tapimo 0.0.2 → 0.2.0

package/src/admin/App.ts

@@ -3,10 +3,10 @@ import { HTTPException } from 'hono/http-exception'
 import { requestId, type RequestIdVariables } from 'hono/request-id'
 
 import * as ApiKey from '../ApiKey.js'
-import * as ApiKeySource from '../ApiKeySource.js'
 import type * as Assets from '../Assets.js'
-import * as Response from '../internal/Response.js'
+import type * as Db from '../db/Db.js'
 import type * as Store from '../internal/Store.js'
+import * as Response from '../internal/Response.js'
 
 import { apiKeys } from './apps/api-keys.js'
 import { scopes } from './apps/scopes.js'
@@ -24,12 +24,12 @@ export type Environment = {
   Variables: RequestIdVariables & {
     /** Static-asset writer (e.g. the R2 icon bucket), when configured. */
     assets: create.Assets | undefined
+    /** Authoritative Postgres store, or a per-request factory. Resolve at the leaf with `Db.get`. */
+    db: Db.Source
+    /** KV state store backing API-key records (mint/list/revoke). */
+    kv: { store: Store.State }
     /** The admin identity, or `null` when unauthenticated (gated routes reject). */
     identity: Identity | null
-    /** The API-key source provisioned against (mint/list/revoke). */
-    source: ApiKeySource.Source
-    /** Verified-token state store, when management is enabled. */
-    verifiedTokens: { store: Store.State } | undefined
   }
 }
 
@@ -39,7 +39,6 @@ export type App = ReturnType<typeof create>
 /** Creates the admin portal Hono app. */
 export function create(options: create.Options) {
   const { identify } = options
-  const { source } = options.apiKey
   // `false` (disabled) collapses to `undefined` so only a real config surfaces
   // `loginUrl`/`logoutUrl` in `/config.json`.
   const ui = options.ui || undefined
@@ -55,9 +54,9 @@ export function create(options: create.Options) {
   app.use('*', async (c, next) => {
     // Admin data is per-principal and mutating: never cache.
     c.header('Cache-Control', 'no-store')
-    c.set('source', source)
     c.set('assets', options.assets)
-    c.set('verifiedTokens', options.verifiedTokens)
+    c.set('db', options.db)
+    c.set('kv', options.kv)
     c.set('identity', await identify(c.req.raw))
     return next()
   })
@@ -173,16 +172,22 @@ export declare namespace create {
 
   /** Options for {@link create}. */
   type Options = {
-    /** API-key provisioning config (mirrors the API app's `apiKey` option). */
-    apiKey: {
-      /** Source to provision against (mint/list/revoke). */
-      source: ApiKeySource.Source
-    }
     /**
      * Static-asset writer for logo uploads (shared with the main API's `assets`
      * loader) to enable `PUT /verified-tokens/:address/logo`; omit for `404`.
      */
     assets?: Assets | undefined
+    /**
+     * Authoritative Postgres store shared with the main API (verified
+     * tokens). Pass a long-lived `Db.postgres(...)` singleton on Node, or a
+     * factory (`() => Db.postgres(...)`) on Workers.
+     */
+    db: Db.Source
+    /**
+     * KV state store backing API-key records (shared with the main API's
+     * `kv` option), provisioned against by the `/api-keys` routes.
+     */
+    kv: { store: Store.State }
     /**
      * Extracts the verified admin identity from a request, or `null` to deny.
      * Must only return an identity for an already-authenticated request (a
@@ -194,16 +199,6 @@ export declare namespace create {
      * `loginUrl`/`logoutUrl` are surfaced in `GET /config.json`.
      */
     ui?: Ui | false | undefined
-    /**
-     * Verified-token management config (store shared with the main API's reads)
-     * to enable the `/verified-tokens` routes; omit to serve them as `404`.
-     */
-    verifiedTokens?:
-      | {
-          /** Verified-token state store (shared with the main API's reads). */
-          store: Store.State
-        }
-      | undefined
   }
 
   /** Admin UI options surfaced to the SPA via `GET /config.json`. */

package/src/admin/apps/api-keys.test.ts

@@ -1,4 +1,5 @@
 import * as ApiKey from '../../ApiKey.js'
+import * as core_ApiKeys from '../../ApiKeys.js'
 
 import * as TestAdmin from '../../../test/Admin.js'
 import * as TestApp from '../../../test/App.js'
@@ -9,7 +10,7 @@ const validBody = { orgId: 'org_test', scopes: ['data:read'] } as const
 
 describe('POST /api-keys', () => {
   test('mints a key, returns the token once, persists a hashed record', async () => {
-    const { client, source, store } = TestAdmin.setup()
+    const { client, store } = TestAdmin.setup()
     const response = await client['api-keys'].$post({ json: { ...validBody, name: 'CI' } })
     const body = await TestApp.json(response, ApiKeys.schema.createApiKey.Response)
 
@@ -34,26 +35,26 @@ describe('POST /api-keys', () => {
       }
     `)
 
-    // The token resolves through the source (proving the record persisted),
+    // The token resolves through the module (proving the record persisted),
     // and at rest it is keyed by the token hash — never the plaintext token.
-    const resolved = await source.resolve(body.token)
+    const resolved = await core_ApiKeys.resolve(store, body.token)
     expect(resolved?.orgId).toBe('org_test')
     expect(await store.get(body.token)).toBeNull()
     expect(await store.get(ApiKey.keyFor(body.token))).not.toBeNull()
   })
 
   test('defaults to the production environment', async () => {
-    const { client, source } = TestAdmin.setup()
+    const { client, store } = TestAdmin.setup()
     const response = await client['api-keys'].$post({ json: validBody })
     const body = await TestApp.json(response, ApiKeys.schema.createApiKey.Response)
 
     expect(response.status).toBe(200)
     expect(body.environment).toBe('production')
-    expect((await source.list())[0]?.environment).toBe('production')
+    expect((await core_ApiKeys.list(store))[0]?.environment).toBe('production')
   })
 
   test('persists a sandbox environment when provided', async () => {
-    const { client, source } = TestAdmin.setup()
+    const { client, store } = TestAdmin.setup()
     const response = await client['api-keys'].$post({
       json: { ...validBody, environment: 'sandbox' },
     })
@@ -63,19 +64,19 @@ describe('POST /api-keys', () => {
     expect(body.environment).toBe('sandbox')
     // Sandbox tokens carry a distinct prefix for recognizability/leak detection.
     expect(body.token).toMatch(/^tempo_sandbox:sk:[a-f0-9]{48}$/)
-    const resolved = await source.resolve(body.token)
+    const resolved = await core_ApiKeys.resolve(store, body.token)
     expect(resolved?.environment).toBe('sandbox')
   })
 
   test('records the expiry when provided', async () => {
-    const { client, source } = TestAdmin.setup()
+    const { client, store } = TestAdmin.setup()
     const expiresAt = '2100-01-01T00:00:00.000Z'
     const response = await client['api-keys'].$post({ json: { ...validBody, expiresAt } })
     const body = await TestApp.json(response, ApiKeys.schema.createApiKey.Response)
 
     expect(response.status).toBe(200)
     expect(body.expiresAt).toBe(expiresAt)
-    expect((await source.list())[0]?.expiresAt).toBe(expiresAt)
+    expect((await core_ApiKeys.list(store))[0]?.expiresAt).toBe(expiresAt)
   })
 
   test('rejects an unknown scope with 400', async () => {
@@ -106,8 +107,8 @@ describe('POST /api-keys', () => {
 
 describe('GET /api-keys', () => {
   test('lists records as metadata only (never the token)', async () => {
-    const { client, source } = TestAdmin.setup()
-    const { token } = await source.mint(validBody)
+    const { client, store } = TestAdmin.setup()
+    const { token } = await core_ApiKeys.mint(store, validBody)
 
     const response = await client['api-keys'].$get({ query: {} })
     const body = await TestApp.json(response, ApiKeys.schema.listApiKeys.Response)
@@ -120,9 +121,9 @@ describe('GET /api-keys', () => {
   })
 
   test('filters by orgId', async () => {
-    const { client, source } = TestAdmin.setup()
-    await source.mint({ orgId: 'org_a', scopes: ['data:read'] })
-    await source.mint({ orgId: 'org_b', scopes: ['data:read'] })
+    const { client, store } = TestAdmin.setup()
+    await core_ApiKeys.mint(store, { orgId: 'org_a', scopes: ['data:read'] })
+    await core_ApiKeys.mint(store, { orgId: 'org_b', scopes: ['data:read'] })
 
     const response = await client['api-keys'].$get({ query: { orgId: 'org_a' } })
     const body = await TestApp.json(response, ApiKeys.schema.listApiKeys.Response)
@@ -133,16 +134,16 @@ describe('GET /api-keys', () => {
 
 describe('DELETE /api-keys/:id', () => {
   test('revokes a key, after which it no longer resolves or lists', async () => {
-    const { client, source } = TestAdmin.setup()
-    const { record, token } = await source.mint(validBody)
+    const { client, store } = TestAdmin.setup()
+    const { record, token } = await core_ApiKeys.mint(store, validBody)
 
     const response = await client['api-keys'][':id'].$delete({ param: { id: record.id } })
     const body = await TestApp.json(response, ApiKeys.schema.revokeApiKey.Response)
 
     expect(response.status).toBe(200)
     expect(body).toEqual({ id: record.id })
-    expect(await source.resolve(token)).toBeNull()
-    expect(await source.list()).toEqual([])
+    expect(await core_ApiKeys.resolve(store, token)).toBeNull()
+    expect(await core_ApiKeys.list(store)).toEqual([])
   })
 
   test('unknown id → 404', async () => {
@@ -154,3 +155,54 @@ describe('DELETE /api-keys/:id', () => {
     expect(body.error?.code).toMatchInlineSnapshot(`"not_found"`)
   })
 })
+
+describe('PATCH /api-keys/:id', () => {
+  test('re-attributes a key to an org and project', async () => {
+    const { client, store } = TestAdmin.setup()
+    const { record, token } = await core_ApiKeys.mint(store, validBody)
+
+    const response = await client['api-keys'][':id'].$patch({
+      json: { orgId: 'org_real', projectId: 'prj_real' },
+      param: { id: record.id },
+    })
+    expect(response.status).toBe(200)
+    const body = await TestApp.json(response, core_ApiKeys.schema.Record)
+    expect(body.orgId).toBe('org_real')
+    expect(body.projectId).toBe('prj_real')
+
+    // The original token keeps resolving, now carrying the attribution.
+    const resolved = await core_ApiKeys.resolve(store, token)
+    expect(resolved?.projectId).toBe('prj_real')
+  })
+
+  test('unknown id → 404', async () => {
+    const { client } = TestAdmin.setup()
+    const response = await client['api-keys'][':id'].$patch({
+      json: { projectId: 'prj_x' },
+      param: { id: 'key_missing' },
+    })
+    expect(response.status).toMatchInlineSnapshot(`404`)
+  })
+})
+
+describe('POST /api-keys/backfill', () => {
+  test('rebuilds index entries for legacy records', async () => {
+    const { client, store } = TestAdmin.setup()
+    const { record } = await core_ApiKeys.mint(store, validBody)
+
+    // Legacy state: records exist, index entries do not.
+    for (const prefix of ['apikey_id:', 'apikey_org:'])
+      for (const { name } of (await store.list({ prefix })).keys) await store.delete(name)
+    expect(await core_ApiKeys.listByOrg(store, 'org_test')).toEqual([])
+
+    const response = await client['api-keys'].backfill.$post()
+    expect(response.status).toBe(200)
+    expect(await TestApp.json(response, ApiKeys.schema.backfillApiKeys.Response)).toEqual({
+      indexed: 1,
+      scanned: 1,
+    })
+    expect((await core_ApiKeys.listByOrg(store, 'org_test')).map(({ id }) => id)).toEqual([
+      record.id,
+    ])
+  })
+})

package/src/admin/apps/api-keys.ts

@@ -1,7 +1,7 @@
 import { Hono } from 'hono'
 import * as z from 'zod/mini'
 
-import * as ApiKeySource from '../../ApiKeySource.js'
+import * as ApiKeys from '../../ApiKeys.js'
 import * as OpenApi from '../../internal/OpenApi.js'
 import * as Response from '../../internal/Response.js'
 import * as Schema from '../../internal/Schema.js'
@@ -16,13 +16,13 @@ export namespace schema {
      * server sets from the verified identity so it can't be spoofed).
      */
     export const Body = Schema.describe(
-      z.omit(ApiKeySource.schema.MintInput, { createdBy: true }),
+      z.omit(ApiKeys.schema.MintInput, { createdBy: true }),
       'Fields accepted when minting an API key.',
     )
 
     /** Response: the record plus the one-time plaintext token. */
     export const Response = Schema.describe(
-      z.extend(ApiKeySource.schema.Record, {
+      z.extend(ApiKeys.schema.Record, {
         token: z
           .string()
           .check(z.describe('The plaintext token, shown once and unrecoverable afterward.')),
@@ -46,13 +46,44 @@ export namespace schema {
     export const Response = Schema.describe(
       z.object({
         data: z
-          .array(ApiKeySource.schema.Record)
+          .array(ApiKeys.schema.Record)
           .check(z.describe('API-key records, newest first (metadata only — never tokens).')),
       }),
       'A list of API-key records.',
     )
   }
 
+  /** Schemas for the attributeApiKey operation. */
+  export namespace attributeApiKey {
+    /** Request body re-attributing a key; omitted fields keep their value. */
+    export const Body = Schema.describe(
+      z.object({
+        orgId: z.optional(z.string()).check(z.describe('New owning organization id (`org_…`).')),
+        projectId: z.optional(z.string()).check(z.describe('New owning project id (`prj_…`).')),
+      }),
+      'Attribution to apply to an API key.',
+    )
+
+    /** Path parameters for attributing a key. */
+    export const Params = z
+      .object({
+        id: z.string().check(z.describe('Stable id of the key to attribute.')),
+      })
+      .check(z.describe('Path parameters for attributing an API key.'))
+  }
+
+  /** Schemas for the backfillApiKeys operation. */
+  export namespace backfillApiKeys {
+    /** Result counts from the index rebuild. */
+    export const Response = Schema.describe(
+      z.object({
+        indexed: z.number().check(z.describe('Records whose index entries were written.')),
+        scanned: z.number().check(z.describe('Stored records scanned.')),
+      }),
+      'Result of rebuilding the API-key indexes.',
+    )
+  }
+
   /** Schemas for the revokeApiKey operation. */
   export namespace revokeApiKey {
     /** Path parameters for revoking a key. */
@@ -70,16 +101,36 @@ export namespace schema {
 }
 
 /**
- * Provisioning routes for API keys, backed by the request's
- * {@link App.Environment} `source`:
+ * Provisioning routes for API keys, backed by the app's KV state store:
  *
  * - `POST /` mints a key, recording `createdBy` from the verified identity and
  *   returning the one-time token.
  * - `GET /` lists key records (metadata only), optionally filtered by `orgId`.
  * - `DELETE /:id` revokes a key by id (`404` if absent).
+ * - `PATCH /:id` re-attributes a key to an org/project (the legacy backfill path).
+ * - `POST /backfill` rebuilds the id and org index entries for every record.
  */
 export function apiKeys() {
   return new Hono<App.Environment>()
+    .post(
+      '/backfill',
+      OpenApi.describeRoute({
+        description: 'Rebuild the id and org index entries for every stored key record. Records are never modified, so existing tokens keep resolving.', // prettier-ignore
+        operationId: 'backfillApiKeys',
+        responses: OpenApi.responses({
+          success: {
+            description: 'Scanned and indexed record counts.',
+            schema: schema.backfillApiKeys.Response,
+          },
+        }),
+        summary: 'Backfill key indexes',
+        tags: ['API keys'],
+      }),
+      async (c) => {
+        const result = await ApiKeys.backfill(c.get('kv').store)
+        return c.json(Response.validated(schema.backfillApiKeys.Response, result))
+      },
+    )
     .post(
       '/',
       OpenApi.validate('json', schema.createApiKey.Body, {
@@ -100,7 +151,7 @@ export function apiKeys() {
       async (c) => {
         // `createdBy` is the verified admin email, never client-supplied.
         // `requireAuth` guarantees identity on this gated route.
-        const { record, token } = await c.get('source').mint({
+        const { record, token } = await ApiKeys.mint(c.get('kv').store, {
           ...c.req.valid('json'),
           createdBy: c.get('identity')!.email,
         })
@@ -123,7 +174,7 @@ export function apiKeys() {
       }),
       async (c) => {
         const { orgId } = c.req.valid('query')
-        const data = await c.get('source').list(orgId ? { orgId } : {})
+        const data = await ApiKeys.list(c.get('kv').store, orgId ? { orgId } : {})
         return c.json(Response.validated(schema.listApiKeys.Response, { data }))
       },
     )
@@ -144,7 +195,7 @@ export function apiKeys() {
       }),
       async (c) => {
         const { id } = c.req.valid('param')
-        const revoked = await c.get('source').revoke(id)
+        const revoked = await ApiKeys.revoke(c.get('kv').store, id)
         if (!revoked)
           return Response.error(c, {
             code: 'not_found',
@@ -154,4 +205,36 @@ export function apiKeys() {
         return c.json(Response.validated(schema.revokeApiKey.Response, { id }))
       },
     )
+    .patch(
+      '/:id',
+      OpenApi.validate('param', schema.attributeApiKey.Params, {
+        code: 'param_invalid',
+        message: 'Invalid path parameters',
+      }),
+      OpenApi.validate('json', schema.attributeApiKey.Body, {
+        code: 'body_invalid',
+        message: 'Invalid request body',
+      }),
+      OpenApi.describeRoute({
+        description: 'Re-attribute a key to an organization and/or project. The token is unchanged.', // prettier-ignore
+        operationId: 'attributeApiKey',
+        responses: OpenApi.responses({
+          errors: { 404: 'API key not found.' },
+          success: { description: 'The updated key record.', schema: ApiKeys.schema.Record },
+        }),
+        summary: 'Attribute API key',
+        tags: ['API keys'],
+      }),
+      async (c) => {
+        const { id } = c.req.valid('param')
+        const updated = await ApiKeys.attribute(c.get('kv').store, id, c.req.valid('json'))
+        if (!updated)
+          return Response.error(c, {
+            code: 'not_found',
+            message: 'API key not found.',
+            status: 404,
+          })
+        return c.json(Response.validated(ApiKeys.schema.Record, updated))
+      },
+    )
 }

package/src/admin/apps/scopes.test.ts

@@ -22,6 +22,14 @@ describe('GET /scopes', () => {
             "description": "Run ad-hoc queries against the raw indexer passthrough.",
             "scope": "indexer:query",
           },
+          {
+            "description": "Fill and submit transactions through the relay.",
+            "scope": "rpc-relay:read",
+          },
+          {
+            "description": "Sponsor transaction fees through the relay as the managed fee payer.",
+            "scope": "rpc-relay:sponsor",
+          },
           {
             "description": "Read webhook subscriptions.",
             "scope": "webhooks:read",

package/src/admin/apps/verified-tokens.test.ts

@@ -1,5 +1,3 @@
-import { Store } from 'cadent'
-
 import * as TestAdmin from '../../../test/Admin.js'
 import * as TestApp from '../../../test/App.js'
 import * as Verified from './verified-tokens.js'
@@ -15,29 +13,14 @@ const novel = {
 
 const chainId = '42431' as const
 
-/** Write-enabled admin client backed by a fresh in-memory state store. */
+/** Write-enabled admin client backed by a fresh schema-isolated database. */
 function writes() {
-  return TestAdmin.setup({ verifiedTokens: { store: Store.memory() } })
+  return TestAdmin.setup()
 }
 
-describe('feature gate', () => {
-  test('write routes return 404 when no store is configured', async () => {
-    const { client } = TestAdmin.setup()
-    const response = await client['verified-tokens'].$post({
-      json: { ...novel, chainId: 42431 },
-    })
-    expect(response.status).toBe(404)
-    const body = (await response.json()) as { error?: { code?: string } }
-    expect(body.error?.code).toBe('verified_tokens_not_enabled')
-  })
-})
-
 describe('authentication', () => {
   test('denied identity → 401', async () => {
-    const { client } = TestAdmin.setup({
-      identify: () => null,
-      verifiedTokens: { store: Store.memory() },
-    })
+    const { client } = TestAdmin.setup({ identify: () => null })
     const response = await client['verified-tokens'].$post({
       json: { ...novel, chainId: 42431 },
     })
@@ -46,12 +29,6 @@ describe('authentication', () => {
 })
 
 describe('list', () => {
-  test('returns 404 when no store is configured', async () => {
-    const { client } = TestAdmin.setup()
-    const response = await client['verified-tokens'].$get({ query: { chainId } })
-    expect(response.status).toBe(404)
-  })
-
   test('empty list → data [] and null version', async () => {
     const { client } = writes()
     const response = await client['verified-tokens'].$get({ query: { chainId } })
@@ -176,7 +153,6 @@ describe('create with inline logo', () => {
         get: async (key) => stored.find((entry) => entry.key === key)?.content,
         put: async (key, content) => void stored.push({ content, key }),
       },
-      verifiedTokens: { store: Store.memory() },
     })
     return { client, stored }
   }
@@ -219,7 +195,6 @@ describe('create with inline logo', () => {
           throw new Error('upload failed')
         },
       },
-      verifiedTokens: { store: Store.memory() },
     })
     const response = await client['verified-tokens'].$post({
       json: { ...novel, chainId: 42431, logo: svg },
@@ -297,7 +272,6 @@ describe('PUT /verified-tokens/:address/logo', () => {
           stored.push({ content, key })
         },
       },
-      verifiedTokens: { store: Store.memory() },
     })
     return { client, stored }
   }
@@ -375,7 +349,6 @@ describe('GET /verified-tokens/:address/logo', () => {
         get: async (key) => objects.get(key),
         put: async (key, content) => void objects.set(key, content),
       },
-      verifiedTokens: { store: Store.memory() },
     })
     return { client, objects }
   }