tapimo 0.15.1 → 0.18.1

package/src/ApiKeys.ts

@@ -19,6 +19,9 @@ import type * as Db from './db/Db.js'
 import * as ApiKeyAdmissions from './db/tables/apiKeyAdmissions.js'
 import * as ApiKeyOwnerTombstones from './db/tables/apiKeyOwnerTombstones.js'
 import * as ApiKeyRevocations from './db/tables/apiKeyRevocations.js'
+import * as Organizations from './db/tables/organizations.js'
+import * as RoutesPolicies from './db/tables/routesPolicies.js'
+import * as RoutesSubsidies from './db/tables/routesSubsidies.js'
 import * as Store from './internal/Store.js'
 import * as Scope from './Scope.js'
 
@@ -158,15 +161,56 @@ export async function mintBounded(
   db: Db.Db,
   state: Store.State,
   input: MintInput,
-  options: mint.Options = {},
+  options: mintBounded.Options = {},
 ): Promise<MintResult> {
-  if (input.orgId === undefined) return mint(state, input, options)
+  if (options.sourceScopes && !options.policySourceApiKeyId)
+    throw new RoutesPolicies.InvalidScopeError()
+  if (input.orgId === undefined) {
+    if (options.policySourceApiKeyId) throw new RoutesPolicies.InvalidScopeError()
+    return mint(state, input, options)
+  }
   const orgId = input.orgId
-  const data = validateMintInput(input, options)
+  const validated = validateMintInput(input, options)
   const id = ApiKey.generateId()
   const result = await db.transaction(async (tx) => {
+    const data = await (async () => {
+      if (!options.policySourceApiKeyId) return validated
+      // Match reassignment/revocation lock order and retain the source lock
+      // through the policy copy. The admission ledger also fences stale KV.
+      await ApiKeyAdmissions.lock(tx, options.policySourceApiKeyId)
+      const source = await get(state, options.policySourceApiKeyId, options)
+      if (
+        !source ||
+        source.orgId !== orgId ||
+        source.projectId !== validated.projectId ||
+        source.environment !== validated.environment ||
+        (options.sourceScopes !== undefined &&
+          !options.sourceScopes.every(
+            (scope) => source.scopes.includes(scope) || source.scopes.includes(Scope.wildcard),
+          )) ||
+        !(await ApiKeyAdmissions.matches(tx, source))
+      )
+        throw new RoutesPolicies.InvalidScopeError()
+      // The locked source, not the caller's earlier snapshot, bounds every copied restriction.
+      const { allowedIps: _allowedIps, expiresAt, rateLimits: _rateLimits, ...rest } = validated
+      const expiry = [expiresAt, source.expiresAt]
+        .filter((value): value is string => value !== undefined)
+        .sort((a, b) => Date.parse(a) - Date.parse(b))[0]
+      return {
+        ...rest,
+        allowedIps: source.allowedIps,
+        ...(expiry === undefined ? {} : { expiresAt: expiry }),
+        ...(source.rateLimits === undefined ? {} : { rateLimits: source.rateLimits }),
+      }
+    })()
+    // Policy copies share deletion's subsidy-before-owner lock order.
+    if (options.policySourceApiKeyId) await RoutesSubsidies.lockOrganization(tx, orgId)
     const owner = { orgId, projectId: data.projectId }
     if (!(await ApiKeyOwnerTombstones.lockActive(tx, owner))) throw new OwnerDeletedError()
+    // A rotated one-off keeps its synthetic owner and policies. Materialize
+    // that owner before the replacement loses the original key's self-owner fallback.
+    if (options.policySourceApiKeyId === orgId && !(await Organizations.get(tx, orgId)))
+      await Organizations.create(tx, { id: orgId, name: orgId })
     await ApiKeyAdmissions.lockOrganization(tx, orgId)
     const legacy = (await ApiKeyAdmissions.isBootstrapped(tx, orgId))
       ? { complete: true, records: [] }
@@ -180,13 +224,59 @@ export async function mintBounded(
       orgId,
       projectId: data.projectId ?? null,
     })
-    return admitted ? mintValidated(state, data, id) : null
+    if (!admitted) return null
+    await ApiKeyAdmissions.setPendingScopes(tx, id, data.scopes)
+    // Keep the credential unprivileged until its policy copy commits. KV cannot
+    // participate in the database transaction, so publishing the requested
+    // scopes here could leave a broadened key behind when copy/commit fails.
+    const minted = await mintValidated(state, { ...data, scopes: [] }, id)
+    if (options.policySourceApiKeyId)
+      await RoutesPolicies.copyKeyIn(tx, {
+        destination: {
+          apiKeyId: minted.record.id,
+          environment: minted.record.environment,
+          orgId: minted.record.orgId,
+          ...(minted.record.projectId === undefined ? {} : { projectId: minted.record.projectId }),
+        },
+        source: {
+          apiKeyId: options.policySourceApiKeyId,
+          environment: minted.record.environment,
+          orgId: minted.record.orgId,
+          ...(minted.record.projectId === undefined ? {} : { projectId: minted.record.projectId }),
+        },
+      })
+    return minted
   })
   if (!result) throw new LiveKeyLimitError(maxLiveKeysPerOrganization)
-  return result
+  try {
+    const record = await publishScopes(db, state, result.record.id, options)
+    if (!record) throw new Error('minted API key missing while publishing scopes')
+    return { ...result, record }
+  } catch (cause) {
+    // The caller never received this credential. Fence even ambiguous KV writes before freeing its slot.
+    await db.transaction(async (tx) => {
+      await ApiKeyAdmissions.lock(tx, result.record.id)
+      await ApiKeyRevocations.markPending(tx, result.record.id, orgId)
+      await ApiKeyAdmissions.release(tx, result.record.id)
+    })
+    try {
+      await revokeBounded(db, state, result.record.id)
+    } catch {
+      // Failed KV cleanup leaves the non-expiring SQL fence intact; preserve the publication error.
+    }
+    throw cause
+  }
 }
 
-/** Durably fences key use before deleting its organization or project. The idempotent fence remains on failure so concurrent attempts cannot reopen the owner. */
+export declare namespace mintBounded {
+  /** Options for {@link mintBounded}. */
+  type Options = mint.Options & {
+    /** Scopes the locked policy-source key must authorize before issuance. */
+    sourceScopes?: readonly Scope.Id[] | undefined
+  }
+}
+
+/** Durably fences key use before deleting its organization or project. Reconcile failed deletions against committed SQL state before removing the fence. */
 export async function markOwnerDeleting(
   state: Store.State,
   owner: markOwnerDeleting.Owner,
@@ -194,6 +284,18 @@ export async function markOwnerDeleting(
   await state.put(ownerDeletedKey(owner), 'deleting')
 }
 
+/** Removes an aborted deletion's KV fence while holding the SQL owner lock against concurrent deletion. */
+export async function reconcileOwnerDeletion(
+  db: Db.Db,
+  state: Store.State,
+  owner: markOwnerDeleting.Owner,
+): Promise<void> {
+  await db.transaction(async (tx) => {
+    if (await ApiKeyOwnerTombstones.lockActive(tx, owner))
+      await state.delete(ownerDeletedKey(owner))
+  })
+}
+
 export declare namespace markOwnerDeleting {
   /** API-key owner being deleted. */
   type Owner = {
@@ -209,6 +311,8 @@ export declare namespace mint {
   type Options = {
     /** Scope catalog accepted while minting the key. */
     scopeCatalog?: Scope.Catalog | undefined
+    /** Existing key whose explicit route-policy overrides are copied to this replacement. */
+    policySourceApiKeyId?: string | undefined
   }
 }
 
@@ -233,7 +337,7 @@ export async function resolve(
     Date.now(),
     options.scopeCatalog ?? Scope.catalog,
   )
-  if (!record || (await isOwnerDeleted(state, record))) return null
+  if (!record || (await isFenced(state, record))) return null
   return record
 }
 
@@ -419,13 +523,15 @@ export declare namespace listByOrg {
 }
 
 /**
- * Revokes a key by id, deleting its record and index entries.
+ * Revokes a key by id with a durable KV marker, then deletes its record and index entries.
  *
  * @param state - The KV state store holding key records.
  * @param id - The key id (`key_…`).
  * @returns Whether a matching record was deleted.
  */
 export async function revoke(state: Store.State, id: string): Promise<boolean> {
+  // The ID index can be missing while the token record survives. Keep its fence permanently, even when cleanup cannot find the record.
+  await state.put(`${revokedPrefix}${id}`, '1')
   const recordKey = await state.get(idKeyFor(id))
   if (!recordKey) return false
   // Parse loosely for the org index entry: even a record the catalog no
@@ -548,6 +654,7 @@ export async function updateBounded(
   input: update.Input,
   options: updateBounded.Options = {},
 ): Promise<Record | null> {
+  let reassigning = false
   const result = await db.transaction(async (tx) => {
     await ApiKeyAdmissions.lock(tx, id)
     const record = await get(state, id, options)
@@ -558,8 +665,13 @@ export async function updateBounded(
         record.projectId !== options.expectedOwner.projectId)
     )
       return { type: 'missing' } as const
-    if (input.orgId === undefined && input.projectId === undefined)
+    const pendingScopes = (await ApiKeyAdmissions.get(tx, id))?.pendingScopes
+    // An explicit scope edit supersedes every earlier deferred publication,
+    // including an intentional empty grant. Never revive it from a stale caller.
+    if (input.orgId === undefined && input.projectId === undefined) {
+      if (input.scopes !== undefined) await ApiKeyAdmissions.setPendingScopes(tx, id, null)
       return { type: 'updated', updated: await update(state, id, input, options) } as const
+    }
     const owner = {
       orgId: input.orgId ?? record.orgId,
       projectId: input.projectId ?? record.projectId,
@@ -567,6 +679,12 @@ export async function updateBounded(
     const owners = [owner]
     if (record.orgId !== record.id)
       owners.push({ orgId: record.orgId, projectId: record.projectId })
+    reassigning = owner.orgId !== record.orgId || owner.projectId !== record.projectId
+    if (reassigning)
+      await RoutesPolicies.lockKeyOrganizations(tx, {
+        apiKeyId: id,
+        orgIds: [record.orgId, owner.orgId],
+      })
     if (!(await ApiKeyOwnerTombstones.lockActiveMany(tx, owners))) throw new OwnerDeletedError()
     await ApiKeyAdmissions.lockOrganization(tx, owner.orgId)
     const legacy = (await ApiKeyAdmissions.isBootstrapped(tx, owner.orgId))
@@ -583,12 +701,41 @@ export async function updateBounded(
       projectId: owner.projectId ?? null,
     })
     if (!admitted) return { type: 'limit' } as const
-    const updated = await update(state, id, input, options)
+    if (reassigning) {
+      // Fail closed across the KV/SQL boundary. The key remains scope-less if
+      // clearing, reassignment, or the eventual SQL commit fails.
+      await ApiKeyAdmissions.setPendingScopes(
+        tx,
+        id,
+        input.scopes ?? pendingScopes ?? record.scopes,
+      )
+      const disabled = await update(state, id, { scopes: [] }, options)
+      if (!disabled) return { type: 'missing' } as const
+      await RoutesPolicies.clearKeyIn(tx, { apiKeyId: id })
+    } else if (input.scopes !== undefined) await ApiKeyAdmissions.setPendingScopes(tx, id, null)
+    const transactionalInput = reassigning ? { ...input, scopes: [] } : input
+    const updated = await update(state, id, transactionalInput, options)
     if (!updated) await ApiKeyAdmissions.release(tx, id)
     return { type: 'updated', updated } as const
   })
   if (result.type === 'limit') throw new LiveKeyLimitError(maxLiveKeysPerOrganization)
-  return result.type === 'missing' ? null : result.updated
+  if (result.type === 'missing') return null
+  if (!result.updated || !reassigning) return result.updated
+  return publishScopes(db, state, id, options)
+}
+
+/** Publishes only the latest committed scope intent, serialized with key edits and revocation. */
+async function publishScopes(db: Db.Db, state: Store.State, id: string, options: update.Options) {
+  return db.transaction(async (tx) => {
+    await ApiKeyAdmissions.lock(tx, id)
+    const record = await get(state, id, options)
+    if (!record || !(await ApiKeyAdmissions.matches(tx, record))) return null
+    const pending = (await ApiKeyAdmissions.get(tx, id))?.pendingScopes
+    if (pending == null) return record
+    const updated = await update(state, id, { scopes: pending }, options)
+    await ApiKeyAdmissions.setPendingScopes(tx, id, null)
+    return updated
+  })
 }
 
 export declare namespace updateBounded {
@@ -942,6 +1089,39 @@ function orgKeyFor(orgId: string, id: string): string {
   return `${orgPrefix}${orgId}:${id}`
 }
 
+/** Storage-key prefix for durable key revocation markers. */
+const revokedPrefix = 'apikey_revoked:'
+
+/** Returns whether a key is revoked or its organization or project is being deleted, in one bulk read. */
+export async function isFenced(state: Store.State, key: isFenced.Key): Promise<boolean> {
+  const revoked = `${revokedPrefix}${key.id}`
+  const org = ownerDeletedKey({ orgId: key.orgId })
+  const project = key.projectId === undefined ? undefined : ownerDeletedKey(key)
+  const values = await Store.getMany(state, project ? [revoked, org, project] : [revoked, org])
+  return (
+    values.get(revoked) != null ||
+    Boolean(values.get(org)) ||
+    (project !== undefined && values.get(project) != null)
+  )
+}
+
+export declare namespace isFenced {
+  /** Key identity the fences apply to. */
+  type Key = {
+    /** Key id (`key_…`). */
+    id: string
+    /** Owning organization id. */
+    orgId: string
+    /** Owning project id, when project-attributed. */
+    projectId?: string | undefined
+  }
+}
+
+/** Returns whether a key has a durable KV revocation marker. */
+export async function isRevoked(state: Store.State, id: string): Promise<boolean> {
+  return (await state.get(`${revokedPrefix}${id}`)) !== null
+}
+
 /** Storage-key prefix for durable owner deletion markers. */
 const ownerDeletedPrefix = 'apikey_owner_deleted:'