tapimo 0.11.0 → 0.13.0

package/src/apps/management/routes/api-keys.test.ts

@@ -82,6 +82,213 @@ async function fixture(app: ReturnType<typeof createApp>, cookie: string) {
   return { org, project }
 }
 
+test('publishes generator-ready OpenAPI contracts', async () => {
+  const app = createApp({ kv: { store: TestApp.kvStore() } })
+  const spec = await (await app.request('/openapi.json')).json()
+  const collection = spec.paths['/v1/orgs/{orgId}/projects/{projectId}/api-keys']
+  const detail = spec.paths['/v1/orgs/{orgId}/projects/{projectId}/api-keys/{keyId}']
+  const organization = spec.paths['/v1/orgs/{orgId}/api-keys']
+  const rotation = spec.paths['/v1/orgs/{orgId}/projects/{projectId}/api-keys/{keyId}/rotate']
+
+  expect({
+    components: [
+      'ApiKey',
+      'ApiKeyList',
+      'CreateApiKeyRequest',
+      'CreateApiKeyResponse',
+      'RevokeApiKeyResponse',
+      'RotateApiKeyResponse',
+      'UpdateApiKeyRequest',
+    ].filter((name) => spec.components.schemas[name]),
+    create: {
+      errors: {
+        400: collection.post.responses[400].content['application/json'].schema,
+        403: collection.post.responses[403].content['application/json'].schema,
+        404: collection.post.responses[404].content['application/json'].schema,
+      },
+      operationId: collection.post.operationId,
+      request: collection.post.requestBody.content['application/json'].schema,
+      response: collection.post.responses[200].content['application/json'].schema,
+    },
+    listOrganization: {
+      errors: {
+        400: organization.get.responses[400].content['application/json'].schema,
+        403: organization.get.responses[403].content['application/json'].schema,
+        404: organization.get.responses[404].content['application/json'].schema,
+      },
+      operationId: organization.get.operationId,
+      response: organization.get.responses[200].content['application/json'].schema,
+    },
+    listProject: {
+      errors: {
+        400: collection.get.responses[400].content['application/json'].schema,
+        403: collection.get.responses[403].content['application/json'].schema,
+        404: collection.get.responses[404].content['application/json'].schema,
+      },
+      operationId: collection.get.operationId,
+      response: collection.get.responses[200].content['application/json'].schema,
+    },
+    revoke: {
+      errors: {
+        400: detail.delete.responses[400].content['application/json'].schema,
+        403: detail.delete.responses[403].content['application/json'].schema,
+        404: detail.delete.responses[404].content['application/json'].schema,
+      },
+      operationId: detail.delete.operationId,
+      response: detail.delete.responses[200].content['application/json'].schema,
+    },
+    rotate: {
+      errors: {
+        400: rotation.post.responses[400].content['application/json'].schema,
+        403: rotation.post.responses[403].content['application/json'].schema,
+        404: rotation.post.responses[404].content['application/json'].schema,
+      },
+      operationId: rotation.post.operationId,
+      response: rotation.post.responses[200].content['application/json'].schema,
+    },
+    timestamps: {
+      createdAt: spec.components.schemas.ApiKey.properties.createdAt.format,
+      expiresAt: spec.components.schemas.ApiKey.properties.expiresAt.format,
+      lastUsedAt: spec.components.schemas.ApiKey.properties.lastUsedAt.format,
+    },
+    update: {
+      errors: {
+        400: detail.patch.responses[400].content['application/json'].schema,
+        403: detail.patch.responses[403].content['application/json'].schema,
+        404: detail.patch.responses[404].content['application/json'].schema,
+      },
+      operationId: detail.patch.operationId,
+      request: detail.patch.requestBody.content['application/json'].schema,
+      response: detail.patch.responses[200].content['application/json'].schema,
+    },
+  }).toMatchInlineSnapshot(`
+    {
+      "components": [
+        "ApiKey",
+        "ApiKeyList",
+        "CreateApiKeyRequest",
+        "CreateApiKeyResponse",
+        "RevokeApiKeyResponse",
+        "RotateApiKeyResponse",
+        "UpdateApiKeyRequest",
+      ],
+      "create": {
+        "errors": {
+          "400": {
+            "$ref": "#/components/schemas/ApiKeyMalformedOrBodyInvalidOrParamInvalidError",
+          },
+          "403": {
+            "$ref": "#/components/schemas/ApiKeyForbiddenOrApiKeyIpForbiddenOrForbiddenOrScopeNotIssuableError",
+          },
+          "404": {
+            "$ref": "#/components/schemas/ApiKeysNotEnabledOrOrganizationNotFoundOrProjectNotFoundError",
+          },
+        },
+        "operationId": "createApiKey",
+        "request": {
+          "$ref": "#/components/schemas/CreateApiKeyRequest",
+        },
+        "response": {
+          "$ref": "#/components/schemas/CreateApiKeyResponse",
+        },
+      },
+      "listOrganization": {
+        "errors": {
+          "400": {
+            "$ref": "#/components/schemas/ApiKeyMalformedOrParamInvalidOrQueryInvalidError",
+          },
+          "403": {
+            "$ref": "#/components/schemas/ForbiddenError",
+          },
+          "404": {
+            "$ref": "#/components/schemas/ApiKeysNotEnabledOrOrganizationNotFoundError",
+          },
+        },
+        "operationId": "listOrgApiKeys",
+        "response": {
+          "$ref": "#/components/schemas/ApiKeyList",
+        },
+      },
+      "listProject": {
+        "errors": {
+          "400": {
+            "$ref": "#/components/schemas/ApiKeyMalformedOrParamInvalidOrQueryInvalidError",
+          },
+          "403": {
+            "$ref": "#/components/schemas/ForbiddenError",
+          },
+          "404": {
+            "$ref": "#/components/schemas/ApiKeysNotEnabledOrOrganizationNotFoundOrProjectNotFoundError",
+          },
+        },
+        "operationId": "listApiKeys",
+        "response": {
+          "$ref": "#/components/schemas/ApiKeyList",
+        },
+      },
+      "revoke": {
+        "errors": {
+          "400": {
+            "$ref": "#/components/schemas/ApiKeyMalformedOrParamInvalidError",
+          },
+          "403": {
+            "$ref": "#/components/schemas/ForbiddenError",
+          },
+          "404": {
+            "$ref": "#/components/schemas/ApiKeyNotFoundOrApiKeysNotEnabledOrOrganizationNotFoundOrProjectNotFoundError",
+          },
+        },
+        "operationId": "revokeApiKey",
+        "response": {
+          "$ref": "#/components/schemas/RevokeApiKeyResponse",
+        },
+      },
+      "rotate": {
+        "errors": {
+          "400": {
+            "$ref": "#/components/schemas/ApiKeyMalformedOrParamInvalidError",
+          },
+          "403": {
+            "$ref": "#/components/schemas/ApiKeyForbiddenOrApiKeyIpForbiddenOrForbiddenOrScopeNotIssuableError",
+          },
+          "404": {
+            "$ref": "#/components/schemas/ApiKeyNotFoundOrApiKeysNotEnabledOrOrganizationNotFoundOrProjectNotFoundError",
+          },
+        },
+        "operationId": "rotateApiKey",
+        "response": {
+          "$ref": "#/components/schemas/RotateApiKeyResponse",
+        },
+      },
+      "timestamps": {
+        "createdAt": "date-time",
+        "expiresAt": "date-time",
+        "lastUsedAt": "date-time",
+      },
+      "update": {
+        "errors": {
+          "400": {
+            "$ref": "#/components/schemas/ApiKeyMalformedOrBodyInvalidOrParamInvalidError",
+          },
+          "403": {
+            "$ref": "#/components/schemas/ForbiddenError",
+          },
+          "404": {
+            "$ref": "#/components/schemas/ApiKeyNotFoundOrApiKeysNotEnabledOrOrganizationNotFoundOrProjectNotFoundError",
+          },
+        },
+        "operationId": "updateApiKey",
+        "request": {
+          "$ref": "#/components/schemas/UpdateApiKeyRequest",
+        },
+        "response": {
+          "$ref": "#/components/schemas/ApiKey",
+        },
+      },
+    }
+  `)
+})
+
 describe('keys', () => {
   test('requires an owner to issue management write keys', async () => {
     const db = TestApp.database()
@@ -109,6 +316,54 @@ describe('keys', () => {
 
     const write = await app.request(base, json('POST', owner, { scopes: ['management:write'] }))
     expect(write.status).toBe(200)
+
+    const created = await TestApp.json(write, Keys.schema.createApiKey.Response)
+    const rotateDenied = await app.request(`${base}/${created.id}/rotate`, {
+      headers: { cookie: admin },
+      method: 'POST',
+    })
+    expect(rotateDenied.status).toBe(403)
+    expect(await rotateDenied.json()).toMatchObject({ error: { code: 'scope_not_issuable' } })
+
+    const rotateAllowed = await app.request(`${base}/${created.id}/rotate`, {
+      headers: { cookie: owner },
+      method: 'POST',
+    })
+    expect(rotateAllowed.status).toBe(200)
+  })
+
+  test('requires an owner to rotate wildcard keys and allows the super admin', async () => {
+    const db = TestApp.database()
+    const store = TestApp.kvStore({ keys: [] })
+    const app = createApp({ db, kv: { store } })
+    const owner = await session(app)
+    const { org, project } = await fixture(app, owner)
+    const admin = await session(app)
+    const user = await TestApp.json(
+      await app.request('/v1/me', { headers: { cookie: admin } }),
+      Me.schema.User,
+    )
+    await Memberships.create(db, { orgId: org.id, role: 'admin', userId: user.id })
+    const base = `/v1/orgs/${org.id}/projects/${project.id}/api-keys`
+    const { record: source } = await ApiKeys.mint(store, {
+      environment: 'production',
+      orgId: org.id,
+      projectId: project.id,
+      scopes: [Scope.wildcard],
+    })
+
+    const denied = await app.request(`${base}/${source.id}/rotate`, {
+      headers: { cookie: admin },
+      method: 'POST',
+    })
+    expect(denied.status).toBe(403)
+    expect(await denied.json()).toMatchObject({ error: { code: 'scope_not_issuable' } })
+
+    const allowed = await app.request(`${base}/${source.id}/rotate`, {
+      headers: { 'tempo-api-key': secret },
+      method: 'POST',
+    })
+    expect(allowed.status).toBe(200)
   })
 
   test('zone scopes are never self-serve', async () => {
@@ -126,6 +381,149 @@ describe('keys', () => {
     }
   })
 
+  test('rotates a super-admin-issued zone key without delegating scope issuance', async () => {
+    const store = TestApp.kvStore({ keys: [] })
+    const app = createApp({ kv: { store } })
+    const owner = await session(app)
+    const { org, project } = await fixture(app, owner)
+    const base = `/v1/orgs/${org.id}/projects/${project.id}/api-keys`
+    const source = await TestApp.json(
+      await app.request(
+        base,
+        superAdminJson('POST', {
+          allowedIps: ['203.0.113.0/24'],
+          environment: 'production',
+          name: 'Privy',
+          scopes: ['zone:421700001:read', 'zone:421700001:write'],
+        }),
+      ),
+      Keys.schema.createApiKey.Response,
+    )
+
+    const response = await app.request(`${base}/${source.id}/rotate`, {
+      headers: { cookie: owner },
+      method: 'POST',
+    })
+    expect(response.status).toBe(200)
+    const replacement = await TestApp.json(response, Keys.schema.rotateApiKey.Response)
+    expect(replacement).toMatchObject({
+      allowedIps: ['203.0.113.0/24'],
+      environment: 'production',
+      name: 'Privy',
+      orgId: org.id,
+      projectId: project.id,
+      scopes: ['zone:421700001:read', 'zone:421700001:write'],
+    })
+    expect(replacement.createdBy).not.toBe('super_admin')
+    expect(replacement.id).not.toBe(source.id)
+    expect(replacement.token).not.toBe(source.token)
+    expect(await ApiKeys.resolve(store, source.token)).not.toBeNull()
+    expect(await ApiKeys.resolve(store, replacement.token)).not.toBeNull()
+  })
+
+  test('rotates an organization-level super-admin-issued zone key', async () => {
+    const store = TestApp.kvStore({ keys: [] })
+    const app = createApp({ kv: { store } })
+    const owner = await session(app)
+    const { org, project } = await fixture(app, owner)
+    const { record: projectSource } = await ApiKeys.mint(store, {
+      orgId: org.id,
+      projectId: project.id,
+      scopes: ['data:read'],
+    })
+    const projectResponse = await app.request(
+      `/v1/orgs/${org.id}/api-keys/${projectSource.id}/rotate`,
+      { headers: { cookie: owner }, method: 'POST' },
+    )
+    expect(projectResponse.status).toBe(404)
+    const projectRevoke = await app.request(`/v1/orgs/${org.id}/api-keys/${projectSource.id}`, {
+      headers: { cookie: owner },
+      method: 'DELETE',
+    })
+    expect(projectRevoke.status).toBe(404)
+
+    const { record: source } = await ApiKeys.mint(store, {
+      createdBy: 'super_admin',
+      environment: 'production',
+      name: 'Privy',
+      orgId: org.id,
+      scopes: ['zone:421700001:read', 'zone:421700001:write'],
+    })
+
+    const response = await app.request(`/v1/orgs/${org.id}/api-keys/${source.id}/rotate`, {
+      headers: { cookie: owner },
+      method: 'POST',
+    })
+    expect(response.status).toBe(200)
+    const replacement = await TestApp.json(response, Keys.schema.rotateApiKey.Response)
+    expect(replacement).toMatchObject({
+      environment: 'production',
+      name: 'Privy',
+      orgId: org.id,
+      scopes: ['zone:421700001:read', 'zone:421700001:write'],
+    })
+    expect(replacement.projectId).toBeUndefined()
+    expect(replacement.createdBy).not.toBe('super_admin')
+    expect(replacement.id).not.toBe(source.id)
+
+    const revoked = await app.request(`/v1/orgs/${org.id}/api-keys/${replacement.id}`, {
+      headers: { cookie: owner },
+      method: 'DELETE',
+    })
+    expect(revoked.status).toBe(200)
+    expect(await TestApp.json(revoked, Keys.schema.revokeApiKey.Response)).toEqual({
+      id: replacement.id,
+    })
+    expect(await ApiKeys.resolve(store, replacement.token)).toBeNull()
+  })
+
+  test('refreshes sandbox billing state during rotation', async () => {
+    const db = TestApp.database()
+    const store = TestApp.kvStore({ keys: [] })
+    const app = createApp({ db, kv: { store } })
+    const owner = await session(app)
+    const { org, project } = await fixture(app, owner)
+    const { record: source } = await ApiKeys.mint(store, {
+      billingActive: true,
+      environment: 'sandbox',
+      orgId: org.id,
+      projectId: project.id,
+      scopes: ['data:read'],
+    })
+
+    const response = await app.request(
+      `/v1/orgs/${org.id}/projects/${project.id}/api-keys/${source.id}/rotate`,
+      { headers: { cookie: owner }, method: 'POST' },
+    )
+    expect(response.status).toBe(200)
+    const replacement = await TestApp.json(response, Keys.schema.rotateApiKey.Response)
+    expect((await ApiKeys.get(store, replacement.id))?.billingActive).toBe(false)
+  })
+
+  test('does not rotate a key from another project', async () => {
+    const app = createApp()
+    const owner = await session(app)
+    const { org, project } = await fixture(app, owner)
+    const other = await TestApp.json(
+      await app.request(`/v1/orgs/${org.id}/projects`, json('POST', owner, { name: 'Other' })),
+      Projects.schema.Project,
+    )
+    const source = await TestApp.json(
+      await app.request(
+        `/v1/orgs/${org.id}/projects/${project.id}/api-keys`,
+        superAdminJson('POST', { scopes: ['zone:421700001:read'] }),
+      ),
+      Keys.schema.createApiKey.Response,
+    )
+
+    const response = await app.request(
+      `/v1/orgs/${org.id}/projects/${other.id}/api-keys/${source.id}/rotate`,
+      { headers: { cookie: owner }, method: 'POST' },
+    )
+    expect(response.status).toBe(404)
+    expect(await response.json()).toMatchObject({ error: { code: 'api_key_not_found' } })
+  })
+
   test('restricts project management keys without delegating issuance', async () => {
     const app = createApp()
     const cookie = await session(app)