Perfect_Python500/MineGeo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add developer API, Prometheus metrics, and community links

Browse Source
This commit is contained in:
perfect_python500
2026-10-12 19:59:37 +05:00
parent 3cc3136762
commit 018be5049e
50 changed files with 4087 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files

127
scripts/test-developer-keys-sql.mjs Normal file
View File

@@ -0,0 +1,127 @@
import assert from "node:assert/strict";
import { readFile, readdir } from "node:fs/promises";
import { PGlite } from "../.data/sql-verification/node_modules/@electric-sql/pglite/dist/index.js";
const db = new PGlite();
const owner = "00000000-0000-4000-8000-000000000001";
const other = "00000000-0000-4000-8000-000000000002";
const deleted = "00000000-0000-4000-8000-000000000003";
const hash = (i) => i.toString(16).padStart(64, "0");
const rpc = async (sql, args = []) => (await db.query(sql, args)).rows[0].value;
const create = (i, account = owner, scopes = ["maps:read"], days = 30) =>
rpc("select public.developer_key_create($1,$2,$3,$4,$5,$6) value", [
account, `Key ${i}`, scopes, hash(i), `mgdev_${i.toString().padStart(8, "0")}`, days,
]);
const consume = (i) => rpc("select public.developer_key_consume($1) value", [hash(i)]);
try {
await db.exec(`create role anon; create role authenticated; create role service_role bypassrls;
create schema auth; create table auth.users(id uuid primary key);
create function auth.uid() returns uuid language sql as $$select null::uuid$$;
create schema storage; create table storage.buckets(id text primary key,name text,public boolean,file_size_limit bigint);`);
for (const file of (await readdir("supabase/migrations")).filter((f) => f.endsWith(".sql")).sort())
await db.exec(await readFile(`supabase/migrations/${file}`, "utf8"));
await db.exec("grant select,insert,update,delete on all tables in schema public to service_role;");
await db.query("insert into auth.users values($1),($2),($3)", [owner, other, deleted]);
await db.query("insert into public.profiles(id,role) values($1,'contributor'),($2,'admin'),($3,'contributor')", [owner, other, deleted]);
// Browser Supabase sessions cannot call RPCs or read hashes/quotas directly.
for (const role of ["anon", "authenticated"]) {
await db.exec(`set role ${role}`);
for (const sql of [
"select token_hash from public.developer_api_keys",
"select * from public.developer_api_owner_limits",
`select public.developer_keys_list('${owner}')`,
`select public.developer_key_create('${owner}','forged',array['maps:read'],'${hash(1)}','mgdev_test1234',30)`,
`select public.developer_key_revoke('${owner}','${other}')`,
`select public.developer_key_consume('${hash(1)}')`,
]) await assert.rejects(db.query(sql), /permission denied/);
await db.exec("reset role");
}
await db.exec("set role service_role");
assert.deepEqual(await rpc("select public.developer_keys_list($1) value", [owner]), []);
for (const scopes of [[], ["admin"], ["maps:read", null], ["account:write"], ["maps:read", "maps:read", "maps:read", "maps:read", "maps:read"]])
await assert.rejects(create(1, owner, scopes), /Invalid API key scopes/);
for (const days of [0, 366, null]) await assert.rejects(create(1, owner, ["maps:read"], days), /Invalid API key settings/);
await assert.rejects(create(1, null), /Account required/);
const first = await create(1, owner, ["maps:read", "account:read", "maps:read"]);
assert.deepEqual(first.scopes, ["account:read", "maps:read"]);
assert.equal(first.name, "Key 1");
assert.ok(!JSON.stringify(first).includes(hash(1)));
for (let i = 2; i <= 5; i++) await create(i);
await assert.rejects(create(6), (error) => error.code === "22023" && error.message === "Maximum 5 active API keys");
const otherKey = await create(10, other);
assert.equal((await rpc("select public.developer_keys_list($1) value", [owner])).length, 5);
assert.equal((await rpc("select public.developer_keys_list($1) value", [other])).length, 1);
assert.equal(await rpc("select public.developer_key_revoke($1,$2) value", [other, first.id]), false);
assert.equal((await consume(1)).ok, true);
assert.equal(await rpc("select public.developer_key_revoke($1,$2) value", [owner, first.id]), true);
assert.deepEqual(await consume(1), {ok: false, error: "invalid_key"});
await create(6);
await db.query("update public.developer_api_keys set expires_at=clock_timestamp()-interval '1 second' where token_hash=$1", [hash(6)]);
assert.deepEqual(await consume(6), {ok: false, error: "invalid_key"});
await create(7);
for (const token of [null, "not-a-hash", hash(999)])
assert.deepEqual(await rpc("select public.developer_key_consume($1) value", [token]), {ok:false,error:"invalid_key"});
// Reset fixtures to the current minute before checking precise quota boundaries.
await db.exec("update public.developer_api_keys set rate_window=null,rate_count=0; delete from public.developer_api_owner_limits");
for (let n = 1; n <= 60; n++) {
const result = await consume(2);
assert.equal(result.ok, true);
assert.equal(result.remaining, 60 - n);
}
const limited = await consume(2);
assert.equal(limited.error, "rate_limited");
assert.equal(limited.remaining, 0);
assert.ok(limited.resetAt > Date.now() / 1000);
for (const i of [3, 4]) for (let n = 0; n < 60; n++) assert.equal((await consume(i)).ok, true);
const ownerLimited = await consume(5);
assert.equal(ownerLimited.error, "rate_limited");
assert.equal(ownerLimited.ownerRemaining, 0);
assert.equal((await consume(10)).ok, true, "Another owner has an independent quota");
const stored = (await db.query("select rate_count from public.developer_api_keys where token_hash=$1", [hash(5)])).rows[0];
assert.equal(stored.rate_count, 0, "Rejected requests do not consume quota");
await db.exec("update public.developer_api_keys set rate_window=date_trunc('minute',clock_timestamp())-interval '1 minute'; update public.developer_api_owner_limits set rate_window=date_trunc('minute',clock_timestamp())-interval '1 minute'");
const nextWindow = await consume(2);
assert.equal(nextWindow.ok, true);
assert.equal(nextWindow.remaining, 59);
assert.equal(nextWindow.ownerRemaining, 179);
assert.ok((await rpc("select public.developer_keys_list($1) value", [owner])).find((k) => k.id === first.id).revokedAt);
assert.ok((await rpc("select public.developer_keys_list($1) value", [owner])).find((k) => k.name === "Key 2").lastUsedAt);
// History stays bounded without losing an older but still active key.
await db.query("update public.developer_api_keys set created_at=clock_timestamp()-interval '2 years' where token_hash=$1", [hash(2)]);
await db.query(`insert into public.developer_api_keys(owner_id,name,prefix,token_hash,scopes,created_at,expires_at,revoked_at)
select $1,'History '||n,'mgdev_history',lpad(to_hex(n),64,'0'),array['maps:read'],
clock_timestamp()-make_interval(secs=>n),clock_timestamp()+interval '1 day',clock_timestamp()
from generate_series(1000,1119) n`, [owner]);
const bounded = await rpc("select public.developer_keys_list($1) value", [owner]);
assert.equal(bounded.length, 100);
assert.deepEqual(new Set(bounded.slice(0,5).map((k) => k.name)), new Set(["Key 2","Key 3","Key 4","Key 5","Key 7"]));
assert.equal(bounded[4].name, "Key 2");
assert.ok(bounded.slice(5).every((k) => k.revokedAt || Date.parse(k.expiresAt) <= Date.now()));
assert.ok(bounded.every((k) => !Object.hasOwn(k,"token_hash") && !Object.hasOwn(k,"tokenHash") && !Object.hasOwn(k,"rate_count")));
// PGlite queues these invocations on one connection. This checks burst
// boundaries; true multi-connection locking is provided by FOR UPDATE in SQL.
const creationBurst = await Promise.allSettled(Array.from({length:6},(_,n) => create(20+n,deleted)));
assert.equal(creationBurst.filter((result) => result.status === "fulfilled").length, 5);
assert.equal(creationBurst.filter((result) => result.status === "rejected" && result.reason.code === "22023").length, 1);
const quotaBurst = await Promise.all(Array.from({length:70},() => consume(20)));
assert.equal(quotaBurst.filter((result) => result.ok).length, 60);
assert.equal(quotaBurst.filter((result) => result.error === "rate_limited").length, 10);
await db.exec("reset role");
await db.query("delete from auth.users where id=$1", [deleted]);
await db.exec("set role service_role");
assert.deepEqual(await consume(20), {ok:false,error:"invalid_key"});
await assert.rejects(create(21, deleted), /Account required/);
await db.exec("reset role");
await db.query("delete from public.profiles where id=$1", [other]);
assert.equal((await db.query("select count(*) n from public.developer_api_keys where id=$1", [otherKey.id])).rows[0].n, 0);
await db.exec("set role service_role");
assert.deepEqual(await consume(10), {ok:false,error:"invalid_key"});
console.log("Developer API SQL checks passed: restricted grants, validation, scope canonicalization, owner isolation, five-key cap, expiry, revocation, deleted accounts, per-key 60/min, shared-owner 180/min, rollover, bounded active-first metadata, queued burst boundaries.");
} finally {
await db.close();
}