Merge pull request #76 from morelucks/feature/api-keys-vaults-tables

feat: api_keys and vaults tables

Author: greatest0fallt1me

README.md

@@ -86,6 +86,32 @@ The API will be available at http://localhost:3000, and the PostgreSQL database
 | `npm start` | Run compiled `dist/index.js` |
 | `npm test` | Run unit/integration tests |
 
+## Database migrations
+
+This repository includes SQL migrations for `api_keys` and `vaults` in `migrations/`.
+
+- `api_keys` stores only `key_hash` (never the raw API key).
+- `api_keys` enforces unique `(user_id, api_id)` and has an index on `(user_id, prefix)` for key lookup.
+- `vaults` stores per-user per-network snapshots with unique `(user_id, network)`.
+
+Run migrations with PostgreSQL:
+
+```bash
+psql "$DATABASE_URL" -f migrations/0001_create_api_keys_and_vaults.up.sql
+```
+
+Rollback:
+
+```bash
+psql "$DATABASE_URL" -f migrations/0001_create_api_keys_and_vaults.down.sql
+```
+
+Validate issue #9 requirements locally:
+
+```bash
+npm run validate:issue-9
+```
+
 ## Project layout
 
 ```text

migrations/0001_create_api_keys_and_vaults.down.sql

@@ -0,0 +1,2 @@
+DROP TABLE IF EXISTS vaults;
+DROP TABLE IF EXISTS api_keys;

migrations/0001_create_api_keys_and_vaults.up.sql

@@ -0,0 +1,32 @@
+CREATE TABLE api_keys (
+  id BIGSERIAL PRIMARY KEY,
+  user_id BIGINT NOT NULL,
+  api_id BIGINT NOT NULL,
+  key_hash TEXT NOT NULL,
+  prefix VARCHAR(16) NOT NULL,
+  scopes TEXT[] NOT NULL DEFAULT '{}'::TEXT[],
+  rate_limit_per_minute INTEGER,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  last_used_at TIMESTAMPTZ,
+  CONSTRAINT api_keys_user_api_unique UNIQUE (user_id, api_id),
+  CONSTRAINT api_keys_rate_limit_positive CHECK (
+    rate_limit_per_minute IS NULL OR rate_limit_per_minute > 0
+  )
+);
+
+CREATE INDEX idx_api_keys_user_prefix ON api_keys (user_id, prefix);
+
+CREATE TABLE vaults (
+  id BIGSERIAL PRIMARY KEY,
+  user_id BIGINT NOT NULL,
+  stellar_vault_contract_id TEXT NOT NULL,
+  network VARCHAR(32) NOT NULL,
+  balance_snapshot NUMERIC(20, 7) NOT NULL DEFAULT 0,
+  last_synced_at TIMESTAMPTZ,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  CONSTRAINT vaults_user_network_unique UNIQUE (user_id, network),
+  CONSTRAINT vaults_balance_snapshot_non_negative CHECK (balance_snapshot >= 0)
+);
+
+CREATE INDEX idx_vaults_user_network ON vaults (user_id, network);

package.json

@@ -11,6 +11,8 @@
     "db:studio": "drizzle-kit studio"
     "lint": "eslint . --ext .ts",
     "typecheck": "tsc --noEmit",
+    "test": "jest --runInBand",
+    "validate:issue-9": "node scripts/validate-issue-9.mjs"
     "test": "node --import tsx --test \"src/**/*.test.ts\""
   },
   "dependencies": {

scripts/validate-issue-9.mjs

@@ -0,0 +1,54 @@
+import fs from 'node:fs';
+import path from 'node:path';
+
+const cwd = process.cwd();
+const upPath = path.join(cwd, 'migrations', '0001_create_api_keys_and_vaults.up.sql');
+const downPath = path.join(cwd, 'migrations', '0001_create_api_keys_and_vaults.down.sql');
+
+function assertMatch(sql, regex, message) {
+  if (!regex.test(sql)) {
+    throw new Error(message);
+  }
+}
+
+function assertNoMatch(sql, regex, message) {
+  if (regex.test(sql)) {
+    throw new Error(message);
+  }
+}
+
+const up = fs.readFileSync(upPath, 'utf8');
+const down = fs.readFileSync(downPath, 'utf8');
+
+assertMatch(up, /create table api_keys/i, 'api_keys table is missing');
+assertMatch(up, /\buser_id\b/i, 'api_keys.user_id is missing');
+assertMatch(up, /\bapi_id\b/i, 'api_keys.api_id is missing');
+assertMatch(up, /\bkey_hash\b/i, 'api_keys.key_hash is missing');
+assertMatch(up, /\bprefix\b/i, 'api_keys.prefix is missing');
+assertMatch(up, /\bscopes\b/i, 'api_keys.scopes is missing');
+assertMatch(up, /\brate_limit_per_minute\b/i, 'api_keys.rate_limit_per_minute is missing');
+assertMatch(up, /\bcreated_at\b/i, 'api_keys.created_at is missing');
+assertMatch(up, /\blast_used_at\b/i, 'api_keys.last_used_at is missing');
+assertMatch(up, /unique\s*\(\s*user_id\s*,\s*api_id\s*\)/i, 'api_keys unique(user_id, api_id) is missing');
+assertMatch(
+  up,
+  /create index idx_api_keys_user_prefix on api_keys\s*\(\s*user_id\s*,\s*prefix\s*\)/i,
+  'api_keys index(user_id, prefix) is missing'
+);
+assertNoMatch(up, /\bapi_key\b/i, 'raw api_key column detected');
+assertNoMatch(up, /\braw_key\b/i, 'raw_key column detected');
+
+assertMatch(up, /create table vaults/i, 'vaults table is missing');
+assertMatch(up, /\buser_id\b/i, 'vaults.user_id is missing');
+assertMatch(up, /\bstellar_vault_contract_id\b/i, 'vaults.stellar_vault_contract_id is missing');
+assertMatch(up, /\bnetwork\b/i, 'vaults.network is missing');
+assertMatch(up, /\bbalance_snapshot\b/i, 'vaults.balance_snapshot is missing');
+assertMatch(up, /\blast_synced_at\b/i, 'vaults.last_synced_at is missing');
+assertMatch(up, /\bcreated_at\b/i, 'vaults.created_at is missing');
+assertMatch(up, /\bupdated_at\b/i, 'vaults.updated_at is missing');
+assertMatch(up, /unique\s*\(\s*user_id\s*,\s*network\s*\)/i, 'vaults unique(user_id, network) is missing');
+
+assertMatch(down, /drop table if exists vaults/i, 'down migration must drop vaults');
+assertMatch(down, /drop table if exists api_keys/i, 'down migration must drop api_keys');
+
+console.log('Issue #9 migration validation passed.');

src/migrations.test.ts

@@ -0,0 +1,60 @@
+import fs from 'node:fs';
+import path from 'node:path';
+
+const migrationDir = path.join(process.cwd(), 'migrations');
+const upMigrationPath = path.join(
+  migrationDir,
+  '0001_create_api_keys_and_vaults.up.sql'
+);
+const downMigrationPath = path.join(
+  migrationDir,
+  '0001_create_api_keys_and_vaults.down.sql'
+);
+
+function read(filePath: string): string {
+  return fs.readFileSync(filePath, 'utf8');
+}
+
+describe('Issue #9 migrations', () => {
+  it('creates api_keys table with required columns and constraints', () => {
+    const sql = read(upMigrationPath);
+
+    expect(sql).toMatch(/create table api_keys/i);
+    expect(sql).toMatch(/\buser_id\b/i);
+    expect(sql).toMatch(/\bapi_id\b/i);
+    expect(sql).toMatch(/\bkey_hash\b/i);
+    expect(sql).toMatch(/\bprefix\b/i);
+    expect(sql).toMatch(/\bscopes\b/i);
+    expect(sql).toMatch(/\brate_limit_per_minute\b/i);
+    expect(sql).toMatch(/\bcreated_at\b/i);
+    expect(sql).toMatch(/\blast_used_at\b/i);
+    expect(sql).toMatch(/unique\s*\(\s*user_id\s*,\s*api_id\s*\)/i);
+    expect(sql).toMatch(
+      /create index idx_api_keys_user_prefix on api_keys\s*\(\s*user_id\s*,\s*prefix\s*\)/i
+    );
+
+    expect(sql).not.toMatch(/\bapi_key\b/i);
+    expect(sql).not.toMatch(/\braw_key\b/i);
+  });
+
+  it('creates vaults table with required columns and constraints', () => {
+    const sql = read(upMigrationPath);
+
+    expect(sql).toMatch(/create table vaults/i);
+    expect(sql).toMatch(/\buser_id\b/i);
+    expect(sql).toMatch(/\bstellar_vault_contract_id\b/i);
+    expect(sql).toMatch(/\bnetwork\b/i);
+    expect(sql).toMatch(/\bbalance_snapshot\b/i);
+    expect(sql).toMatch(/\blast_synced_at\b/i);
+    expect(sql).toMatch(/\bcreated_at\b/i);
+    expect(sql).toMatch(/\bupdated_at\b/i);
+    expect(sql).toMatch(/unique\s*\(\s*user_id\s*,\s*network\s*\)/i);
+  });
+
+  it('includes rollback migration for both tables', () => {
+    const sql = read(downMigrationPath);
+
+    expect(sql).toMatch(/drop table if exists vaults/i);
+    expect(sql).toMatch(/drop table if exists api_keys/i);
+  });
+});