tapimo 0.19.0 → 0.20.0

package/src/admin/apps/zone-key-requests.ts

@@ -1,231 +0,0 @@
-import { Hono } from 'hono'
-import * as z from 'zod/mini'
-
-import * as ApiKeys from '../../ApiKeys.js'
-import * as Db from '../../db/Db.js'
-import * as Organizations from '../../db/tables/organizations.js'
-import * as Projects from '../../db/tables/projects.js'
-import * as ZoneKeyRequests from '../../db/tables/zoneKeyRequests.js'
-import * as Cursor from '../../internal/Cursor.js'
-import * as OpenApi from '../../internal/OpenApi.js'
-import * as Response from '../../internal/Response.js'
-import * as ZoneKeyApproval from '../../internal/ZoneKeyApproval.js'
-import type * as App from '../App.js'
-import * as Keys from './api-keys.js'
-
-/** Request schemas for the Zone key approval workflow. */
-namespace schema {
-  export const Body = z
-    .extend(Keys.schema.createApiKey.Body, {
-      orgId: z
-        .string()
-        .check(z.regex(/^org_[A-Za-z0-9_-]+$/), z.describe('Organization receiving the key.')),
-    })
-    .check(
-      z.refine((body) => ZoneKeyApproval.required(body.scopes)),
-      z.describe('Immutable Zone key settings to approve.'),
-    )
-  export const Query = z.object({
-    cursor: z
-      .optional(
-        z.string().check(
-          z.maxLength(512),
-          z.refine((value) => Boolean(Cursor.decode(value, ['timestamp', 'id']))),
-        ),
-      )
-      .check(
-        z.describe('Next-page cursor from a prior response.'),
-        z.meta({ examples: [Cursor.encode(['2026-01-01T00:00:00.000Z', 'zkr_example'])] }),
-      ),
-  })
-  export const Params = z.object({
-    id: z
-      .string()
-      .check(z.regex(/^zkr_[A-Za-z0-9_-]+$/), z.describe('Zone key request identifier.')),
-  })
-}
-
-/** Mounts authenticated request, review, approval, issuance, and cancellation operations. */
-export function zoneKeyRequests() {
-  return new Hono<App.Environment>()
-    .use('*', async (c, next) => {
-      const config = c.get('zoneKeyApproval')
-      if (!config?.groupId || !config.lookup)
-        return Response.error(c, {
-          code: 'zone_key_approval_unconfigured',
-          message: 'The internal identity approver group is not configured.',
-          status: 503,
-        })
-      try {
-        const member = await config.identify(c.req.raw, c)
-        if (
-          !ZoneKeyApproval.active(member) ||
-          member.email.toLowerCase() !== c.get('identity')?.email.toLowerCase()
-        )
-          return Response.error(c, {
-            code: 'unauthorized',
-            message: 'A verified internal identity session is required.',
-            status: 401,
-          })
-        c.set('zoneKeyMember', member)
-        await next()
-        if (c.error) throw c.error
-        return
-      } catch (cause) {
-        if (cause instanceof ZoneKeyApproval.RequiredError) {
-          c.res = Response.error(c, {
-            code: 'zone_key_approval_required',
-            message: cause.message,
-            status: 403,
-          })
-          return c.res
-        }
-        c.get('metrics')?.count('zone_key_approval_failure_count', 1)
-        // Downstream errors may already have finalized Hono's response.
-        c.res = Response.upstream(c, cause)
-        return c.res
-      }
-    })
-    .post(
-      '/',
-      OpenApi.validate('json', schema.Body, {
-        code: 'body_invalid',
-        message: 'Invalid key request.',
-      }),
-      OpenApi.describeRoute({
-        operationId: 'createZoneKeyRequest',
-        responses: { 201: { description: 'The pending Zone key request.' } },
-        summary: 'Request Zone key',
-        tags: ['Zone Key Requests'],
-      }),
-      async (c) => {
-        const config = c.get('zoneKeyApproval')!
-        const requester = c.get('zoneKeyMember')
-        const input = c.req.valid('json')
-        const db = Db.get(c.get('db'))
-        const org = await Organizations.get(db, input.orgId)
-        const project = input.projectId ? await Projects.get(db, input.projectId) : undefined
-        if (!org || (input.projectId && project?.orgId !== input.orgId))
-          return Response.error(c, {
-            code: 'not_found',
-            message: 'Organization or project not found.',
-            status: 404,
-          })
-        const request = await ZoneKeyRequests.create(db, {
-          groupId: config.groupId,
-          input: { ...input, createdBy: requester.email },
-          requester,
-        })
-        return c.json(request, 201)
-      },
-    )
-    .get(
-      '/',
-      OpenApi.validate('query', schema.Query, {
-        code: 'query_invalid',
-        message: 'Invalid request cursor.',
-      }),
-      OpenApi.describeRoute({
-        operationId: 'listZoneKeyRequests',
-        responses: { 200: { description: 'A page of Zone key requests, newest first.' } },
-        summary: 'List Zone key requests',
-        tags: ['Zone Key Requests'],
-      }),
-      async (c) =>
-        c.json(await ZoneKeyRequests.list(Db.get(c.get('db')), c.req.valid('query')), 200),
-    )
-    .get(
-      '/:id',
-      OpenApi.validate('param', schema.Params, {
-        code: 'param_invalid',
-        message: 'Invalid request id.',
-      }),
-      OpenApi.describeRoute({
-        operationId: 'getZoneKeyRequest',
-        responses: { 200: { description: 'The Zone key request.' } },
-        summary: 'Get Zone key request',
-        tags: ['Zone Key Requests'],
-      }),
-      async (c) => {
-        const request = await ZoneKeyRequests.get(Db.get(c.get('db')), c.req.valid('param').id)
-        if (!request)
-          return Response.error(c, {
-            code: 'not_found',
-            message: 'Request not found.',
-            status: 404,
-          })
-        return c.json(request, 200)
-      },
-    )
-    .post(
-      '/:id/approve',
-      OpenApi.validate('param', schema.Params, {
-        code: 'param_invalid',
-        message: 'Invalid request id.',
-      }),
-      OpenApi.describeRoute({
-        operationId: 'approveZoneKeyRequest',
-        responses: { 200: { description: 'The Zone key request with the recorded approval.' } },
-        summary: 'Approve Zone key request',
-        tags: ['Zone Key Requests'],
-      }),
-      async (c) => {
-        const request = await ZoneKeyRequests.approve(Db.get(c.get('db')), {
-          groupId: c.get('zoneKeyApproval')!.groupId,
-          id: c.req.valid('param').id,
-          lookup: (ids) => c.get('zoneKeyApproval')!.lookup(c.req.raw, ids),
-          member: c.get('zoneKeyMember'),
-        })
-        return c.json(request, 200)
-      },
-    )
-    .post(
-      '/:id/issue',
-      OpenApi.validate('param', schema.Params, {
-        code: 'param_invalid',
-        message: 'Invalid request id.',
-      }),
-      OpenApi.describeRoute({
-        operationId: 'issueZoneKeyRequest',
-        responses: { 200: { description: 'The issued API key, including its one-time token.' } },
-        summary: 'Issue Zone key',
-        tags: ['Zone Key Requests'],
-      }),
-      async (c) => {
-        const { record, token } = await ApiKeys.mintApproved(
-          Db.get(c.get('db')),
-          c.get('kv').store,
-          {
-            groupId: c.get('zoneKeyApproval')!.groupId,
-            id: c.req.valid('param').id,
-            lookup: (ids) => c.get('zoneKeyApproval')!.lookup(c.req.raw, ids),
-            member: c.get('zoneKeyMember'),
-          },
-        )
-        return c.json({ ...record, token }, 200)
-      },
-    )
-    .delete(
-      '/:id',
-      OpenApi.validate('param', schema.Params, {
-        code: 'param_invalid',
-        message: 'Invalid request id.',
-      }),
-      OpenApi.describeRoute({
-        operationId: 'cancelZoneKeyRequest',
-        responses: { 200: { description: 'The canceled Zone key request.' } },
-        summary: 'Cancel Zone key request',
-        tags: ['Zone Key Requests'],
-      }),
-      async (c) => {
-        const request = await ZoneKeyRequests.cancel(Db.get(c.get('db')), c.req.valid('param').id)
-        if (!request)
-          return Response.error(c, {
-            code: 'not_found',
-            message: 'Pending request not found.',
-            status: 404,
-          })
-        return c.json(request, 200)
-      },
-    )
-}

package/src/internal/ZoneKeyApproval.test.ts

@@ -1,46 +0,0 @@
-import * as ZoneKeyApproval from './ZoneKeyApproval.js'
-
-describe('required', () => {
-  test('covers wildcard and per-zone read access without blocking unrelated scopes', () => {
-    expect([
-      ZoneKeyApproval.required(['*']),
-      ZoneKeyApproval.required(['zone:421700001:read']),
-      ZoneKeyApproval.required(['data:read', 'zone:424310001:read']),
-      ZoneKeyApproval.required(['data:read']),
-      ZoneKeyApproval.required(['zone:421700001:write']),
-      ZoneKeyApproval.required(['zone:read']),
-      ZoneKeyApproval.required([]),
-    ]).toMatchInlineSnapshot(`
-      [
-        true,
-        true,
-        true,
-        false,
-        false,
-        false,
-        false,
-      ]
-    `)
-  })
-})
-
-describe('active', () => {
-  test('rejects absent, expired, malformed, or incomplete session identities', () => {
-    const member = {
-      email: 'staff@tempo.xyz',
-      eligible: false,
-      expiresAt: new Date(Date.now() + 60_000).toISOString(),
-      id: 'employee_staff',
-    }
-    expect(ZoneKeyApproval.active(member)).toBe(true)
-    for (const value of [
-      null,
-      undefined,
-      { ...member, expiresAt: new Date().toISOString() },
-      { ...member, expiresAt: 'invalid' },
-      { ...member, id: '' },
-      { ...member, email: '' },
-    ])
-      expect(ZoneKeyApproval.active(value)).toBe(false)
-  })
-})