alepha 0.15.0 → 0.15.2

package/dist/api/keys/index.js

@@ -0,0 +1,476 @@
+import { $inject, $module, Alepha, t } from "alepha";
+import { $action, ForbiddenError, NotFoundError, okSchema } from "alepha/server";
+import { $entity, $repository, db, pageQuerySchema, sql } from "alepha/orm";
+import { createHash, randomBytes } from "node:crypto";
+import { $cache } from "alepha/cache";
+import { DateTimeProvider } from "alepha/datetime";
+import { $logger } from "alepha/logger";
+
+//#region ../../src/api/keys/schemas/adminApiKeyQuerySchema.ts
+const adminApiKeyQuerySchema = t.extend(pageQuerySchema, {
+	userId: t.optional(t.uuid()),
+	includeRevoked: t.optional(t.boolean())
+});
+
+//#endregion
+//#region ../../src/api/keys/schemas/adminApiKeyResourceSchema.ts
+const adminApiKeyResourceSchema = t.object({
+	id: t.uuid(),
+	userId: t.uuid(),
+	name: t.string(),
+	description: t.optional(t.string()),
+	tokenPrefix: t.string(),
+	tokenSuffix: t.string(),
+	roles: t.array(t.string()),
+	createdAt: t.datetime(),
+	lastUsedAt: t.optional(t.datetime()),
+	lastUsedIp: t.optional(t.string()),
+	expiresAt: t.optional(t.datetime()),
+	revokedAt: t.optional(t.datetime()),
+	usageCount: t.integer()
+});
+
+//#endregion
+//#region ../../src/api/keys/entities/apiKeyEntity.ts
+const apiKeyEntity = $entity({
+	name: "api_keys",
+	schema: t.object({
+		id: db.primaryKey(t.uuid()),
+		createdAt: db.createdAt(),
+		updatedAt: db.updatedAt(),
+		userId: t.uuid(),
+		name: t.text({ maxLength: 100 }),
+		description: t.optional(t.text({ maxLength: 500 })),
+		tokenHash: t.string({ maxLength: 256 }),
+		tokenPrefix: t.string({ maxLength: 10 }),
+		tokenSuffix: t.string({ maxLength: 8 }),
+		roles: db.default(t.array(t.string()), []),
+		lastUsedAt: t.optional(t.datetime()),
+		lastUsedIp: t.optional(t.string({ maxLength: 45 })),
+		usageCount: db.default(t.integer(), 0),
+		expiresAt: t.optional(t.datetime()),
+		revokedAt: t.optional(t.datetime())
+	}),
+	indexes: [{
+		columns: ["userId", "name"],
+		unique: true
+	}, {
+		columns: ["tokenHash"],
+		unique: true
+	}]
+});
+
+//#endregion
+//#region ../../src/api/keys/services/ApiKeyService.ts
+var ApiKeyService = class {
+	alepha = $inject(Alepha);
+	dateTimeProvider = $inject(DateTimeProvider);
+	log = $logger();
+	repo = $repository(apiKeyEntity);
+	/**
+	* Cache validated API keys for 15 minutes.
+	*/
+	validationCache = $cache({
+		name: "api-key-validation",
+		ttl: [15, "minutes"]
+	});
+	/**
+	* Create an issuer resolver for API key authentication.
+	* Lower priority means it runs before JWT resolver.
+	*
+	* @param options.priority - Priority of this resolver (default: 50, JWT is 100)
+	* @param options.prefix - API key prefix to match in Bearer header (default: "ak")
+	*/
+	createResolver(options = {}) {
+		const { priority = 50, prefix = "ak" } = options;
+		const prefixPattern = `${prefix}_`;
+		return {
+			priority,
+			onRequest: async (req) => {
+				let token = (typeof req.url === "string" ? new URL(req.url) : req.url).searchParams.get("api_key");
+				if (!token) {
+					const auth = req.headers.authorization;
+					if (auth?.startsWith("Bearer ")) {
+						const bearerToken = auth.slice(7);
+						if (bearerToken.startsWith(prefixPattern)) token = bearerToken;
+					}
+				}
+				if (!token) return null;
+				return this.validate(token);
+			}
+		};
+	}
+	/**
+	* Create a new API key for a user.
+	* Returns both the API key entity and the plain token (which is only available once).
+	*/
+	async create(options) {
+		const prefix = options.prefix ?? "ak";
+		const token = `${prefix}_${randomBytes(24).toString("base64url")}`;
+		const hash = this.hashToken(token);
+		const suffix = token.slice(-8);
+		const apiKey = await this.repo.create({
+			userId: options.userId,
+			name: options.name,
+			description: options.description,
+			tokenHash: hash,
+			tokenPrefix: prefix,
+			tokenSuffix: suffix,
+			roles: options.roles,
+			expiresAt: options.expiresAt?.toISOString()
+		});
+		this.log.info("API key created", {
+			apiKeyId: apiKey.id,
+			userId: options.userId,
+			name: options.name
+		});
+		return {
+			apiKey,
+			token
+		};
+	}
+	/**
+	* List all non-revoked API keys for a user.
+	*/
+	async list(userId) {
+		return this.repo.findMany({
+			where: {
+				userId: { eq: userId },
+				revokedAt: { isNull: true }
+			},
+			orderBy: {
+				column: "createdAt",
+				direction: "desc"
+			}
+		});
+	}
+	/**
+	* Find all API keys with optional filtering (admin only).
+	*/
+	async findAll(query) {
+		query.sort ??= "-createdAt";
+		const where = this.repo.createQueryWhere();
+		if (query.userId) where.userId = { eq: query.userId };
+		if (!query.includeRevoked) where.revokedAt = { isNull: true };
+		return this.repo.paginate(query, { where }, { count: true });
+	}
+	/**
+	* Get an API key by ID (admin only).
+	*/
+	async getById(id) {
+		const apiKey = await this.repo.findById(id).catch(() => null);
+		if (!apiKey) throw new NotFoundError("API key not found");
+		return apiKey;
+	}
+	/**
+	* Revoke any API key (admin only).
+	*/
+	async revokeByAdmin(id) {
+		const apiKey = await this.repo.findById(id).catch(() => null);
+		if (!apiKey) throw new NotFoundError("API key not found");
+		if (apiKey.revokedAt) return;
+		await this.validationCache.invalidate(apiKey.tokenHash);
+		await this.repo.updateById(id, { revokedAt: this.dateTimeProvider.now().toISOString() });
+		this.log.info("API key revoked by admin", {
+			apiKeyId: id,
+			userId: apiKey.userId
+		});
+	}
+	/**
+	* Revoke an API key. Only the owner can revoke their own keys.
+	*/
+	async revoke(id, userId) {
+		const apiKey = await this.repo.findById(id).catch(() => null);
+		if (!apiKey) throw new NotFoundError("API key not found");
+		if (apiKey.userId !== userId) throw new ForbiddenError("Not your API key");
+		await this.validationCache.invalidate(apiKey.tokenHash);
+		await this.repo.updateById(id, { revokedAt: this.dateTimeProvider.now().toISOString() });
+		this.log.info("API key revoked", {
+			apiKeyId: id,
+			userId
+		});
+	}
+	/**
+	* Validate an API key token and return user info if valid.
+	*/
+	async validate(token) {
+		if (!token.includes("_")) return null;
+		const hash = this.hashToken(token);
+		let apiKey = await this.validationCache.get(hash);
+		if (apiKey === void 0) {
+			apiKey = await this.repo.findOne({ where: { tokenHash: { eq: hash } } }).catch(() => null);
+			if (apiKey) await this.validationCache.set(hash, apiKey);
+		}
+		if (!apiKey) return null;
+		if (apiKey.revokedAt) return null;
+		if (apiKey.expiresAt && this.dateTimeProvider.now().isAfter(apiKey.expiresAt)) return null;
+		this.updateUsage(apiKey.id).catch((error) => {
+			this.log.warn("Failed to update API key usage", { error });
+		});
+		return {
+			id: apiKey.userId,
+			roles: apiKey.roles
+		};
+	}
+	/**
+	* Update usage statistics for an API key.
+	*/
+	async updateUsage(id) {
+		const request = this.alepha.context.get("request");
+		await this.repo.updateById(id, {
+			lastUsedAt: this.dateTimeProvider.now().toISOString(),
+			lastUsedIp: request?.ip,
+			usageCount: sql`${this.repo.table.usageCount} + 1`
+		});
+	}
+	/**
+	* Hash a token using SHA-256.
+	*/
+	hashToken(token) {
+		return createHash("sha256").update(token).digest("hex");
+	}
+};
+
+//#endregion
+//#region ../../src/api/keys/controllers/AdminApiKeyController.ts
+/**
+* REST API controller for admin API key management.
+* Admins can list, view, and revoke any API key.
+*/
+var AdminApiKeyController = class {
+	url = "/admin/api-keys";
+	group = "admin:api-keys";
+	apiKeyService = $inject(ApiKeyService);
+	/**
+	* Find all API keys with optional filtering.
+	*/
+	findApiKeys = $action({
+		path: this.url,
+		group: this.group,
+		secure: true,
+		description: "Find API keys with pagination and filtering",
+		schema: {
+			query: adminApiKeyQuerySchema,
+			response: t.page(adminApiKeyResourceSchema)
+		},
+		handler: ({ query }) => {
+			const { userId, includeRevoked, ...pagination } = query;
+			return this.apiKeyService.findAll({
+				userId,
+				includeRevoked,
+				...pagination
+			});
+		}
+	});
+	/**
+	* Get an API key by ID.
+	*/
+	getApiKey = $action({
+		path: `${this.url}/:id`,
+		group: this.group,
+		secure: true,
+		description: "Get an API key by ID",
+		schema: {
+			params: t.object({ id: t.uuid() }),
+			response: adminApiKeyResourceSchema
+		},
+		handler: ({ params }) => this.apiKeyService.getById(params.id)
+	});
+	/**
+	* Revoke any API key.
+	*/
+	revokeApiKey = $action({
+		method: "DELETE",
+		path: `${this.url}/:id`,
+		group: this.group,
+		secure: true,
+		description: "Revoke an API key",
+		schema: {
+			params: t.object({ id: t.uuid() }),
+			response: okSchema
+		},
+		handler: async ({ params }) => {
+			await this.apiKeyService.revokeByAdmin(params.id);
+			return {
+				ok: true,
+				id: params.id
+			};
+		}
+	});
+};
+
+//#endregion
+//#region ../../src/api/keys/schemas/createApiKeyBodySchema.ts
+const createApiKeyBodySchema = t.object({
+	name: t.text({
+		minLength: 1,
+		maxLength: 100
+	}),
+	description: t.optional(t.text({ maxLength: 500 })),
+	expiresAt: t.optional(t.datetime())
+});
+
+//#endregion
+//#region ../../src/api/keys/schemas/createApiKeyResponseSchema.ts
+const createApiKeyResponseSchema = t.object({
+	id: t.uuid(),
+	name: t.string(),
+	token: t.string(),
+	tokenSuffix: t.string(),
+	roles: t.array(t.string()),
+	createdAt: t.datetime(),
+	expiresAt: t.optional(t.datetime())
+});
+
+//#endregion
+//#region ../../src/api/keys/schemas/listApiKeyResponseSchema.ts
+const listApiKeyItemSchema = t.object({
+	id: t.uuid(),
+	name: t.string(),
+	tokenPrefix: t.string(),
+	tokenSuffix: t.string(),
+	roles: t.array(t.string()),
+	createdAt: t.datetime(),
+	lastUsedAt: t.optional(t.datetime()),
+	expiresAt: t.optional(t.datetime()),
+	usageCount: t.integer()
+});
+const listApiKeyResponseSchema = t.array(listApiKeyItemSchema);
+
+//#endregion
+//#region ../../src/api/keys/schemas/revokeApiKeyParamsSchema.ts
+const revokeApiKeyParamsSchema = t.object({ id: t.uuid() });
+
+//#endregion
+//#region ../../src/api/keys/schemas/revokeApiKeyResponseSchema.ts
+const revokeApiKeyResponseSchema = t.object({ ok: t.boolean() });
+
+//#endregion
+//#region ../../src/api/keys/controllers/ApiKeyController.ts
+/**
+* REST API controller for user's own API key management.
+* Users can create, list, and revoke their own API keys.
+*/
+var ApiKeyController = class {
+	url = "/api-keys";
+	group = "api-keys";
+	apiKeyService = $inject(ApiKeyService);
+	/**
+	* Create a new API key for the authenticated user.
+	* The token is only returned once upon creation.
+	*/
+	createApiKey = $action({
+		method: "POST",
+		path: this.url,
+		group: this.group,
+		description: "Create a new API key",
+		secure: true,
+		schema: {
+			body: createApiKeyBodySchema,
+			response: createApiKeyResponseSchema
+		},
+		handler: async (request) => {
+			const { apiKey, token } = await this.apiKeyService.create({
+				userId: request.user.id,
+				name: request.body.name,
+				description: request.body.description,
+				roles: request.user.roles ?? [],
+				expiresAt: request.body.expiresAt ? new Date(request.body.expiresAt) : void 0
+			});
+			return {
+				id: apiKey.id,
+				name: apiKey.name,
+				token,
+				tokenSuffix: apiKey.tokenSuffix,
+				roles: apiKey.roles,
+				createdAt: apiKey.createdAt,
+				expiresAt: apiKey.expiresAt
+			};
+		}
+	});
+	/**
+	* List all active API keys for the authenticated user.
+	* Does not return the actual tokens.
+	*/
+	listApiKeys = $action({
+		path: this.url,
+		group: this.group,
+		description: "List your API keys",
+		secure: true,
+		schema: { response: listApiKeyResponseSchema },
+		handler: async (request) => {
+			return (await this.apiKeyService.list(request.user.id)).map((apiKey) => ({
+				id: apiKey.id,
+				name: apiKey.name,
+				tokenPrefix: apiKey.tokenPrefix,
+				tokenSuffix: apiKey.tokenSuffix,
+				roles: apiKey.roles,
+				createdAt: apiKey.createdAt,
+				lastUsedAt: apiKey.lastUsedAt,
+				expiresAt: apiKey.expiresAt,
+				usageCount: apiKey.usageCount
+			}));
+		}
+	});
+	/**
+	* Revoke an API key. Only the owner can revoke their own keys.
+	*/
+	revokeApiKey = $action({
+		method: "DELETE",
+		path: `${this.url}/:id`,
+		group: this.group,
+		description: "Revoke an API key",
+		secure: true,
+		schema: {
+			params: revokeApiKeyParamsSchema,
+			response: revokeApiKeyResponseSchema
+		},
+		handler: async (request) => {
+			await this.apiKeyService.revoke(request.params.id, request.user.id);
+			return { ok: true };
+		}
+	});
+};
+
+//#endregion
+//#region ../../src/api/keys/index.ts
+/**
+* | type | quality | stability |
+* |------|---------|--------------|
+* | backend | good | experimental |
+*
+* API key management module for programmatic access.
+*
+* **Features:**
+* - Create API keys with role snapshots
+* - List and revoke API keys
+* - 15-minute validation caching
+* - Query param (?api_key=) and Bearer header support
+*
+* **Integration:**
+* To enable API key authentication for an issuer, register the resolver:
+*
+* ```ts
+* class MyApp {
+*   apiKeyService = $inject(ApiKeyService);
+*   issuer = $issuer({
+*     secret: env.APP_SECRET,
+*     resolvers: [this.apiKeyService.createResolver()],
+*   });
+* }
+* ```
+*
+* @module alepha.api.keys
+*/
+const AlephaApiKeys = $module({
+	name: "alepha.api.keys",
+	services: [
+		ApiKeyService,
+		ApiKeyController,
+		AdminApiKeyController
+	]
+});
+
+//#endregion
+export { AdminApiKeyController, AlephaApiKeys, ApiKeyController, ApiKeyService, adminApiKeyQuerySchema, adminApiKeyResourceSchema, apiKeyEntity, createApiKeyBodySchema, createApiKeyResponseSchema, listApiKeyItemSchema, listApiKeyResponseSchema, revokeApiKeyParamsSchema, revokeApiKeyResponseSchema };
+//# sourceMappingURL=index.js.map

package/dist/api/keys/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":[],"sources":["../../../src/api/keys/schemas/adminApiKeyQuerySchema.ts","../../../src/api/keys/schemas/adminApiKeyResourceSchema.ts","../../../src/api/keys/entities/apiKeyEntity.ts","../../../src/api/keys/services/ApiKeyService.ts","../../../src/api/keys/controllers/AdminApiKeyController.ts","../../../src/api/keys/schemas/createApiKeyBodySchema.ts","../../../src/api/keys/schemas/createApiKeyResponseSchema.ts","../../../src/api/keys/schemas/listApiKeyResponseSchema.ts","../../../src/api/keys/schemas/revokeApiKeyParamsSchema.ts","../../../src/api/keys/schemas/revokeApiKeyResponseSchema.ts","../../../src/api/keys/controllers/ApiKeyController.ts","../../../src/api/keys/index.ts"],"sourcesContent":["import { t } from \"alepha\";\nimport { pageQuerySchema } from \"alepha/orm\";\n\nexport const adminApiKeyQuerySchema = t.extend(pageQuerySchema, {\n  userId: t.optional(t.uuid()),\n  includeRevoked: t.optional(t.boolean()),\n});\n","import { t } from \"alepha\";\n\nexport const adminApiKeyResourceSchema = t.object({\n  id: t.uuid(),\n  userId: t.uuid(),\n  name: t.string(),\n  description: t.optional(t.string()),\n  tokenPrefix: t.string(),\n  tokenSuffix: t.string(),\n  roles: t.array(t.string()),\n  createdAt: t.datetime(),\n  lastUsedAt: t.optional(t.datetime()),\n  lastUsedIp: t.optional(t.string()),\n  expiresAt: t.optional(t.datetime()),\n  revokedAt: t.optional(t.datetime()),\n  usageCount: t.integer(),\n});\n","import { type Static, t } from \"alepha\";\nimport { $entity, db } from \"alepha/orm\";\n\nexport const apiKeyEntity = $entity({\n  name: \"api_keys\",\n  schema: t.object({\n    id: db.primaryKey(t.uuid()),\n    createdAt: db.createdAt(),\n    updatedAt: db.updatedAt(),\n\n    // Owner\n    userId: t.uuid(),\n\n    // Key metadata\n    name: t.text({ maxLength: 100 }),\n    description: t.optional(t.text({ maxLength: 500 })),\n\n    // Token (hashed) - internal, not user input\n    tokenHash: t.string({ maxLength: 256 }),\n    tokenPrefix: t.string({ maxLength: 10 }),\n    tokenSuffix: t.string({ maxLength: 8 }),\n\n    // Roles (snapshot from user at creation)\n    roles: db.default(t.array(t.string()), []),\n\n    // Tracking\n    lastUsedAt: t.optional(t.datetime()),\n    lastUsedIp: t.optional(t.string({ maxLength: 45 })),\n    usageCount: db.default(t.integer(), 0),\n\n    // Lifecycle\n    expiresAt: t.optional(t.datetime()),\n    revokedAt: t.optional(t.datetime()),\n  }),\n  indexes: [\n    { columns: [\"userId\", \"name\"], unique: true },\n    { columns: [\"tokenHash\"], unique: true },\n  ],\n});\n\nexport type ApiKeyEntity = Static<typeof apiKeyEntity.schema>;\n","import { createHash, randomBytes } from \"node:crypto\";\nimport { $inject, Alepha } from \"alepha\";\nimport { $cache } from \"alepha/cache\";\nimport { DateTimeProvider } from \"alepha/datetime\";\nimport { $logger } from \"alepha/logger\";\nimport { $repository, sql } from \"alepha/orm\";\nimport type { IssuerResolver, UserInfo } from \"alepha/security\";\nimport {\n  ForbiddenError,\n  NotFoundError,\n  type ServerRequest,\n} from \"alepha/server\";\nimport { type ApiKeyEntity, apiKeyEntity } from \"../entities/apiKeyEntity.ts\";\n\nexport class ApiKeyService {\n  protected readonly alepha = $inject(Alepha);\n  protected readonly dateTimeProvider = $inject(DateTimeProvider);\n  protected readonly log = $logger();\n  protected readonly repo = $repository(apiKeyEntity);\n\n  /**\n   * Cache validated API keys for 15 minutes.\n   */\n  protected readonly validationCache = $cache<ApiKeyEntity | null, [string]>({\n    name: \"api-key-validation\",\n    ttl: [15, \"minutes\"],\n  });\n\n  // -------------------------------------------------------------------------\n  // Resolver\n  // -------------------------------------------------------------------------\n\n  /**\n   * Create an issuer resolver for API key authentication.\n   * Lower priority means it runs before JWT resolver.\n   *\n   * @param options.priority - Priority of this resolver (default: 50, JWT is 100)\n   * @param options.prefix - API key prefix to match in Bearer header (default: \"ak\")\n   */\n  public createResolver(\n    options: { priority?: number; prefix?: string } = {},\n  ): IssuerResolver {\n    const { priority = 50, prefix = \"ak\" } = options;\n    const prefixPattern = `${prefix}_`;\n\n    return {\n      priority,\n      onRequest: async (req: ServerRequest) => {\n        // Try query param first\n        const url = typeof req.url === \"string\" ? new URL(req.url) : req.url;\n        let token = url.searchParams.get(\"api_key\");\n\n        // Try Bearer header - only if token starts with expected prefix\n        if (!token) {\n          const auth = req.headers.authorization;\n          if (auth?.startsWith(\"Bearer \")) {\n            const bearerToken = auth.slice(7);\n            if (bearerToken.startsWith(prefixPattern)) {\n              token = bearerToken;\n            }\n          }\n        }\n\n        if (!token) {\n          return null;\n        }\n\n        return this.validate(token);\n      },\n    };\n  }\n\n  // -------------------------------------------------------------------------\n  // CRUD\n  // -------------------------------------------------------------------------\n\n  /**\n   * Create a new API key for a user.\n   * Returns both the API key entity and the plain token (which is only available once).\n   */\n  public async create(options: {\n    userId: string;\n    name: string;\n    roles: string[];\n    description?: string;\n    expiresAt?: Date;\n    prefix?: string;\n  }): Promise<{ apiKey: ApiKeyEntity; token: string }> {\n    const prefix = options.prefix ?? \"ak\";\n    const random = randomBytes(24).toString(\"base64url\");\n    const token = `${prefix}_${random}`;\n    const hash = this.hashToken(token);\n    const suffix = token.slice(-8);\n\n    const apiKey = await this.repo.create({\n      userId: options.userId,\n      name: options.name,\n      description: options.description,\n      tokenHash: hash,\n      tokenPrefix: prefix,\n      tokenSuffix: suffix,\n      roles: options.roles,\n      expiresAt: options.expiresAt?.toISOString(),\n    });\n\n    this.log.info(\"API key created\", {\n      apiKeyId: apiKey.id,\n      userId: options.userId,\n      name: options.name,\n    });\n\n    return { apiKey, token };\n  }\n\n  /**\n   * List all non-revoked API keys for a user.\n   */\n  public async list(userId: string): Promise<ApiKeyEntity[]> {\n    return this.repo.findMany({\n      where: {\n        userId: { eq: userId },\n        revokedAt: { isNull: true },\n      },\n      orderBy: { column: \"createdAt\", direction: \"desc\" },\n    });\n  }\n\n  // -------------------------------------------------------------------------\n  // Admin Operations\n  // -------------------------------------------------------------------------\n\n  /**\n   * Find all API keys with optional filtering (admin only).\n   */\n  public async findAll(query: {\n    userId?: string;\n    includeRevoked?: boolean;\n    page?: number;\n    size?: number;\n    sort?: string;\n  }) {\n    query.sort ??= \"-createdAt\";\n\n    const where = this.repo.createQueryWhere();\n\n    if (query.userId) {\n      where.userId = { eq: query.userId };\n    }\n\n    if (!query.includeRevoked) {\n      where.revokedAt = { isNull: true };\n    }\n\n    return this.repo.paginate(query, { where }, { count: true });\n  }\n\n  /**\n   * Get an API key by ID (admin only).\n   */\n  public async getById(id: string): Promise<ApiKeyEntity> {\n    const apiKey = await this.repo.findById(id).catch(() => null);\n\n    if (!apiKey) {\n      throw new NotFoundError(\"API key not found\");\n    }\n\n    return apiKey;\n  }\n\n  /**\n   * Revoke any API key (admin only).\n   */\n  public async revokeByAdmin(id: string): Promise<void> {\n    const apiKey = await this.repo.findById(id).catch(() => null);\n\n    if (!apiKey) {\n      throw new NotFoundError(\"API key not found\");\n    }\n\n    if (apiKey.revokedAt) {\n      return; // Already revoked\n    }\n\n    // Invalidate cache\n    await this.validationCache.invalidate(apiKey.tokenHash);\n\n    await this.repo.updateById(id, {\n      revokedAt: this.dateTimeProvider.now().toISOString(),\n    });\n\n    this.log.info(\"API key revoked by admin\", {\n      apiKeyId: id,\n      userId: apiKey.userId,\n    });\n  }\n\n  // -------------------------------------------------------------------------\n  // User Operations\n  // -------------------------------------------------------------------------\n\n  /**\n   * Revoke an API key. Only the owner can revoke their own keys.\n   */\n  public async revoke(id: string, userId: string): Promise<void> {\n    const apiKey = await this.repo.findById(id).catch(() => null);\n\n    if (!apiKey) {\n      throw new NotFoundError(\"API key not found\");\n    }\n\n    if (apiKey.userId !== userId) {\n      throw new ForbiddenError(\"Not your API key\");\n    }\n\n    await this.validationCache.invalidate(apiKey.tokenHash);\n\n    await this.repo.updateById(id, {\n      revokedAt: this.dateTimeProvider.now().toISOString(),\n    });\n\n    this.log.info(\"API key revoked\", {\n      apiKeyId: id,\n      userId,\n    });\n  }\n\n  // -------------------------------------------------------------------------\n  // Validation\n  // -------------------------------------------------------------------------\n\n  /**\n   * Validate an API key token and return user info if valid.\n   */\n  public async validate(token: string): Promise<UserInfo | null> {\n    // Quick check for API key format\n    if (!token.includes(\"_\")) {\n      return null;\n    }\n\n    const hash = this.hashToken(token);\n\n    // Try cache first\n    let apiKey = await this.validationCache.get(hash);\n\n    // If not in cache, look up in database\n    if (apiKey === undefined) {\n      apiKey = await this.repo\n        .findOne({\n          where: { tokenHash: { eq: hash } },\n        })\n        .catch(() => null);\n\n      // Store in cache (even if null, to prevent repeated lookups)\n      if (apiKey) {\n        await this.validationCache.set(hash, apiKey);\n      }\n    }\n\n    if (!apiKey) {\n      return null;\n    }\n\n    // Check revocation\n    if (apiKey.revokedAt) {\n      return null;\n    }\n\n    // Check expiration\n    if (\n      apiKey.expiresAt &&\n      this.dateTimeProvider.now().isAfter(apiKey.expiresAt)\n    ) {\n      return null;\n    }\n\n    // Update usage stats (fire and forget)\n    this.updateUsage(apiKey.id).catch((error) => {\n      this.log.warn(\"Failed to update API key usage\", { error });\n    });\n\n    return {\n      id: apiKey.userId,\n      roles: apiKey.roles,\n    };\n  }\n\n  /**\n   * Update usage statistics for an API key.\n   */\n  protected async updateUsage(id: string): Promise<void> {\n    const request = this.alepha.context.get<ServerRequest>(\"request\");\n\n    await this.repo.updateById(id, {\n      lastUsedAt: this.dateTimeProvider.now().toISOString(),\n      lastUsedIp: request?.ip,\n      usageCount: sql`${this.repo.table.usageCount} + 1`,\n    });\n  }\n\n  /**\n   * Hash a token using SHA-256.\n   */\n  protected hashToken(token: string): string {\n    return createHash(\"sha256\").update(token).digest(\"hex\");\n  }\n}\n","import { $inject, t } from \"alepha\";\nimport { $action, okSchema } from \"alepha/server\";\nimport { adminApiKeyQuerySchema } from \"../schemas/adminApiKeyQuerySchema.ts\";\nimport { adminApiKeyResourceSchema } from \"../schemas/adminApiKeyResourceSchema.ts\";\nimport { ApiKeyService } from \"../services/ApiKeyService.ts\";\n\n/**\n * REST API controller for admin API key management.\n * Admins can list, view, and revoke any API key.\n */\nexport class AdminApiKeyController {\n  protected readonly url = \"/admin/api-keys\";\n  protected readonly group = \"admin:api-keys\";\n  protected readonly apiKeyService = $inject(ApiKeyService);\n\n  /**\n   * Find all API keys with optional filtering.\n   */\n  public readonly findApiKeys = $action({\n    path: this.url,\n    group: this.group,\n    secure: true,\n    description: \"Find API keys with pagination and filtering\",\n    schema: {\n      query: adminApiKeyQuerySchema,\n      response: t.page(adminApiKeyResourceSchema),\n    },\n    handler: ({ query }) => {\n      const { userId, includeRevoked, ...pagination } = query;\n      return this.apiKeyService.findAll({\n        userId,\n        includeRevoked,\n        ...pagination,\n      });\n    },\n  });\n\n  /**\n   * Get an API key by ID.\n   */\n  public readonly getApiKey = $action({\n    path: `${this.url}/:id`,\n    group: this.group,\n    secure: true,\n    description: \"Get an API key by ID\",\n    schema: {\n      params: t.object({\n        id: t.uuid(),\n      }),\n      response: adminApiKeyResourceSchema,\n    },\n    handler: ({ params }) => this.apiKeyService.getById(params.id),\n  });\n\n  /**\n   * Revoke any API key.\n   */\n  public readonly revokeApiKey = $action({\n    method: \"DELETE\",\n    path: `${this.url}/:id`,\n    group: this.group,\n    secure: true,\n    description: \"Revoke an API key\",\n    schema: {\n      params: t.object({\n        id: t.uuid(),\n      }),\n      response: okSchema,\n    },\n    handler: async ({ params }) => {\n      await this.apiKeyService.revokeByAdmin(params.id);\n      return { ok: true, id: params.id };\n    },\n  });\n}\n","import { t } from \"alepha\";\n\nexport const createApiKeyBodySchema = t.object({\n  name: t.text({ minLength: 1, maxLength: 100 }),\n  description: t.optional(t.text({ maxLength: 500 })),\n  expiresAt: t.optional(t.datetime()),\n});\n","import { t } from \"alepha\";\n\nexport const createApiKeyResponseSchema = t.object({\n  id: t.uuid(),\n  name: t.string(),\n  token: t.string(),\n  tokenSuffix: t.string(),\n  roles: t.array(t.string()),\n  createdAt: t.datetime(),\n  expiresAt: t.optional(t.datetime()),\n});\n","import { t } from \"alepha\";\n\nexport const listApiKeyItemSchema = t.object({\n  id: t.uuid(),\n  name: t.string(),\n  tokenPrefix: t.string(),\n  tokenSuffix: t.string(),\n  roles: t.array(t.string()),\n  createdAt: t.datetime(),\n  lastUsedAt: t.optional(t.datetime()),\n  expiresAt: t.optional(t.datetime()),\n  usageCount: t.integer(),\n});\n\nexport const listApiKeyResponseSchema = t.array(listApiKeyItemSchema);\n","import { t } from \"alepha\";\n\nexport const revokeApiKeyParamsSchema = t.object({\n  id: t.uuid(),\n});\n","import { t } from \"alepha\";\n\nexport const revokeApiKeyResponseSchema = t.object({\n  ok: t.boolean(),\n});\n","import { $inject } from \"alepha\";\nimport { $action } from \"alepha/server\";\nimport { createApiKeyBodySchema } from \"../schemas/createApiKeyBodySchema.ts\";\nimport { createApiKeyResponseSchema } from \"../schemas/createApiKeyResponseSchema.ts\";\nimport { listApiKeyResponseSchema } from \"../schemas/listApiKeyResponseSchema.ts\";\nimport { revokeApiKeyParamsSchema } from \"../schemas/revokeApiKeyParamsSchema.ts\";\nimport { revokeApiKeyResponseSchema } from \"../schemas/revokeApiKeyResponseSchema.ts\";\nimport { ApiKeyService } from \"../services/ApiKeyService.ts\";\n\n/**\n * REST API controller for user's own API key management.\n * Users can create, list, and revoke their own API keys.\n */\nexport class ApiKeyController {\n  protected readonly url = \"/api-keys\";\n  protected readonly group = \"api-keys\";\n  protected readonly apiKeyService = $inject(ApiKeyService);\n\n  /**\n   * Create a new API key for the authenticated user.\n   * The token is only returned once upon creation.\n   */\n  public readonly createApiKey = $action({\n    method: \"POST\",\n    path: this.url,\n    group: this.group,\n    description: \"Create a new API key\",\n    secure: true,\n    schema: {\n      body: createApiKeyBodySchema,\n      response: createApiKeyResponseSchema,\n    },\n    handler: async (request) => {\n      const { apiKey, token } = await this.apiKeyService.create({\n        userId: request.user.id,\n        name: request.body.name,\n        description: request.body.description,\n        roles: request.user.roles ?? [],\n        expiresAt: request.body.expiresAt\n          ? new Date(request.body.expiresAt)\n          : undefined,\n      });\n\n      return {\n        id: apiKey.id,\n        name: apiKey.name,\n        token,\n        tokenSuffix: apiKey.tokenSuffix,\n        roles: apiKey.roles,\n        createdAt: apiKey.createdAt,\n        expiresAt: apiKey.expiresAt,\n      };\n    },\n  });\n\n  /**\n   * List all active API keys for the authenticated user.\n   * Does not return the actual tokens.\n   */\n  public readonly listApiKeys = $action({\n    path: this.url,\n    group: this.group,\n    description: \"List your API keys\",\n    secure: true,\n    schema: {\n      response: listApiKeyResponseSchema,\n    },\n    handler: async (request) => {\n      const apiKeys = await this.apiKeyService.list(request.user.id);\n\n      return apiKeys.map((apiKey) => ({\n        id: apiKey.id,\n        name: apiKey.name,\n        tokenPrefix: apiKey.tokenPrefix,\n        tokenSuffix: apiKey.tokenSuffix,\n        roles: apiKey.roles,\n        createdAt: apiKey.createdAt,\n        lastUsedAt: apiKey.lastUsedAt,\n        expiresAt: apiKey.expiresAt,\n        usageCount: apiKey.usageCount,\n      }));\n    },\n  });\n\n  /**\n   * Revoke an API key. Only the owner can revoke their own keys.\n   */\n  public readonly revokeApiKey = $action({\n    method: \"DELETE\",\n    path: `${this.url}/:id`,\n    group: this.group,\n    description: \"Revoke an API key\",\n    secure: true,\n    schema: {\n      params: revokeApiKeyParamsSchema,\n      response: revokeApiKeyResponseSchema,\n    },\n    handler: async (request) => {\n      await this.apiKeyService.revoke(request.params.id, request.user.id);\n      return { ok: true };\n    },\n  });\n}\n","import { $module } from \"alepha\";\nimport { AdminApiKeyController } from \"./controllers/AdminApiKeyController.ts\";\nimport { ApiKeyController } from \"./controllers/ApiKeyController.ts\";\nimport { ApiKeyService } from \"./services/ApiKeyService.ts\";\n\nexport * from \"./controllers/AdminApiKeyController.ts\";\nexport * from \"./controllers/ApiKeyController.ts\";\nexport * from \"./entities/apiKeyEntity.ts\";\nexport * from \"./schemas/adminApiKeyQuerySchema.ts\";\nexport * from \"./schemas/adminApiKeyResourceSchema.ts\";\nexport * from \"./schemas/createApiKeyBodySchema.ts\";\nexport * from \"./schemas/createApiKeyResponseSchema.ts\";\nexport * from \"./schemas/listApiKeyResponseSchema.ts\";\nexport * from \"./schemas/revokeApiKeyParamsSchema.ts\";\nexport * from \"./schemas/revokeApiKeyResponseSchema.ts\";\nexport * from \"./services/ApiKeyService.ts\";\n\n/**\n * | type | quality | stability |\n * |------|---------|--------------|\n * | backend | good | experimental |\n *\n * API key management module for programmatic access.\n *\n * **Features:**\n * - Create API keys with role snapshots\n * - List and revoke API keys\n * - 15-minute validation caching\n * - Query param (?api_key=) and Bearer header support\n *\n * **Integration:**\n * To enable API key authentication for an issuer, register the resolver:\n *\n * ```ts\n * class MyApp {\n *   apiKeyService = $inject(ApiKeyService);\n *   issuer = $issuer({\n *     secret: env.APP_SECRET,\n *     resolvers: [this.apiKeyService.createResolver()],\n *   });\n * }\n * ```\n *\n * @module alepha.api.keys\n */\nexport const AlephaApiKeys = $module({\n  name: \"alepha.api.keys\",\n  services: [ApiKeyService, ApiKeyController, AdminApiKeyController],\n});\n"],"mappings":";;;;;;;;;AAGA,MAAa,yBAAyB,EAAE,OAAO,iBAAiB;CAC9D,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC;CAC5B,gBAAgB,EAAE,SAAS,EAAE,SAAS,CAAC;CACxC,CAAC;;;;ACJF,MAAa,4BAA4B,EAAE,OAAO;CAChD,IAAI,EAAE,MAAM;CACZ,QAAQ,EAAE,MAAM;CAChB,MAAM,EAAE,QAAQ;CAChB,aAAa,EAAE,SAAS,EAAE,QAAQ,CAAC;CACnC,aAAa,EAAE,QAAQ;CACvB,aAAa,EAAE,QAAQ;CACvB,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC;CAC1B,WAAW,EAAE,UAAU;CACvB,YAAY,EAAE,SAAS,EAAE,UAAU,CAAC;CACpC,YAAY,EAAE,SAAS,EAAE,QAAQ,CAAC;CAClC,WAAW,EAAE,SAAS,EAAE,UAAU,CAAC;CACnC,WAAW,EAAE,SAAS,EAAE,UAAU,CAAC;CACnC,YAAY,EAAE,SAAS;CACxB,CAAC;;;;ACbF,MAAa,eAAe,QAAQ;CAClC,MAAM;CACN,QAAQ,EAAE,OAAO;EACf,IAAI,GAAG,WAAW,EAAE,MAAM,CAAC;EAC3B,WAAW,GAAG,WAAW;EACzB,WAAW,GAAG,WAAW;EAGzB,QAAQ,EAAE,MAAM;EAGhB,MAAM,EAAE,KAAK,EAAE,WAAW,KAAK,CAAC;EAChC,aAAa,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,KAAK,CAAC,CAAC;EAGnD,WAAW,EAAE,OAAO,EAAE,WAAW,KAAK,CAAC;EACvC,aAAa,EAAE,OAAO,EAAE,WAAW,IAAI,CAAC;EACxC,aAAa,EAAE,OAAO,EAAE,WAAW,GAAG,CAAC;EAGvC,OAAO,GAAG,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;EAG1C,YAAY,EAAE,SAAS,EAAE,UAAU,CAAC;EACpC,YAAY,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,IAAI,CAAC,CAAC;EACnD,YAAY,GAAG,QAAQ,EAAE,SAAS,EAAE,EAAE;EAGtC,WAAW,EAAE,SAAS,EAAE,UAAU,CAAC;EACnC,WAAW,EAAE,SAAS,EAAE,UAAU,CAAC;EACpC,CAAC;CACF,SAAS,CACP;EAAE,SAAS,CAAC,UAAU,OAAO;EAAE,QAAQ;EAAM,EAC7C;EAAE,SAAS,CAAC,YAAY;EAAE,QAAQ;EAAM,CACzC;CACF,CAAC;;;;ACxBF,IAAa,gBAAb,MAA2B;CACzB,AAAmB,SAAS,QAAQ,OAAO;CAC3C,AAAmB,mBAAmB,QAAQ,iBAAiB;CAC/D,AAAmB,MAAM,SAAS;CAClC,AAAmB,OAAO,YAAY,aAAa;;;;CAKnD,AAAmB,kBAAkB,OAAsC;EACzE,MAAM;EACN,KAAK,CAAC,IAAI,UAAU;EACrB,CAAC;;;;;;;;CAaF,AAAO,eACL,UAAkD,EAAE,EACpC;EAChB,MAAM,EAAE,WAAW,IAAI,SAAS,SAAS;EACzC,MAAM,gBAAgB,GAAG,OAAO;AAEhC,SAAO;GACL;GACA,WAAW,OAAO,QAAuB;IAGvC,IAAI,SADQ,OAAO,IAAI,QAAQ,WAAW,IAAI,IAAI,IAAI,IAAI,GAAG,IAAI,KACjD,aAAa,IAAI,UAAU;AAG3C,QAAI,CAAC,OAAO;KACV,MAAM,OAAO,IAAI,QAAQ;AACzB,SAAI,MAAM,WAAW,UAAU,EAAE;MAC/B,MAAM,cAAc,KAAK,MAAM,EAAE;AACjC,UAAI,YAAY,WAAW,cAAc,CACvC,SAAQ;;;AAKd,QAAI,CAAC,MACH,QAAO;AAGT,WAAO,KAAK,SAAS,MAAM;;GAE9B;;;;;;CAWH,MAAa,OAAO,SAOiC;EACnD,MAAM,SAAS,QAAQ,UAAU;EAEjC,MAAM,QAAQ,GAAG,OAAO,GADT,YAAY,GAAG,CAAC,SAAS,YAAY;EAEpD,MAAM,OAAO,KAAK,UAAU,MAAM;EAClC,MAAM,SAAS,MAAM,MAAM,GAAG;EAE9B,MAAM,SAAS,MAAM,KAAK,KAAK,OAAO;GACpC,QAAQ,QAAQ;GAChB,MAAM,QAAQ;GACd,aAAa,QAAQ;GACrB,WAAW;GACX,aAAa;GACb,aAAa;GACb,OAAO,QAAQ;GACf,WAAW,QAAQ,WAAW,aAAa;GAC5C,CAAC;AAEF,OAAK,IAAI,KAAK,mBAAmB;GAC/B,UAAU,OAAO;GACjB,QAAQ,QAAQ;GAChB,MAAM,QAAQ;GACf,CAAC;AAEF,SAAO;GAAE;GAAQ;GAAO;;;;;CAM1B,MAAa,KAAK,QAAyC;AACzD,SAAO,KAAK,KAAK,SAAS;GACxB,OAAO;IACL,QAAQ,EAAE,IAAI,QAAQ;IACtB,WAAW,EAAE,QAAQ,MAAM;IAC5B;GACD,SAAS;IAAE,QAAQ;IAAa,WAAW;IAAQ;GACpD,CAAC;;;;;CAUJ,MAAa,QAAQ,OAMlB;AACD,QAAM,SAAS;EAEf,MAAM,QAAQ,KAAK,KAAK,kBAAkB;AAE1C,MAAI,MAAM,OACR,OAAM,SAAS,EAAE,IAAI,MAAM,QAAQ;AAGrC,MAAI,CAAC,MAAM,eACT,OAAM,YAAY,EAAE,QAAQ,MAAM;AAGpC,SAAO,KAAK,KAAK,SAAS,OAAO,EAAE,OAAO,EAAE,EAAE,OAAO,MAAM,CAAC;;;;;CAM9D,MAAa,QAAQ,IAAmC;EACtD,MAAM,SAAS,MAAM,KAAK,KAAK,SAAS,GAAG,CAAC,YAAY,KAAK;AAE7D,MAAI,CAAC,OACH,OAAM,IAAI,cAAc,oBAAoB;AAG9C,SAAO;;;;;CAMT,MAAa,cAAc,IAA2B;EACpD,MAAM,SAAS,MAAM,KAAK,KAAK,SAAS,GAAG,CAAC,YAAY,KAAK;AAE7D,MAAI,CAAC,OACH,OAAM,IAAI,cAAc,oBAAoB;AAG9C,MAAI,OAAO,UACT;AAIF,QAAM,KAAK,gBAAgB,WAAW,OAAO,UAAU;AAEvD,QAAM,KAAK,KAAK,WAAW,IAAI,EAC7B,WAAW,KAAK,iBAAiB,KAAK,CAAC,aAAa,EACrD,CAAC;AAEF,OAAK,IAAI,KAAK,4BAA4B;GACxC,UAAU;GACV,QAAQ,OAAO;GAChB,CAAC;;;;;CAUJ,MAAa,OAAO,IAAY,QAA+B;EAC7D,MAAM,SAAS,MAAM,KAAK,KAAK,SAAS,GAAG,CAAC,YAAY,KAAK;AAE7D,MAAI,CAAC,OACH,OAAM,IAAI,cAAc,oBAAoB;AAG9C,MAAI,OAAO,WAAW,OACpB,OAAM,IAAI,eAAe,mBAAmB;AAG9C,QAAM,KAAK,gBAAgB,WAAW,OAAO,UAAU;AAEvD,QAAM,KAAK,KAAK,WAAW,IAAI,EAC7B,WAAW,KAAK,iBAAiB,KAAK,CAAC,aAAa,EACrD,CAAC;AAEF,OAAK,IAAI,KAAK,mBAAmB;GAC/B,UAAU;GACV;GACD,CAAC;;;;;CAUJ,MAAa,SAAS,OAAyC;AAE7D,MAAI,CAAC,MAAM,SAAS,IAAI,CACtB,QAAO;EAGT,MAAM,OAAO,KAAK,UAAU,MAAM;EAGlC,IAAI,SAAS,MAAM,KAAK,gBAAgB,IAAI,KAAK;AAGjD,MAAI,WAAW,QAAW;AACxB,YAAS,MAAM,KAAK,KACjB,QAAQ,EACP,OAAO,EAAE,WAAW,EAAE,IAAI,MAAM,EAAE,EACnC,CAAC,CACD,YAAY,KAAK;AAGpB,OAAI,OACF,OAAM,KAAK,gBAAgB,IAAI,MAAM,OAAO;;AAIhD,MAAI,CAAC,OACH,QAAO;AAIT,MAAI,OAAO,UACT,QAAO;AAIT,MACE,OAAO,aACP,KAAK,iBAAiB,KAAK,CAAC,QAAQ,OAAO,UAAU,CAErD,QAAO;AAIT,OAAK,YAAY,OAAO,GAAG,CAAC,OAAO,UAAU;AAC3C,QAAK,IAAI,KAAK,kCAAkC,EAAE,OAAO,CAAC;IAC1D;AAEF,SAAO;GACL,IAAI,OAAO;GACX,OAAO,OAAO;GACf;;;;;CAMH,MAAgB,YAAY,IAA2B;EACrD,MAAM,UAAU,KAAK,OAAO,QAAQ,IAAmB,UAAU;AAEjE,QAAM,KAAK,KAAK,WAAW,IAAI;GAC7B,YAAY,KAAK,iBAAiB,KAAK,CAAC,aAAa;GACrD,YAAY,SAAS;GACrB,YAAY,GAAG,GAAG,KAAK,KAAK,MAAM,WAAW;GAC9C,CAAC;;;;;CAMJ,AAAU,UAAU,OAAuB;AACzC,SAAO,WAAW,SAAS,CAAC,OAAO,MAAM,CAAC,OAAO,MAAM;;;;;;;;;;ACrS3D,IAAa,wBAAb,MAAmC;CACjC,AAAmB,MAAM;CACzB,AAAmB,QAAQ;CAC3B,AAAmB,gBAAgB,QAAQ,cAAc;;;;CAKzD,AAAgB,cAAc,QAAQ;EACpC,MAAM,KAAK;EACX,OAAO,KAAK;EACZ,QAAQ;EACR,aAAa;EACb,QAAQ;GACN,OAAO;GACP,UAAU,EAAE,KAAK,0BAA0B;GAC5C;EACD,UAAU,EAAE,YAAY;GACtB,MAAM,EAAE,QAAQ,gBAAgB,GAAG,eAAe;AAClD,UAAO,KAAK,cAAc,QAAQ;IAChC;IACA;IACA,GAAG;IACJ,CAAC;;EAEL,CAAC;;;;CAKF,AAAgB,YAAY,QAAQ;EAClC,MAAM,GAAG,KAAK,IAAI;EAClB,OAAO,KAAK;EACZ,QAAQ;EACR,aAAa;EACb,QAAQ;GACN,QAAQ,EAAE,OAAO,EACf,IAAI,EAAE,MAAM,EACb,CAAC;GACF,UAAU;GACX;EACD,UAAU,EAAE,aAAa,KAAK,cAAc,QAAQ,OAAO,GAAG;EAC/D,CAAC;;;;CAKF,AAAgB,eAAe,QAAQ;EACrC,QAAQ;EACR,MAAM,GAAG,KAAK,IAAI;EAClB,OAAO,KAAK;EACZ,QAAQ;EACR,aAAa;EACb,QAAQ;GACN,QAAQ,EAAE,OAAO,EACf,IAAI,EAAE,MAAM,EACb,CAAC;GACF,UAAU;GACX;EACD,SAAS,OAAO,EAAE,aAAa;AAC7B,SAAM,KAAK,cAAc,cAAc,OAAO,GAAG;AACjD,UAAO;IAAE,IAAI;IAAM,IAAI,OAAO;IAAI;;EAErC,CAAC;;;;;ACvEJ,MAAa,yBAAyB,EAAE,OAAO;CAC7C,MAAM,EAAE,KAAK;EAAE,WAAW;EAAG,WAAW;EAAK,CAAC;CAC9C,aAAa,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,KAAK,CAAC,CAAC;CACnD,WAAW,EAAE,SAAS,EAAE,UAAU,CAAC;CACpC,CAAC;;;;ACJF,MAAa,6BAA6B,EAAE,OAAO;CACjD,IAAI,EAAE,MAAM;CACZ,MAAM,EAAE,QAAQ;CAChB,OAAO,EAAE,QAAQ;CACjB,aAAa,EAAE,QAAQ;CACvB,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC;CAC1B,WAAW,EAAE,UAAU;CACvB,WAAW,EAAE,SAAS,EAAE,UAAU,CAAC;CACpC,CAAC;;;;ACRF,MAAa,uBAAuB,EAAE,OAAO;CAC3C,IAAI,EAAE,MAAM;CACZ,MAAM,EAAE,QAAQ;CAChB,aAAa,EAAE,QAAQ;CACvB,aAAa,EAAE,QAAQ;CACvB,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC;CAC1B,WAAW,EAAE,UAAU;CACvB,YAAY,EAAE,SAAS,EAAE,UAAU,CAAC;CACpC,WAAW,EAAE,SAAS,EAAE,UAAU,CAAC;CACnC,YAAY,EAAE,SAAS;CACxB,CAAC;AAEF,MAAa,2BAA2B,EAAE,MAAM,qBAAqB;;;;ACZrE,MAAa,2BAA2B,EAAE,OAAO,EAC/C,IAAI,EAAE,MAAM,EACb,CAAC;;;;ACFF,MAAa,6BAA6B,EAAE,OAAO,EACjD,IAAI,EAAE,SAAS,EAChB,CAAC;;;;;;;;ACSF,IAAa,mBAAb,MAA8B;CAC5B,AAAmB,MAAM;CACzB,AAAmB,QAAQ;CAC3B,AAAmB,gBAAgB,QAAQ,cAAc;;;;;CAMzD,AAAgB,eAAe,QAAQ;EACrC,QAAQ;EACR,MAAM,KAAK;EACX,OAAO,KAAK;EACZ,aAAa;EACb,QAAQ;EACR,QAAQ;GACN,MAAM;GACN,UAAU;GACX;EACD,SAAS,OAAO,YAAY;GAC1B,MAAM,EAAE,QAAQ,UAAU,MAAM,KAAK,cAAc,OAAO;IACxD,QAAQ,QAAQ,KAAK;IACrB,MAAM,QAAQ,KAAK;IACnB,aAAa,QAAQ,KAAK;IAC1B,OAAO,QAAQ,KAAK,SAAS,EAAE;IAC/B,WAAW,QAAQ,KAAK,YACpB,IAAI,KAAK,QAAQ,KAAK,UAAU,GAChC;IACL,CAAC;AAEF,UAAO;IACL,IAAI,OAAO;IACX,MAAM,OAAO;IACb;IACA,aAAa,OAAO;IACpB,OAAO,OAAO;IACd,WAAW,OAAO;IAClB,WAAW,OAAO;IACnB;;EAEJ,CAAC;;;;;CAMF,AAAgB,cAAc,QAAQ;EACpC,MAAM,KAAK;EACX,OAAO,KAAK;EACZ,aAAa;EACb,QAAQ;EACR,QAAQ,EACN,UAAU,0BACX;EACD,SAAS,OAAO,YAAY;AAG1B,WAFgB,MAAM,KAAK,cAAc,KAAK,QAAQ,KAAK,GAAG,EAE/C,KAAK,YAAY;IAC9B,IAAI,OAAO;IACX,MAAM,OAAO;IACb,aAAa,OAAO;IACpB,aAAa,OAAO;IACpB,OAAO,OAAO;IACd,WAAW,OAAO;IAClB,YAAY,OAAO;IACnB,WAAW,OAAO;IAClB,YAAY,OAAO;IACpB,EAAE;;EAEN,CAAC;;;;CAKF,AAAgB,eAAe,QAAQ;EACrC,QAAQ;EACR,MAAM,GAAG,KAAK,IAAI;EAClB,OAAO,KAAK;EACZ,aAAa;EACb,QAAQ;EACR,QAAQ;GACN,QAAQ;GACR,UAAU;GACX;EACD,SAAS,OAAO,YAAY;AAC1B,SAAM,KAAK,cAAc,OAAO,QAAQ,OAAO,IAAI,QAAQ,KAAK,GAAG;AACnE,UAAO,EAAE,IAAI,MAAM;;EAEtB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACxDJ,MAAa,gBAAgB,QAAQ;CACnC,MAAM;CACN,UAAU;EAAC;EAAe;EAAkB;EAAsB;CACnE,CAAC"}

package/dist/api/notifications/index.browser.js

@@ -260,12 +260,12 @@ var NotificationService = class {
 		maxSize: 100,
 		maxDuration: [15, "seconds"],
 		schema: notificationCreateSchema,
-		handler: async (notifications$1) => {
+		handler: async (notifications) => {
 			this.log.debug("Processing notification batch", {
-				size: notifications$1.length,
-				templates: [...new Set(notifications$1.map((n) => n.template))]
+				size: notifications.length,
+				templates: [...new Set(notifications.map((n) => n.template))]
 			});
-			const entities = await this.notificationRepository.createMany(notifications$1);
+			const entities = await this.notificationRepository.createMany(notifications);
 			await this.alepha.inject(NotificationQueues).processNotification.push(...entities.map((it) => ({ notificationId: it.id })));
 			this.log.info("Notification batch queued", {
 				count: entities.length,