tapimo 0.4.1 → 0.4.3

package/src/db/tables/projects.ts

@@ -81,6 +81,53 @@ export function listByOrg(db: Db.Db, orgId: string): Promise<Record[]> {
     .execute()
 }
 
+/**
+ * Lists a bounded page of an organization's projects, newest first.
+ *
+ * @param db - The database.
+ * @param orgId - The organization id.
+ * @param options - Keyset and page-size options.
+ * @returns At most `limit + 1` rows for next-cursor derivation.
+ */
+export function listByOrgPage(
+  db: Db.Db,
+  orgId: string,
+  options: listByOrgPage.Options,
+): Promise<Record[]> {
+  const cursor = options.cursor
+  let query = db.kysely.selectFrom('projects').selectAll().where('orgId', '=', orgId)
+  if (cursor)
+    query = query.where((eb) =>
+      eb.or([
+        eb('createdAt', '<', cursor.createdAt),
+        eb.and([eb('createdAt', '=', cursor.createdAt), eb('id', '<', cursor.id)]),
+      ]),
+    )
+  return query
+    .orderBy('createdAt', 'desc')
+    .orderBy('id', 'desc')
+    .limit(options.limit + 1)
+    .execute()
+}
+
+export declare namespace listByOrgPage {
+  /** Cursor fields for the last project on the previous page. */
+  type Cursor = {
+    /** Project creation time. */
+    createdAt: string
+    /** Project id, used as a deterministic tie-breaker. */
+    id: string
+  }
+
+  /** Options for {@link listByOrgPage}. */
+  type Options = {
+    /** Last project returned by the previous page. */
+    cursor?: Cursor | undefined
+    /** Requested page size. */
+    limit: number
+  }
+}
+
 /**
  * Renames a project, bumping `updatedAt`.
  *

package/src/db/tables/webhookDeliveries.ts

@@ -10,6 +10,12 @@ export type Table = db_Schema.WebhookDelivery
 /** A stored webhook-delivery row. */
 export type Record = Selectable<Table>
 
+/** A failed delivery joined to its organization-owned subscription. */
+export type OrganizationFailure = Pick<
+  Record,
+  'attempt' | 'createdAt' | 'error' | 'id' | 'responseStatus' | 'subscriptionId'
+>
+
 /** Maps a stored row to the domain delivery (null columns → absent fields). */
 export function toDelivery(row: Record): Webhooks.Delivery {
   return {
@@ -85,6 +91,83 @@ export async function list(
   return (await query.execute()).map(toDelivery)
 }
 
+/** Lists recent failed webhook deliveries across an organization. */
+export function listFailuresByOrg(
+  db: Db.Db,
+  orgId: string,
+  options: listFailuresByOrg.Options,
+): Promise<OrganizationFailure[]> {
+  return db.kysely
+    .selectFrom('webhook_deliveries')
+    .innerJoin(
+      'webhook_subscriptions',
+      'webhook_subscriptions.id',
+      'webhook_deliveries.subscriptionId',
+    )
+    .select([
+      'webhook_deliveries.attempt',
+      'webhook_deliveries.createdAt',
+      'webhook_deliveries.error',
+      'webhook_deliveries.id',
+      'webhook_deliveries.responseStatus',
+      'webhook_deliveries.subscriptionId',
+    ])
+    .where('webhook_subscriptions.ownerId', '=', orgId)
+    .where('webhook_subscriptions.ownerType', '=', 'api_key')
+    .where('webhook_deliveries.createdAt', '>=', options.from)
+    .where('webhook_deliveries.expiresAt', '>', options.now)
+    .where('webhook_deliveries.status', '=', 'failed')
+    .orderBy('webhook_deliveries.createdAt', 'desc')
+    .orderBy('webhook_deliveries.id', 'desc')
+    .limit(options.limit)
+    .execute()
+}
+
+export declare namespace listFailuresByOrg {
+  /** Bounds for the organization failure scan. */
+  type Options = {
+    /** Window start (ISO 8601), inclusive. */
+    from: string
+    /** Maximum failures to return. */
+    limit: number
+    /** ISO timestamp retention is evaluated against. */
+    now: string
+  }
+}
+
+/** Counts failed webhook deliveries across an organization in a time window. */
+export async function countFailuresByOrg(
+  db: Db.Db,
+  orgId: string,
+  options: countFailuresByOrg.Options,
+): Promise<number> {
+  const row = await db.kysely
+    .selectFrom('webhook_deliveries')
+    .innerJoin(
+      'webhook_subscriptions',
+      'webhook_subscriptions.id',
+      'webhook_deliveries.subscriptionId',
+    )
+    .select((eb) => eb.fn.countAll().as('count'))
+    .where('webhook_subscriptions.ownerId', '=', orgId)
+    .where('webhook_subscriptions.ownerType', '=', 'api_key')
+    .where('webhook_deliveries.createdAt', '>=', options.from)
+    .where('webhook_deliveries.expiresAt', '>', options.now)
+    .where('webhook_deliveries.status', '=', 'failed')
+    .executeTakeFirstOrThrow()
+  return Number(row.count)
+}
+
+export declare namespace countFailuresByOrg {
+  /** Bounds for the organization failure count. */
+  type Options = {
+    /** Window start (ISO 8601), inclusive. */
+    from: string
+    /** ISO timestamp retention is evaluated against. */
+    now: string
+  }
+}
+
 export declare namespace list {
   /** Options for {@link list}. */
   type Options = {

package/src/internal/Auth.test.ts

@@ -1,8 +1,13 @@
-import { Hono } from 'hono'
+import { Hono, type Context } from 'hono'
 import { requestId } from 'hono/request-id'
 import { Mppx, tempo } from 'mppx/hono'
 import { RateLimit } from 'tapimo'
 import * as ApiKey from '../ApiKey.js'
+import type * as Db from '../db/Db.js'
+import * as Memberships from '../db/tables/memberships.js'
+import * as Organizations from '../db/tables/organizations.js'
+import * as Projects from '../db/tables/projects.js'
+import * as Users from '../db/tables/users.js'
 import * as Auth from './Auth.js'
 import * as Log from './Log.js'
 import * as Scope from '../Scope.js'
@@ -75,12 +80,13 @@ describe('require', () => {
       `)
     })
 
-    test('accepts API key from deprecated key query param', async () => {
+    test('accepts API key from key query param', async () => {
       const app = createApp()
       const response = await app.request(`/protected?key=${token}`)
       const body = await response.json()
 
       expect(response.status).toMatchInlineSnapshot(`200`)
+      expect(response.headers.get('cache-control')).toMatchInlineSnapshot(`"private"`)
       expect(body).toMatchInlineSnapshot(`
         {
           "id": "key_test",
@@ -90,11 +96,30 @@ describe('require', () => {
       `)
     })
 
-    test('strips the deprecated key query param before route validation', async () => {
-      // Regression: route query schemas are strict (`z.strictObject`), so the
-      // `key` auth param must be removed from the URL once consumed — otherwise
-      // the downstream validator rejects it as `query_invalid` and the legacy
-      // `?key=...` lane breaks on every strict-query endpoint.
+    test('keeps query-authenticated responses private after downstream caching', async () => {
+      const auth = {
+        apiKey: { resolve: TestApp.resolver({ keys: [{ ...key, token }] }) },
+        rateLimit: RateLimit.memory(),
+      }
+      const app = new Hono<Auth.Environment>()
+      app.use('*', async (c, next) => {
+        c.set('auth', auth)
+        await next()
+      })
+      app.use('/cached', Auth.require({ apiKey: { scopes: ['data:read'] } }))
+      app.get('/cached', (c) => {
+        c.header('Cache-Control', 'public, max-age=86400')
+        return c.json({ ok: true })
+      })
+
+      const response = await app.request(`/cached?key=${token}`)
+
+      expect(response.status).toMatchInlineSnapshot(`200`)
+      expect(response.headers.get('cache-control')).toMatchInlineSnapshot(`"private"`)
+    })
+
+    test('strips the key query param before route validation', async () => {
+      // Auth owns `key`, so strict route schemas must not see it.
       const auth = {
         apiKey: { resolve: TestApp.resolver({ keys: [{ ...key, token }] }) },
         rateLimit: RateLimit.memory(),
@@ -1298,6 +1323,87 @@ describe('require', () => {
   })
 })
 
+describe('ensureProject', () => {
+  test('authorizes a flat project route against the API key organization', async () => {
+    const db = TestApp.database()
+    const organization = await Organizations.create(db, { id: key.orgId, name: 'Test org' })
+    const project = await Projects.create(db, { name: 'Test project', orgId: organization.id })
+    const response = await createProjectGuardApp(db, apiKeyPrincipal(organization.id)).request(
+      `/v1/projects/${project.id}/resource`,
+    )
+
+    expect(response.status).toMatchInlineSnapshot(`200`)
+    expect(await response.json()).toEqual({
+      membership: null,
+      orgId: organization.id,
+      projectId: project.id,
+    })
+  })
+
+  test('hides a flat project from an API key in another organization', async () => {
+    const db = TestApp.database()
+    const organization = await Organizations.create(db, { id: key.orgId, name: 'Test org' })
+    const project = await Projects.create(db, { name: 'Test project', orgId: organization.id })
+    const response = await createProjectGuardApp(db, apiKeyPrincipal('org_foreign')).request(
+      `/v1/projects/${project.id}/resource`,
+    )
+
+    expect(response.status).toMatchInlineSnapshot(`404`)
+    expect(await response.json()).toMatchInlineSnapshot(`
+      {
+        "error": {
+          "code": "project_not_found",
+          "message": "Project not found",
+        },
+      }
+    `)
+  })
+
+  test('resolves session membership for a flat project route', async () => {
+    const db = TestApp.database()
+    const user = await Users.upsertByAddress(db, {
+      address: '0x0000000000000000000000000000000000000001',
+    })
+    const organization = await Organizations.create(db, { name: 'Test org' })
+    await Memberships.create(db, { orgId: organization.id, role: 'member', userId: user.id })
+    const project = await Projects.create(db, { name: 'Test project', orgId: organization.id })
+    const response = await createProjectGuardApp(db, sessionPrincipal(user.id)).request(
+      `/v1/projects/${project.id}/resource`,
+    )
+    const body = (await response.json()) as Record<string, unknown>
+
+    expect(response.status).toMatchInlineSnapshot(`200`)
+    expect(body).toEqual({
+      membership: 'member',
+      orgId: organization.id,
+      projectId: project.id,
+    })
+  })
+
+  test('preserves nested organization role authorization', async () => {
+    const db = TestApp.database()
+    const user = await Users.upsertByAddress(db, {
+      address: '0x0000000000000000000000000000000000000001',
+    })
+    const organization = await Organizations.create(db, { name: 'Test org' })
+    await Memberships.create(db, { orgId: organization.id, role: 'member', userId: user.id })
+    const project = await Projects.create(db, { name: 'Test project', orgId: organization.id })
+    const response = await createNestedProjectGuardApp(db, sessionPrincipal(user.id)).request(
+      `/v1/orgs/${organization.id}/projects/${project.id}/resource`,
+    )
+
+    expect(response.status).toMatchInlineSnapshot(`403`)
+    expect(await response.json()).toMatchInlineSnapshot(`
+      {
+        "error": {
+          "code": "forbidden",
+          "message": "Requires the admin role",
+        },
+      }
+    `)
+  })
+})
+
 function createScopedApp(options: {
   auth?: Auth.Context | undefined
   routes: readonly { path: string; policy: Auth.require.Policy }[]
@@ -1322,6 +1428,67 @@ function createScopedApp(options: {
   return app
 }
 
+type GuardEnvironment = {
+  Variables: Auth.Variables & { db: Db.Source }
+}
+
+function createProjectGuardApp(db: Db.Source, principal: Auth.Principal) {
+  const app = new Hono<GuardEnvironment>()
+  app.use('*', async (c, next) => {
+    c.set('db', db)
+    c.set('principal', principal)
+    await next()
+  })
+  app.get('/v1/projects/:projectId/resource', Auth.ensureProject(), projectGuardHandler)
+  return app
+}
+
+function createNestedProjectGuardApp(db: Db.Source, principal: Auth.Principal) {
+  const app = new Hono<GuardEnvironment>()
+  app.use('*', async (c, next) => {
+    c.set('db', db)
+    c.set('principal', principal)
+    await next()
+  })
+  app.get(
+    '/v1/orgs/:orgId/projects/:projectId/resource',
+    Auth.ensureOrg({ role: 'admin' }),
+    Auth.ensureProject(),
+    projectGuardHandler,
+  )
+  return app
+}
+
+function projectGuardHandler(c: Context<GuardEnvironment>) {
+  return c.json({
+    membership: Auth.membership(c)?.role ?? null,
+    orgId: Auth.org(c).id,
+    projectId: Auth.project(c).id,
+  })
+}
+
+function apiKeyPrincipal(orgId: string): Auth.Principal {
+  const apiKey = { ...key, orgId }
+  return {
+    apiKey,
+    environment: apiKey.environment,
+    id: apiKey.id,
+    orgId,
+    type: 'api_key',
+  }
+}
+
+function sessionPrincipal(id: string): Auth.Principal {
+  return {
+    id,
+    identity: {
+      provider: 'wallet',
+      subject: '0x0000000000000000000000000000000000000001',
+    },
+    type: 'session',
+  }
+}
+
 type Options = {
   auth?: Auth.Context | undefined
   logger?: Log.Emit | undefined