79 lines
2.7 KiB
TypeScript
79 lines
2.7 KiB
TypeScript
|
import { createHash, randomBytes } from "crypto"
|
||
|
|
import { eq } from "drizzle-orm"
|
||
|
|
import { db } from "@/lib/db"
|
||
|
|
import { api_keys } from "@/lib/db/schema"
|
||
|
|
import { getAccountContext } from "@/lib/account"
|
||
|
|
|
||
|
|
// ============================================================================
|
||
|
|
// Public API authentication (Bearer API keys for /api/v1).
|
||
|
|
//
|
||
|
|
// Keys look like `pmn_live_<48 hex chars>`. We persist ONLY the SHA-256 hash;
|
||
|
|
// the plaintext is returned once at creation and never stored. Lookups hash the
|
||
|
|
// presented token and match on the unique key_hash column.
|
||
|
|
// ============================================================================
|
||
|
|
|
||
|
|
const KEY_PREFIX = "pmn_live_"
|
||
|
|
|
||
|
|
/** Generate a new API key. Returns the one-time plaintext plus what to store. */
|
||
|
|
export function generateApiKey(): { plaintext: string; hash: string; prefix: string } {
|
||
|
|
const secret = randomBytes(24).toString("hex") // 48 hex chars
|
||
|
|
const plaintext = `${KEY_PREFIX}${secret}`
|
||
|
|
return {
|
||
|
|
plaintext,
|
||
|
|
hash: hashApiKey(plaintext),
|
||
|
|
// Non-secret display identifier, e.g. "pmn_live_ab12cd34…"
|
||
|
|
prefix: `${KEY_PREFIX}${secret.slice(0, 8)}…`,
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
export function hashApiKey(key: string): string {
|
||
|
|
return createHash("sha256").update(key).digest("hex")
|
||
|
|
}
|
||
|
|
|
||
|
|
/** Extract a Bearer token from the Authorization header, or null. */
|
||
|
|
function bearerToken(request: Request): string | null {
|
||
|
|
const header = request.headers.get("authorization") ?? ""
|
||
|
|
const m = /^Bearer\s+(.+)$/i.exec(header.trim())
|
||
|
|
const token = m?.[1]?.trim()
|
||
|
|
return token ? token : null
|
||
|
|
}
|
||
|
|
|
||
|
|
export type ApiContext = {
|
||
|
|
/** The user the API key belongs to. */
|
||
|
|
userId: string
|
||
|
|
/** Whose portfolio to scope data by (team-aware). */
|
||
|
|
ownerId: string
|
||
|
|
/** False for viewer-role memberships. */
|
||
|
|
canWrite: boolean
|
||
|
|
}
|
||
|
|
|
||
|
|
/**
|
||
|
|
* Resolve an incoming API request to its account context, or null if the
|
||
|
|
* Bearer key is missing/invalid/revoked. Also best-effort stamps last_used_at.
|
||
|
|
* Data queries MUST scope by the returned `ownerId`, mirroring the session
|
||
|
|
* routes' use of getEffectiveOwnerId.
|
||
|
|
*/
|
||
|
|
export async function resolveApiRequest(request: Request): Promise<ApiContext | null> {
|
||
|
|
const token = bearerToken(request)
|
||
|
|
if (!token) return null
|
||
|
|
|
||
|
|
const row = await db.query.api_keys.findFirst({
|
||
|
|
where: eq(api_keys.key_hash, hashApiKey(token)),
|
||
|
|
columns: { id: true, user_id: true, revoked_at: true },
|
||
|
|
})
|
||
|
|
if (!row || row.revoked_at) return null
|
||
|
|
|
||
|
|
// Best-effort usage timestamp; never block the request on it.
|
||
|
|
try {
|
||
|
|
await db
|
||
|
|
.update(api_keys)
|
||
|
|
.set({ last_used_at: new Date().toISOString() })
|
||
|
|
.where(eq(api_keys.id, row.id))
|
||
|
|
} catch {
|
||
|
|
/* ignore */
|
||
|
|
}
|
||
|
|
|
||
|
|
const ctx = await getAccountContext(row.user_id)
|
||
|
|
return { userId: row.user_id, ownerId: ctx.ownerId, canWrite: ctx.canWrite }
|
||
|
|
}
|