domma-cms 0.23.0 → 0.25.0

package/server/routes/api/api-tokens.js

@@ -0,0 +1,83 @@
+/**
+ * API Tokens API
+ *
+ * GET    /api/api-tokens      — list tokens visible to the caller (sanitised; never the hash)
+ * POST   /api/api-tokens      — create; response carries the plaintext ONCE
+ * PUT    /api/api-tokens/:id  — rename, enable/disable, edit scopes/expiry
+ * DELETE /api/api-tokens/:id  — revoke (immediate)
+ *
+ * Tokens are project-scoped artefacts: non-super-admin users with a
+ * `projects: []` access scope only see/manage tokens in their projects.
+ * Auth middlewares are accepted as DI options so tests can supply no-ops.
+ */
+import {
+    authenticate as defaultAuthenticate,
+    requirePermission as defaultRequirePermission
+} from '../../middleware/auth.js';
+import {
+    createToken,
+    getTokenSanitised,
+    listTokensSanitised,
+    revokeToken,
+    updateToken
+} from '../../services/apiTokens.js';
+import {canSeeArtefact} from '../../services/projects.js';
+
+/**
+ * Register the api-tokens routes.
+ *
+ * @param {import('fastify').FastifyInstance} fastify
+ * @param {{authenticate?: Function, requirePermission?: Function}} [opts]
+ * @returns {Promise<void>}
+ */
+export async function apiTokensRoutes(fastify, opts = {}) {
+    const authenticate      = opts.authenticate      || defaultAuthenticate;
+    const requirePermission = opts.requirePermission || defaultRequirePermission;
+
+    const canRead   = {preHandler: [authenticate, requirePermission('api-tokens', 'read')]};
+    const canCreate = {preHandler: [authenticate, requirePermission('api-tokens', 'create')]};
+    const canUpdate = {preHandler: [authenticate, requirePermission('api-tokens', 'update')]};
+    const canDelete = {preHandler: [authenticate, requirePermission('api-tokens', 'delete')]};
+
+    fastify.get('/api-tokens', canRead, async (request) => {
+        return listTokensSanitised(request.user);
+    });
+
+    fastify.post('/api-tokens', canCreate, async (request, reply) => {
+        const {name, project, scopes, expiresAt} = request.body || {};
+        if (project && !canSeeArtefact(request.user, {meta: {project}})) {
+            return reply.status(403).send({error: 'Access denied for this project'});
+        }
+        try {
+            const creator = request.user?.name || request.user?.email || null;
+            const {entry, plaintext} = await createToken({name, project, scopes, expiresAt, createdBy: creator});
+            // The plaintext appears here and nowhere else — only the hash is stored.
+            return reply.status(201).send({token: entry, plaintext});
+        } catch (err) {
+            return reply.status(400).send({error: err.message});
+        }
+    });
+
+    fastify.put('/api-tokens/:id', canUpdate, async (request, reply) => {
+        const existing = await getTokenSanitised(request.params.id);
+        if (!existing) return reply.status(404).send({error: 'Token not found'});
+        if (!canSeeArtefact(request.user, {meta: {project: existing.project}})) {
+            return reply.status(403).send({error: 'Access denied for this project'});
+        }
+        try {
+            return await updateToken(request.params.id, request.body || {});
+        } catch (err) {
+            return reply.status(400).send({error: err.message});
+        }
+    });
+
+    fastify.delete('/api-tokens/:id', canDelete, async (request, reply) => {
+        const existing = await getTokenSanitised(request.params.id);
+        if (!existing) return reply.status(404).send({error: 'Token not found'});
+        if (!canSeeArtefact(request.user, {meta: {project: existing.project}})) {
+            return reply.status(403).send({error: 'Access denied for this project'});
+        }
+        await revokeToken(request.params.id);
+        return {success: true};
+    });
+}