tapimo 0.19.0 → 0.20.0

package/src/ApiKeys.test.ts

@@ -1,14 +1,15 @@
 import { sql } from 'kysely'
 
+import * as ApiKey from './ApiKey.js'
 import * as ApiKeys from './ApiKeys.js'
 import * as ApiKeyAdmissions from './db/tables/apiKeyAdmissions.js'
 import * as ApiKeyOwnerTombstones from './db/tables/apiKeyOwnerTombstones.js'
 import * as ApiKeyRevocations from './db/tables/apiKeyRevocations.js'
 import * as Organizations from './db/tables/organizations.js'
+import * as ZoneDelegations from './db/tables/zoneDelegations.js'
 import * as Projects from './db/tables/projects.js'
 import * as RoutesPolicies from './db/tables/routesPolicies.js'
 import * as Store from './internal/Store.js'
-import * as ZoneKeyApproval from './internal/ZoneKeyApproval.js'
 import * as Scope from './Scope.js'
 import * as TestApp from '../test/App.js'
 
@@ -188,14 +189,25 @@ describe('mint', () => {
     ).rejects.toThrowError(/invalid API key input/)
   })
 
-  test('mints per-zone read and write scopes', async () => {
+  test('refuses fresh per-zone write scopes while stored ones still resolve and rotate', async () => {
     const state = Store.memory()
-    const { token } = await ApiKeys.mint(state, {
-      orgId: 'org_a',
-      scopes: ['zone:421700001:read', 'zone:421700001:write'],
-    })
-    const resolved = await ApiKeys.resolve(state, token)
-    expect(resolved?.scopes).toEqual(['zone:421700001:read', 'zone:421700001:write'])
+    await expect(
+      ApiKeys.mint(state, { orgId: 'org_a', scopes: ['zone:read', 'zone:421700001:write'] }),
+    ).rejects.toThrowErrorMatchingInlineSnapshot(
+      `[ApiKeys.InvalidInputError: invalid API key input: per-Zone scopes are retired; grant zone:read or zone:write with zoneTags]`,
+    )
+    const token = 'secret_legacy_writer'
+    await state.put(
+      ApiKey.keyFor(token),
+      JSON.stringify({ createdAt: '2026-01-01T00:00:00.000Z', environment: 'production', id: 'key_writer', orgId: 'org_a', scopes: ['zone:421700001:write'], tokenLast4: 'iter' }), // prettier-ignore
+    )
+    await state.put('apikey_id:key_writer', ApiKey.keyFor(token))
+    expect((await ApiKeys.resolve(state, token))?.scopes).toEqual(['zone:421700001:write'])
+    // A stored scope may be republished unchanged, never granted anew.
+    expect((await ApiKeys.update(state, 'key_writer', { scopes: ['zone:421700001:write'] }))?.scopes).toEqual(['zone:421700001:write']) // prettier-ignore
+    await expect(
+      ApiKeys.update(state, 'key_writer', { scopes: ['zone:421700001:write', 'zone:421700002:write'] }), // prettier-ignore
+    ).rejects.toBeInstanceOf(ApiKeys.InvalidInputError)
   })
 
   test('rejects malformed zone scopes', async () => {
@@ -999,6 +1011,27 @@ describe('mintBounded', () => {
 })
 
 describe('mint', () => {
+  test('refuses retired per-Zone read scopes on fresh grants while stored ones republish', async () => {
+    const state = Store.memory()
+    await expect(
+      ApiKeys.mint(state, { scopes: ['data:read', 'zone:421700001:read'] }),
+    ).rejects.toThrowErrorMatchingInlineSnapshot(
+      `[ApiKeys.InvalidInputError: invalid API key input: per-Zone scopes are retired; grant zone:read or zone:write with zoneTags]`,
+    )
+    const token = 'secret_legacy_reader'
+    await state.put(
+      ApiKey.keyFor(token),
+      JSON.stringify({ createdAt: '2026-01-01T00:00:00.000Z', environment: 'production', id: 'key_legacy', orgId: 'org_legacy', scopes: ['zone:421700001:read', 'zone:read'], tokenLast4: 'ader', zoneTags: [421700001] }), // prettier-ignore
+    )
+    await ApiKeys.backfill(state)
+    // Scopes the record already holds republish; a new retired scope is refused.
+    expect((await ApiKeys.update(state, 'key_legacy', { name: 'Renamed', scopes: ['zone:421700001:read', 'zone:read'] }))?.scopes).toEqual(['zone:421700001:read', 'zone:read']) // prettier-ignore
+    await expect(ApiKeys.update(state, 'key_legacy', { scopes: ['zone:421700001:read', 'zone:421700002:read', 'zone:read'] })).rejects.toThrow(ApiKeys.InvalidInputError) // prettier-ignore
+    // The plain update republishes the record; the bounded reassignment drops the inert scope (admin api-keys test).
+    expect((await ApiKeys.update(state, 'key_legacy', { orgId: 'org_next' }))?.scopes).toEqual(['zone:421700001:read', 'zone:read']) // prettier-ignore
+    expect(await ApiKeys.resolve(state, token)).toMatchObject({ orgId: 'org_next', zoneTags: [421700001] }) // prettier-ignore
+  })
+
   test('stores deduplicated Zone tags', async () => {
     const state = Store.memory()
     const { record, token } = await ApiKeys.mint(state, {
@@ -1031,17 +1064,37 @@ describe('rotateBounded', () => {
     expect(record).toMatchObject({ allowedIps: ['203.0.113.0/24'], zoneTags: [421700001] })
   })
 
-  test('replaces a Zone read key with the same scopes without approval', async () => {
+  test('narrows a broadcasting copy to the tags still delegated instead of refusing the rotation', async () => {
+    const db = TestApp.database()
+    const state = Store.memory()
+    const org = await Organizations.create(db, { name: 'Zone revoke' })
+    await TestApp.delegateZone(db, { chainIds: [421700001, 421700002], orgId: org.id })
+    const { record: source } = await ApiKeys.mintBounded(db, state, {
+      orgId: org.id,
+      scopes: ['zone:write'],
+      zoneTags: [421700001, 421700002],
+    })
+    const [revoked] = (await ZoneDelegations.listActive(db, { environment: 'production', orgId: org.id })).filter((row) => row.chainId === 421700002) // prettier-ignore
+    await ZoneDelegations.revoke(db, revoked!.id)
+    // One revoked Zone drops out of the copy; the other keeps broadcasting.
+    const { record } = await ApiKeys.rotateBounded(db, state, { orgId: org.id, scopes: source.scopes }, { policySourceApiKeyId: source.id }) // prettier-ignore
+    expect(record).toMatchObject({ scopes: ['zone:write'], zoneTags: [421700001] })
+    // With every delegation gone the copy carries no tags, so it broadcasts nowhere until retagged.
+    for (const row of await ZoneDelegations.listActive(db, { environment: 'production', orgId: org.id })) await ZoneDelegations.revoke(db, row.id) // prettier-ignore
+    const { record: bare } = await ApiKeys.rotateBounded(db, state, { orgId: org.id, scopes: record.scopes }, { policySourceApiKeyId: record.id }) // prettier-ignore
+    expect(bare.scopes).toEqual(['zone:write'])
+    expect(bare).not.toHaveProperty('zoneTags')
+  })
+
+  test('replaces a Zone read key with the same scopes', async () => {
     const db = TestApp.database()
     const state = Store.memory()
     const org = await Organizations.create(db, { name: 'Zone rotation' })
     const { record: source } = await ApiKeys.mint(state, {
       orgId: org.id,
-      scopes: ['zone:421700001:read', 'data:read'],
+      scopes: ['zone:read', 'data:read'],
+      zoneTags: [421700001],
     })
-    await expect(
-      ApiKeys.mintBounded(db, state, { orgId: org.id, scopes: source.scopes }),
-    ).rejects.toBeInstanceOf(ZoneKeyApproval.RequiredError)
 
     const { record } = await ApiKeys.rotateBounded(
       db,
@@ -1062,13 +1115,14 @@ describe('rotateBounded', () => {
     const org = await Organizations.create(db, { name: 'Zone widening' })
     const { record: source } = await ApiKeys.mint(state, {
       orgId: org.id,
-      scopes: ['zone:421700001:read'],
+      scopes: ['zone:read'],
+      zoneTags: [421700001],
     })
     await expect(
       ApiKeys.rotateBounded(
         db,
         state,
-        { orgId: org.id, scopes: ['zone:421700001:read', 'zone:421700002:read'] },
+        { orgId: org.id, scopes: ['zone:read', 'data:read'] },
         { policySourceApiKeyId: source.id },
       ),
     ).rejects.toBeInstanceOf(RoutesPolicies.InvalidScopeError)
@@ -1145,62 +1199,41 @@ describe('updateBounded', () => {
     expect(await ApiKeys.get(state, record.id)).not.toHaveProperty('expiresAt')
   })
 
-  test('lets a protected Zone key only move its expiry earlier without approval', async () => {
+  test('lets owners retag and re-bound a Zone read key', async () => {
     const db = TestApp.database()
     const state = Store.memory()
-    const org = await Organizations.create(db, { name: 'Zone shortening' })
+    const org = await Organizations.create(db, { name: 'Zone retag' })
     const expiresAt = new Date(Date.now() + 86_400_000).toISOString()
     const { record } = await ApiKeys.mint(state, {
       expiresAt,
       orgId: org.id,
-      scopes: ['zone:421700001:read'],
-    })
-    const gated = [
-      { expiresAt: null },
-      { expiresAt: new Date(Date.now() + 2 * 86_400_000).toISOString() },
-      { zoneTags: [421700001] },
-      { zoneTags: null },
-      { allowedIps: [] },
-    ]
-    for (const input of gated)
-      await expect(ApiKeys.updateBounded(db, state, record.id, input)).rejects.toBeInstanceOf(
-        ZoneKeyApproval.RequiredError,
-      )
+      scopes: ['zone:read'],
+      zoneTags: [421700001],
+    })
     const sooner = new Date(Date.now() + 3_600_000).toISOString()
     expect(
-      (await ApiKeys.updateBounded(db, state, record.id, { expiresAt: sooner }))?.expiresAt,
-    ).toBe(sooner)
+      await ApiKeys.updateBounded(db, state, record.id, { expiresAt: sooner, zoneTags: [421700002] }), // prettier-ignore
+    ).toMatchObject({ expiresAt: sooner, zoneTags: [421700002] })
+    expect((await ApiKeys.updateBounded(db, state, record.id, { zoneTags: null }))?.zoneTags).toBeUndefined() // prettier-ignore
   })
 
-  test('gives a self-owned protected Zone key its organization once without approval', async () => {
+  test('gives a self-owned key its organization, keeping its token and tags', async () => {
     const db = TestApp.database()
     const state = Store.memory()
     const org = await Organizations.create(db, { name: 'Zone adopter' })
-    const other = await Organizations.create(db, { name: 'Zone other' })
     // Legacy keys minted before organizations existed own themselves.
     const { record, token } = await ApiKeys.mint(state, {
       name: 'legacy',
-      scopes: ['zone:421700001:read', 'data:read'],
+      scopes: ['zone:read', 'data:read'],
+      zoneTags: [421700001],
     })
     expect(record.orgId).toBe(record.id)
-    for (const input of [
-      { orgId: org.id, zoneTags: [421700001] },
-      { orgId: org.id, name: 'x' },
-    ])
-      await expect(ApiKeys.updateBounded(db, state, record.id, input)).rejects.toBeInstanceOf(
-        ZoneKeyApproval.RequiredError,
-      )
 
     const adopted = await ApiKeys.updateBounded(db, state, record.id, { orgId: org.id })
-    expect(adopted).toMatchObject({ id: record.id, orgId: org.id, scopes: record.scopes })
+    expect(adopted).toMatchObject({ id: record.id, orgId: org.id, scopes: record.scopes, zoneTags: [421700001] }) // prettier-ignore
     expect(await ApiKeys.resolve(state, token)).toMatchObject({ id: record.id, orgId: org.id })
     expect((await ApiKeys.listByOrg(state, org.id)).map(({ id }) => id)).toEqual([record.id])
     expect(await ApiKeyAdmissions.get(db, record.id)).toMatchObject({ orgId: org.id })
-
-    // Once owned, moving it again is a reviewed change like any other edit.
-    await expect(
-      ApiKeys.updateBounded(db, state, record.id, { orgId: other.id }),
-    ).rejects.toBeInstanceOf(ZoneKeyApproval.RequiredError)
   })
 
   test('rejects null for fields that cannot be cleared and sub-minute expiries', async () => {
@@ -2383,13 +2416,13 @@ describe('update', () => {
     })
 
     const updated = await ApiKeys.update(state, record.id, {
-      scopes: ['management:read', 'zone:421700001:write'],
+      scopes: ['management:read', 'webhooks:write'],
     })
 
-    expect(updated?.scopes).toEqual(['management:read', 'zone:421700001:write'])
+    expect(updated?.scopes).toEqual(['management:read', 'webhooks:write'])
     expect((await ApiKeys.resolve(state, token))?.scopes).toEqual([
       'management:read',
-      'zone:421700001:write',
+      'webhooks:write',
     ])
   })
 
@@ -2633,3 +2666,203 @@ async function installDeferredAdmissionFailure(
   `)
     .execute(db.kysely)
 }
+
+describe('planZoneReadRewrite', () => {
+  test('adds zone:read and merged, alias-resolved tags beside per-Zone read scopes; wildcard, mixed, and invalid keys are listed', async () => {
+    const state = Store.memory()
+    const stored = async (id: string, extra: Record<string, unknown>) => {
+      const token = `secret_${id}`
+      await state.put(
+        ApiKey.keyFor(token),
+        JSON.stringify({ createdAt: '2026-01-01T00:00:00.000Z', environment: 'production', id, orgId: 'org_rewrite', tokenLast4: token.slice(-4), ...extra }), // prettier-ignore
+      )
+      return token
+    }
+    const legacy = await stored('key_legacy', { scopes: ['data:read', 'zone:1424310001:read', 'zone:421700001:read'] }) // prettier-ignore
+    // Writes to the same Zone as the reads share its tag.
+    await stored('key_both', { scopes: ['zone:421700001:read', 'zone:421700001:write'] })
+    // Tags already naming a scope's Zone merge without duplicates.
+    await stored('key_tagged', { scopes: ['zone:421700002:read', 'zone:read'], zoneTags: [421700001] }) // prettier-ignore
+    // Already in both formats: planned so its delegation is checked, never written.
+    await stored('key_done', {
+      scopes: ['zone:421700001:read', 'zone:read'],
+      zoneTags: [421700001],
+    })
+    await stored('key_wild', { scopes: ['*', 'zone:421700001:read'] })
+    await stored('key_plain', { scopes: ['data:read'] })
+    // Writes to another Zone than the reads cannot share one tag list.
+    await stored('key_mixed', { scopes: ['zone:421700001:read', 'zone:421700002:write'] })
+    // Fifty tags plus one more Zone exceeds the tag limit, so the record is reported, not rewritten.
+    await stored('key_full', { scopes: ['zone:read', 'zone:421700001:read'], zoneTags: Array.from({ length: 50 }, (_, index) => 421700100 + index) }) // prettier-ignore
+    await stored('key_revoked', { scopes: ['zone:421700003:read'] })
+    await state.put('apikey_revoked:key_revoked', '1')
+    // KV refuses a TTL under a minute; the record lapses on its own.
+    await stored('key_soon', { expiresAt: new Date(Date.now() + 30_000).toISOString(), scopes: ['zone:421700003:read'] }) // prettier-ignore
+    await stored('key_expired', { expiresAt: '2000-01-01T00:00:00.000Z', scopes: ['zone:421700003:read'] }) // prettier-ignore
+
+    const plan = await ApiKeys.planZoneReadRewrite(state)
+    expect({
+      ...plan,
+      changes: plan.changes.map(({ chainIds, complete, record, rewritten }) => ({ chainIds, complete, id: record.id, scopes: rewritten.scopes, zoneTags: rewritten.zoneTags })), // prettier-ignore
+      expiring: plan.expiring.map(({ id }) => id),
+      invalid: plan.invalid.map(({ id }) => id),
+      mixed: plan.mixed.map(({ id }) => id),
+      wildcard: plan.wildcard.map(({ id }) => id),
+    }).toMatchInlineSnapshot(`
+      {
+        "changes": [
+          {
+            "chainIds": [
+              421700001,
+            ],
+            "complete": false,
+            "id": "key_both",
+            "scopes": [
+              "zone:421700001:read",
+              "zone:421700001:write",
+              "zone:read",
+              "zone:write",
+            ],
+            "zoneTags": [
+              421700001,
+            ],
+          },
+          {
+            "chainIds": [
+              421700001,
+            ],
+            "complete": true,
+            "id": "key_done",
+            "scopes": [
+              "zone:421700001:read",
+              "zone:read",
+            ],
+            "zoneTags": [
+              421700001,
+            ],
+          },
+          {
+            "chainIds": [
+              421700001,
+              1424310003,
+            ],
+            "complete": false,
+            "id": "key_legacy",
+            "scopes": [
+              "data:read",
+              "zone:1424310001:read",
+              "zone:421700001:read",
+              "zone:read",
+            ],
+            "zoneTags": [
+              421700001,
+              1424310003,
+            ],
+          },
+          {
+            "chainIds": [
+              421700002,
+            ],
+            "complete": false,
+            "id": "key_tagged",
+            "scopes": [
+              "zone:421700002:read",
+              "zone:read",
+            ],
+            "zoneTags": [
+              421700001,
+              421700002,
+            ],
+          },
+        ],
+        "expiring": [
+          "key_soon",
+        ],
+        "invalid": [
+          "key_full",
+        ],
+        "keys": 9,
+        "mixed": [
+          "key_mixed",
+        ],
+        "tagless": [],
+        "unreadableRecords": 1,
+        "wildcard": [
+          "key_wild",
+        ],
+      }
+    `)
+
+    // key_tagged already holds zone:read; only its tag list grows.
+    expect(await ApiKeys.applyZoneReadRewrite(state, plan.changes)).toBe(3)
+    expect(await ApiKeys.resolve(state, legacy)).toMatchObject({
+      scopes: ['data:read', 'zone:1424310001:read', 'zone:421700001:read', 'zone:read'],
+      zoneTags: [421700001, 1424310003],
+    })
+    expect(await ApiKeys.resolve(state, 'secret_key_both')).toMatchObject({ scopes: ['zone:421700001:read', 'zone:421700001:write', 'zone:read', 'zone:write'], zoneTags: [421700001] }) // prettier-ignore
+    expect(await ApiKeys.resolve(state, 'secret_key_tagged')).toMatchObject({ scopes: ['zone:421700002:read', 'zone:read'], zoneTags: [421700001, 421700002] }) // prettier-ignore
+    // A rerun plans only complete records, for their delegations, and writes nothing.
+    const again = await ApiKeys.planZoneReadRewrite(state)
+    expect(again.changes.map(({ complete, record }) => [record.id, complete]).sort()).toEqual([['key_both', true], ['key_done', true], ['key_legacy', true], ['key_tagged', true]]) // prettier-ignore
+    expect(await ApiKeys.applyZoneReadRewrite(state, again.changes)).toBe(0)
+  })
+
+  test('keeps a key that reads nothing yet holds zone:read out of the write mapping', async () => {
+    const state = Store.memory()
+    // Tags would serve both verbs, so a reader with no Zones yet cannot silently gain reads from its write scope.
+    await state.put(
+      ApiKey.keyFor('secret_reader_writer'),
+      JSON.stringify({ createdAt: '2026-01-01T00:00:00.000Z', environment: 'production', id: 'key_reader_writer', orgId: 'org_rewrite', scopes: ['data:read', 'zone:read', 'zone:421700005:write'], tokenLast4: 'iter' }), // prettier-ignore
+    )
+    // A pure writer has no read scope to widen, so its Zone becomes a tag beside `zone:write`.
+    await state.put(
+      ApiKey.keyFor('secret_writer'),
+      JSON.stringify({ createdAt: '2026-01-01T00:00:00.000Z', environment: 'production', id: 'key_writer', orgId: 'org_rewrite', scopes: ['mpp:write', 'zone:421700005:write'], tokenLast4: 'iter' }), // prettier-ignore
+    )
+    // A writer with leftover tags for other Zones would broadcast to them once tagged for `zone:write`.
+    await state.put(
+      ApiKey.keyFor('secret_tagged_writer'),
+      JSON.stringify({ createdAt: '2026-01-01T00:00:00.000Z', environment: 'production', id: 'key_tagged_writer', orgId: 'org_rewrite', scopes: ['mpp:write', 'zone:421700005:write'], tokenLast4: 'iter', zoneTags: [421700007] }), // prettier-ignore
+    )
+    // A key already broadcasting through `zone:write` writes exactly its tags, so a retired read Zone must not join them.
+    await state.put(
+      ApiKey.keyFor('secret_generic_writer'),
+      JSON.stringify({ createdAt: '2026-01-01T00:00:00.000Z', environment: 'production', id: 'key_generic_writer', orgId: 'org_rewrite', scopes: ['zone:write', 'zone:421700005:read'], tokenLast4: 'iter', zoneTags: [421700007] }), // prettier-ignore
+    )
+    const plan = await ApiKeys.planZoneReadRewrite(state)
+    expect(plan.mixed.map(({ id }) => id).sort()).toEqual([
+      'key_generic_writer',
+      'key_reader_writer',
+      'key_tagged_writer',
+    ])
+    expect(plan.changes.map(({ chainIds, record, writeChainIds }) => [record.id, chainIds, writeChainIds])).toEqual([['key_writer', [], [421700005]]]) // prettier-ignore
+    expect(await ApiKeys.applyZoneReadRewrite(state, plan.changes)).toBe(1)
+    expect(await ApiKeys.resolve(state, 'secret_writer')).toMatchObject({ scopes: ['mpp:write', 'zone:421700005:write', 'zone:write'], zoneTags: [421700005] }) // prettier-ignore
+  })
+
+  test('earns no tag for Zones the deployment does not serve, and drops the tags it finds', async () => {
+    const state = Store.memory()
+    await state.put(
+      ApiKey.keyFor('secret_stale'),
+      JSON.stringify({ createdAt: '2026-01-01T00:00:00.000Z', environment: 'production', id: 'key_stale', orgId: 'org_rewrite', scopes: ['zone:421700001:read', 'zone:421700009:read'], tokenLast4: 'tale', zoneTags: [421700009] }), // prettier-ignore
+    )
+    // A stale tag beside matching read and write scopes is dropped before the verbs are compared, so the key is not mixed.
+    // Unserved Zones are dropped from tags and scopes alike before the verbs are compared, so neither key is mixed.
+    await state.put(
+      ApiKey.keyFor('secret_both_unserved'),
+      JSON.stringify({ createdAt: '2026-01-01T00:00:00.000Z', environment: 'production', id: 'key_both_unserved', orgId: 'org_rewrite', scopes: ['zone:421700001:read', 'zone:421700001:write', 'zone:421700009:write'], tokenLast4: 'tale' }), // prettier-ignore
+    )
+    await state.put(
+      ApiKey.keyFor('secret_both_stale'),
+      JSON.stringify({ createdAt: '2026-01-01T00:00:00.000Z', environment: 'production', id: 'key_both_stale', orgId: 'org_rewrite', scopes: ['zone:421700001:read', 'zone:421700001:write'], tokenLast4: 'tale', zoneTags: [421700009] }), // prettier-ignore
+    )
+    const zones = new Set([421700001])
+    const plan = await ApiKeys.planZoneReadRewrite(state, { zones })
+    expect(plan.mixed).toEqual([])
+    expect(plan.changes.map(({ chainIds, record, unconfigured }) => [record.id, chainIds, unconfigured] as const).sort(([a], [b]) => a.localeCompare(b))).toEqual([['key_both_stale', [421700001], []], ['key_both_unserved', [421700001], [421700009]], ['key_stale', [421700001], [421700009]]]) // prettier-ignore
+    expect(await ApiKeys.applyZoneReadRewrite(state, plan.changes, { zones })).toBe(3)
+    expect(await ApiKeys.resolve(state, 'secret_both_unserved')).toMatchObject({ scopes: ['zone:421700001:read', 'zone:421700001:write', 'zone:421700009:write', 'zone:read', 'zone:write'], zoneTags: [421700001] }) // prettier-ignore
+    expect(await ApiKeys.resolve(state, 'secret_stale')).toMatchObject({ scopes: ['zone:421700001:read', 'zone:421700009:read', 'zone:read'], zoneTags: [421700001] }) // prettier-ignore
+    expect(await ApiKeys.resolve(state, 'secret_both_stale')).toMatchObject({ scopes: ['zone:421700001:read', 'zone:421700001:write', 'zone:read', 'zone:write'], zoneTags: [421700001] }) // prettier-ignore
+  })
+})