Removed internal Riddler getKey calls

server/routerlicious/packages/routerlicious-base/package.json

@@ -146,6 +146,9 @@
 			},
 			"ClassDeclaration_TenantManager": {
 				"forwardCompat": false
+			},
+			"InterfaceDeclaration_ITenantDocument": {
+				"backCompat": false
 			}
 		}
 	}

server/routerlicious/packages/routerlicious-base/src/alfred/routes/api/documents.ts

@@ -103,7 +103,7 @@ async function generateCreateDocumentResponseBody(
 		if (token === undefined) {
 			throw new NetworkError(400, "Authorization header is missing or malformed");
 		}
-		newDocumentAccessToken = await getCreationToken(tenantManager, token, tenantId, documentId);
+		newDocumentAccessToken = await getCreationToken(tenantManager, token, documentId);
 	}
 	let newDocumentSession: ISession | undefined;
 	if (enableDiscovery) {

server/routerlicious/packages/routerlicious-base/src/riddler/api.ts

@@ -66,6 +66,30 @@ export function create(
 		);
 	});
 
+	/**
+	 * Signs a tenant token using the given tenant's key.
+	 */
+	router.post("/tenants/:id/accesstoken", (request, response) => {
+		const tenantId = request.params.id;
+		const scopes = request.body.scopes;
+		const documentId = request.body.documentId ?? "";
+		const user = request.body.user;
+		const lifetime = request.body.lifetime;
+		const ver = request.body.ver;
+		const jti = request.body.jti;
+		const accessTokenP = manager.signToken(
+			tenantId,
+			documentId,
+			scopes,
+			user,
+			lifetime,
+			ver,
+			jti,
+			getIncludeDisabledFlag(request),
+		);
+		handleResponse(accessTokenP, response);
+	});
+
 	/**
 	 * Retrieves details for the given tenant
 	 */
@@ -91,13 +115,7 @@ export function create(
 	router.get("/tenants/:id/keys", (request, response) => {
 		const tenantId = request.params.id;
 		const includeDisabledTenant = getIncludeDisabledFlag(request);
-		const usePrivateKeys = getUsePrivateKeysFlag(request);
-		const tenantP = manager.getTenantKeys(
-			tenantId,
-			includeDisabledTenant,
-			false /* bypassCache */,
-			usePrivateKeys,
-		);
+		const tenantP = manager.getTenantKeys(tenantId, includeDisabledTenant);
 		handleResponse(tenantP, response);
 	});
 
@@ -122,10 +140,15 @@ export function create(
 	/**
 	 * Updates the keyless access setting for the given tenant
 	 */
-	router.put("/tenants/:id/privateKeyAccess", (request, response) => {
+	router.put("/tenants/:id/keyAccess", (request, response) => {
 		const tenantId = request.params.id;
 		const enablePrivateKeyAccess = request.body.enablePrivateKeyAccess ?? false;
-		const storageP = manager.updatePrivateKeyAccessPolicy(tenantId, enablePrivateKeyAccess);
+		const enableSharedKeyAccess = request.body.enableSharedKeyAccess ?? true;
+		const storageP = manager.updateKeyAccessPolicy(
+			tenantId,
+			enablePrivateKeyAccess,
+			enableSharedKeyAccess,
+		);
 		handleResponse(storageP, response);
 	});
 
@@ -139,7 +162,8 @@ export function create(
 	});
 
 	/**
-	 * Refreshes the key for the given tenant
+	 * Refreshes the key for the given tenant. Private keys are refreshed only if refreshPrivateKey is true.
+	 * Private keys are refreshed only by internal service calls.
 	 */
 	router.put("/tenants/:id/key", (request, response) => {
 		const tenantId = request.params.id;
@@ -160,11 +184,13 @@ export function create(
 			? request.body.customData
 			: {};
 		const enablePrivateKeyAccess = request.body.enablePrivateKeyAccess ?? false;
+		const enableSharedKeyAccess = request.body.enableSharedKeyAccess ?? true;
 		const tenantP = manager.createTenant(
 			tenantId,
 			tenantStorage,
 			tenantOrderer,
 			tenantCustomData,
+			enableSharedKeyAccess,
 			enablePrivateKeyAccess,
 		);
 		handleResponse(tenantP, response);
@@ -188,10 +214,5 @@ export function create(
 		return includeDisabledRaw?.toLowerCase() === "true";
 	}
 
-	function getUsePrivateKeysFlag(request): boolean {
-		const usePrivateKeys = request.query.usePrivateKeys as string;
-		return usePrivateKeys?.toLowerCase() === "true";
-	}
-
 	return router;
 }