ruicesar/clube67_newwhats.local
1
0
Fork 0
Code Issues 13 Pull Requests Actions Packages Projects 11 Releases Wiki Activity

feat(ext-api): chave de satélite e-mail-capable (REST + WS)

Browse Source 
A integration_key do satélite (nwk_) passa a resolver por x-nw-email quando
presente (preserva multi-conta: cada usuário vê o WhatsApp do seu e-mail),
caindo no tenant dono do par quando ausente — igual no middleware REST e no
handshake do WS bridge. Valida o par (revoke) antes de resolver por email.
Permite migrar o scoreodonto da EXT_MASTER_KEY global p/ chave própria
(revogável/auditada), sem mudança de comportamento.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
VPS 4 Deploy Agent
2026-07-02 03:56:25 +02:00
parent 89758a0e6b
commit 35188b4f9a
6 changed files with 52 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
newwhats.clube67.com/newwhats.local/plugins/ext-api/backend/ws-bridge.js
+10 -3
View File
@@ -43,10 +43,13 @@ function buildWsBridge(httpServer, prisma, hooks) {
}
let tenantId;
try {
// Chave mestra → resolve o tenant pelo x-nw-email do handshake (o túnel do
// satélite injeta o email do usuário autenticado). Chave normal → tabela apiKey.
// Resolução do tenant no handshake (o túnel do satélite injeta x-nw-email):
// - chave mestra → exige x-nw-email → resolve por email;
// - chave de satélite (nwk_) → confiável: com x-nw-email resolve por email
// (preserva multi-conta), senão cai no tenant dono do par;
// - chave normal → tabela apiKey.
const email = req.headers['x-nw-email']?.trim().toLowerCase();
if ((0, apikey_auth_1.isMasterKey)(apiKey)) {
const email = req.headers['x-nw-email']?.trim().toLowerCase();
if (!email) {
socket.write('HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\n\r\nx-nw-email ausente (chave mestra)');
socket.destroy();
@@ -54,6 +57,10 @@ function buildWsBridge(httpServer, prisma, hooks) {
}
tenantId = await (0, apikey_auth_1.resolveMasterEmail)(prisma, email);
}
else if (apiKey.startsWith('nwk_')) {
const owner = await (0, apikey_auth_1.resolvePairKey)(prisma, apiKey);
tenantId = owner ? (email ? await (0, apikey_auth_1.resolveMasterEmail)(prisma, email) : owner) : null;
}
else {
tenantId = await (0, apikey_auth_1.resolveApiKey)(prisma, apiKey);
}