sea-dev 1.0.0

package/libs/dal/src/api-key.test.ts

@@ -0,0 +1,397 @@
+import { resetTestDb } from "@/_tests/mock-db"; // Must always be the first import
+
+import { db, schema } from "@sea/db";
+import { and, eq, isNull } from "drizzle-orm";
+import { beforeEach, describe, expect, it } from "vitest";
+import { checkApiKey, checkApiKeyWithSubmission, createKey, deleteKey, getKeys } from "./api-key";
+
+const keys: [string] = ["secret-key"];
+
+describe("dbtest: createKey", () => {
+  beforeEach(async () => {
+    await resetTestDb();
+  });
+
+  it("prevents access to api keys from other organizations", async () => {
+    // Create two organizations
+    const [org1, org2] = await db
+      .insert(schema.organization)
+      .values([{ name: "Org 1" }, { name: "Org 2" }])
+      .returning();
+
+    // Create users for both organizations
+    const [user1, user2] = await db
+      .insert(schema.user)
+      .values([
+        { name: "User 1", email: "user1-createkey@example.com", emailVerified: true },
+        { name: "User 2", email: "user2-createkey@example.com", emailVerified: true },
+      ])
+      .returning();
+
+    // Create members for both organizations
+    const [member1, member2] = await db
+      .insert(schema.member)
+      .values([
+        { organizationId: org1!.id, userId: user1!.id, role: "member" },
+        { organizationId: org2!.id, userId: user2!.id, role: "member" },
+      ])
+      .returning();
+
+    // Create API key for org1
+    const result1 = await createKey({ member: member1!, name: "Test Key 1", keys });
+
+    // Create API key for org2
+    const result2 = await createKey({ member: member2!, name: "Test Key 2", keys });
+
+    // Verify both keys were created
+    expect(result1.key).toBeDefined();
+    expect(result2.key).toBeDefined();
+
+    // Verify the API keys are stored with correct organization isolation
+    const org1ApiKeys = await db.query.apiKey.findMany({
+      where: eq(schema.apiKey.organizationId, org1!.id),
+    });
+
+    const org2ApiKeys = await db.query.apiKey.findMany({
+      where: eq(schema.apiKey.organizationId, org2!.id),
+    });
+
+    // Each organization should only have their own API key
+    expect(org1ApiKeys).toHaveLength(1);
+    expect(org2ApiKeys).toHaveLength(1);
+    expect(org1ApiKeys[0]!.organizationId).toBe(org1!.id);
+    expect(org2ApiKeys[0]!.organizationId).toBe(org2!.id);
+    expect(org1ApiKeys[0]!.name).toBe("Test Key 1");
+    expect(org2ApiKeys[0]!.name).toBe("Test Key 2");
+  });
+});
+
+describe("dbtest: checkApiKeyWithSubmission", () => {
+  beforeEach(async () => {
+    await resetTestDb();
+  });
+
+  it("prevents access to submissions from other organizations", async () => {
+    // Create two organizations
+    const [org1, org2] = await db
+      .insert(schema.organization)
+      .values([{ name: "Org 1" }, { name: "Org 2" }])
+      .returning();
+
+    // Create users
+    const [user1, user2] = await db
+      .insert(schema.user)
+      .values([
+        { name: "User 1", email: "user1-checksubmission@example.com", emailVerified: true },
+        { name: "User 2", email: "user2-checksubmission@example.com", emailVerified: true },
+      ])
+      .returning();
+
+    // Create members
+    const [member1, member2] = await db
+      .insert(schema.member)
+      .values([
+        { organizationId: org1!.id, userId: user1!.id, role: "member" },
+        { organizationId: org2!.id, userId: user2!.id, role: "member" },
+      ])
+      .returning();
+
+    // Create conversations
+    const [conversation1, conversation2] = await db
+      .insert(schema.conversation)
+      .values([
+        { organizationId: org1!.id, model: "gpt-4.1" },
+        { organizationId: org2!.id, model: "gpt-4.1" },
+      ])
+      .returning();
+
+    // Create workflow schemas
+    const [workflow1, workflow2] = await db
+      .insert(schema.workflow)
+      .values([
+        { organizationId: org1!.id, name: "Workflow 1" },
+        { organizationId: org2!.id, name: "Workflow 2" },
+      ])
+      .returning();
+
+    // Create forms
+    const [form1, form2] = await db
+      .insert(schema.form)
+      .values([
+        {
+          workflowId: workflow1!.id,
+          organizationId: org1!.id,
+          conversationId: conversation1!.id,
+          name: "Form 1",
+        },
+        {
+          workflowId: workflow2!.id,
+          organizationId: org2!.id,
+          conversationId: conversation2!.id,
+          name: "Form 2",
+        },
+      ])
+      .returning();
+
+    // Create deals
+    const [deal1, deal2] = await db
+      .insert(schema.deal)
+      .values([
+        { organizationId: org1!.id, name: "Deal 1" },
+        { organizationId: org2!.id, name: "Deal 2" },
+      ])
+      .returning();
+
+    // Create submissions
+    const [submission1, submission2] = await db
+      .insert(schema.submission)
+      .values([
+        {
+          formId: form1!.id,
+          dealId: deal1!.id,
+          organizationId: org1!.id,
+          conversationId: conversation1!.id,
+        },
+        {
+          formId: form2!.id,
+          dealId: deal2!.id,
+          organizationId: org2!.id,
+          conversationId: conversation2!.id,
+        },
+      ])
+      .returning();
+
+    // Create API key for org1 that targets submission1
+    const { key: apiKey1 } = await createKey({ member: member1!, name: "Test Key 1", keys });
+
+    // Update the API key to target submission1
+    await db
+      .update(schema.apiKey)
+      .set({ targetType: "submission", targetId: submission1!.id })
+      .where(eq(schema.apiKey.organizationId, org1!.id));
+
+    // Create API key for org2 that targets submission2
+    const { key: apiKey2 } = await createKey({ member: member2!, name: "Test Key 2", keys });
+
+    // Update the API key to target submission2
+    await db
+      .update(schema.apiKey)
+      .set({ targetType: "submission", targetId: submission2!.id })
+      .where(eq(schema.apiKey.organizationId, org2!.id));
+
+    // Test that org1's API key can access org1's submission
+    const result1 = await checkApiKeyWithSubmission({ key: apiKey1 });
+    expect(result1.success).toBe(true);
+    expect(result1.data?.submission.id).toBe(submission1!.id);
+
+    // Test that org2's API key can access org2's submission
+    const result2 = await checkApiKeyWithSubmission({ key: apiKey2 });
+    expect(result2.success).toBe(true);
+    expect(result2.data?.submission.id).toBe(submission2!.id);
+
+    // Test cross-organization access prevention by manually updating API key target
+    // Update org1's API key to target org2's submission (this should fail)
+    await db
+      .update(schema.apiKey)
+      .set({ targetId: submission2!.id })
+      .where(eq(schema.apiKey.organizationId, org1!.id));
+
+    // This should fail because the submission belongs to org2 but the API key belongs to org1
+    const crossOrgResult = await checkApiKeyWithSubmission({ key: apiKey1 });
+    expect(crossOrgResult.success).toBe(false);
+    expect(crossOrgResult.data).toBeUndefined();
+  });
+});
+
+describe("dbtest: checkApiKey", () => {
+  beforeEach(async () => {
+    await resetTestDb();
+  });
+
+  it("prevents access to api keys from other organizations", async () => {
+    // Create two organizations
+    const [org1, org2] = await db
+      .insert(schema.organization)
+      .values([{ name: "Org 1" }, { name: "Org 2" }])
+      .returning();
+
+    // Create users for both organizations
+    const [user1, user2] = await db
+      .insert(schema.user)
+      .values([
+        { name: "User 1", email: "user1-checkapi@example.com", emailVerified: true },
+        { name: "User 2", email: "user2-checkapi@example.com", emailVerified: true },
+      ])
+      .returning();
+
+    // Create members for both organizations
+    const [member1, member2] = await db
+      .insert(schema.member)
+      .values([
+        { organizationId: org1!.id, userId: user1!.id, role: "member" },
+        { organizationId: org2!.id, userId: user2!.id, role: "member" },
+      ])
+      .returning();
+
+    // Create API key for org1
+    const result1 = await createKey({ member: member1!, name: "Test Key 1", keys });
+
+    // Create API key for org2
+    const result2 = await createKey({ member: member2!, name: "Test Key 2", keys });
+
+    // Check that each key can only be found by its respective organization
+    const checkResult1 = await checkApiKey(result1.key);
+    const checkResult2 = await checkApiKey(result2.key);
+
+    // Verify both keys are found
+    expect(checkResult1.success).toBe(true);
+    expect(checkResult2.success).toBe(true);
+
+    // Verify organization isolation - each key should only return its own organization's data
+    expect(checkResult1.data?.organizationId).toBe(org1!.id);
+    expect(checkResult2.data?.organizationId).toBe(org2!.id);
+    expect(checkResult1.data?.member.organizationId).toBe(org1!.id);
+    expect(checkResult2.data?.member.organizationId).toBe(org2!.id);
+
+    // Verify that a non-existent key returns false
+    const checkInvalidKey = await checkApiKey("sk-sea-invalid-key");
+    expect(checkInvalidKey.success).toBe(false);
+  });
+});
+
+describe("dbtest: deleteKey", () => {
+  beforeEach(async () => {
+    await resetTestDb();
+  });
+
+  it("prevents deleting api keys from other organizations", async () => {
+    // Create two organizations
+    const [org1, org2] = await db
+      .insert(schema.organization)
+      .values([{ name: "Org 1" }, { name: "Org 2" }])
+      .returning();
+
+    // Create users for both organizations
+    const [user1, user2] = await db
+      .insert(schema.user)
+      .values([
+        { name: "User 1", email: "user1-deletekey@example.com", emailVerified: true },
+        { name: "User 2", email: "user2-deletekey@example.com", emailVerified: true },
+      ])
+      .returning();
+
+    // Create members for both organizations
+    const [member1, member2] = await db
+      .insert(schema.member)
+      .values([
+        { organizationId: org1!.id, userId: user1!.id, role: "member" },
+        { organizationId: org2!.id, userId: user2!.id, role: "member" },
+      ])
+      .returning();
+
+    // Create API keys for both organizations
+    await createKey({ member: member1!, name: "Test Key 1", keys });
+    await createKey({ member: member2!, name: "Test Key 2", keys });
+
+    // Get the API key IDs
+    const org1ApiKeys = await db.query.apiKey.findMany({
+      where: eq(schema.apiKey.organizationId, org1!.id),
+    });
+    const org2ApiKeys = await db.query.apiKey.findMany({
+      where: eq(schema.apiKey.organizationId, org2!.id),
+    });
+
+    const org1ApiKeyId = org1ApiKeys[0]!.id;
+    const org2ApiKeyId = org2ApiKeys[0]!.id;
+
+    // Attempt to delete org2's API key using member1 (should not work)
+    await deleteKey({ member: member1!, apiKeyId: org2ApiKeyId });
+
+    // Verify org2's API key is NOT deleted (still exists and not soft-deleted)
+    const org2ApiKeyAfterAttempt = await db.query.apiKey.findFirst({
+      where: and(eq(schema.apiKey.id, org2ApiKeyId), isNull(schema.apiKey.deletedAt)),
+    });
+    expect(org2ApiKeyAfterAttempt).toBeDefined();
+
+    // Now delete org1's API key using member1 (should work)
+    await deleteKey({ member: member1!, apiKeyId: org1ApiKeyId });
+
+    // Verify org1's API key is deleted (soft-deleted)
+    const org1ApiKeyAfterDelete = await db.query.apiKey.findFirst({
+      where: and(eq(schema.apiKey.id, org1ApiKeyId), isNull(schema.apiKey.deletedAt)),
+    });
+    expect(org1ApiKeyAfterDelete).toBeUndefined();
+
+    // Verify org2's API key is still not deleted
+    const org2ApiKeyFinal = await db.query.apiKey.findFirst({
+      where: and(eq(schema.apiKey.id, org2ApiKeyId), isNull(schema.apiKey.deletedAt)),
+    });
+    expect(org2ApiKeyFinal).toBeDefined();
+  });
+});
+
+describe("dbtest: getKeys", () => {
+  beforeEach(async () => {
+    await resetTestDb();
+  });
+
+  it("prevents access to api keys from other organizations", async () => {
+    // Create two organizations
+    const [org1, org2] = await db
+      .insert(schema.organization)
+      .values([{ name: "Org 1" }, { name: "Org 2" }])
+      .returning();
+
+    // Create users for both organizations
+    const [user1, user2] = await db
+      .insert(schema.user)
+      .values([
+        { name: "User 1", email: "user1-getkeys@example.com", emailVerified: true },
+        { name: "User 2", email: "user2-getkeys@example.com", emailVerified: true },
+      ])
+      .returning();
+
+    // Create members for both organizations
+    const [member1, member2] = await db
+      .insert(schema.member)
+      .values([
+        { organizationId: org1!.id, userId: user1!.id, role: "member" },
+        { organizationId: org2!.id, userId: user2!.id, role: "member" },
+      ])
+      .returning();
+
+    // Create multiple API keys for org1
+    await createKey({ member: member1!, name: "Org1 Key 1", keys });
+    await createKey({ member: member1!, name: "Org1 Key 2", keys });
+
+    // Create multiple API keys for org2
+    await createKey({ member: member2!, name: "Org2 Key 1", keys });
+    await createKey({ member: member2!, name: "Org2 Key 2", keys });
+    await createKey({ member: member2!, name: "Org2 Key 3", keys });
+
+    // Get keys for org1 member
+    const org1Keys = await getKeys({ member: member1! });
+
+    // Get keys for org2 member
+    const org2Keys = await getKeys({ member: member2! });
+
+    // Verify org1 member only sees org1 keys
+    expect(org1Keys).toHaveLength(2);
+    expect(org1Keys.every((key) => key.organizationId === org1!.id)).toBe(true);
+    expect(org1Keys.map((key) => key.name).sort()).toEqual(["Org1 Key 1", "Org1 Key 2"]);
+
+    // Verify org2 member only sees org2 keys
+    expect(org2Keys).toHaveLength(3);
+    expect(org2Keys.every((key) => key.organizationId === org2!.id)).toBe(true);
+    expect(org2Keys.map((key) => key.name).sort()).toEqual([
+      "Org2 Key 1",
+      "Org2 Key 2",
+      "Org2 Key 3",
+    ]);
+
+    // Verify that keys from different organizations are not mixed
+    const org1KeyIds = org1Keys.map((key) => key.id);
+    const org2KeyIds = org2Keys.map((key) => key.id);
+    expect(org1KeyIds.some((id) => org2KeyIds.includes(id))).toBe(false);
+  });
+});

package/libs/dal/src/api-key.ts

@@ -0,0 +1,110 @@
+import { db, schema } from "@sea/db";
+import type { ApiKey, Member, Submission } from "@sea/db/types";
+import { encrypt, hashKey } from "@sea/util/encryption";
+import { invariant } from "@sea/util/invariant";
+import { and, desc, eq, isNull } from "drizzle-orm";
+import { customAlphabet } from "nanoid";
+import type { MemberHydrated } from "./member";
+
+const PREFIX = "sk-sea-";
+
+// This is approximately 128 bits of randomness
+// We only use 21 characters in the nanoid function everywhere else
+const keyGenerator = customAlphabet("abcdefghijklmnopqrstuvwxyz234568", 25);
+
+type Keys = [string, ...string[]];
+
+// Using encryption rather than hashing so that share-able URLs
+// can be shown multiple times
+export function createApiKey(keys: Keys) {
+  const random = keyGenerator();
+  const key = PREFIX + random;
+  const keyEncrypted = encrypt(keys, key);
+  const keyHash = hashKey(key);
+  return { key, keyHash, keyEncrypted };
+}
+
+type Result<T> = { success: true; data: T } | { success: false; data: undefined };
+type ApiKeyWithOrg = ApiKey & { member: MemberHydrated };
+
+export async function checkApiKey(key: string): Promise<Result<ApiKeyWithOrg>> {
+  const keyHash = hashKey(key);
+  const match = await db.query.apiKey.findFirst({
+    where: and(isNull(schema.apiKey.deletedAt), eq(schema.apiKey.keyHash, keyHash)),
+    with: { member: { with: { user: true, organization: true } } },
+  });
+  if (!match) {
+    return { success: false, data: undefined };
+  }
+  return { success: true, data: match };
+}
+
+type ApiKeySubmission = ApiKeyWithOrg & {
+  submission: Submission;
+};
+
+export async function checkApiKeyWithSubmission({
+  key,
+}: {
+  key: string;
+}): Promise<Result<ApiKeySubmission>> {
+  const keyHash = hashKey(key);
+  const match = await db.query.apiKey.findFirst({
+    where: and(isNull(schema.apiKey.deletedAt), eq(schema.apiKey.keyHash, keyHash)),
+    with: { member: { with: { user: true, organization: true } }, submission: true },
+  });
+  if (!match) {
+    return { success: false, data: undefined };
+  }
+  const { submission } = match;
+  if (!submission || submission.organizationId !== match.organizationId) {
+    return { success: false, data: undefined };
+  }
+
+  return { success: true, data: { ...match, submission } };
+}
+
+export async function createKey({
+  member,
+  name,
+  keys,
+}: {
+  member: Member;
+  name: string;
+  keys: Keys;
+}) {
+  const { key, keyHash } = createApiKey(keys);
+  const [apiKey] = await db
+    .insert(schema.apiKey)
+    .values({
+      organizationId: member.organizationId,
+      memberId: member.id,
+      name,
+      keyHash,
+      lastFour: key.slice(-4),
+    })
+    .returning();
+  invariant(apiKey);
+  return { key };
+}
+
+export async function deleteKey({ member, apiKeyId }: { member: Member; apiKeyId: string }) {
+  await db
+    .update(schema.apiKey)
+    .set({ deletedAt: new Date() })
+    .where(
+      and(eq(schema.apiKey.organizationId, member.organizationId), eq(schema.apiKey.id, apiKeyId)),
+    );
+}
+
+export async function getKeys({ member }: { member: Member }) {
+  const apiKeys = await db.query.apiKey.findMany({
+    where: and(
+      eq(schema.apiKey.organizationId, member.organizationId),
+      isNull(schema.apiKey.deletedAt),
+    ),
+    with: { member: { with: { user: true } } },
+    orderBy: desc(schema.apiKey.createdAt),
+  });
+  return apiKeys;
+}

package/libs/dal/src/billing.ts

@@ -0,0 +1,23 @@
+import { db, schema } from "@sea/db";
+import { maxExtractPerMonthByPlan } from "@sea/util/billing";
+import { startOfMonth } from "date-fns";
+import { and, count, eq, gte } from "drizzle-orm";
+import type { MemberHydrated } from "./member";
+
+export async function checkCanExtract({ member }: { member: MemberHydrated }): Promise<boolean> {
+  const [numExtractionsRaw] = await db
+    .select({ numExtractions: count(schema.documentExtraction.id) })
+    .from(schema.documentExtraction)
+    .leftJoin(schema.submission, eq(schema.submission.id, schema.documentExtraction.submissionId))
+    .where(
+      and(
+        eq(schema.submission.organizationId, member.organizationId),
+        gte(schema.documentExtraction.createdAt, startOfMonth(new Date())),
+      ),
+    );
+
+  const numExtractions = numExtractionsRaw?.numExtractions ?? 0;
+  const maxExtractions = maxExtractPerMonthByPlan[member.organization.plan];
+  const canExtract = numExtractions < maxExtractions;
+  return canExtract;
+}