notifkit 0.1.7 → 0.1.8

package/dist/{main-CFSukWm8.mjs → main-BAO4kKce.mjs}

@@ -1,8 +1,11 @@
-import { Bt as PreferencesSchema, C as ProjectRepository, D as WorkflowRepository, E as UserRepository, Ft as ContactChannelSchema, G as normaliseTarget, Ht as SyncTemplatesSchema, It as CreateWorkflowSchema, K as LRUCache, Kt as UpdateUserSchema, Nt as AddUserSchema, Pt as BatchAddContactsSchema, Q as metrics, T as TemplateRepository, W as getPriorityBucket, Wt as TriggerWorkflowSchema, X as StreamProducer, Xt as buildStreamEvent, Z as getMetricsRegistry, _n as readBaseConfig, ct as projectApiKeys, dt as suppressions, et as createLogger, ft as userTopicPreferences, hn as loadEnv, it as createDatabase, k as RedisClient, lt as projects, mt as workflowDefinitions, nn as STREAMS, p as verifyUnsubscribeToken, pt as users, q as globalEmitter, st as messageLogs, tn as PUBSUB_CHANNELS, ut as scheduledPayloads, w as SegmentRepository, x as ContactRepository, zt as NotifyRequestSchema } from "./src-CPMwsUCJ.mjs";
+import { $ as metrics, A as RedisClient, Bt as NotifyRequestSchema, D as UserRepository, E as TemplateRepository, Ft as BatchAddContactsSchema, G as getPriorityBucket, Gt as TriggerWorkflowSchema, It as ContactChannelSchema, J as globalEmitter, K as normaliseTarget, Lt as CreateWorkflowSchema, O as WorkflowRepository, Pt as AddUserSchema, Q as getMetricsRegistry, S as ContactRepository, T as SegmentRepository, Ut as SyncTemplatesSchema, Vt as PreferencesSchema, Z as StreamProducer, Zt as buildStreamEvent, at as createDatabase, ct as messageLogs, dt as scheduledPayloads, ft as suppressions, gn as loadEnv, ht as workflowDefinitions, lt as projectApiKeys, mt as users, nn as PUBSUB_CHANNELS, p as verifyUnsubscribeToken, pt as userTopicPreferences, q as LRUCache, qt as UpdateUserSchema, rn as STREAMS, tt as createLogger, ut as projects, vn as readBaseConfig, w as ProjectRepository, x as AdminUserRepository } from "./src-DkvHYM3y.mjs";
+import { extname, join, resolve } from "node:path";
 import { z } from "zod";
-import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
+import { createHash, randomBytes, randomUUID, scrypt, timingSafeEqual } from "node:crypto";
 import { and, desc, eq, gte, inArray, isNotNull, like, lt, lte, or, sql } from "drizzle-orm";
-import { createServer } from "node:http";
+import { createServer, request } from "node:http";
+import { promisify } from "node:util";
+import { createReadStream, existsSync, statSync } from "node:fs";
 //#region src/services/api/http.ts
 async function readRawBody(req) {
 	return await new Promise((resolve, reject) => {
@@ -122,6 +125,73 @@ function split(path) {
 	return path.split("/").filter((s) => s.length > 0);
 }
 //#endregion
+//#region src/services/auth/index.ts
+const scryptAsync = promisify(scrypt);
+const DEFAULT_SESSION_TTL_SECONDS = 604800;
+const SESSION_PREFIX = "notif:session:";
+/**
+* Hashes a plaintext password using crypto.scrypt with a random 16-byte salt.
+* Returns salt and hash separated by a colon.
+*/
+async function hashPassword(password) {
+	const salt = randomBytes(16).toString("hex");
+	return `${salt}:${(await scryptAsync(password, salt, 64)).toString("hex")}`;
+}
+/**
+* Verifies a plaintext password against a stored salt:hash string using constant-time comparison.
+*/
+async function verifyPassword(password, storedHash) {
+	const [salt, key] = storedHash.split(":");
+	if (!salt || !key) return false;
+	const keyBuffer = Buffer.from(key, "hex");
+	const derivedKey = await scryptAsync(password, salt, keyBuffer.length);
+	if (derivedKey.length !== keyBuffer.length) return false;
+	return timingSafeEqual(derivedKey, keyBuffer);
+}
+/**
+* Creates a secure session in Redis for an authenticated admin user.
+*/
+async function createAdminSession(redis, user, ttlSeconds = DEFAULT_SESSION_TTL_SECONDS) {
+	const token = `nk_sess_${randomBytes(32).toString("hex")}`;
+	const now = Date.now();
+	const session = {
+		token,
+		adminId: user.id,
+		email: user.email,
+		username: user.username,
+		role: user.role,
+		createdAt: now,
+		expiresAt: now + ttlSeconds * 1e3
+	};
+	await redis.set(`${SESSION_PREFIX}${token}`, JSON.stringify(session), "EX", ttlSeconds);
+	return session;
+}
+/**
+* Retrieves an admin session from Redis if valid and unexpired.
+*/
+async function getAdminSession(redis, token) {
+	if (!token || !token.startsWith("nk_sess_")) return null;
+	const raw = await redis.get(`${SESSION_PREFIX}${token}`);
+	if (!raw) return null;
+	try {
+		const session = JSON.parse(raw);
+		if (session.expiresAt <= Date.now()) {
+			await redis.del(`${SESSION_PREFIX}${token}`);
+			return null;
+		}
+		return session;
+	} catch {
+		return null;
+	}
+}
+/**
+* Revokes an active admin session.
+*/
+async function revokeAdminSession(redis, token) {
+	if (!token) return;
+	await redis.del(`${SESSION_PREFIX}${token}`);
+}
+//#endregion
 //#region src/services/api/handlers.ts
 const IngestEventSchema = z.object({
 	name: z.string().min(1),
@@ -809,17 +879,28 @@ function createHandlers(deps) {
 		} catch {
 			streamDepths[key] = 0;
 		}
-		const totalTasksRes = await deps.db.select({ count: sql`count(distinct ${messageLogs.taskId})` }).from(messageLogs).where(eq(messageLogs.projectId, ctx.projectId));
-		const deliveredTasksRes = await deps.db.select({ count: sql`count(distinct ${messageLogs.taskId})` }).from(messageLogs).where(and(eq(messageLogs.projectId, ctx.projectId), eq(messageLogs.status, "delivered")));
-		const total = Number(totalTasksRes[0]?.count ?? 0);
-		const delivered = Number(deliveredTasksRes[0]?.count ?? 0);
+		let total = 0;
+		let delivered = 0;
+		if (ctx.projectId) {
+			const totalTasksRes = await deps.db.select({ count: sql`count(distinct ${messageLogs.taskId})` }).from(messageLogs).where(eq(messageLogs.projectId, ctx.projectId));
+			const deliveredTasksRes = await deps.db.select({ count: sql`count(distinct ${messageLogs.taskId})` }).from(messageLogs).where(and(eq(messageLogs.projectId, ctx.projectId), eq(messageLogs.status, "delivered")));
+			total = Number(totalTasksRes[0]?.count ?? 0);
+			delivered = Number(deliveredTasksRes[0]?.count ?? 0);
+		} else {
+			const totalTasksRes = await deps.db.select({ count: sql`count(distinct ${messageLogs.taskId})` }).from(messageLogs);
+			const deliveredTasksRes = await deps.db.select({ count: sql`count(distinct ${messageLogs.taskId})` }).from(messageLogs).where(eq(messageLogs.status, "delivered"));
+			total = Number(totalTasksRes[0]?.count ?? 0);
+			delivered = Number(deliveredTasksRes[0]?.count ?? 0);
+		}
+		const failed = streamDepths.DEAD_LETTER || 0;
+		const successRate = total > 0 ? Number((delivered / total * 100).toFixed(2)) : 100;
 		sendJson(res, 200, {
 			streams: streamDepths,
 			deliveryStats: {
 				total,
 				delivered,
-				failed: streamDepths.DEAD_LETTER || 0,
-				successRate: total > 0 ? Number((delivered / total * 100).toFixed(2)) : 100
+				failed,
+				successRate
 			}
 		});
 	}
@@ -1151,7 +1232,88 @@ code{background:#f4f4f5;padding:.1rem .35rem;border-radius:4px}</style>
 		await deps.db.delete(suppressions).where(and(eq(suppressions.projectId, ctx.projectId), eq(suppressions.channel, channel), eq(suppressions.target, normaliseTarget(decodeURIComponent(target)))));
 		sendNoContent(res);
 	}
+	async function login(req, res) {
+		if (!deps.adminUserRepo) {
+			sendJson(res, 500, {
+				error: "internal_error",
+				message: "Admin user repository not initialized"
+			});
+			return;
+		}
+		const body = await readJsonBody(req);
+		const parsed = z.object({
+			identifier: z.string().min(1, "Identifier (email or username) is required"),
+			password: z.string().min(1, "Password is required")
+		}).safeParse(body);
+		if (!parsed.success) {
+			sendValidationError(res, parsed.error);
+			return;
+		}
+		const { identifier, password } = parsed.data;
+		const user = await deps.adminUserRepo.findByEmailOrUsername(identifier);
+		if (!user) {
+			sendJson(res, 401, {
+				error: "unauthorized",
+				message: "Invalid credentials"
+			});
+			return;
+		}
+		if (!await verifyPassword(password, user.passwordHash)) {
+			sendJson(res, 401, {
+				error: "unauthorized",
+				message: "Invalid credentials"
+			});
+			return;
+		}
+		const session = await createAdminSession(deps.redis.native, user);
+		sendJson(res, 200, {
+			token: session.token,
+			user: {
+				id: user.id,
+				email: user.email,
+				username: user.username,
+				role: user.role
+			},
+			expiresAt: session.expiresAt
+		});
+	}
+	async function logout(req, res) {
+		const authHeader = req.headers["authorization"];
+		let token;
+		if (typeof authHeader === "string" && authHeader.toLowerCase().startsWith("bearer ")) token = authHeader.slice(7).trim();
+		if (token) await revokeAdminSession(deps.redis.native, token);
+		sendJson(res, 200, { message: "Logged out successfully" });
+	}
+	async function getMe(req, res) {
+		const authHeader = req.headers["authorization"];
+		let token;
+		if (typeof authHeader === "string" && authHeader.toLowerCase().startsWith("bearer ")) token = authHeader.slice(7).trim();
+		if (!token) {
+			sendJson(res, 401, {
+				error: "unauthorized",
+				message: "Missing token"
+			});
+			return;
+		}
+		const session = await getAdminSession(deps.redis.native, token);
+		if (!session) {
+			sendJson(res, 401, {
+				error: "unauthorized",
+				message: "Invalid or expired session"
+			});
+			return;
+		}
+		sendJson(res, 200, { user: {
+			id: session.adminId,
+			email: session.email,
+			username: session.username,
+			role: session.role
+		} });
+	}
 	return {
+		login,
+		logout,
+		getMe,
 		syncTemplates,
 		addUser,
 		updateUser,
@@ -1201,6 +1363,158 @@ code{background:#f4f4f5;padding:.1rem .35rem;border-radius:4px}</style>
 	};
 }
 //#endregion
+//#region src/services/api/admin-static.ts
+const MIME_TYPES = {
+	".html": "text/html; charset=utf-8",
+	".js": "application/javascript; charset=utf-8",
+	".mjs": "application/javascript; charset=utf-8",
+	".css": "text/css; charset=utf-8",
+	".json": "application/json; charset=utf-8",
+	".png": "image/png",
+	".jpg": "image/jpeg",
+	".jpeg": "image/jpeg",
+	".gif": "image/gif",
+	".svg": "image/svg+xml",
+	".ico": "image/x-icon",
+	".woff": "font/woff",
+	".woff2": "font/woff2",
+	".ttf": "font/ttf",
+	".webp": "image/webp",
+	".txt": "text/plain; charset=utf-8",
+	".map": "application/json; charset=utf-8"
+};
+const POSSIBLE_DASHBOARD_DIRS = [
+	resolve(process.cwd(), "dashboard", "dist"),
+	resolve(process.cwd(), "dashboard", "out"),
+	resolve(process.cwd(), "dist", "admin"),
+	resolve(process.cwd(), "dist", "dashboard")
+];
+function getDashboardDir() {
+	for (const dir of POSSIBLE_DASHBOARD_DIRS) if (existsSync(dir) && existsSync(join(dir, "index.html"))) return dir;
+	return null;
+}
+/**
+* Proxies request to frontend dev server if running.
+*/
+function proxyToDevServer(req, res, targetHost, targetPort) {
+	return new Promise((resolvePromise) => {
+		const proxyReq = request({
+			host: targetHost,
+			port: targetPort,
+			path: req.url,
+			method: req.method,
+			headers: req.headers
+		}, (proxyRes) => {
+			res.writeHead(proxyRes.statusCode || 200, proxyRes.headers);
+			proxyRes.pipe(res);
+			resolvePromise(true);
+		});
+		proxyReq.on("error", () => {
+			resolvePromise(false);
+		});
+		if (req.readable) req.pipe(proxyReq);
+		else proxyReq.end();
+	});
+}
+/**
+* Handles incoming HTTP requests for `/admin` and `/admin/*`.
+* Serves static exported assets from Vite SPA build with index.html fallback,
+* or proxies to Vite dev server if running in development mode.
+*/
+async function handleAdminRequest(req, res, url) {
+	if (url.pathname !== "/admin" && !url.pathname.startsWith("/admin/")) return false;
+	if (url.pathname === "/admin") {
+		res.writeHead(301, { Location: "/admin/" + (url.search || "") });
+		res.end();
+		return true;
+	}
+	if (process.env.NODE_ENV !== "production") {
+		const devProxyUrl = process.env.VITE_DEV_URL || process.env.ADMIN_DEV_URL || process.env.NEXT_DEV_URL;
+		const targetPort = devProxyUrl ? parseInt(new URL(devProxyUrl).port, 10) : 5173;
+		if (await proxyToDevServer(req, res, devProxyUrl ? new URL(devProxyUrl).hostname : "127.0.0.1", targetPort)) return true;
+	}
+	const dashboardDir = getDashboardDir();
+	if (!dashboardDir) {
+		res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+		res.end(`
+      <!DOCTYPE html>
+      <html lang="en">
+      <head>
+        <meta charset="utf-8">
+        <title>Notifkit Admin Dashboard</title>
+        <style>
+          body { font-family: system-ui, -apple-system, sans-serif; background: #09090b; color: #f4f4f5; display: flex; align-items: center; justify-content: center; height: 100vh; margin: 0; }
+          .card { background: #18181b; border: 1px solid #27272a; padding: 2rem; border-radius: 0.75rem; max-width: 500px; text-align: center; }
+          h1 { margin-top: 0; color: #fafafa; }
+          code { background: #27272a; padding: 0.2rem 0.4rem; border-radius: 0.25rem; font-family: monospace; font-size: 0.9em; }
+        </style>
+      </head>
+      <body>
+        <div class="card">
+          <h1>Notifkit Admin Dashboard</h1>
+          <p>The dashboard static bundle has not been built yet.</p>
+          <p>Please build it by running:</p>
+          <p><code>npm run build:dashboard</code></p>
+          <p>or run the dev server with <code>npm --prefix dashboard run dev</code>.</p>
+        </div>
+      </body>
+      </html>
+    `);
+		return true;
+	}
+	let subPath = url.pathname.slice(6);
+	if (subPath.startsWith("/")) subPath = subPath.slice(1);
+	if (!subPath) subPath = "index.html";
+	const normalizedSubPath = subPath.replace(/\/$/, "");
+	let filePath = resolve(dashboardDir, subPath);
+	if (!filePath.startsWith(dashboardDir)) {
+		res.writeHead(403, { "Content-Type": "text/plain" });
+		res.end("Forbidden");
+		return true;
+	}
+	let stat = null;
+	if (existsSync(filePath)) {
+		stat = statSync(filePath);
+		if (stat.isDirectory()) {
+			filePath = join(filePath, "index.html");
+			stat = existsSync(filePath) ? statSync(filePath) : null;
+		}
+	}
+	if (!stat) {
+		const htmlPath = resolve(dashboardDir, `${normalizedSubPath}.html`);
+		if (existsSync(htmlPath)) {
+			filePath = htmlPath;
+			stat = statSync(filePath);
+		}
+	}
+	if (!stat) {
+		const dirIndexPath = resolve(dashboardDir, normalizedSubPath, "index.html");
+		if (existsSync(dirIndexPath)) {
+			filePath = dirIndexPath;
+			stat = statSync(filePath);
+		}
+	}
+	if (!stat) {
+		filePath = resolve(dashboardDir, "index.html");
+		if (existsSync(filePath)) stat = statSync(filePath);
+	}
+	if (!stat) {
+		res.writeHead(404, { "Content-Type": "text/plain" });
+		res.end("Not Found");
+		return true;
+	}
+	const ext = extname(filePath).toLowerCase();
+	const contentType = MIME_TYPES[ext] || "application/octet-stream";
+	const cacheControl = filePath.includes("_next") || ext === ".js" || ext === ".css" ? "public, max-age=31536000, immutable" : "public, max-age=0, must-revalidate";
+	res.writeHead(200, {
+		"Content-Type": contentType,
+		"Content-Length": stat.size,
+		"Cache-Control": cacheControl
+	});
+	createReadStream(filePath).pipe(res);
+	return true;
+}
+//#endregion
 //#region src/services/api/main.ts
 /** Pub/sub channel used to drop a cached API key across every API process. */
 const API_KEY_INVALIDATION_CHANNEL = "apikey.invalidated";
@@ -1370,6 +1684,21 @@ async function startApiServer() {
 			logger
 		})
 	};
+	const adminUserRepo = new AdminUserRepository(db);
+	if (config.ADMIN_EMAIL && config.ADMIN_PASSWORD) try {
+		if (!await adminUserRepo.findByEmailOrUsername(config.ADMIN_EMAIL)) {
+			const passwordHash = await hashPassword(config.ADMIN_PASSWORD);
+			await adminUserRepo.create({
+				email: config.ADMIN_EMAIL,
+				username: config.ADMIN_USERNAME,
+				passwordHash,
+				role: "superadmin"
+			});
+			logger.info({ email: config.ADMIN_EMAIL }, "Bootstrapped initial admin user");
+		}
+	} catch (err) {
+		logger.error({ err }, "Failed to bootstrap default admin user");
+	}
 	deps = {
 		logger,
 		redis,
@@ -1380,11 +1709,12 @@ async function startApiServer() {
 		projectRepo: new ProjectRepository(db),
 		workflowRepo: new WorkflowRepository(db),
 		segmentRepo: new SegmentRepository(db),
+		adminUserRepo,
 		db
 	};
 	h = createHandlers(deps);
 	router = new Router();
-	router.put("/v1/templates", h.syncTemplates).get("/v1/templates", h.listTemplates).get("/v1/templates/:id", h.getTemplate).delete("/v1/templates/:id", h.deleteTemplate).post("/v1/users", h.addUser).get("/v1/users", h.listUsers).get("/v1/users/:id", h.getUser).get("/v1/users/:id/details", h.getUserDetails).patch("/v1/users/:id", h.updateUser).delete("/v1/users/:id", h.deleteUser).post("/v1/users/:id/contacts", h.addContact).get("/v1/users/:id/contacts", h.getUserContacts).delete("/v1/users/:id/contacts/:channel/:target", h.deleteContact).get("/v1/users/:id/preferences", h.getUserPreferences).patch("/v1/users/:id/preferences", h.updateUserPreferences).post("/v1/notify", h.notify).get("/v1/notifications/scheduled", h.getScheduledMessages).get("/v1/notifications/logs", h.getNotificationLogs).get("/v1/notifications/:taskId", h.getNotificationStatus).delete("/v1/notifications/:taskId", h.cancelNotification).get("/v1/unsubscribe", h.unsubscribePage).post("/v1/unsubscribe", h.unsubscribe).get("/v1/campaigns", h.listCampaigns).get("/v1/campaigns/:campaign/stats", h.getCampaignStats).get("/v1/suppressions", h.listSuppressions).post("/v1/suppressions", h.createSuppression).delete("/v1/suppressions/:channel/:target", h.deleteSuppression).get("/v1/system/health", h.getSystemHealth).get("/v1/system/metrics", h.getSystemMetrics).get("/v1/dlq", h.getDLQMessages).post("/v1/dlq/replay", h.replayDLQMessage).delete("/v1/dlq/:id", h.deleteDLQMessage).post("/v1/workflows", h.createWorkflow).get("/v1/workflows", h.listWorkflows).get("/v1/workflows/instances/:id", h.getWorkflow).delete("/v1/workflows/instances/:id", h.cancelWorkflow).post("/v1/workflows/trigger", h.triggerWorkflow).get("/v1/segments", h.listSegments).post("/v1/events", h.ingestEvent).get("/v1/events/stream", h.getEventsStream).get("/v1/projects", h.listProjects).post("/v1/projects", handleCreateProject).delete("/v1/projects/:id", h.deleteProject).patch("/v1/projects/:id", h.updateProject).post("/v1/projects/:id/keys", h.createProjectKey).get("/v1/projects/:id/keys", h.listProjectKeys).delete("/v1/projects/:id/keys/:keyId", h.deleteProjectKey).get("/health", handleHealth).get("/metrics", handleMetrics).get("/live", handleLive).get("/ready", handleReady);
+	router.post("/v1/auth/login", h.login).post("/v1/auth/logout", h.logout).get("/v1/auth/me", h.getMe).put("/v1/templates", h.syncTemplates).get("/v1/templates", h.listTemplates).get("/v1/templates/:id", h.getTemplate).delete("/v1/templates/:id", h.deleteTemplate).post("/v1/users", h.addUser).get("/v1/users", h.listUsers).get("/v1/users/:id", h.getUser).get("/v1/users/:id/details", h.getUserDetails).patch("/v1/users/:id", h.updateUser).delete("/v1/users/:id", h.deleteUser).post("/v1/users/:id/contacts", h.addContact).get("/v1/users/:id/contacts", h.getUserContacts).delete("/v1/users/:id/contacts/:channel/:target", h.deleteContact).get("/v1/users/:id/preferences", h.getUserPreferences).patch("/v1/users/:id/preferences", h.updateUserPreferences).post("/v1/notify", h.notify).get("/v1/notifications/scheduled", h.getScheduledMessages).get("/v1/notifications/logs", h.getNotificationLogs).get("/v1/notifications/:taskId", h.getNotificationStatus).delete("/v1/notifications/:taskId", h.cancelNotification).get("/v1/unsubscribe", h.unsubscribePage).post("/v1/unsubscribe", h.unsubscribe).get("/v1/campaigns", h.listCampaigns).get("/v1/campaigns/:campaign/stats", h.getCampaignStats).get("/v1/suppressions", h.listSuppressions).post("/v1/suppressions", h.createSuppression).delete("/v1/suppressions/:channel/:target", h.deleteSuppression).get("/v1/system/health", h.getSystemHealth).get("/v1/system/metrics", h.getSystemMetrics).get("/v1/dlq", h.getDLQMessages).post("/v1/dlq/replay", h.replayDLQMessage).delete("/v1/dlq/:id", h.deleteDLQMessage).post("/v1/workflows", h.createWorkflow).get("/v1/workflows", h.listWorkflows).get("/v1/workflows/instances/:id", h.getWorkflow).delete("/v1/workflows/instances/:id", h.cancelWorkflow).post("/v1/workflows/trigger", h.triggerWorkflow).get("/v1/segments", h.listSegments).post("/v1/events", h.ingestEvent).get("/v1/events/stream", h.getEventsStream).get("/v1/projects", h.listProjects).post("/v1/projects", handleCreateProject).delete("/v1/projects/:id", h.deleteProject).patch("/v1/projects/:id", h.updateProject).post("/v1/projects/:id/keys", h.createProjectKey).get("/v1/projects/:id/keys", h.listProjectKeys).delete("/v1/projects/:id/keys/:keyId", h.deleteProjectKey).get("/health", handleHealth).get("/metrics", handleMetrics).get("/live", handleLive).get("/ready", handleReady);
 	server = createServer((req, res) => {
 		handleRequest(req, res);
 	});
@@ -1401,12 +1731,16 @@ async function startApiServer() {
 			return;
 		}
 		const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
+		if (url.pathname === "/admin" || url.pathname.startsWith("/admin/")) {
+			if (await handleAdminRequest(req, res, url)) return;
+		}
 		let projectId = void 0;
 		let projectRateLimitRpm = 600;
 		let keyRole = "admin";
 		const isProjectManagement = url.pathname === "/v1/projects" || url.pathname.startsWith("/v1/projects/");
 		const isPublicUnsubscribe = url.pathname === "/v1/unsubscribe";
-		if (url.pathname.startsWith("/v1/") && !isProjectManagement && !isPublicUnsubscribe) {
+		const isPublicAuth = url.pathname === "/v1/auth/login";
+		if (url.pathname.startsWith("/v1/") && !isProjectManagement && !isPublicUnsubscribe && !isPublicAuth) {
 			let token = extractAuthToken(req);
 			if (!token && url.searchParams.has("token")) token = url.searchParams.get("token") || void 0;
 			if (!token) {
@@ -1417,14 +1751,21 @@ async function startApiServer() {
 				return;
 			}
 			let isAdminToken = false;
-			if (config.ADMIN_API_KEY) {
+			if (token.startsWith("nk_sess_")) {
+				const session = await getAdminSession(redis.native, token);
+				if (session) {
+					isAdminToken = true;
+					keyRole = session.role === "superadmin" ? "admin" : session.role;
+				}
+			} else if (config.ADMIN_API_KEY) {
 				const expectedBuffer = Buffer.from(config.ADMIN_API_KEY);
 				const providedBuffer = Buffer.from(token);
 				if (expectedBuffer.length === providedBuffer.length && timingSafeEqual(expectedBuffer, providedBuffer)) isAdminToken = true;
 			}
 			if (isAdminToken) {
 				const headerProjectId = req.headers["x-project-id"] || url.searchParams.get("projectId") || void 0;
-				if (!headerProjectId) {
+				const isProjectAgnostic = url.pathname.startsWith("/v1/auth/") || url.pathname.startsWith("/v1/system/") || url.pathname.startsWith("/v1/dlq");
+				if (!headerProjectId && !isProjectAgnostic) {
 					sendJson(res, 400, {
 						error: "bad_request",
 						message: "x-project-id header or projectId query param required when using admin token"
@@ -1433,7 +1774,7 @@ async function startApiServer() {
 				}
 				projectId = headerProjectId;
 				projectRateLimitRpm = 6e3;
-				keyRole = "admin";
+				if (!token.startsWith("nk_sess_")) keyRole = "admin";
 			} else {
 				const tokenHash = createHash("sha256").update(token).digest("hex");
 				const cached = authCache.get(tokenHash);
@@ -1485,7 +1826,7 @@ async function startApiServer() {
         end
         return -1
       `;
-			const rlKey = `rate-limit:api:req:${projectId}`;
+			const rlKey = `rate-limit:api:req:${projectId || "global"}`;
 			const nowMs = Date.now();
 			if (await redis.native.eval(LUA_LIMIT, 1, rlKey, nowMs, 6e4, projectRateLimitRpm, randomBytes(4).toString("hex")) === -1) {
 				if (!res.headersSent) {
@@ -1499,13 +1840,6 @@ async function startApiServer() {
 			}
 		} else if (isProjectManagement) {
 			const token = extractAuthToken(req);
-			if (!config.ADMIN_API_KEY) {
-				sendJson(res, 403, {
-					error: "forbidden",
-					message: "Project management disabled (no ADMIN_API_KEY set)"
-				});
-				return;
-			}
 			if (!token) {
 				sendJson(res, 401, {
 					error: "unauthorized",
@@ -1513,9 +1847,15 @@ async function startApiServer() {
 				});
 				return;
 			}
-			const expectedBuffer = Buffer.from(config.ADMIN_API_KEY);
-			const providedBuffer = Buffer.from(token);
-			if (expectedBuffer.length !== providedBuffer.length || !timingSafeEqual(expectedBuffer, providedBuffer)) {
+			let authorized = false;
+			if (token.startsWith("nk_sess_")) {
+				if (await getAdminSession(redis.native, token)) authorized = true;
+			} else if (config.ADMIN_API_KEY) {
+				const expectedBuffer = Buffer.from(config.ADMIN_API_KEY);
+				const providedBuffer = Buffer.from(token);
+				if (expectedBuffer.length === providedBuffer.length && timingSafeEqual(expectedBuffer, providedBuffer)) authorized = true;
+			}
+			if (!authorized) {
 				sendJson(res, 401, {
 					error: "unauthorized",
 					message: "Invalid admin token"
@@ -1729,4 +2069,4 @@ async function stopApiServer() {
 //#endregion
 export { startApiServer, stopApiServer };
 
-//# sourceMappingURL=main-CFSukWm8.mjs.map
+//# sourceMappingURL=main-BAO4kKce.mjs.map