emdash 1.0.1 → 1.2.0

package/dist/api-tokens-BGbfWZVO.mjs

@@ -1,166 +0,0 @@
-import { i as generatePrefixedToken, o as hashApiToken } from "./api-tokens-B4COohsb.mjs";
-import { ulid } from "ulidx";
-
-//#region src/api/handlers/api-tokens.ts
-/**
-* Create a new API token for a user.
-*/
-async function handleApiTokenCreate(db, userId, input) {
-	try {
-		const id = ulid();
-		const { raw, hash, prefix } = generatePrefixedToken("ec_pat_");
-		await db.insertInto("_emdash_api_tokens").values({
-			id,
-			name: input.name,
-			token_hash: hash,
-			prefix,
-			user_id: userId,
-			scopes: JSON.stringify(input.scopes),
-			expires_at: input.expiresAt ?? null
-		}).execute();
-		return {
-			success: true,
-			data: {
-				token: raw,
-				info: {
-					id,
-					name: input.name,
-					prefix,
-					scopes: input.scopes,
-					userId,
-					expiresAt: input.expiresAt ?? null,
-					lastUsedAt: null,
-					createdAt: (/* @__PURE__ */ new Date()).toISOString()
-				}
-			}
-		};
-	} catch {
-		return {
-			success: false,
-			error: {
-				code: "TOKEN_CREATE_ERROR",
-				message: "Failed to create API token"
-			}
-		};
-	}
-}
-/**
-* List all API tokens for a user (never returns the raw token or hash).
-*/
-async function handleApiTokenList(db, userId) {
-	try {
-		return {
-			success: true,
-			data: { items: (await db.selectFrom("_emdash_api_tokens").select([
-				"id",
-				"name",
-				"prefix",
-				"scopes",
-				"user_id",
-				"expires_at",
-				"last_used_at",
-				"created_at"
-			]).where("user_id", "=", userId).orderBy("created_at", "desc").execute()).map((row) => ({
-				id: row.id,
-				name: row.name,
-				prefix: row.prefix,
-				scopes: JSON.parse(row.scopes),
-				userId: row.user_id,
-				expiresAt: row.expires_at,
-				lastUsedAt: row.last_used_at,
-				createdAt: row.created_at
-			})) }
-		};
-	} catch {
-		return {
-			success: false,
-			error: {
-				code: "TOKEN_LIST_ERROR",
-				message: "Failed to list API tokens"
-			}
-		};
-	}
-}
-/**
-* Revoke (delete) an API token.
-*/
-async function handleApiTokenRevoke(db, tokenId, userId) {
-	try {
-		if ((await db.deleteFrom("_emdash_api_tokens").where("id", "=", tokenId).where("user_id", "=", userId).executeTakeFirst()).numDeletedRows === 0n) return {
-			success: false,
-			error: {
-				code: "NOT_FOUND",
-				message: "Token not found"
-			}
-		};
-		return {
-			success: true,
-			data: { revoked: true }
-		};
-	} catch {
-		return {
-			success: false,
-			error: {
-				code: "TOKEN_REVOKE_ERROR",
-				message: "Failed to revoke API token"
-			}
-		};
-	}
-}
-/**
-* Delete every token with the given name for a user, returning how many were
-* removed. Token names aren't unique, so this is a bulk delete — used by the
-* dev-bypass flow to keep a single `dev-bypass-token` instead of minting a new
-* one on every reset.
-*/
-async function deleteApiTokensByName(db, userId, name) {
-	const result = await db.deleteFrom("_emdash_api_tokens").where("user_id", "=", userId).where("name", "=", name).executeTakeFirst();
-	return Number(result.numDeletedRows ?? 0n);
-}
-/**
-* Resolve a raw API token (ec_pat_...) to a user ID and scopes.
-* Updates last_used_at on successful lookup.
-* Returns null if the token is invalid or expired.
-*/
-async function resolveApiToken(db, rawToken) {
-	const hash = hashApiToken(rawToken);
-	const row = await db.selectFrom("_emdash_api_tokens").select([
-		"id",
-		"user_id",
-		"scopes",
-		"expires_at"
-	]).where("token_hash", "=", hash).executeTakeFirst();
-	if (!row) return null;
-	if (row.expires_at && new Date(row.expires_at) < /* @__PURE__ */ new Date()) return null;
-	db.updateTable("_emdash_api_tokens").set({ last_used_at: (/* @__PURE__ */ new Date()).toISOString() }).where("id", "=", row.id).execute().catch(() => {});
-	return {
-		userId: row.user_id,
-		scopes: JSON.parse(row.scopes),
-		tokenId: row.id
-	};
-}
-/**
-* Resolve an OAuth access token (ec_oat_...) to a user ID and scopes.
-* Returns null if the token is invalid or expired.
-*/
-async function resolveOAuthToken(db, rawToken) {
-	const hash = hashApiToken(rawToken);
-	const row = await db.selectFrom("_emdash_oauth_tokens").select([
-		"user_id",
-		"scopes",
-		"expires_at",
-		"token_type",
-		"refresh_token_hash"
-	]).where("token_hash", "=", hash).where("token_type", "=", "access").executeTakeFirst();
-	if (!row) return null;
-	if (new Date(row.expires_at) < /* @__PURE__ */ new Date()) return null;
-	return {
-		userId: row.user_id,
-		scopes: JSON.parse(row.scopes),
-		tokenId: `oauth:${hashApiToken(row.refresh_token_hash ?? hash)}`
-	};
-}
-
-//#endregion
-export { resolveApiToken as a, handleApiTokenRevoke as i, handleApiTokenCreate as n, resolveOAuthToken as o, handleApiTokenList as r, deleteApiTokensByName as t };
-//# sourceMappingURL=api-tokens-BGbfWZVO.mjs.map

package/dist/api-tokens-BGbfWZVO.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"api-tokens-BGbfWZVO.mjs","names":[],"sources":["../src/api/handlers/api-tokens.ts"],"sourcesContent":["/**\n * API token management handlers.\n *\n * Creates, lists, and revokes Personal Access Tokens (PATs).\n * Token format: ec_pat_<base64url>\n * Only the SHA-256 hash is stored — raw token shown once at creation.\n */\n\nimport type { Kysely } from \"kysely\";\nimport { ulid } from \"ulidx\";\n\nimport { hashApiToken, generatePrefixedToken } from \"../../auth/api-tokens.js\";\nimport type { Database } from \"../../database/types.js\";\nimport type { ApiResult } from \"../types.js\";\n\n// ---------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------\n\nexport interface ApiTokenInfo {\n\tid: string;\n\tname: string;\n\tprefix: string;\n\tscopes: string[];\n\tuserId: string;\n\texpiresAt: string | null;\n\tlastUsedAt: string | null;\n\tcreatedAt: string;\n}\n\nexport interface ApiTokenCreateResult {\n\t/** The raw token — shown once, never stored */\n\ttoken: string;\n\t/** Token metadata */\n\tinfo: ApiTokenInfo;\n}\n\n// ---------------------------------------------------------------------------\n// Handlers\n// ---------------------------------------------------------------------------\n\n/**\n * Create a new API token for a user.\n */\nexport async function handleApiTokenCreate(\n\tdb: Kysely<Database>,\n\tuserId: string,\n\tinput: {\n\t\tname: string;\n\t\tscopes: string[];\n\t\texpiresAt?: string;\n\t},\n): Promise<ApiResult<ApiTokenCreateResult>> {\n\ttry {\n\t\tconst id = ulid();\n\t\tconst { raw, hash, prefix } = generatePrefixedToken(\"ec_pat_\");\n\n\t\tawait db\n\t\t\t.insertInto(\"_emdash_api_tokens\")\n\t\t\t.values({\n\t\t\t\tid,\n\t\t\t\tname: input.name,\n\t\t\t\ttoken_hash: hash,\n\t\t\t\tprefix,\n\t\t\t\tuser_id: userId,\n\t\t\t\tscopes: JSON.stringify(input.scopes),\n\t\t\t\texpires_at: input.expiresAt ?? null,\n\t\t\t})\n\t\t\t.execute();\n\n\t\tconst info: ApiTokenInfo = {\n\t\t\tid,\n\t\t\tname: input.name,\n\t\t\tprefix,\n\t\t\tscopes: input.scopes,\n\t\t\tuserId,\n\t\t\texpiresAt: input.expiresAt ?? null,\n\t\t\tlastUsedAt: null,\n\t\t\tcreatedAt: new Date().toISOString(),\n\t\t};\n\n\t\treturn { success: true, data: { token: raw, info } };\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"TOKEN_CREATE_ERROR\",\n\t\t\t\tmessage: \"Failed to create API token\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * List all API tokens for a user (never returns the raw token or hash).\n */\nexport async function handleApiTokenList(\n\tdb: Kysely<Database>,\n\tuserId: string,\n): Promise<ApiResult<{ items: ApiTokenInfo[] }>> {\n\ttry {\n\t\tconst rows = await db\n\t\t\t.selectFrom(\"_emdash_api_tokens\")\n\t\t\t.select([\n\t\t\t\t\"id\",\n\t\t\t\t\"name\",\n\t\t\t\t\"prefix\",\n\t\t\t\t\"scopes\",\n\t\t\t\t\"user_id\",\n\t\t\t\t\"expires_at\",\n\t\t\t\t\"last_used_at\",\n\t\t\t\t\"created_at\",\n\t\t\t])\n\t\t\t.where(\"user_id\", \"=\", userId)\n\t\t\t.orderBy(\"created_at\", \"desc\")\n\t\t\t.execute();\n\n\t\tconst items: ApiTokenInfo[] = rows.map((row) => ({\n\t\t\tid: row.id,\n\t\t\tname: row.name,\n\t\t\tprefix: row.prefix,\n\t\t\tscopes: JSON.parse(row.scopes) as string[],\n\t\t\tuserId: row.user_id,\n\t\t\texpiresAt: row.expires_at,\n\t\t\tlastUsedAt: row.last_used_at,\n\t\t\tcreatedAt: row.created_at,\n\t\t}));\n\n\t\treturn { success: true, data: { items } };\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"TOKEN_LIST_ERROR\",\n\t\t\t\tmessage: \"Failed to list API tokens\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Revoke (delete) an API token.\n */\nexport async function handleApiTokenRevoke(\n\tdb: Kysely<Database>,\n\ttokenId: string,\n\tuserId: string,\n): Promise<ApiResult<{ revoked: boolean }>> {\n\ttry {\n\t\tconst result = await db\n\t\t\t.deleteFrom(\"_emdash_api_tokens\")\n\t\t\t.where(\"id\", \"=\", tokenId)\n\t\t\t.where(\"user_id\", \"=\", userId)\n\t\t\t.executeTakeFirst();\n\n\t\tif (result.numDeletedRows === 0n) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"NOT_FOUND\", message: \"Token not found\" },\n\t\t\t};\n\t\t}\n\n\t\treturn { success: true, data: { revoked: true } };\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"TOKEN_REVOKE_ERROR\",\n\t\t\t\tmessage: \"Failed to revoke API token\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Delete every token with the given name for a user, returning how many were\n * removed. Token names aren't unique, so this is a bulk delete — used by the\n * dev-bypass flow to keep a single `dev-bypass-token` instead of minting a new\n * one on every reset.\n */\nexport async function deleteApiTokensByName(\n\tdb: Kysely<Database>,\n\tuserId: string,\n\tname: string,\n): Promise<number> {\n\tconst result = await db\n\t\t.deleteFrom(\"_emdash_api_tokens\")\n\t\t.where(\"user_id\", \"=\", userId)\n\t\t.where(\"name\", \"=\", name)\n\t\t.executeTakeFirst();\n\treturn Number(result.numDeletedRows ?? 0n);\n}\n\n/**\n * A resolved bearer token. `tokenId` identifies the credential (not the\n * user) and is safe to store and show: the token row id for a PAT, and for\n * an OAuth token a one-way id of its grant that stays the same across\n * access-token refreshes.\n */\nexport interface ResolvedBearerToken {\n\tuserId: string;\n\tscopes: string[];\n\ttokenId: string;\n}\n\n/**\n * Resolve a raw API token (ec_pat_...) to a user ID and scopes.\n * Updates last_used_at on successful lookup.\n * Returns null if the token is invalid or expired.\n */\nexport async function resolveApiToken(\n\tdb: Kysely<Database>,\n\trawToken: string,\n): Promise<ResolvedBearerToken | null> {\n\tconst hash = hashApiToken(rawToken);\n\n\tconst row = await db\n\t\t.selectFrom(\"_emdash_api_tokens\")\n\t\t.select([\"id\", \"user_id\", \"scopes\", \"expires_at\"])\n\t\t.where(\"token_hash\", \"=\", hash)\n\t\t.executeTakeFirst();\n\n\tif (!row) return null;\n\n\t// Check expiry\n\tif (row.expires_at && new Date(row.expires_at) < new Date()) {\n\t\treturn null;\n\t}\n\n\t// Update last_used_at (fire-and-forget, don't block the request)\n\tdb.updateTable(\"_emdash_api_tokens\")\n\t\t.set({ last_used_at: new Date().toISOString() })\n\t\t.where(\"id\", \"=\", row.id)\n\t\t.execute()\n\t\t.catch(() => {}); // Non-critical, swallow errors\n\n\treturn {\n\t\tuserId: row.user_id,\n\t\tscopes: JSON.parse(row.scopes) as string[],\n\t\ttokenId: row.id,\n\t};\n}\n\n/**\n * Resolve an OAuth access token (ec_oat_...) to a user ID and scopes.\n * Returns null if the token is invalid or expired.\n */\nexport async function resolveOAuthToken(\n\tdb: Kysely<Database>,\n\trawToken: string,\n): Promise<ResolvedBearerToken | null> {\n\tconst hash = hashApiToken(rawToken);\n\n\tconst row = await db\n\t\t.selectFrom(\"_emdash_oauth_tokens\")\n\t\t.select([\"user_id\", \"scopes\", \"expires_at\", \"token_type\", \"refresh_token_hash\"])\n\t\t.where(\"token_hash\", \"=\", hash)\n\t\t.where(\"token_type\", \"=\", \"access\")\n\t\t.executeTakeFirst();\n\n\tif (!row) return null;\n\n\t// Check expiry\n\tif (new Date(row.expires_at) < new Date()) {\n\t\treturn null;\n\t}\n\n\treturn {\n\t\tuserId: row.user_id,\n\t\tscopes: JSON.parse(row.scopes) as string[],\n\t\t// Hashing the stored hash again keeps the id from being a token lookup key.\n\t\ttokenId: `oauth:${hashApiToken(row.refresh_token_hash ?? hash)}`,\n\t};\n}\n"],"mappings":";;;;;;;AA4CA,eAAsB,qBACrB,IACA,QACA,OAK2C;AAC3C,KAAI;EACH,MAAM,KAAK,MAAM;EACjB,MAAM,EAAE,KAAK,MAAM,WAAW,sBAAsB,UAAU;AAE9D,QAAM,GACJ,WAAW,qBAAqB,CAChC,OAAO;GACP;GACA,MAAM,MAAM;GACZ,YAAY;GACZ;GACA,SAAS;GACT,QAAQ,KAAK,UAAU,MAAM,OAAO;GACpC,YAAY,MAAM,aAAa;GAC/B,CAAC,CACD,SAAS;AAaX,SAAO;GAAE,SAAS;GAAM,MAAM;IAAE,OAAO;IAAK,MAXjB;KAC1B;KACA,MAAM,MAAM;KACZ;KACA,QAAQ,MAAM;KACd;KACA,WAAW,MAAM,aAAa;KAC9B,YAAY;KACZ,4BAAW,IAAI,MAAM,EAAC,aAAa;KACnC;IAEiD;GAAE;SAC7C;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;AAOH,eAAsB,mBACrB,IACA,QACgD;AAChD,KAAI;AA4BH,SAAO;GAAE,SAAS;GAAM,MAAM,EAAE,QA3BnB,MAAM,GACjB,WAAW,qBAAqB,CAChC,OAAO;IACP;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA,CAAC,CACD,MAAM,WAAW,KAAK,OAAO,CAC7B,QAAQ,cAAc,OAAO,CAC7B,SAAS,EAEwB,KAAK,SAAS;IAChD,IAAI,IAAI;IACR,MAAM,IAAI;IACV,QAAQ,IAAI;IACZ,QAAQ,KAAK,MAAM,IAAI,OAAO;IAC9B,QAAQ,IAAI;IACZ,WAAW,IAAI;IACf,YAAY,IAAI;IAChB,WAAW,IAAI;IACf,EAAE,EAEoC;GAAE;SAClC;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;AAOH,eAAsB,qBACrB,IACA,SACA,QAC2C;AAC3C,KAAI;AAOH,OANe,MAAM,GACnB,WAAW,qBAAqB,CAChC,MAAM,MAAM,KAAK,QAAQ,CACzB,MAAM,WAAW,KAAK,OAAO,CAC7B,kBAAkB,EAET,mBAAmB,GAC7B,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAa,SAAS;IAAmB;GACxD;AAGF,SAAO;GAAE,SAAS;GAAM,MAAM,EAAE,SAAS,MAAM;GAAE;SAC1C;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;;;;AAUH,eAAsB,sBACrB,IACA,QACA,MACkB;CAClB,MAAM,SAAS,MAAM,GACnB,WAAW,qBAAqB,CAChC,MAAM,WAAW,KAAK,OAAO,CAC7B,MAAM,QAAQ,KAAK,KAAK,CACxB,kBAAkB;AACpB,QAAO,OAAO,OAAO,kBAAkB,GAAG;;;;;;;AAoB3C,eAAsB,gBACrB,IACA,UACsC;CACtC,MAAM,OAAO,aAAa,SAAS;CAEnC,MAAM,MAAM,MAAM,GAChB,WAAW,qBAAqB,CAChC,OAAO;EAAC;EAAM;EAAW;EAAU;EAAa,CAAC,CACjD,MAAM,cAAc,KAAK,KAAK,CAC9B,kBAAkB;AAEpB,KAAI,CAAC,IAAK,QAAO;AAGjB,KAAI,IAAI,cAAc,IAAI,KAAK,IAAI,WAAW,mBAAG,IAAI,MAAM,CAC1D,QAAO;AAIR,IAAG,YAAY,qBAAqB,CAClC,IAAI,EAAE,+BAAc,IAAI,MAAM,EAAC,aAAa,EAAE,CAAC,CAC/C,MAAM,MAAM,KAAK,IAAI,GAAG,CACxB,SAAS,CACT,YAAY,GAAG;AAEjB,QAAO;EACN,QAAQ,IAAI;EACZ,QAAQ,KAAK,MAAM,IAAI,OAAO;EAC9B,SAAS,IAAI;EACb;;;;;;AAOF,eAAsB,kBACrB,IACA,UACsC;CACtC,MAAM,OAAO,aAAa,SAAS;CAEnC,MAAM,MAAM,MAAM,GAChB,WAAW,uBAAuB,CAClC,OAAO;EAAC;EAAW;EAAU;EAAc;EAAc;EAAqB,CAAC,CAC/E,MAAM,cAAc,KAAK,KAAK,CAC9B,MAAM,cAAc,KAAK,SAAS,CAClC,kBAAkB;AAEpB,KAAI,CAAC,IAAK,QAAO;AAGjB,KAAI,IAAI,KAAK,IAAI,WAAW,mBAAG,IAAI,MAAM,CACxC,QAAO;AAGR,QAAO;EACN,QAAQ,IAAI;EACZ,QAAQ,KAAK,MAAM,IAAI,OAAO;EAE9B,SAAS,SAAS,aAAa,IAAI,sBAAsB,KAAK;EAC9D"}