tapimo 0.1.0 → 0.3.0

package/src/apps/platform/routes/api-keys.test.ts

@@ -0,0 +1,493 @@
+import { generatePrivateKey, privateKeyToAccount } from 'viem/accounts'
+
+import * as ApiKeys from '../../../ApiKeys.js'
+import * as TestApp from '../../../../test/App.js'
+import * as Keys from './api-keys.js'
+import * as Orgs from './orgs.js'
+import * as Projects from './projects.js'
+
+/** Origin pinned for SIWE domain binding; Hono test requests use this host. */
+const origin = 'http://localhost'
+
+/** Super admin secret configured on the test app. */
+const secret = 'tempo:sk:c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2'
+
+/** RequestInit for a JSON mutation carrying the session cookie. */
+function json(method: 'PATCH' | 'POST', cookie: string, body: unknown) {
+  return {
+    body: JSON.stringify(body),
+    headers: { 'content-type': 'application/json', cookie },
+    method,
+  }
+}
+
+/** RequestInit for a JSON mutation authenticated as the super admin. */
+function superAdminJson(method: 'PATCH' | 'POST', body: unknown) {
+  return {
+    body: JSON.stringify(body),
+    headers: { 'content-type': 'application/json', 'tempo-api-key': secret },
+    method,
+  }
+}
+
+// Resolve-cache disabled so revocation assertions observe the store directly.
+type State = ReturnType<typeof TestApp.kvStore>
+
+function createApp(options: { kv?: { store: State } } = {}) {
+  return TestApp.create({
+    auth: { cache: false, superAdmin: { secret } },
+    ...(options.kv ? { kv: options.kv } : {}),
+    session: { wallet: { origin } },
+  })
+}
+
+function failRecordDeletes(store: State) {
+  const delete_ = store.delete.bind(store)
+  store.delete = async (key) => {
+    if (key.startsWith('apikey:')) throw new Error('KV delete failed.')
+    await delete_(key)
+  }
+}
+
+/** Signs in a fresh scripted account; returns its session cookie. */
+async function session(app: TestApp.signIn.App) {
+  const account = privateKeyToAccount(generatePrivateKey())
+  const { cookie } = await TestApp.signIn(app, account)
+  return cookie!
+}
+
+/** Creates an org and a project owned by the session. */
+async function fixture(app: ReturnType<typeof createApp>, cookie: string) {
+  const org = await TestApp.json(
+    await app.request('/v1/orgs', json('POST', cookie, { name: 'Acme' })),
+    Orgs.schema.Organization,
+  )
+  const project = await TestApp.json(
+    await app.request(`/v1/orgs/${org.id}/projects`, json('POST', cookie, { name: 'Checkout' })),
+    Projects.schema.Project,
+  )
+  return { org, project }
+}
+
+describe('keys', () => {
+  test('mints, lists, authenticates, and revokes a project key', async () => {
+    const app = createApp()
+    const cookie = await session(app)
+    const { org, project } = await fixture(app, cookie)
+    const base = `/v1/orgs/${org.id}/projects/${project.id}/api-keys`
+
+    // Scoped keys mint through the super admin: no scope is self-issuable.
+    const minted = await app.request(
+      base,
+      superAdminJson('POST', { environment: 'sandbox', name: 'CI', scopes: ['data:read'] }),
+    )
+    expect(minted.status).toBe(200)
+    const created = await TestApp.json(minted, Keys.schema.createApiKey.Response)
+    expect(created.id).toMatch(/^key_/)
+    expect(created.token).toMatch(/^tempo_sandbox:sk:[a-f0-9]{48}$/)
+    expect(created.orgId).toBe(org.id)
+    expect(created.projectId).toBe(project.id)
+    expect(created.createdBy).toBe('super_admin')
+
+    // The minted key authenticates data API requests. `no-store` forces an
+    // origin pass — an edge-cache hit would skip auth and mask the assertion.
+    const data = await app.request('/v1/tokens', {
+      headers: { 'cache-control': 'no-store', 'tempo-api-key': created.token },
+    })
+    expect(data.status).toBe(200)
+
+    // Listing exposes metadata only — never the token. The key is sandbox, so
+    // the list is scoped to that environment (production is the default).
+    const listed = await app.request(`${base}?environment=sandbox`, { headers: { cookie } })
+    expect(listed.status).toBe(200)
+    const list = await TestApp.json(listed, Keys.schema.listApiKeys.Response)
+    expect(list.data.map(({ id }) => id)).toEqual([created.id])
+    expect(JSON.stringify(list)).not.toContain(created.token)
+    expect(list.data[0]!.tokenLast4).toBe(created.token.slice(-4))
+
+    const revoked = await app.request(`${base}/${created.id}`, {
+      headers: { cookie },
+      method: 'DELETE',
+    })
+    expect(revoked.status).toBe(200)
+    expect(await TestApp.json(revoked, Keys.schema.revokeApiKey.Response)).toEqual({
+      id: created.id,
+    })
+
+    // With the resolve cache disabled, revocation is immediate.
+    const after = await app.request('/v1/tokens', {
+      headers: { 'cache-control': 'no-store', 'tempo-api-key': created.token },
+    })
+    expect(after.status).toBe(401)
+    const empty = await TestApp.json(
+      await app.request(base, { headers: { cookie } }),
+      Keys.schema.listApiKeys.Response,
+    )
+    expect(empty).toEqual({ data: [] })
+  })
+
+  test('rejects the wildcard scope at mint', async () => {
+    const app = createApp()
+    const cookie = await session(app)
+    const { org, project } = await fixture(app, cookie)
+
+    const response = await app.request(
+      `/v1/orgs/${org.id}/projects/${project.id}/api-keys`,
+      json('POST', cookie, { scopes: ['*'] }),
+    )
+    expect(response.status).toBe(400)
+  })
+
+  test('mints zero-scope keys for sessions', async () => {
+    const app = createApp()
+    const cookie = await session(app)
+    const { org, project } = await fixture(app, cookie)
+
+    const minted = await app.request(
+      `/v1/orgs/${org.id}/projects/${project.id}/api-keys`,
+      json('POST', cookie, { name: 'CI' }),
+    )
+    expect(minted.status).toBe(200)
+    const created = await TestApp.json(minted, Keys.schema.createApiKey.Response)
+    expect(created.scopes).toEqual([])
+    expect(created.createdBy).toMatch(/^usr_/)
+
+    // The key authenticates but grants nothing: scoped routes stay forbidden.
+    const data = await app.request('/v1/tokens', {
+      headers: { 'cache-control': 'no-store', 'tempo-api-key': created.token },
+    })
+    expect(data.status).toBe(403)
+    const { requestId, ...body } = (await data.json()) as { requestId?: string }
+    expect(requestId).toBeDefined()
+    expect(body).toMatchInlineSnapshot(`
+      {
+        "error": {
+          "code": "api_key_forbidden",
+          "message": "API key missing required scope",
+        },
+      }
+    `)
+  })
+
+  test('lets sessions mint catalog scopes on production keys', async () => {
+    const app = createApp()
+    const cookie = await session(app)
+    const { org, project } = await fixture(app, cookie)
+
+    const created = await TestApp.json(
+      await app.request(
+        `/v1/orgs/${org.id}/projects/${project.id}/api-keys`,
+        json('POST', cookie, { scopes: ['data:read'] }),
+      ),
+      Keys.schema.createApiKey.Response,
+    )
+    expect(created.environment).toBe('production')
+    expect(created.scopes).toEqual(['data:read'])
+    // Session-minted, not granted through the super admin.
+    expect(created.createdBy).not.toBe('super_admin')
+  })
+
+  test('rejects session mints of non-self-serve scopes (webhooks)', async () => {
+    const app = createApp()
+    const cookie = await session(app)
+    const { org, project } = await fixture(app, cookie)
+
+    const response = await app.request(
+      `/v1/orgs/${org.id}/projects/${project.id}/api-keys`,
+      json('POST', cookie, { scopes: ['webhooks:write'] }),
+    )
+    expect(response.status).toBe(403)
+    const body = (await response.json()) as { error: { code: string } }
+    expect(body.error.code).toBe('scope_not_issuable')
+  })
+
+  test('lets sessions mint catalog scopes on sandbox keys', async () => {
+    const app = createApp()
+    const cookie = await session(app)
+    const { org, project } = await fixture(app, cookie)
+
+    const created = await TestApp.json(
+      await app.request(
+        `/v1/orgs/${org.id}/projects/${project.id}/api-keys`,
+        json('POST', cookie, { environment: 'sandbox', scopes: ['data:read'] }),
+      ),
+      Keys.schema.createApiKey.Response,
+    )
+    expect(created.environment).toBe('sandbox')
+    expect(created.scopes).toEqual(['data:read'])
+    // Session-minted, not granted through the super admin.
+    expect(created.createdBy).not.toBe('super_admin')
+  })
+
+  test('binds keys to their project on every verb', async () => {
+    const app = createApp()
+    const owner = await session(app)
+    const { org, project } = await fixture(app, owner)
+    const other = await TestApp.json(
+      await app.request(`/v1/orgs/${org.id}/projects`, json('POST', owner, { name: 'Payments' })),
+      Projects.schema.Project,
+    )
+    const minted = await TestApp.json(
+      await app.request(
+        `/v1/orgs/${org.id}/projects/${project.id}/api-keys`,
+        superAdminJson('POST', { scopes: ['data:read'] }),
+      ),
+      Keys.schema.createApiKey.Response,
+    )
+
+    // Same org, sibling project: the key id must not resolve through it.
+    const crossList = await app.request(`/v1/orgs/${org.id}/projects/${other.id}/api-keys`, {
+      headers: { cookie: owner },
+    })
+    expect((await TestApp.json(crossList, Keys.schema.listApiKeys.Response)).data).toEqual([])
+    const crossRevoke = await app.request(
+      `/v1/orgs/${org.id}/projects/${other.id}/api-keys/${minted.id}`,
+      { headers: { cookie: owner }, method: 'DELETE' },
+    )
+    expect(crossRevoke.status).toBe(404)
+
+    // Foreign session: the whole surface 404s at the org-ownership link.
+    const stranger = await session(app)
+    const foreignMint = await app.request(
+      `/v1/orgs/${org.id}/projects/${project.id}/api-keys`,
+      json('POST', stranger, { scopes: ['data:read'] }),
+    )
+    expect(foreignMint.status).toBe(404)
+    const foreignRevoke = await app.request(
+      `/v1/orgs/${org.id}/projects/${project.id}/api-keys/${minted.id}`,
+      { headers: { cookie: stranger }, method: 'DELETE' },
+    )
+    expect(foreignRevoke.status).toBe(404)
+
+    // The key survives every attempt, still listed for the owner.
+    const listed = await app.request(`/v1/orgs/${org.id}/projects/${project.id}/api-keys`, {
+      headers: { cookie: owner },
+    })
+    const list = await TestApp.json(listed, Keys.schema.listApiKeys.Response)
+    expect(list.data.map(({ id }) => id)).toEqual([minted.id])
+  })
+
+  test('lists keys org-wide across projects', async () => {
+    const store = TestApp.kvStore({ keys: [] })
+    const app = createApp({ kv: { store } })
+    const owner = await session(app)
+    const { org, project } = await fixture(app, owner)
+    const other = await TestApp.json(
+      await app.request(`/v1/orgs/${org.id}/projects`, json('POST', owner, { name: 'Payments' })),
+      Projects.schema.Project,
+    )
+
+    const first = await TestApp.json(
+      await app.request(
+        `/v1/orgs/${org.id}/projects/${project.id}/api-keys`,
+        superAdminJson('POST', { name: 'Checkout CI', scopes: ['data:read'] }),
+      ),
+      Keys.schema.createApiKey.Response,
+    )
+    const second = await TestApp.json(
+      await app.request(
+        `/v1/orgs/${org.id}/projects/${other.id}/api-keys`,
+        superAdminJson('POST', { name: 'Payments CI', scopes: ['data:read'] }),
+      ),
+      Keys.schema.createApiKey.Response,
+    )
+    // Org-attributed key without a project (admin-surface mints land like this).
+    const orgWide = await ApiKeys.mint(store, { orgId: org.id, scopes: ['data:read'] })
+
+    const listed = await app.request(`/v1/orgs/${org.id}/api-keys`, {
+      headers: { cookie: owner },
+    })
+    const list = await TestApp.json(listed, Keys.schema.listOrgApiKeys.Response)
+    expect(list.data.map(({ id }) => id).sort()).toEqual(
+      [first.id, second.id, orgWide.record.id].sort(),
+    )
+    expect(list.data.find(({ id }) => id === first.id)?.projectId).toBe(project.id)
+    expect(list.data.find(({ id }) => id === second.id)?.projectId).toBe(other.id)
+    expect(list.data.find(({ id }) => id === orgWide.record.id)?.projectId).toBeUndefined()
+
+    // Non-members see the org as absent.
+    const stranger = await session(app)
+    const foreign = await app.request(`/v1/orgs/${org.id}/api-keys`, {
+      headers: { cookie: stranger },
+    })
+    expect(foreign.status).toBe(404)
+  })
+
+  test('filters keys by environment (defaulting to production)', async () => {
+    const app = createApp()
+    const cookie = await session(app)
+    const { org, project } = await fixture(app, cookie)
+    const projectBase = `/v1/orgs/${org.id}/projects/${project.id}/api-keys`
+    const orgBase = `/v1/orgs/${org.id}/api-keys`
+
+    const production = await TestApp.json(
+      await app.request(
+        projectBase,
+        superAdminJson('POST', { name: 'Prod', scopes: ['data:read'] }),
+      ),
+      Keys.schema.createApiKey.Response,
+    )
+    const sandbox = await TestApp.json(
+      await app.request(
+        projectBase,
+        superAdminJson('POST', { environment: 'sandbox', name: 'Sandbox', scopes: ['data:read'] }),
+      ),
+      Keys.schema.createApiKey.Response,
+    )
+
+    const ids = async (path: string) =>
+      (
+        await TestApp.json(
+          await app.request(path, { headers: { cookie } }),
+          Keys.schema.listApiKeys.Response,
+        )
+      ).data
+        .map(({ id }) => id)
+        .sort()
+
+    // Each filter returns only its own environment.
+    expect(await ids(`${projectBase}?environment=production`)).toEqual([production.id])
+    expect(await ids(`${projectBase}?environment=sandbox`)).toEqual([sandbox.id])
+    // Absent param defaults to production.
+    expect(await ids(projectBase)).toEqual([production.id])
+
+    // Same behavior on the org-wide list route.
+    const orgIds = async (path: string) =>
+      (
+        await TestApp.json(
+          await app.request(path, { headers: { cookie } }),
+          Keys.schema.listOrgApiKeys.Response,
+        )
+      ).data
+        .map(({ id }) => id)
+        .sort()
+    expect(await orgIds(`${orgBase}?environment=sandbox`)).toEqual([sandbox.id])
+    expect(await orgIds(orgBase)).toEqual([production.id])
+
+    // An unknown environment value is rejected.
+    const invalid = await app.request(`${projectBase}?environment=staging`, { headers: { cookie } })
+    expect(invalid.status).toBe(400)
+  })
+
+  test('revokes keys when their project or organization is deleted', async () => {
+    const app = createApp()
+    const cookie = await session(app)
+    const { org, project } = await fixture(app, cookie)
+    const minted = await TestApp.json(
+      await app.request(
+        `/v1/orgs/${org.id}/projects/${project.id}/api-keys`,
+        superAdminJson('POST', { scopes: ['data:read'] }),
+      ),
+      Keys.schema.createApiKey.Response,
+    )
+
+    const deletedProject = await app.request(`/v1/orgs/${org.id}/projects/${project.id}`, {
+      headers: { cookie },
+      method: 'DELETE',
+    })
+    expect(deletedProject.status).toBe(200)
+    const afterProject = await app.request('/v1/tokens', {
+      headers: { 'cache-control': 'no-store', 'tempo-api-key': minted.token },
+    })
+    expect(afterProject.status).toBe(401)
+
+    // Org deletion revokes keys of every remaining project.
+    const other = await TestApp.json(
+      await app.request(`/v1/orgs/${org.id}/projects`, json('POST', cookie, { name: 'Payments' })),
+      Projects.schema.Project,
+    )
+    const survivor = await TestApp.json(
+      await app.request(
+        `/v1/orgs/${org.id}/projects/${other.id}/api-keys`,
+        superAdminJson('POST', { scopes: ['data:read'] }),
+      ),
+      Keys.schema.createApiKey.Response,
+    )
+    const deletedOrg = await app.request(`/v1/orgs/${org.id}`, {
+      headers: { cookie },
+      method: 'DELETE',
+    })
+    expect(deletedOrg.status).toBe(200)
+    const afterOrg = await app.request('/v1/tokens', {
+      headers: { 'cache-control': 'no-store', 'tempo-api-key': survivor.token },
+    })
+    expect(afterOrg.status).toBe(401)
+  })
+
+  test('keeps the project when key revocation fails during project deletion', async () => {
+    const store = TestApp.kvStore({ keys: [] })
+    const app = createApp({ kv: { store } })
+    const cookie = await session(app)
+    const { org, project } = await fixture(app, cookie)
+    await TestApp.json(
+      await app.request(
+        `/v1/orgs/${org.id}/projects/${project.id}/api-keys`,
+        superAdminJson('POST', { scopes: ['data:read'] }),
+      ),
+      Keys.schema.createApiKey.Response,
+    )
+    failRecordDeletes(store)
+
+    const deletedProject = await app.request(`/v1/orgs/${org.id}/projects/${project.id}`, {
+      headers: { cookie },
+      method: 'DELETE',
+    })
+    expect(deletedProject.status).toBe(502)
+
+    const projectStill = await app.request(`/v1/orgs/${org.id}/projects/${project.id}`, {
+      headers: { cookie },
+    })
+    expect(projectStill.status).toBe(200)
+  })
+
+  test('keeps the organization when key revocation fails during organization deletion', async () => {
+    const store = TestApp.kvStore({ keys: [] })
+    const app = createApp({ kv: { store } })
+    const cookie = await session(app)
+    const { org, project } = await fixture(app, cookie)
+    await TestApp.json(
+      await app.request(
+        `/v1/orgs/${org.id}/projects/${project.id}/api-keys`,
+        superAdminJson('POST', { scopes: ['data:read'] }),
+      ),
+      Keys.schema.createApiKey.Response,
+    )
+    failRecordDeletes(store)
+
+    const deletedOrg = await app.request(`/v1/orgs/${org.id}`, {
+      headers: { cookie },
+      method: 'DELETE',
+    })
+    expect(deletedOrg.status).toBe(502)
+
+    const orgStill = await app.request(`/v1/orgs/${org.id}`, { headers: { cookie } })
+    expect(orgStill.status).toBe(200)
+  })
+
+  test('mints as the super admin with super admin attribution', async () => {
+    const app = createApp()
+    const cookie = await session(app)
+    const { org, project } = await fixture(app, cookie)
+
+    const minted = await app.request(`/v1/orgs/${org.id}/projects/${project.id}/api-keys`, {
+      body: JSON.stringify({ scopes: ['data:read'] }),
+      headers: { 'content-type': 'application/json', 'tempo-api-key': secret },
+      method: 'POST',
+    })
+    expect(minted.status).toBe(200)
+    const created = await TestApp.json(minted, Keys.schema.createApiKey.Response)
+    expect(created.createdBy).toBe('super_admin')
+    expect(created.environment).toBe('production')
+  })
+
+  test('rejects API keys on the keys surface', async () => {
+    const app = createApp()
+    const cookie = await session(app)
+    const { org, project } = await fixture(app, cookie)
+
+    const response = await app.request(`/v1/orgs/${org.id}/projects/${project.id}/api-keys`, {
+      headers: { 'tempo-api-key': TestApp.key.token },
+    })
+    expect(response.status).toBe(403)
+  })
+})