emdash 1.3.1 → 1.4.0

package/dist/api-tokens-DqSlkDVI.mjs

@@ -0,0 +1,9 @@
+import { TOKEN_PREFIXES, TRANSFER_SCOPES, VALID_SCOPES, generatePrefixedToken, hasScope as hasScope$1, hashPrefixedToken as hashApiToken, isValidScope } from "@emdash-cms/auth";
+
+//#region src/auth/api-tokens.ts
+/** OAuth access token TTL: 1 hour */
+const ACCESS_TOKEN_TTL_SECONDS = 3600;
+
+//#endregion
+export { generatePrefixedToken as a, isValidScope as c, VALID_SCOPES as i, TOKEN_PREFIXES as n, hasScope$1 as o, TRANSFER_SCOPES as r, hashApiToken as s, ACCESS_TOKEN_TTL_SECONDS as t };
+//# sourceMappingURL=api-tokens-DqSlkDVI.mjs.map

package/dist/api-tokens-DqSlkDVI.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-tokens-DqSlkDVI.mjs","names":[],"sources":["../src/auth/api-tokens.ts"],"sourcesContent":["/**\n * API token generation and hashing utilities.\n *\n * Re-exports from @emdash-cms/auth which owns the implementations.\n * Uses Oslo.js (@oslojs/crypto, @oslojs/encoding) for all crypto.\n *\n * Token format: `ec_pat_<base64url>` (Personal Access Tokens)\n *               `ec_oat_<base64url>` (OAuth Access Tokens)\n *               `ec_ort_<base64url>` (OAuth Refresh Tokens)\n *\n * Prefix makes tokens identifiable in logs and secret scanners.\n * Only the SHA-256 hash is stored server-side.\n */\n\nexport {\n\tTOKEN_PREFIXES,\n\tgeneratePrefixedToken,\n\thashPrefixedToken,\n\thashPrefixedToken as hashApiToken,\n\tVALID_SCOPES,\n\tTRANSFER_SCOPES,\n\tvalidateScopes,\n\tisValidScope,\n\thasScope,\n\tcomputeS256Challenge,\n\ttype ApiTokenScope,\n} from \"@emdash-cms/auth\";\n\n/** OAuth access token TTL: 1 hour */\nexport const ACCESS_TOKEN_TTL_SECONDS = 60 * 60;\n"],"mappings":";;;;AA6BA,MAAa,2BAA2B"}

package/dist/api-tokens-GNCsIegW.mjs

@@ -0,0 +1,173 @@
+import { t as after } from "./after-32yNRvd2.mjs";
+import { a as generatePrefixedToken, s as hashApiToken } from "./api-tokens-DqSlkDVI.mjs";
+import { ulid } from "ulidx";
+
+//#region src/api/handlers/api-tokens.ts
+/**
+* Create a new API token for a user.
+*/
+async function handleApiTokenCreate(db, userId, input) {
+	try {
+		const id = ulid();
+		const { raw, hash, prefix } = generatePrefixedToken("ec_pat_");
+		await db.insertInto("_emdash_api_tokens").values({
+			id,
+			name: input.name,
+			token_hash: hash,
+			prefix,
+			user_id: userId,
+			scopes: JSON.stringify(input.scopes),
+			expires_at: input.expiresAt ?? null
+		}).execute();
+		return {
+			success: true,
+			data: {
+				token: raw,
+				info: {
+					id,
+					name: input.name,
+					prefix,
+					scopes: input.scopes,
+					userId,
+					expiresAt: input.expiresAt ?? null,
+					lastUsedAt: null,
+					createdAt: (/* @__PURE__ */ new Date()).toISOString()
+				}
+			}
+		};
+	} catch {
+		return {
+			success: false,
+			error: {
+				code: "TOKEN_CREATE_ERROR",
+				message: "Failed to create API token"
+			}
+		};
+	}
+}
+/**
+* List all API tokens for a user (never returns the raw token or hash).
+*/
+async function handleApiTokenList(db, userId) {
+	try {
+		return {
+			success: true,
+			data: { items: (await db.selectFrom("_emdash_api_tokens").select([
+				"id",
+				"name",
+				"prefix",
+				"scopes",
+				"user_id",
+				"expires_at",
+				"last_used_at",
+				"created_at"
+			]).where("user_id", "=", userId).orderBy("created_at", "desc").execute()).map((row) => ({
+				id: row.id,
+				name: row.name,
+				prefix: row.prefix,
+				scopes: JSON.parse(row.scopes),
+				userId: row.user_id,
+				expiresAt: row.expires_at,
+				lastUsedAt: row.last_used_at,
+				createdAt: row.created_at
+			})) }
+		};
+	} catch {
+		return {
+			success: false,
+			error: {
+				code: "TOKEN_LIST_ERROR",
+				message: "Failed to list API tokens"
+			}
+		};
+	}
+}
+/**
+* Revoke (delete) an API token.
+*/
+async function handleApiTokenRevoke(db, tokenId, userId) {
+	try {
+		if ((await db.deleteFrom("_emdash_api_tokens").where("id", "=", tokenId).where("user_id", "=", userId).executeTakeFirst()).numDeletedRows === 0n) return {
+			success: false,
+			error: {
+				code: "NOT_FOUND",
+				message: "Token not found"
+			}
+		};
+		return {
+			success: true,
+			data: { revoked: true }
+		};
+	} catch {
+		return {
+			success: false,
+			error: {
+				code: "TOKEN_REVOKE_ERROR",
+				message: "Failed to revoke API token"
+			}
+		};
+	}
+}
+/**
+* Delete every token with the given name for a user, returning how many were
+* removed. Token names aren't unique, so this is a bulk delete — used by the
+* dev-bypass flow to keep a single `dev-bypass-token` instead of minting a new
+* one on every reset.
+*/
+async function deleteApiTokensByName(db, userId, name) {
+	const result = await db.deleteFrom("_emdash_api_tokens").where("user_id", "=", userId).where("name", "=", name).executeTakeFirst();
+	return Number(result.numDeletedRows ?? 0n);
+}
+/**
+* Resolve a raw API token (ec_pat_...) to a user ID and scopes.
+* Updates last_used_at on successful lookup.
+* Returns null if the token is invalid or expired.
+*/
+async function resolveApiToken(db, rawToken) {
+	const hash = hashApiToken(rawToken);
+	const row = await db.selectFrom("_emdash_api_tokens").select([
+		"id",
+		"user_id",
+		"scopes",
+		"expires_at"
+	]).where("token_hash", "=", hash).executeTakeFirst();
+	if (!row) return null;
+	if (row.expires_at && new Date(row.expires_at) < /* @__PURE__ */ new Date()) return null;
+	after(async () => {
+		try {
+			await db.updateTable("_emdash_api_tokens").set({ last_used_at: (/* @__PURE__ */ new Date()).toISOString() }).where("id", "=", row.id).execute();
+		} catch (error) {
+			console.error("[api-tokens] failed to record token use:", error);
+		}
+	});
+	return {
+		userId: row.user_id,
+		scopes: JSON.parse(row.scopes),
+		tokenId: row.id
+	};
+}
+/**
+* Resolve an OAuth access token (ec_oat_...) to a user ID and scopes.
+* Returns null if the token is invalid or expired.
+*/
+async function resolveOAuthToken(db, rawToken) {
+	const hash = hashApiToken(rawToken);
+	const row = await db.selectFrom("_emdash_oauth_tokens").select([
+		"user_id",
+		"scopes",
+		"expires_at",
+		"token_type",
+		"refresh_token_hash"
+	]).where("token_hash", "=", hash).where("token_type", "=", "access").executeTakeFirst();
+	if (!row) return null;
+	if (new Date(row.expires_at) < /* @__PURE__ */ new Date()) return null;
+	return {
+		userId: row.user_id,
+		scopes: JSON.parse(row.scopes),
+		tokenId: `oauth:${hashApiToken(row.refresh_token_hash ?? hash)}`
+	};
+}
+
+//#endregion
+export { resolveApiToken as a, handleApiTokenRevoke as i, handleApiTokenCreate as n, resolveOAuthToken as o, handleApiTokenList as r, deleteApiTokensByName as t };
+//# sourceMappingURL=api-tokens-GNCsIegW.mjs.map

package/dist/api-tokens-GNCsIegW.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-tokens-GNCsIegW.mjs","names":[],"sources":["../src/api/handlers/api-tokens.ts"],"sourcesContent":["/**\n * API token management handlers.\n *\n * Creates, lists, and revokes Personal Access Tokens (PATs).\n * Token format: ec_pat_<base64url>\n * Only the SHA-256 hash is stored — raw token shown once at creation.\n */\n\nimport type { Kysely } from \"kysely\";\nimport { ulid } from \"ulidx\";\n\nimport { after } from \"../../after.js\";\nimport { hashApiToken, generatePrefixedToken } from \"../../auth/api-tokens.js\";\nimport type { Database } from \"../../database/types.js\";\nimport type { ApiResult } from \"../types.js\";\n\n// ---------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------\n\nexport interface ApiTokenInfo {\n\tid: string;\n\tname: string;\n\tprefix: string;\n\tscopes: string[];\n\tuserId: string;\n\texpiresAt: string | null;\n\tlastUsedAt: string | null;\n\tcreatedAt: string;\n}\n\nexport interface ApiTokenCreateResult {\n\t/** The raw token — shown once, never stored */\n\ttoken: string;\n\t/** Token metadata */\n\tinfo: ApiTokenInfo;\n}\n\n// ---------------------------------------------------------------------------\n// Handlers\n// ---------------------------------------------------------------------------\n\n/**\n * Create a new API token for a user.\n */\nexport async function handleApiTokenCreate(\n\tdb: Kysely<Database>,\n\tuserId: string,\n\tinput: {\n\t\tname: string;\n\t\tscopes: string[];\n\t\texpiresAt?: string;\n\t},\n): Promise<ApiResult<ApiTokenCreateResult>> {\n\ttry {\n\t\tconst id = ulid();\n\t\tconst { raw, hash, prefix } = generatePrefixedToken(\"ec_pat_\");\n\n\t\tawait db\n\t\t\t.insertInto(\"_emdash_api_tokens\")\n\t\t\t.values({\n\t\t\t\tid,\n\t\t\t\tname: input.name,\n\t\t\t\ttoken_hash: hash,\n\t\t\t\tprefix,\n\t\t\t\tuser_id: userId,\n\t\t\t\tscopes: JSON.stringify(input.scopes),\n\t\t\t\texpires_at: input.expiresAt ?? null,\n\t\t\t})\n\t\t\t.execute();\n\n\t\tconst info: ApiTokenInfo = {\n\t\t\tid,\n\t\t\tname: input.name,\n\t\t\tprefix,\n\t\t\tscopes: input.scopes,\n\t\t\tuserId,\n\t\t\texpiresAt: input.expiresAt ?? null,\n\t\t\tlastUsedAt: null,\n\t\t\tcreatedAt: new Date().toISOString(),\n\t\t};\n\n\t\treturn { success: true, data: { token: raw, info } };\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"TOKEN_CREATE_ERROR\",\n\t\t\t\tmessage: \"Failed to create API token\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * List all API tokens for a user (never returns the raw token or hash).\n */\nexport async function handleApiTokenList(\n\tdb: Kysely<Database>,\n\tuserId: string,\n): Promise<ApiResult<{ items: ApiTokenInfo[] }>> {\n\ttry {\n\t\tconst rows = await db\n\t\t\t.selectFrom(\"_emdash_api_tokens\")\n\t\t\t.select([\n\t\t\t\t\"id\",\n\t\t\t\t\"name\",\n\t\t\t\t\"prefix\",\n\t\t\t\t\"scopes\",\n\t\t\t\t\"user_id\",\n\t\t\t\t\"expires_at\",\n\t\t\t\t\"last_used_at\",\n\t\t\t\t\"created_at\",\n\t\t\t])\n\t\t\t.where(\"user_id\", \"=\", userId)\n\t\t\t.orderBy(\"created_at\", \"desc\")\n\t\t\t.execute();\n\n\t\tconst items: ApiTokenInfo[] = rows.map((row) => ({\n\t\t\tid: row.id,\n\t\t\tname: row.name,\n\t\t\tprefix: row.prefix,\n\t\t\tscopes: JSON.parse(row.scopes) as string[],\n\t\t\tuserId: row.user_id,\n\t\t\texpiresAt: row.expires_at,\n\t\t\tlastUsedAt: row.last_used_at,\n\t\t\tcreatedAt: row.created_at,\n\t\t}));\n\n\t\treturn { success: true, data: { items } };\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"TOKEN_LIST_ERROR\",\n\t\t\t\tmessage: \"Failed to list API tokens\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Revoke (delete) an API token.\n */\nexport async function handleApiTokenRevoke(\n\tdb: Kysely<Database>,\n\ttokenId: string,\n\tuserId: string,\n): Promise<ApiResult<{ revoked: boolean }>> {\n\ttry {\n\t\tconst result = await db\n\t\t\t.deleteFrom(\"_emdash_api_tokens\")\n\t\t\t.where(\"id\", \"=\", tokenId)\n\t\t\t.where(\"user_id\", \"=\", userId)\n\t\t\t.executeTakeFirst();\n\n\t\tif (result.numDeletedRows === 0n) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"NOT_FOUND\", message: \"Token not found\" },\n\t\t\t};\n\t\t}\n\n\t\treturn { success: true, data: { revoked: true } };\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"TOKEN_REVOKE_ERROR\",\n\t\t\t\tmessage: \"Failed to revoke API token\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Delete every token with the given name for a user, returning how many were\n * removed. Token names aren't unique, so this is a bulk delete — used by the\n * dev-bypass flow to keep a single `dev-bypass-token` instead of minting a new\n * one on every reset.\n */\nexport async function deleteApiTokensByName(\n\tdb: Kysely<Database>,\n\tuserId: string,\n\tname: string,\n): Promise<number> {\n\tconst result = await db\n\t\t.deleteFrom(\"_emdash_api_tokens\")\n\t\t.where(\"user_id\", \"=\", userId)\n\t\t.where(\"name\", \"=\", name)\n\t\t.executeTakeFirst();\n\treturn Number(result.numDeletedRows ?? 0n);\n}\n\n/**\n * A resolved bearer token. `tokenId` identifies the credential (not the\n * user) and is safe to store and show: the token row id for a PAT, and for\n * an OAuth token a one-way id of its grant that stays the same across\n * access-token refreshes.\n */\nexport interface ResolvedBearerToken {\n\tuserId: string;\n\tscopes: string[];\n\ttokenId: string;\n}\n\n/**\n * Resolve a raw API token (ec_pat_...) to a user ID and scopes.\n * Updates last_used_at on successful lookup.\n * Returns null if the token is invalid or expired.\n */\nexport async function resolveApiToken(\n\tdb: Kysely<Database>,\n\trawToken: string,\n): Promise<ResolvedBearerToken | null> {\n\tconst hash = hashApiToken(rawToken);\n\n\tconst row = await db\n\t\t.selectFrom(\"_emdash_api_tokens\")\n\t\t.select([\"id\", \"user_id\", \"scopes\", \"expires_at\"])\n\t\t.where(\"token_hash\", \"=\", hash)\n\t\t.executeTakeFirst();\n\n\tif (!row) return null;\n\n\t// Check expiry\n\tif (row.expires_at && new Date(row.expires_at) < new Date()) {\n\t\treturn null;\n\t}\n\n\tafter(async () => {\n\t\ttry {\n\t\t\tawait db\n\t\t\t\t.updateTable(\"_emdash_api_tokens\")\n\t\t\t\t.set({ last_used_at: new Date().toISOString() })\n\t\t\t\t.where(\"id\", \"=\", row.id)\n\t\t\t\t.execute();\n\t\t} catch (error) {\n\t\t\tconsole.error(\"[api-tokens] failed to record token use:\", error);\n\t\t}\n\t});\n\n\treturn {\n\t\tuserId: row.user_id,\n\t\tscopes: JSON.parse(row.scopes) as string[],\n\t\ttokenId: row.id,\n\t};\n}\n\n/**\n * Resolve an OAuth access token (ec_oat_...) to a user ID and scopes.\n * Returns null if the token is invalid or expired.\n */\nexport async function resolveOAuthToken(\n\tdb: Kysely<Database>,\n\trawToken: string,\n): Promise<ResolvedBearerToken | null> {\n\tconst hash = hashApiToken(rawToken);\n\n\tconst row = await db\n\t\t.selectFrom(\"_emdash_oauth_tokens\")\n\t\t.select([\"user_id\", \"scopes\", \"expires_at\", \"token_type\", \"refresh_token_hash\"])\n\t\t.where(\"token_hash\", \"=\", hash)\n\t\t.where(\"token_type\", \"=\", \"access\")\n\t\t.executeTakeFirst();\n\n\tif (!row) return null;\n\n\t// Check expiry\n\tif (new Date(row.expires_at) < new Date()) {\n\t\treturn null;\n\t}\n\n\treturn {\n\t\tuserId: row.user_id,\n\t\tscopes: JSON.parse(row.scopes) as string[],\n\t\t// Hashing the stored hash again keeps the id from being a token lookup key.\n\t\ttokenId: `oauth:${hashApiToken(row.refresh_token_hash ?? hash)}`,\n\t};\n}\n"],"mappings":";;;;;;;;AA6CA,eAAsB,qBACrB,IACA,QACA,OAK2C;AAC3C,KAAI;EACH,MAAM,KAAK,MAAM;EACjB,MAAM,EAAE,KAAK,MAAM,WAAW,sBAAsB,UAAU;AAE9D,QAAM,GACJ,WAAW,qBAAqB,CAChC,OAAO;GACP;GACA,MAAM,MAAM;GACZ,YAAY;GACZ;GACA,SAAS;GACT,QAAQ,KAAK,UAAU,MAAM,OAAO;GACpC,YAAY,MAAM,aAAa;GAC/B,CAAC,CACD,SAAS;AAaX,SAAO;GAAE,SAAS;GAAM,MAAM;IAAE,OAAO;IAAK,MAXjB;KAC1B;KACA,MAAM,MAAM;KACZ;KACA,QAAQ,MAAM;KACd;KACA,WAAW,MAAM,aAAa;KAC9B,YAAY;KACZ,4BAAW,IAAI,MAAM,EAAC,aAAa;KACnC;IAEiD;GAAE;SAC7C;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;AAOH,eAAsB,mBACrB,IACA,QACgD;AAChD,KAAI;AA4BH,SAAO;GAAE,SAAS;GAAM,MAAM,EAAE,QA3BnB,MAAM,GACjB,WAAW,qBAAqB,CAChC,OAAO;IACP;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA,CAAC,CACD,MAAM,WAAW,KAAK,OAAO,CAC7B,QAAQ,cAAc,OAAO,CAC7B,SAAS,EAEwB,KAAK,SAAS;IAChD,IAAI,IAAI;IACR,MAAM,IAAI;IACV,QAAQ,IAAI;IACZ,QAAQ,KAAK,MAAM,IAAI,OAAO;IAC9B,QAAQ,IAAI;IACZ,WAAW,IAAI;IACf,YAAY,IAAI;IAChB,WAAW,IAAI;IACf,EAAE,EAEoC;GAAE;SAClC;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;AAOH,eAAsB,qBACrB,IACA,SACA,QAC2C;AAC3C,KAAI;AAOH,OANe,MAAM,GACnB,WAAW,qBAAqB,CAChC,MAAM,MAAM,KAAK,QAAQ,CACzB,MAAM,WAAW,KAAK,OAAO,CAC7B,kBAAkB,EAET,mBAAmB,GAC7B,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAa,SAAS;IAAmB;GACxD;AAGF,SAAO;GAAE,SAAS;GAAM,MAAM,EAAE,SAAS,MAAM;GAAE;SAC1C;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;;;;AAUH,eAAsB,sBACrB,IACA,QACA,MACkB;CAClB,MAAM,SAAS,MAAM,GACnB,WAAW,qBAAqB,CAChC,MAAM,WAAW,KAAK,OAAO,CAC7B,MAAM,QAAQ,KAAK,KAAK,CACxB,kBAAkB;AACpB,QAAO,OAAO,OAAO,kBAAkB,GAAG;;;;;;;AAoB3C,eAAsB,gBACrB,IACA,UACsC;CACtC,MAAM,OAAO,aAAa,SAAS;CAEnC,MAAM,MAAM,MAAM,GAChB,WAAW,qBAAqB,CAChC,OAAO;EAAC;EAAM;EAAW;EAAU;EAAa,CAAC,CACjD,MAAM,cAAc,KAAK,KAAK,CAC9B,kBAAkB;AAEpB,KAAI,CAAC,IAAK,QAAO;AAGjB,KAAI,IAAI,cAAc,IAAI,KAAK,IAAI,WAAW,mBAAG,IAAI,MAAM,CAC1D,QAAO;AAGR,OAAM,YAAY;AACjB,MAAI;AACH,SAAM,GACJ,YAAY,qBAAqB,CACjC,IAAI,EAAE,+BAAc,IAAI,MAAM,EAAC,aAAa,EAAE,CAAC,CAC/C,MAAM,MAAM,KAAK,IAAI,GAAG,CACxB,SAAS;WACH,OAAO;AACf,WAAQ,MAAM,4CAA4C,MAAM;;GAEhE;AAEF,QAAO;EACN,QAAQ,IAAI;EACZ,QAAQ,KAAK,MAAM,IAAI,OAAO;EAC9B,SAAS,IAAI;EACb;;;;;;AAOF,eAAsB,kBACrB,IACA,UACsC;CACtC,MAAM,OAAO,aAAa,SAAS;CAEnC,MAAM,MAAM,MAAM,GAChB,WAAW,uBAAuB,CAClC,OAAO;EAAC;EAAW;EAAU;EAAc;EAAc;EAAqB,CAAC,CAC/E,MAAM,cAAc,KAAK,KAAK,CAC9B,MAAM,cAAc,KAAK,SAAS,CAClC,kBAAkB;AAEpB,KAAI,CAAC,IAAK,QAAO;AAGjB,KAAI,IAAI,KAAK,IAAI,WAAW,mBAAG,IAAI,MAAM,CACxC,QAAO;AAGR,QAAO;EACN,QAAQ,IAAI;EACZ,QAAQ,KAAK,MAAM,IAAI,OAAO;EAE9B,SAAS,SAAS,aAAa,IAAI,sBAAsB,KAAK;EAC9D"}