstance", () => {
+        const originalFetch = globalThis.fetch;
+        beforeEach(() => {
+            globalThis.fetch = vi.fn();
+        });
+        afterEach(() => {
+            globalThis.fetch = originalFetch;
+        });
+        it("forwards body opaquely and returns ok on success", async () => {
+            vi.mocked(globalThis.fetch).mockResolvedValue(new Response(null, { status: 200 }));
+            const result = await forwardSecretsToInstance("http://container:3000", "session-token", '{"KEY":"val"}');
+            expect(result.ok).toBe(true);
+            expect(result.status).toBe(200);
+            expect(globalThis.fetch).toHaveBeenCalledWith("http://container:3000/config/secrets", expect.objectContaining({
+                method: "PUT",
+                body: '{"KEY":"val"}',
+                headers: expect.objectContaining({
+                    Authorization: "Bearer session-token",
+                }),
+            }));
+        });
+        it("returns error on non-ok response", async () => {
+            vi.mocked(globalThis.fetch).mockResolvedValue(new Response("Forbidden", { status: 403 }));
+            const result = await forwardSecretsToInstance("http://container:3000", "token", "{}");
+            expect(result.ok).toBe(false);
+            expect(result.status).toBe(403);
+            expect(result.error).toBe("Forbidden");
+        });
+        it("returns 502 on network error", async () => {
+            vi.mocked(globalThis.fetch).mockRejectedValue(new Error("Connection refused"));
+            const result = await forwardSecretsToInstance("http://container:3000", "token", "{}");
+            expect(result.ok).toBe(false);
+            expect(result.status).toBe(502);
+            expect(result.error).toBe("Connection refused");
+        });
+        it("returns 502 with fallback message when thrown value is not an Error", async () => {
+            vi.mocked(globalThis.fetch).mockRejectedValue("string error");
+            const result = await forwardSecretsToInstance("http://container:3000", "token", "{}");
+            expect(result.ok).toBe(false);
+            expect(result.status).toBe(502);
+            expect(result.error).toBe("Failed to forward secrets");
+        });
+    });
+});

package/dist/security/key-validation.d.ts

@@ -0,0 +1,16 @@
+import type { Provider, ProviderEndpoint, ValidateKeyResponse } from "./types.js";
+/**
+ * Provider API endpoints used for key validation.
+ * For CORS-friendly providers, the browser can call these directly.
+ * For CORS-blocked providers (e.g., Anthropic), the platform proxy decrypts
+ * and validates in memory without ever logging the key.
+ * URLs are sourced from PROVIDER_API_URLS; headers are provider-specific.
+ */
+export declare const PROVIDER_ENDPOINTS: Record<Provider, ProviderEndpoint>;
+/**
+ * Validate a provider API key by making a lightweight read-only request.
+ * The key is held in memory only for the duration of the fetch and then discarded.
+ *
+ * SECURITY: This function must NEVER log, persist, or return the key itself.
+ */
+export declare function validateProviderKey(provider: Provider, key: string): Promise<ValidateKeyResponse>;

package/dist/security/key-validation.js

@@ -0,0 +1,78 @@
+import { PROVIDER_API_URLS } from "../config/provider-endpoints.js";
+/**
+ * Provider API endpoints used for key validation.
+ * For CORS-friendly providers, the browser can call these directly.
+ * For CORS-blocked providers (e.g., Anthropic), the platform proxy decrypts
+ * and validates in memory without ever logging the key.
+ * URLs are sourced from PROVIDER_API_URLS; headers are provider-specific.
+ */
+export const PROVIDER_ENDPOINTS = {
+    anthropic: {
+        url: PROVIDER_API_URLS.anthropic,
+        headers: (key) => ({
+            "x-api-key": key,
+            "anthropic-version": "2023-06-01",
+        }),
+    },
+    openai: {
+        url: PROVIDER_API_URLS.openai,
+        headers: (key) => ({
+            Authorization: `Bearer ${key}`,
+        }),
+    },
+    google: {
+        url: PROVIDER_API_URLS.google,
+        headers: (key) => ({
+            "x-goog-api-key": key,
+        }),
+    },
+    discord: {
+        url: PROVIDER_API_URLS.discord,
+        headers: (key) => ({
+            Authorization: `Bot ${key}`,
+        }),
+    },
+    elevenlabs: {
+        url: PROVIDER_API_URLS.elevenlabs,
+        headers: (key) => ({
+            "xi-api-key": key,
+        }),
+    },
+    deepgram: {
+        url: PROVIDER_API_URLS.deepgram,
+        headers: (key) => ({
+            Authorization: `Token ${key}`,
+        }),
+    },
+};
+/**
+ * Validate a provider API key by making a lightweight read-only request.
+ * The key is held in memory only for the duration of the fetch and then discarded.
+ *
+ * SECURITY: This function must NEVER log, persist, or return the key itself.
+ */
+export async function validateProviderKey(provider, key) {
+    const endpoint = PROVIDER_ENDPOINTS[provider];
+    if (!endpoint) {
+        return { valid: false, error: `Unknown provider: ${provider}` };
+    }
+    try {
+        const response = await fetch(endpoint.url, {
+            method: "GET",
+            headers: endpoint.headers(key),
+            signal: AbortSignal.timeout(10_000),
+        });
+        if (response.ok) {
+            return { valid: true };
+        }
+        // 401/403 = invalid key; other errors are transient
+        if (response.status === 401 || response.status === 403) {
+            return { valid: false, error: "Invalid API key" };
+        }
+        return { valid: false, error: `Provider returned status ${response.status}` };
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : "Validation request failed";
+        return { valid: false, error: message };
+    }
+}

package/dist/security/key-validation.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/security/key-validation.test.js

@@ -0,0 +1,87 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { PROVIDER_API_URLS } from "../config/provider-endpoints.js";
+import { PROVIDER_ENDPOINTS, validateProviderKey } from "./key-validation.js";
+describe("key-validation", () => {
+    describe("PROVIDER_API_URLS", () => {
+        it("exports a URL for every supported provider", () => {
+            expect(PROVIDER_API_URLS.anthropic).toBe("https://api.anthropic.com/v1/models");
+            expect(PROVIDER_API_URLS.openai).toBe("https://api.openai.com/v1/models");
+            expect(PROVIDER_API_URLS.google).toBe("https://generativelanguage.googleapis.com/v1/models");
+            expect(PROVIDER_API_URLS.discord).toBe("https://discord.com/api/v10/users/@me");
+            expect(PROVIDER_API_URLS.elevenlabs).toBe("https://api.elevenlabs.io/v1/user");
+            expect(PROVIDER_API_URLS.deepgram).toBe("https://api.deepgram.com/v1/projects");
+        });
+    });
+    describe("PROVIDER_ENDPOINTS", () => {
+        it("has entries for all supported providers", () => {
+            expect(PROVIDER_ENDPOINTS.anthropic).toEqual(expect.any(Object));
+            expect(PROVIDER_ENDPOINTS.openai).toEqual(expect.any(Object));
+            expect(PROVIDER_ENDPOINTS.google).toEqual(expect.any(Object));
+            expect(PROVIDER_ENDPOINTS.discord).toEqual(expect.any(Object));
+        });
+        it("anthropic headers include x-api-key", () => {
+            const headers = PROVIDER_ENDPOINTS.anthropic.headers("test-key");
+            expect(headers["x-api-key"]).toBe("test-key");
+            expect(headers["anthropic-version"]).toBe("2023-06-01");
+        });
+        it("openai headers include Bearer token", () => {
+            const headers = PROVIDER_ENDPOINTS.openai.headers("test-key");
+            expect(headers.Authorization).toBe("Bearer test-key");
+        });
+        it("google headers include x-goog-api-key", () => {
+            const headers = PROVIDER_ENDPOINTS.google.headers("test-key");
+            expect(headers["x-goog-api-key"]).toBe("test-key");
+        });
+        it("discord headers include Bot prefix", () => {
+            const headers = PROVIDER_ENDPOINTS.discord.headers("test-key");
+            expect(headers.Authorization).toBe("Bot test-key");
+        });
+    });
+    describe("validateProviderKey", () => {
+        const originalFetch = globalThis.fetch;
+        beforeEach(() => {
+            globalThis.fetch = vi.fn();
+        });
+        afterEach(() => {
+            globalThis.fetch = originalFetch;
+        });
+        it("returns valid=true when provider returns 200", async () => {
+            vi.mocked(globalThis.fetch).mockResolvedValue(new Response(null, { status: 200 }));
+            const result = await validateProviderKey("openai", "sk-valid-key");
+            expect(result.valid).toBe(true);
+            expect(result.error).toBeUndefined();
+        });
+        it("returns valid=false with error for 401", async () => {
+            vi.mocked(globalThis.fetch).mockResolvedValue(new Response(null, { status: 401 }));
+            const result = await validateProviderKey("anthropic", "sk-ant-invalid");
+            expect(result.valid).toBe(false);
+            expect(result.error).toBe("Invalid API key");
+        });
+        it("returns valid=false with error for 403", async () => {
+            vi.mocked(globalThis.fetch).mockResolvedValue(new Response(null, { status: 403 }));
+            const result = await validateProviderKey("discord", "bad-token");
+            expect(result.valid).toBe(false);
+            expect(result.error).toBe("Invalid API key");
+        });
+        it("returns valid=false with status for non-auth errors", async () => {
+            vi.mocked(globalThis.fetch).mockResolvedValue(new Response(null, { status: 500 }));
+            const result = await validateProviderKey("openai", "sk-key");
+            expect(result.valid).toBe(false);
+            expect(result.error).toBe("Provider returned status 500");
+        });
+        it("returns valid=false on network error", async () => {
+            vi.mocked(globalThis.fetch).mockRejectedValue(new Error("Network timeout"));
+            const result = await validateProviderKey("google", "AIza-key");
+            expect(result.valid).toBe(false);
+            expect(result.error).toBe("Network timeout");
+        });
+        it("calls the correct provider URL", async () => {
+            vi.mocked(globalThis.fetch).mockResolvedValue(new Response(null, { status: 200 }));
+            await validateProviderKey("anthropic", "sk-ant-test");
+            expect(globalThis.fetch).toHaveBeenCalledWith("https://api.anthropic.com/v1/models", expect.objectContaining({
+                method: "GET",
+                headers: expect.objectContaining({ "x-api-key": "sk-ant-test" }),
+            }));
+        });
+    });
+});

package/dist/security/redirect-allowlist.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Throws if `url` is not rooted at one of the allowed origins.
+ * Comparison is scheme + host (origin), not prefix string match,
+ * to prevent bypasses like `https://app.wopr.bot.evil.com`.
+ */
+export declare function assertSafeRedirectUrl(url: string): void;

package/dist/security/redirect-allowlist.js

@@ -0,0 +1,36 @@
+const ALLOWED_REDIRECT_ORIGINS = [
+    "https://app.wopr.bot",
+    "https://wopr.network",
+    ...(process.env.NODE_ENV !== "production" ? ["http://localhost:3000", "http://localhost:3001"] : []),
+    ...(process.env.PLATFORM_UI_URL ? [process.env.PLATFORM_UI_URL] : []),
+    ...(process.env.NODE_ENV !== "production" ? ["https://example.com"] : []),
+];
+/**
+ * Throws if `url` is not rooted at one of the allowed origins.
+ * Comparison is scheme + host (origin), not prefix string match,
+ * to prevent bypasses like `https://app.wopr.bot.evil.com`.
+ */
+export function assertSafeRedirectUrl(url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        throw new Error("Invalid redirect URL");
+    }
+    if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+        throw new Error("Invalid redirect URL");
+    }
+    const origin = parsed.origin;
+    const allowed = ALLOWED_REDIRECT_ORIGINS.some((o) => {
+        try {
+            return origin === new URL(o).origin;
+        }
+        catch {
+            return false;
+        }
+    });
+    if (!allowed) {
+        throw new Error("Invalid redirect URL");
+    }
+}

package/dist/security/redirect-allowlist.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/security/redirect-allowlist.test.js

@@ -0,0 +1,55 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { assertSafeRedirectUrl } from "./redirect-allowlist.js";
+describe("assertSafeRedirectUrl", () => {
+    it("allows https://app.wopr.bot paths", () => {
+        expect(() => assertSafeRedirectUrl("https://app.wopr.bot/billing/success")).not.toThrow();
+    });
+    it("allows https://app.wopr.bot with query params", () => {
+        expect(() => assertSafeRedirectUrl("https://app.wopr.bot/dashboard?vps=activated")).not.toThrow();
+    });
+    it("allows https://wopr.network paths", () => {
+        expect(() => assertSafeRedirectUrl("https://wopr.network/welcome")).not.toThrow();
+    });
+    it("allows http://localhost:3000 in dev", () => {
+        expect(() => assertSafeRedirectUrl("http://localhost:3000/billing")).not.toThrow();
+    });
+    it("allows http://localhost:3001 in dev", () => {
+        expect(() => assertSafeRedirectUrl("http://localhost:3001/billing")).not.toThrow();
+    });
+    it("rejects external domains", () => {
+        expect(() => assertSafeRedirectUrl("https://evil.com/phishing")).toThrow("Invalid redirect URL");
+    });
+    it("rejects subdomain spoofing (app.wopr.bot.evil.com)", () => {
+        expect(() => assertSafeRedirectUrl("https://app.wopr.bot.evil.com/phishing")).toThrow("Invalid redirect URL");
+    });
+    it("rejects non-URL strings", () => {
+        expect(() => assertSafeRedirectUrl("not-a-url")).toThrow("Invalid redirect URL");
+    });
+    it("rejects javascript: URIs", () => {
+        expect(() => assertSafeRedirectUrl("javascript:alert(1)")).toThrow("Invalid redirect URL");
+    });
+    it("rejects data: URIs", () => {
+        expect(() => assertSafeRedirectUrl("data:text/html,<h1>pwned</h1>")).toThrow("Invalid redirect URL");
+    });
+    it("rejects empty string", () => {
+        expect(() => assertSafeRedirectUrl("")).toThrow("Invalid redirect URL");
+    });
+    describe("PLATFORM_UI_URL env-driven entry", () => {
+        beforeEach(() => {
+            process.env.PLATFORM_UI_URL = "https://platform.example.com";
+            vi.resetModules();
+        });
+        afterEach(() => {
+            delete process.env.PLATFORM_UI_URL;
+            vi.resetModules();
+        });
+        it("allows PLATFORM_UI_URL when set", async () => {
+            const { assertSafeRedirectUrl: assertSafe } = await import("./redirect-allowlist.js");
+            expect(() => assertSafe("https://platform.example.com/dashboard")).not.toThrow();
+        });
+        it("rejects URLs not matching PLATFORM_UI_URL", async () => {
+            const { assertSafeRedirectUrl: assertSafe } = await import("./redirect-allowlist.js");
+            expect(() => assertSafe("https://other.example.com/dashboard")).toThrow("Invalid redirect URL");
+        });
+    });
+});

package/dist/security/tenant-keys/capability-settings-store.d.ts

@@ -0,0 +1,22 @@
+import type { PlatformDb } from "../../db/index.js";
+export declare const ALL_CAPABILITIES: readonly ["transcription", "image-gen", "text-gen", "embeddings"];
+export type CapabilityName = (typeof ALL_CAPABILITIES)[number];
+export interface TenantCapabilitySetting {
+    tenant_id: string;
+    capability: string;
+    mode: string;
+    updated_at: number;
+}
+/** Repository for tenant capability mode settings (hosted vs byok). */
+export interface ICapabilitySettingsRepository {
+    listForTenant(tenantId: string): Promise<TenantCapabilitySetting[]>;
+    upsert(tenantId: string, capability: string, mode: string): Promise<void>;
+}
+export declare class CapabilitySettingsStore implements ICapabilitySettingsRepository {
+    private readonly db;
+    constructor(db: PlatformDb);
+    /** Get all capability settings for a tenant. Returns empty array if none set (defaults to hosted). */
+    listForTenant(tenantId: string): Promise<TenantCapabilitySetting[]>;
+    /** Set the mode for a specific capability. Upserts. */
+    upsert(tenantId: string, capability: string, mode: string): Promise<void>;
+}

package/dist/security/tenant-keys/capability-settings-store.js

@@ -0,0 +1,33 @@
+import { eq } from "drizzle-orm";
+import { tenantCapabilitySettings } from "../../db/schema/index.js";
+export const ALL_CAPABILITIES = ["transcription", "image-gen", "text-gen", "embeddings"];
+export class CapabilitySettingsStore {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    /** Get all capability settings for a tenant. Returns empty array if none set (defaults to hosted). */
+    async listForTenant(tenantId) {
+        const rows = await this.db
+            .select()
+            .from(tenantCapabilitySettings)
+            .where(eq(tenantCapabilitySettings.tenantId, tenantId));
+        return rows.map((r) => ({
+            tenant_id: r.tenantId,
+            capability: r.capability,
+            mode: r.mode,
+            updated_at: r.updatedAt,
+        }));
+    }
+    /** Set the mode for a specific capability. Upserts. */
+    async upsert(tenantId, capability, mode) {
+        const now = Date.now();
+        await this.db
+            .insert(tenantCapabilitySettings)
+            .values({ tenantId, capability, mode, updatedAt: now })
+            .onConflictDoUpdate({
+            target: [tenantCapabilitySettings.tenantId, tenantCapabilitySettings.capability],
+            set: { mode, updatedAt: now },
+        });
+    }
+}

package/dist/security/tenant-keys/capability-settings-store.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/security/tenant-keys/capability-settings-store.test.js

@@ -0,0 +1,77 @@
+import { afterAll, beforeAll, beforeEach, describe, expect, it } from "vitest";
+import { createTestDb, truncateAllTables } from "../../test/db.js";
+import { CapabilitySettingsStore } from "./capability-settings-store.js";
+describe("CapabilitySettingsStore", () => {
+    let db;
+    let pool;
+    let store;
+    beforeAll(async () => {
+        ({ db, pool } = await createTestDb());
+    });
+    afterAll(async () => {
+        await pool.close();
+    });
+    beforeEach(async () => {
+        await truncateAllTables(pool);
+        store = new CapabilitySettingsStore(db);
+    });
+    it("returns empty array for tenant with no overrides (platform defaults apply)", async () => {
+        const settings = await store.listForTenant("tenant-no-overrides");
+        expect(settings).toEqual([]);
+    });
+    it("upsert sets per-tenant override that listForTenant returns", async () => {
+        await store.upsert("tenant-1", "transcription", "byok");
+        const settings = await store.listForTenant("tenant-1");
+        expect(settings).toHaveLength(1);
+        expect(settings[0]).toMatchObject({
+            tenant_id: "tenant-1",
+            capability: "transcription",
+            mode: "byok",
+        });
+        expect(settings[0].updated_at).toBeGreaterThan(0);
+    });
+    it("upsert can toggle mode between hosted and byok", async () => {
+        await store.upsert("tenant-2", "image-gen", "byok");
+        let settings = await store.listForTenant("tenant-2");
+        expect(settings[0].mode).toBe("byok");
+        await store.upsert("tenant-2", "image-gen", "hosted");
+        settings = await store.listForTenant("tenant-2");
+        expect(settings).toHaveLength(1);
+        expect(settings[0].mode).toBe("hosted");
+    });
+    it("upsert overwrites previous mode via onConflictDoUpdate", async () => {
+        await store.upsert("tenant-3", "text-gen", "hosted");
+        const before = await store.listForTenant("tenant-3");
+        const firstUpdatedAt = before[0].updated_at;
+        // Small delay so timestamp differs
+        await new Promise((r) => setTimeout(r, 5));
+        await store.upsert("tenant-3", "text-gen", "byok");
+        const after = await store.listForTenant("tenant-3");
+        expect(after).toHaveLength(1);
+        expect(after[0].mode).toBe("byok");
+        expect(after[0].updated_at).toBeGreaterThanOrEqual(firstUpdatedAt);
+    });
+    it("tenant A overrides do not appear in tenant B list", async () => {
+        await store.upsert("tenant-A", "transcription", "byok");
+        await store.upsert("tenant-A", "image-gen", "byok");
+        await store.upsert("tenant-B", "embeddings", "hosted");
+        const settingsA = await store.listForTenant("tenant-A");
+        const settingsB = await store.listForTenant("tenant-B");
+        expect(settingsA).toHaveLength(2);
+        expect(settingsA.every((s) => s.tenant_id === "tenant-A")).toBe(true);
+        expect(settingsB).toHaveLength(1);
+        expect(settingsB[0].tenant_id).toBe("tenant-B");
+        expect(settingsB[0].capability).toBe("embeddings");
+    });
+    it("upsert changes are immediately visible in subsequent reads (no stale cache)", async () => {
+        await store.upsert("tenant-C", "text-gen", "hosted");
+        const read1 = await store.listForTenant("tenant-C");
+        expect(read1[0].mode).toBe("hosted");
+        await store.upsert("tenant-C", "text-gen", "byok");
+        const read2 = await store.listForTenant("tenant-C");
+        expect(read2[0].mode).toBe("byok");
+        await store.upsert("tenant-C", "image-gen", "byok");
+        const read3 = await store.listForTenant("tenant-C");
+        expect(read3).toHaveLength(2);
+    });
+});

package/dist/security/tenant-keys/index.d.ts

@@ -0,0 +1,10 @@
+export type { IKeyResolutionRepository } from "./key-resolution-repository.js";
+export { DrizzleKeyResolutionRepository } from "./key-resolution-repository.js";
+export type { ResolvedKey } from "./key-resolution.js";
+export { resolveApiKey, buildPooledKeysMap } from "./key-resolution.js";
+export type { TenantApiKey, ITenantKeyRepository } from "./tenant-key-repository.js";
+export { TenantKeyRepository } from "./tenant-key-repository.js";
+export type { CapabilityName, TenantCapabilitySetting, ICapabilitySettingsRepository } from "./capability-settings-store.js";
+export { ALL_CAPABILITIES, CapabilitySettingsStore } from "./capability-settings-store.js";
+export type { IOrgMembershipRepository, OrgResolvedKey } from "./org-key-resolution.js";
+export { DrizzleOrgMembershipRepository, resolveApiKeyWithOrgFallback } from "./org-key-resolution.js";

package/dist/security/tenant-keys/index.js

@@ -0,0 +1,5 @@
+export { DrizzleKeyResolutionRepository } from "./key-resolution-repository.js";
+export { resolveApiKey, buildPooledKeysMap } from "./key-resolution.js";
+export { TenantKeyRepository } from "./tenant-key-repository.js";
+export { ALL_CAPABILITIES, CapabilitySettingsStore } from "./capability-settings-store.js";
+export { DrizzleOrgMembershipRepository, resolveApiKeyWithOrgFallback } from "./org-key-resolution.js";

package/dist/security/tenant-keys/key-resolution-repository.d.ts

@@ -0,0 +1,15 @@
+import type { PlatformDb } from "../../db/index.js";
+import type { Provider } from "../types.js";
+/** Repository for looking up tenant BYOK keys by tenant + provider. */
+export interface IKeyResolutionRepository {
+    findEncryptedKey(tenantId: string, provider: Provider): Promise<{
+        encryptedKey: string;
+    } | null>;
+}
+export declare class DrizzleKeyResolutionRepository implements IKeyResolutionRepository {
+    private readonly db;
+    constructor(db: PlatformDb);
+    findEncryptedKey(tenantId: string, provider: Provider): Promise<{
+        encryptedKey: string;
+    } | null>;
+}

package/dist/security/tenant-keys/key-resolution-repository.js

@@ -0,0 +1,18 @@
+import { and, eq } from "drizzle-orm";
+import { tenantApiKeys } from "../../db/schema/index.js";
+// ---------------------------------------------------------------------------
+// Implementation
+// ---------------------------------------------------------------------------
+export class DrizzleKeyResolutionRepository {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    async findEncryptedKey(tenantId, provider) {
+        const row = (await this.db
+            .select({ encryptedKey: tenantApiKeys.encryptedKey })
+            .from(tenantApiKeys)
+            .where(and(eq(tenantApiKeys.tenantId, tenantId), eq(tenantApiKeys.provider, provider))))[0];
+        return row ?? null;
+    }
+}

package/dist/security/tenant-keys/key-resolution-repository.test.d.ts

@@ -0,0 +1 @@
+export {};