tapimo 0.1.0 → 0.3.0

package/src/Scope.ts

@@ -1,9 +1,8 @@
 /**
  * The issuable API-key scope vocabulary: the single source of truth for the
  * `/scopes` catalog, for key minting (`ApiKeys.mint`), and for the scopes
- * required by route policies (`Auth.policy`). Exposing it publicly lets operator
- * tooling (e.g. the provisioning CLI) validate scopes against the same list the
- * server enforces.
+ * required by route policies (`Auth.policy`). Exposing it publicly lets super
+ * admin tooling validate scopes against the same list the server enforces.
  */
 
 /**
@@ -19,6 +18,8 @@ type Entry = {
   description: string
   /** Scope identifier used in a key's `scopes` and in route policies. */
   scope: string
+  /** Whether a session may self-mint this scope (else super-admin-only). */
+  selfServe: boolean
 }
 
 /**
@@ -31,24 +32,45 @@ export const catalog = [
   {
     description: 'Read public chain data: tokens, transactions, transfers, blocks, and receipts.',
     scope: 'data:read',
+    selfServe: true,
   },
   {
     description: 'Run ad-hoc queries against the raw indexer passthrough.',
     scope: 'indexer:query',
+    selfServe: true,
   },
   {
     description: 'Fill and submit transactions through the relay.',
-    scope: 'rpc-relay',
+    scope: 'rpc-relay:read',
+    selfServe: true,
+  },
+  {
+    description: 'Sponsor transaction fees through the relay as the managed fee payer.',
+    scope: 'rpc-relay:sponsor',
+    selfServe: true,
   },
   {
     description: 'Read webhook subscriptions.',
     scope: 'webhooks:read',
+    selfServe: false,
   },
   {
     description: 'Create, update, and delete webhook subscriptions.',
     scope: 'webhooks:write',
+    selfServe: false,
   },
 ] as const satisfies readonly Entry[]
 
 /** Issuable API-key scope identifier — the union of every {@link catalog} entry. */
 export type Id = (typeof catalog)[number]['scope']
+
+/**
+ * Scopes a session may self-mint through the developer platform, derived from
+ * the catalog's `selfServe` flag. Paid usage (mainnet sponsorship) is gated by
+ * an active billing source at request time, so self-serve users cannot consume
+ * paid APIs for free. Webhooks stay super-admin-only, as does {@link wildcard}
+ * (intentionally absent from the catalog).
+ */
+export const selfServe: readonly Id[] = catalog
+  .filter((entry) => entry.selfServe)
+  .map((entry) => entry.scope)

package/src/Webhooks.ts

@@ -1,4 +1,4 @@
-import * as AppWebhooks from './apps/webhooks.js'
+import * as AppWebhooks from './apps/data/routes/webhooks.js'
 import * as Db from './db/Db.js'
 import * as MetricSink from './internal/MetricSink.js'
 import * as Store from './internal/Store.js'
@@ -16,7 +16,7 @@ export * from './internal/Webhooks.js'
 // type delivery bodies: `Webhooks.schema.Envelope` (a discriminated union on
 // `type`), plus the per-event `TransferEvent` / `TransactionEvent` / `PingEvent`
 // payloads. Infer a type with `z.infer<typeof Webhooks.schema.Envelope>`.
-export { eventTypes, schema } from './apps/webhooks.js'
+export { eventTypes, schema } from './apps/data/routes/webhooks.js'
 
 /**
  * Builds a scheduled webhook poller bound to a state store and chain config.

package/src/admin/apps/api-keys.test.ts

@@ -155,3 +155,54 @@ describe('DELETE /api-keys/:id', () => {
     expect(body.error?.code).toMatchInlineSnapshot(`"not_found"`)
   })
 })
+
+describe('PATCH /api-keys/:id', () => {
+  test('re-attributes a key to an org and project', async () => {
+    const { client, store } = TestAdmin.setup()
+    const { record, token } = await core_ApiKeys.mint(store, validBody)
+
+    const response = await client['api-keys'][':id'].$patch({
+      json: { orgId: 'org_real', projectId: 'prj_real' },
+      param: { id: record.id },
+    })
+    expect(response.status).toBe(200)
+    const body = await TestApp.json(response, core_ApiKeys.schema.Record)
+    expect(body.orgId).toBe('org_real')
+    expect(body.projectId).toBe('prj_real')
+
+    // The original token keeps resolving, now carrying the attribution.
+    const resolved = await core_ApiKeys.resolve(store, token)
+    expect(resolved?.projectId).toBe('prj_real')
+  })
+
+  test('unknown id → 404', async () => {
+    const { client } = TestAdmin.setup()
+    const response = await client['api-keys'][':id'].$patch({
+      json: { projectId: 'prj_x' },
+      param: { id: 'key_missing' },
+    })
+    expect(response.status).toMatchInlineSnapshot(`404`)
+  })
+})
+
+describe('POST /api-keys/backfill', () => {
+  test('rebuilds index entries for legacy records', async () => {
+    const { client, store } = TestAdmin.setup()
+    const { record } = await core_ApiKeys.mint(store, validBody)
+
+    // Legacy state: records exist, index entries do not.
+    for (const prefix of ['apikey_id:', 'apikey_org:'])
+      for (const { name } of (await store.list({ prefix })).keys) await store.delete(name)
+    expect(await core_ApiKeys.listByOrg(store, 'org_test')).toEqual([])
+
+    const response = await client['api-keys'].backfill.$post()
+    expect(response.status).toBe(200)
+    expect(await TestApp.json(response, ApiKeys.schema.backfillApiKeys.Response)).toEqual({
+      indexed: 1,
+      scanned: 1,
+    })
+    expect((await core_ApiKeys.listByOrg(store, 'org_test')).map(({ id }) => id)).toEqual([
+      record.id,
+    ])
+  })
+})

package/src/admin/apps/api-keys.ts

@@ -53,6 +53,37 @@ export namespace schema {
     )
   }
 
+  /** Schemas for the attributeApiKey operation. */
+  export namespace attributeApiKey {
+    /** Request body re-attributing a key; omitted fields keep their value. */
+    export const Body = Schema.describe(
+      z.object({
+        orgId: z.optional(z.string()).check(z.describe('New owning organization id (`org_…`).')),
+        projectId: z.optional(z.string()).check(z.describe('New owning project id (`prj_…`).')),
+      }),
+      'Attribution to apply to an API key.',
+    )
+
+    /** Path parameters for attributing a key. */
+    export const Params = z
+      .object({
+        id: z.string().check(z.describe('Stable id of the key to attribute.')),
+      })
+      .check(z.describe('Path parameters for attributing an API key.'))
+  }
+
+  /** Schemas for the backfillApiKeys operation. */
+  export namespace backfillApiKeys {
+    /** Result counts from the index rebuild. */
+    export const Response = Schema.describe(
+      z.object({
+        indexed: z.number().check(z.describe('Records whose index entries were written.')),
+        scanned: z.number().check(z.describe('Stored records scanned.')),
+      }),
+      'Result of rebuilding the API-key indexes.',
+    )
+  }
+
   /** Schemas for the revokeApiKey operation. */
   export namespace revokeApiKey {
     /** Path parameters for revoking a key. */
@@ -76,9 +107,30 @@ export namespace schema {
  *   returning the one-time token.
  * - `GET /` lists key records (metadata only), optionally filtered by `orgId`.
  * - `DELETE /:id` revokes a key by id (`404` if absent).
+ * - `PATCH /:id` re-attributes a key to an org/project (the legacy backfill path).
+ * - `POST /backfill` rebuilds the id and org index entries for every record.
  */
 export function apiKeys() {
   return new Hono<App.Environment>()
+    .post(
+      '/backfill',
+      OpenApi.describeRoute({
+        description: 'Rebuild the id and org index entries for every stored key record. Records are never modified, so existing tokens keep resolving.', // prettier-ignore
+        operationId: 'backfillApiKeys',
+        responses: OpenApi.responses({
+          success: {
+            description: 'Scanned and indexed record counts.',
+            schema: schema.backfillApiKeys.Response,
+          },
+        }),
+        summary: 'Backfill key indexes',
+        tags: ['API keys'],
+      }),
+      async (c) => {
+        const result = await ApiKeys.backfill(c.get('kv').store)
+        return c.json(Response.validated(schema.backfillApiKeys.Response, result))
+      },
+    )
     .post(
       '/',
       OpenApi.validate('json', schema.createApiKey.Body, {
@@ -153,4 +205,36 @@ export function apiKeys() {
         return c.json(Response.validated(schema.revokeApiKey.Response, { id }))
       },
     )
+    .patch(
+      '/:id',
+      OpenApi.validate('param', schema.attributeApiKey.Params, {
+        code: 'param_invalid',
+        message: 'Invalid path parameters',
+      }),
+      OpenApi.validate('json', schema.attributeApiKey.Body, {
+        code: 'body_invalid',
+        message: 'Invalid request body',
+      }),
+      OpenApi.describeRoute({
+        description: 'Re-attribute a key to an organization and/or project. The token is unchanged.', // prettier-ignore
+        operationId: 'attributeApiKey',
+        responses: OpenApi.responses({
+          errors: { 404: 'API key not found.' },
+          success: { description: 'The updated key record.', schema: ApiKeys.schema.Record },
+        }),
+        summary: 'Attribute API key',
+        tags: ['API keys'],
+      }),
+      async (c) => {
+        const { id } = c.req.valid('param')
+        const updated = await ApiKeys.attribute(c.get('kv').store, id, c.req.valid('json'))
+        if (!updated)
+          return Response.error(c, {
+            code: 'not_found',
+            message: 'API key not found.',
+            status: 404,
+          })
+        return c.json(Response.validated(ApiKeys.schema.Record, updated))
+      },
+    )
 }

package/src/admin/apps/scopes.test.ts

@@ -17,22 +17,32 @@ describe('GET /scopes', () => {
           {
             "description": "Read public chain data: tokens, transactions, transfers, blocks, and receipts.",
             "scope": "data:read",
+            "selfServe": true,
           },
           {
             "description": "Run ad-hoc queries against the raw indexer passthrough.",
             "scope": "indexer:query",
+            "selfServe": true,
           },
           {
             "description": "Fill and submit transactions through the relay.",
-            "scope": "rpc-relay",
+            "scope": "rpc-relay:read",
+            "selfServe": true,
+          },
+          {
+            "description": "Sponsor transaction fees through the relay as the managed fee payer.",
+            "scope": "rpc-relay:sponsor",
+            "selfServe": true,
           },
           {
             "description": "Read webhook subscriptions.",
             "scope": "webhooks:read",
+            "selfServe": false,
           },
           {
             "description": "Create, update, and delete webhook subscriptions.",
             "scope": "webhooks:write",
+            "selfServe": false,
           },
         ],
       }

package/src/admin/apps/scopes.ts

@@ -18,6 +18,9 @@ export namespace schema {
         scope: z
           .string()
           .check(z.describe('Scope identifier used in API-key grants and route policies.')),
+        selfServe: z
+          .boolean()
+          .check(z.describe('Whether a session may self-mint this scope (else super-admin-only).')),
       })
       .check(z.describe('A single issuable API-key scope.'))
 

package/src/admin/apps/verified-tokens.ts

@@ -6,7 +6,7 @@ import * as Response from '../../internal/Response.js'
 import * as Schema from '../../internal/Schema.js'
 import * as Db from '../../db/Db.js'
 import * as VerifiedTokens from '../../internal/VerifiedTokens.js'
-import { schema as readSchema } from '../../apps/verified-tokens.js'
+import { schema as readSchema } from '../../apps/data/routes/verified-tokens.js'
 import type * as App from '../App.js'
 
 /** Required `chainId` query: admin mutations always address a chain explicitly. */

package/src/admin/ui/src/components/Page.tsx

@@ -1,4 +1,5 @@
 import type { ReactNode } from 'react'
+import { cx } from 'regen-ui'
 
 import { MobileProfile } from './MobileProfile'
 
@@ -37,9 +38,7 @@ export function Page(props: {
 /** Bordered surface container used for lists and forms. */
 export function Card(props: { children: ReactNode; className?: string }) {
   return (
-    <div className={`border border-border bg-surface ${props.className ?? ''}`}>
-      {props.children}
-    </div>
+    <div className={cx('border border-border bg-surface', props.className)}>{props.children}</div>
   )
 }
 

package/src/admin/ui/src/routes/__root.tsx

@@ -207,12 +207,12 @@ function MobileNav() {
 
 function SignInRequired({ loginUrl }: { loginUrl?: string }) {
   return (
-    <div className="flex min-h-screen flex-col items-center justify-center gap-3 bg-background text-foreground">
+    <div className="flex min-h-dvh flex-col items-center justify-center gap-3 bg-background text-foreground">
       <p className="font-medium">Sign in required</p>
       {loginUrl ? (
         <Button render={<a href={loginUrl} />}>Sign in</Button>
       ) : (
-        <p className="text-sm text-foreground-secondary">Your session has expired.</p>
+        <p className="text-copy-14 text-foreground-secondary">Your session has expired.</p>
       )}
     </div>
   )

package/src/admin/ui/src/routes/api-keys.tsx

@@ -1,6 +1,6 @@
 import { createFileRoute } from '@tanstack/react-router'
 import { type ReactNode, useState } from 'react'
-import { Button, Fields, Input, Rows, Select, useCopy } from 'regen-ui'
+import { Button, cx, Fields, Input, Rows, Select, useCopy } from 'regen-ui'
 import { Check, ChevronRight, Copy as CopyIcon, Plus, Trash2, X } from 'lucide-react'
 
 import { Card, Notice, Page } from '../components/Page'
@@ -313,7 +313,7 @@ function KeyRow(props: { record: ApiKeys.ApiKey }) {
 
 function Detail(props: { children: ReactNode; className?: string; label: ReactNode }) {
   return (
-    <div className={`flex min-w-0 flex-col gap-1 ${props.className ?? ''}`}>
+    <div className={cx('flex min-w-0 flex-col gap-1', props.className)}>
       <dt className="text-label-12 text-foreground-secondary">{props.label}</dt>
       <dd className="min-w-0 text-label-13 text-foreground">{props.children}</dd>
     </div>