tapimo 0.14.0 → 0.15.0

package/src/admin/apps/api-keys.test.ts

@@ -57,6 +57,27 @@ describe('POST /api-keys', () => {
     expect((await core_ApiKeys.list(store))[0]?.environment).toBe('production')
   })
 
+  test('mints a disabled key without scopes', async () => {
+    const { client, store } = await setup()
+    const response = await client['api-keys'].$post({
+      json: { ...validBody, scopes: [] },
+    })
+
+    expect(response.status).toBe(200)
+    const body = await TestApp.json(response, ApiKeys.schema.createApiKey.Response)
+    expect((await core_ApiKeys.get(store, body.id))?.scopes).toEqual([])
+  })
+
+  test('returns not found when the owner is fenced during minting', async () => {
+    const { client, store } = await setup()
+    await core_ApiKeys.markOwnerDeleting(store, { orgId: validBody.orgId })
+
+    const response = await client['api-keys'].$post({ json: validBody })
+
+    expect(response.status).toBe(404)
+    expect(await response.json()).toMatchObject({ error: { code: 'not_found' } })
+  })
+
   test('requires a human-readable name', async () => {
     const { client } = await setup()
     const response = await client['api-keys'].$post({
@@ -114,6 +135,16 @@ describe('POST /api-keys', () => {
     expect(response.status).toBe(400)
   })
 
+  test('rejects a malformed expiry with 400', async () => {
+    const { client } = await setup()
+    const response = await client['api-keys'].$post({
+      json: { ...validBody, expiresAt: 'not-a-date' } as never,
+    })
+
+    expect(response.status).toBe(400)
+    expect(await response.json()).toMatchObject({ error: { code: 'body_invalid' } })
+  })
+
   test('rejects an unknown scope with 400', async () => {
     const { client } = await setup()
     const response = await client['api-keys'].$post({
@@ -126,6 +157,17 @@ describe('POST /api-keys', () => {
     expect(body.error?.code).toMatchInlineSnapshot(`"body_invalid"`)
   })
 
+  test('rejects duplicate scopes with 400', async () => {
+    const { client } = await setup()
+    const response = await client['api-keys'].$post({
+      json: { ...validBody, scopes: ['data:read', 'data:read'] } as never,
+    })
+    const body = (await response.json()) as { error?: { code?: string } }
+
+    expect(response.status).toBe(400)
+    expect(body.error?.code).toBe('body_invalid')
+  })
+
   test('rejects non-concrete or non-canonical Zone scopes with 400', async () => {
     for (const scope of [
       'zone:<chainId>:read',
@@ -351,6 +393,42 @@ describe('POST /api-keys/:id/rotate', () => {
     expect(response.status).toMatchInlineSnapshot(`404`)
   })
 
+  test('deduplicates legacy scopes while rotating', async () => {
+    const { client, store } = await setup()
+    const { record: source } = await core_ApiKeys.mint(store, {
+      orgId: validBody.orgId,
+      scopes: ['data:read'],
+    })
+    const { keys } = await store.list({ prefix: 'apikey:' })
+    const recordKey = keys.find(({ name }) => name.startsWith('apikey:'))!.name
+    const value = JSON.parse((await store.get(recordKey))!) as Record<string, unknown>
+    await store.put(recordKey, JSON.stringify({ ...value, scopes: ['data:read', 'data:read'] }))
+
+    const response = await client['api-keys'][':id'].rotate.$post({
+      param: { id: source.id },
+    })
+    const replacement = await TestApp.json(response, ApiKeys.schema.rotateApiKey.Response)
+
+    expect(response.status).toBe(200)
+    expect(replacement.scopes).toEqual(['data:read'])
+  })
+
+  test('returns not found when the owner is fenced during rotation', async () => {
+    const { client, store } = await setup()
+    const { record: source } = await core_ApiKeys.mint(store, {
+      orgId: validBody.orgId,
+      scopes: ['data:read'],
+    })
+    await core_ApiKeys.markOwnerDeleting(store, { orgId: validBody.orgId })
+
+    const response = await client['api-keys'][':id'].rotate.$post({
+      param: { id: source.id },
+    })
+
+    expect(response.status).toBe(404)
+    expect(await response.json()).toMatchObject({ error: { code: 'not_found' } })
+  })
+
   test('keeps a rotated one-off key assignable to an organization', async () => {
     const { client, db, store } = await setup()
     const organization = await Organizations.create(db, { name: 'Tempo' })
@@ -392,9 +470,87 @@ describe('PATCH /api-keys/:id', () => {
     expect((await core_ApiKeys.get(store, record.id))?.allowedIps).toEqual(['203.0.113.0/24'])
   })
 
+  test('updates scopes without changing the token', async () => {
+    const { client, store } = TestAdmin.setup()
+    const { record, token } = await core_ApiKeys.mint(store, {
+      name: 'Restricted',
+      scopes: ['data:read'],
+    })
+
+    const response = await client['api-keys'][':id'].$patch({
+      json: { scopes: ['management:read', 'zone:421700001:write'] },
+      param: { id: record.id },
+    })
+
+    expect(response.status).toBe(200)
+    expect((await core_ApiKeys.resolve(store, token))?.scopes).toEqual([
+      'management:read',
+      'zone:421700001:write',
+    ])
+  })
+
+  test('updates the rate limit without changing the token', async () => {
+    const { client, store } = TestAdmin.setup()
+    const { record, token } = await core_ApiKeys.mint(store, {
+      name: 'Restricted',
+      rateLimits: { '*': { limit: 10_000, period: 'minute' } },
+      scopes: ['data:read'],
+    })
+
+    const response = await client['api-keys'][':id'].$patch({
+      json: { rateLimits: { '*': { limit: 25_000, period: 'minute' } } },
+      param: { id: record.id },
+    })
+
+    expect(response.status).toBe(200)
+    expect((await core_ApiKeys.resolve(store, token))?.rateLimits).toEqual({
+      '*': { limit: 25_000, period: 'minute' },
+    })
+  })
+
+  test('clears scopes and rejects unknown scopes', async () => {
+    const { client, store } = TestAdmin.setup()
+    const { record } = await core_ApiKeys.mint(store, {
+      name: 'Restricted',
+      scopes: ['data:read'],
+    })
+
+    const empty = await client['api-keys'][':id'].$patch({
+      json: { scopes: [] },
+      param: { id: record.id },
+    })
+    const unknown = await client['api-keys'][':id'].$patch({
+      json: { scopes: ['not-a-scope'] as never },
+      param: { id: record.id },
+    })
+
+    expect(empty.status).toBe(200)
+    expect((await core_ApiKeys.get(store, record.id))?.scopes).toEqual([])
+    expect(unknown.status).toBe(400)
+  })
+
+  test('rejects duplicate scopes and fenced owner attribution', async () => {
+    const { client, db, store } = TestAdmin.setup()
+    const organization = await Organizations.create(db, { name: 'Deleted' })
+    const { record } = await core_ApiKeys.mint(store, { scopes: ['data:read'] })
+    const duplicate = await client['api-keys'][':id'].$patch({
+      json: { scopes: ['data:read', 'data:read'] } as never,
+      param: { id: record.id },
+    })
+    await core_ApiKeys.markOwnerDeleting(store, { orgId: organization.id })
+    const deleted = await client['api-keys'][':id'].$patch({
+      json: { orgId: organization.id },
+      param: { id: record.id },
+    })
+
+    expect(duplicate.status).toBe(400)
+    expect(deleted.status).toBe(404)
+  })
+
   test('renames and associates a one-off key without changing its token', async () => {
     const { client, db, store } = TestAdmin.setup()
     const organization = await Organizations.create(db, { name: 'Tempo' })
+    const project = await Projects.create(db, { name: 'Explorer', orgId: organization.id })
     const { record, token } = await core_ApiKeys.mint(store, {
       name: 'Trial',
       scopes: ['data:read'],
@@ -405,7 +561,7 @@ describe('PATCH /api-keys/:id', () => {
         allowedIps: ['203.0.113.0/24'],
         name: 'Explorer',
         orgId: organization.id,
-        projectId: 'prj_real',
+        projectId: project.id,
       },
       param: { id: record.id },
     })
@@ -414,7 +570,7 @@ describe('PATCH /api-keys/:id', () => {
     expect(body.name).toBe('Explorer')
     expect(body.allowedIps).toEqual(['203.0.113.0/24'])
     expect(body.orgId).toBe(organization.id)
-    expect(body.projectId).toBe('prj_real')
+    expect(body.projectId).toBe(project.id)
 
     expect((await core_ApiKeys.resolve(store, token))?.orgId).toBe(organization.id)
     expect(await core_ApiKeys.listByOrg(store, record.id)).toEqual([])
@@ -435,7 +591,7 @@ describe('PATCH /api-keys/:id', () => {
     expect((await core_ApiKeys.get(store, record.id))?.orgId).toBe(record.id)
   })
 
-  test('rejects changing an assigned organization', async () => {
+  test('changes an assigned organization without changing the token', async () => {
     const { client, db, store } = TestAdmin.setup()
     const organization = await Organizations.create(db, { name: 'Tempo' })
     const other = await Organizations.create(db, { name: 'Other' })
@@ -447,11 +603,117 @@ describe('PATCH /api-keys/:id', () => {
       json: { orgId: other.id },
       param: { id: record.id },
     })
+    expect(response.status).toBe(200)
+    expect((await core_ApiKeys.resolve(store, token))?.orgId).toBe(other.id)
+    expect(await core_ApiKeys.listByOrg(store, organization.id)).toEqual([])
+    expect((await core_ApiKeys.listByOrg(store, other.id)).map(({ id }) => id)).toEqual([record.id])
+  })
+
+  test('enforces the destination organization limit when changing attribution', async () => {
+    const { client, db, store } = TestAdmin.setup()
+    const organization = await Organizations.create(db, { name: 'Full' })
+    await Promise.all(
+      Array.from({ length: core_ApiKeys.maxLiveKeysPerOrganization }, () =>
+        core_ApiKeys.mintBounded(db, store, {
+          orgId: organization.id,
+          scopes: ['data:read'],
+        }),
+      ),
+    )
+    const { record } = await core_ApiKeys.mint(store, { scopes: ['data:read'] })
+
+    const response = await client['api-keys'][':id'].$patch({
+      json: { orgId: organization.id },
+      param: { id: record.id },
+    })
+
+    expect(response.status).toBe(409)
+    expect(await response.json()).toMatchObject({ error: { code: 'api_key_limit_reached' } })
+    expect((await core_ApiKeys.get(store, record.id))?.orgId).toBe(record.id)
+  })
+
+  test('atomically changes a key organization and project', async () => {
+    const { client, db, store } = TestAdmin.setup()
+    const organization = await Organizations.create(db, { name: 'Tempo' })
+    const other = await Organizations.create(db, { name: 'Other' })
+    const project = await Projects.create(db, { name: 'Explorer', orgId: organization.id })
+    const otherProject = await Projects.create(db, { name: 'App', orgId: other.id })
+    const { record, token } = await core_ApiKeys.mint(store, {
+      orgId: organization.id,
+      projectId: project.id,
+      scopes: ['data:read'],
+    })
+
+    const response = await client['api-keys'][':id'].$patch({
+      json: { orgId: other.id, projectId: otherProject.id },
+      param: { id: record.id },
+    })
+
+    expect(response.status).toBe(200)
+    expect(await core_ApiKeys.resolve(store, token)).toMatchObject({
+      orgId: other.id,
+      projectId: otherProject.id,
+    })
+  })
+
+  test('rejects assigning a project from another organization', async () => {
+    const { client, db, store } = TestAdmin.setup()
+    const organization = await Organizations.create(db, { name: 'Tempo' })
+    const other = await Organizations.create(db, { name: 'Other' })
+    const project = await Projects.create(db, { name: 'App', orgId: other.id })
+    const { record } = await core_ApiKeys.mint(store, {
+      orgId: organization.id,
+      scopes: ['data:read'],
+    })
+
+    const response = await client['api-keys'][':id'].$patch({
+      json: { projectId: project.id },
+      param: { id: record.id },
+    })
     const body = (await response.json()) as { error?: { code?: string } }
 
     expect(response.status).toBe(409)
-    expect(body.error?.code).toBe('organization_already_assigned')
-    expect((await core_ApiKeys.resolve(store, token))?.orgId).toBe(organization.id)
+    expect(body.error?.code).toBe('project_organization_mismatch')
+    expect((await core_ApiKeys.get(store, record.id))?.projectId).toBeUndefined()
+  })
+
+  test('rejects assigning an unknown project', async () => {
+    const { client, db, store } = TestAdmin.setup()
+    const organization = await Organizations.create(db, { name: 'Tempo' })
+    const { record } = await core_ApiKeys.mint(store, {
+      orgId: organization.id,
+      scopes: ['data:read'],
+    })
+
+    const response = await client['api-keys'][':id'].$patch({
+      json: { projectId: 'prj_missing' },
+      param: { id: record.id },
+    })
+
+    expect(response.status).toBe(404)
+    expect((await core_ApiKeys.get(store, record.id))?.projectId).toBeUndefined()
+  })
+
+  test('rejects moving a project key to another organization', async () => {
+    const { client, db, store } = TestAdmin.setup()
+    const organization = await Organizations.create(db, { name: 'Tempo' })
+    const other = await Organizations.create(db, { name: 'Other' })
+    const project = await Projects.create(db, { name: 'Explorer', orgId: organization.id })
+    const { record } = await core_ApiKeys.mint(store, {
+      orgId: organization.id,
+      projectId: project.id,
+      scopes: ['data:read'],
+    })
+
+    const response = await client['api-keys'][':id'].$patch({
+      json: { orgId: other.id },
+      param: { id: record.id },
+    })
+    const body = (await response.json()) as { error?: { code?: string } }
+
+    expect(response.status).toBe(409)
+    expect(body.error?.code).toBe('project_organization_mismatch')
+    expect((await core_ApiKeys.get(store, record.id))?.orgId).toBe(organization.id)
   })
 
   test('unknown id → 404', async () => {

package/src/admin/apps/api-keys.ts

@@ -41,6 +41,20 @@ export namespace schema {
     z.meta({ examples: ['2100-01-01T00:00:00.000Z'] }),
   )
 
+  const GrantedScopes = z
+    .readonly(
+      z.array(
+        z.union([
+          z.enum([...Scope.catalog.map((entry) => entry.scope), Scope.wildcard]),
+          Scope.schema.Zone,
+        ]),
+      ),
+    )
+    .check(
+      z.refine((scopes) => new Set(scopes).size === scopes.length),
+      z.describe("Unique granted scopes. '*' grants all scopes."),
+    )
+
   const ApiKey = Schema.describe(
     z.extend(ApiKeys.schema.Record, {
       createdByLabel: z
@@ -75,16 +89,7 @@ export namespace schema {
       z.extend(z.omit(ApiKeys.schema.MintInput, { createdBy: true, name: true }), {
         expiresAt: ExpiresAt,
         name: Name,
-        scopes: z
-          .readonly(
-            z.array(
-              z.union([
-                z.enum([...Scope.catalog.map((entry) => entry.scope), Scope.wildcard]),
-                Scope.schema.Zone,
-              ]),
-            ),
-          )
-          .check(z.describe("Granted scopes. '*' grants all scopes.")),
+        scopes: GrantedScopes,
       }),
       'Fields accepted when minting an API key.',
     )
@@ -131,10 +136,12 @@ export namespace schema {
           .optional(core_ApiKey.schema.AllowedIps)
           .check(z.describe('Replacement client IP/CIDR allowlist. An empty list clears it.')),
         name: z.optional(Name).check(z.describe('New human-readable key name.')),
-        orgId: z
-          .optional(z.string())
-          .check(z.describe('Owning organization id to assign to an unattributed key (`org_…`).')),
+        orgId: z.optional(z.string()).check(z.describe('New owning organization id (`org_…`).')),
         projectId: z.optional(z.string()).check(z.describe('New attributed project id (`prj_…`).')),
+        rateLimits: core_ApiKey.schema.ApiKey.shape.rateLimits.check(
+          z.describe('Replacement per-key quota overrides.'),
+        ),
+        scopes: z.optional(GrantedScopes).check(z.describe('Replacement granted scopes.')),
       }),
       'Metadata to apply to an API key.',
     )
@@ -200,7 +207,7 @@ export namespace schema {
  *   returning the one-time token.
  * - `GET /` lists key records (metadata only), optionally filtered by `orgId`.
  * - `DELETE /:id` revokes a key by id (`404` if absent).
- * - `PATCH /:id` updates a key's allowlist, name, or project, or assigns its first organization.
+ * - `PATCH /:id` updates a key's allowlist, name, quotas, scopes, or attribution.
  * - `POST /:id/rotate` mints a replacement with the source key's access and attribution.
  * - `POST /backfill` rebuilds the id and org index entries for every record.
  */
@@ -234,7 +241,10 @@ export function apiKeys() {
       OpenApi.describeRoute({
         operationId: 'createApiKey',
         responses: OpenApi.responses({
-          errors: { 404: 'Organization or project not found.' },
+          errors: {
+            404: 'Organization or project not found.',
+            409: 'Organization API-key limit reached.',
+          },
           success: {
             description: 'Minted key (includes the one-time token).',
             schema: schema.createApiKey.Response,
@@ -273,13 +283,15 @@ export function apiKeys() {
 
           // `createdBy` is the verified admin email, never client-supplied.
           // `requireAuth` guarantees identity on this gated route.
-          const { record, token } = await ApiKeys.mint(c.get('kv').store, {
+          const { record, token } = await ApiKeys.mintBounded(db, c.get('kv').store, {
             ...input,
             createdBy: c.get('identity')!.email,
             ...(orgId === undefined ? {} : { orgId }),
           })
           return c.json(Response.validated(schema.createApiKey.Response, { ...record, token }))
         } catch (cause) {
+          if (cause instanceof ApiKeys.OwnerDeletedError) return ownerNotFound(c)
+          if (cause instanceof ApiKeys.LiveKeyLimitError) return keyLimitReached(c)
           return Response.upstream(c, cause)
         }
       },
@@ -324,7 +336,7 @@ export function apiKeys() {
       }),
       async (c) => {
         const { id } = c.req.valid('param')
-        const revoked = await ApiKeys.revoke(c.get('kv').store, id)
+        const revoked = await ApiKeys.revokeBounded(Db.get(c.get('db')), c.get('kv').store, id)
         if (!revoked)
           return Response.error(c, {
             code: 'not_found',
@@ -344,7 +356,7 @@ export function apiKeys() {
         description: 'Create a replacement that preserves the source key access and attribution. The source key remains active.', // prettier-ignore
         operationId: 'rotateAdminApiKey',
         responses: OpenApi.responses({
-          errors: { 404: 'API key not found.' },
+          errors: { 404: 'API key not found.', 409: 'Organization API-key limit reached.' },
           success: {
             description: 'Replacement key (includes the one-time token).',
             schema: schema.rotateApiKey.Response,
@@ -364,19 +376,25 @@ export function apiKeys() {
             status: 404,
           })
 
-        const { record, token } = await ApiKeys.mint(store, {
-          allowedIps: source.allowedIps,
-          createdBy: c.get('identity')!.email,
-          environment: source.environment,
-          scopes: source.scopes,
-          ...(source.billingActive === undefined ? {} : { billingActive: source.billingActive }),
-          ...(source.expiresAt === undefined ? {} : { expiresAt: source.expiresAt }),
-          ...(source.name === undefined ? {} : { name: source.name }),
-          ...(source.orgId === source.id ? {} : { orgId: source.orgId }),
-          ...(source.projectId === undefined ? {} : { projectId: source.projectId }),
-          ...(source.rateLimits === undefined ? {} : { rateLimits: source.rateLimits }),
-        })
-        return c.json(Response.validated(schema.rotateApiKey.Response, { ...record, token }), 200)
+        try {
+          const { record, token } = await ApiKeys.mintBounded(Db.get(c.get('db')), store, {
+            allowedIps: source.allowedIps,
+            createdBy: c.get('identity')!.email,
+            environment: source.environment,
+            scopes: [...new Set(source.scopes)],
+            ...(source.billingActive === undefined ? {} : { billingActive: source.billingActive }),
+            ...(source.expiresAt === undefined ? {} : { expiresAt: source.expiresAt }),
+            ...(source.name === undefined ? {} : { name: source.name }),
+            ...(source.orgId === source.id ? {} : { orgId: source.orgId }),
+            ...(source.projectId === undefined ? {} : { projectId: source.projectId }),
+            ...(source.rateLimits === undefined ? {} : { rateLimits: source.rateLimits }),
+          })
+          return c.json(Response.validated(schema.rotateApiKey.Response, { ...record, token }), 200)
+        } catch (cause) {
+          if (cause instanceof ApiKeys.OwnerDeletedError) return ownerNotFound(c)
+          if (cause instanceof ApiKeys.LiveKeyLimitError) return keyLimitReached(c)
+          return Response.upstream(c, cause)
+        }
       },
     )
     .patch(
@@ -390,12 +408,12 @@ export function apiKeys() {
         message: 'Invalid request body',
       }),
       OpenApi.describeRoute({
-        description: 'Update a key allowlist, name, or project, or assign its first organization. The token is unchanged.', // prettier-ignore
+        description: 'Update a key allowlist, name, quotas, scopes, or attribution. The token is unchanged.', // prettier-ignore
         operationId: 'updateApiKey',
         responses: OpenApi.responses({
           errors: {
-            404: 'API key or organization not found.',
-            409: 'API key already belongs to another organization.',
+            404: 'API key, organization, or project not found.',
+            409: 'Project mismatch or organization API-key limit reached.',
           },
           success: { description: 'The updated key record.', schema: ApiKeys.schema.Record },
         }),
@@ -414,35 +432,67 @@ export function apiKeys() {
             status: 404,
           })
 
-        // One-off keys use their key id as `orgId`.
-        if (input.orgId !== undefined && record.orgId !== record.id && input.orgId !== record.orgId)
-          return Response.error(c, {
-            code: 'organization_already_assigned',
-            message: 'API key already belongs to an organization.',
-            status: 409,
-          })
-        if (
-          input.orgId !== undefined &&
-          !(await Organizations.get(Db.get(c.get('db')), input.orgId))
-        )
+        const db = Db.get(c.get('db'))
+        const orgId = input.orgId ?? record.orgId
+        const projectId = input.projectId ?? record.projectId
+        const attributionChanged = input.orgId !== undefined || input.projectId !== undefined
+        const [organization, project] = await Promise.all([
+          input.orgId === undefined ? undefined : Organizations.get(db, input.orgId),
+          !attributionChanged || projectId === undefined ? undefined : Projects.get(db, projectId),
+        ])
+        if (input.orgId !== undefined && !organization)
           return Response.error(c, {
             code: 'not_found',
             message: 'Organization not found.',
             status: 404,
           })
-
-        const updated = await ApiKeys.update(store, id, input)
-        if (!updated)
+        if (attributionChanged && projectId !== undefined && !project)
           return Response.error(c, {
             code: 'not_found',
-            message: 'API key not found.',
+            message: 'Project not found.',
             status: 404,
           })
-        return c.json(Response.validated(ApiKeys.schema.Record, updated))
+        if (project && project.orgId !== orgId)
+          return Response.error(c, {
+            code: 'project_organization_mismatch',
+            message: 'The API key project belongs to another organization.',
+            status: 409,
+          })
+
+        try {
+          const updated = await ApiKeys.updateBounded(db, store, id, input)
+          if (!updated)
+            return Response.error(c, {
+              code: 'not_found',
+              message: 'API key not found.',
+              status: 404,
+            })
+          return c.json(Response.validated(ApiKeys.schema.Record, updated))
+        } catch (cause) {
+          if (cause instanceof ApiKeys.OwnerDeletedError) return ownerNotFound(c)
+          if (cause instanceof ApiKeys.LiveKeyLimitError) return keyLimitReached(c)
+          return Response.upstream(c, cause)
+        }
       },
     )
 }
 
+function ownerNotFound(c: Parameters<typeof Response.error>[0]) {
+  return Response.error(c, {
+    code: 'not_found',
+    message: 'Organization or project not found.',
+    status: 404,
+  })
+}
+
+function keyLimitReached(c: Parameters<typeof Response.error>[0]) {
+  return Response.error(c, {
+    code: 'api_key_limit_reached',
+    message: `Organizations may have at most ${ApiKeys.maxLiveKeysPerOrganization} live API keys.`,
+    status: 409,
+  })
+}
+
 /** Resolves display labels without changing the authoritative key record. */
 async function enrichKeys(db: Db.Db, records: readonly ApiKeys.Record[]) {
   const organizationIds = [