zeekay
478588036d
fix: standardize key prefixes — always hyphen, never underscore
...
Canonical prefixes:
pk- publishable key (frontend, read-only)
sk- secret key (backend, full access)
hk- hanzo key (IAM user key, legacy)
hi- hanzo insights (analytics events)
ha- hanzo analytics (lightweight web analytics)
hz- hanzo widget (restricted chat/embed)
Added IsAnalyticsKey() and IsWidgetKey() helpers.
Removed pk_/sk_ underscore variants — one way only.
2026-03-01 23:43:25 -07:00
zeekay
6a53ac0c9f
feat: native IAM API key auth in platform plugin
...
Every Base app now supports IAM-managed API keys (hk-/pk-/sk-) natively.
Keys are created and managed in IAM — Base resolves them via IAM's
GET /api/get-user?accessKey= endpoint (cached 5min).
Auth chain: JWKS JWT → IAM API key → unauthenticated
Key types:
pk-/pk_ = publishable (frontend-safe, read-only)
sk-/sk_ = secret (backend-only, full access)
hk- = IAM key (legacy, full access)
Gateway validates JWTs statelessly via JWKS.
Base validates API keys via IAM (one canonical key store).
One way to do auth. IAM is the source of truth.
2026-03-01 23:18:56 -07:00
zeekay
7f17d4b316
Add realtime DX platform: CRDT engine, WebSocket, SDKs, typegen, scheduler, multi-tenant
...
7-phase implementation of Convex-inspired realtime developer experience:
- crdt/: Go CRDT engine (GCounter, PNCounter, LWWRegister, ORSet, RGA text)
with state-vector sync protocol and convergence-tested types (31 tests)
- apis/ws.go: Pure RFC 6455 WebSocket endpoint with JWT auth, CRDT sync,
presence tracking, channel subscriptions
- apis/presence.go: Channel-based presence manager for collaborative awareness
- cmd/typegen/: CLI tool to generate TypeScript interfaces from Base schemas
(4 tests, all 14 field types mapped)
- plugins/scheduler/: Scheduled functions with exactly-once semantics,
retry with backoff, JSVM bindings (8 tests)
- plugins/platform/: Multi-tenant platform with IAM (hanzo.id) auth,
KMS (kms.hanzo.ai) secrets, tenant isolation via collection prefixes,
RBAC roles, API key management (7 tests)
- sdk/base-js/: @hanzoai/base TypeScript SDK with reactive queries,
query deduplication, optimistic updates, state versioning, CRDT client
(72 smoke tests passing)
- sdk/base-react/: @hanzoai/base-react React hooks (useQuery, useMutation,
useAuth, useRealtime, useCRDT, usePresence) with useSyncExternalStore
2026-02-27 10:00:24 -08:00
zeekay