Documentation
¶
Index ¶
- Variables
- func GenerateAPIKey() (id, rawKey string, err error)
- type APIKeyRecord
- type APIKeyStore
- func (s *APIKeyStore) Authenticate(ctx context.Context, rawToken string) (string, bool)
- func (s *APIKeyStore) Create(ctx context.Context, label string, now time.Time) (APIKeyRecord, string, error)
- func (s *APIKeyStore) List(ctx context.Context) ([]APIKeyRecord, error)
- func (s *APIKeyStore) Revoke(ctx context.Context, id string, now time.Time) error
Constants ¶
This section is empty.
Variables ¶
var ErrAPIKeyNotFound = errors.New("api key not found")
ErrAPIKeyNotFound is returned by Revoke when no key has the given id.
Functions ¶
func GenerateAPIKey ¶
GenerateAPIKey returns a new (id, rawKey) pair. The rawKey is the secret the caller presents as a bearer token; the id is the public handle. Only the hash of rawKey is ever persisted.
Types ¶
type APIKeyRecord ¶
type APIKeyRecord struct {
ID string
Label string
CreatedAt time.Time
LastUsedAt *time.Time
RevokedAt *time.Time
}
APIKeyRecord is the metadata for a single API key. It never carries the raw key or its hash — those never leave the store.
type APIKeyStore ¶
type APIKeyStore struct {
// contains filtered or unexported fields
}
APIKeyStore persists revocable API keys in Postgres. Keys are stored as SHA-256 hashes; the raw key is shown once at creation and never again.
func NewAPIKeyStore ¶
func NewAPIKeyStore(db *sql.DB) *APIKeyStore
NewAPIKeyStore creates a Postgres-backed API key store. It shares the same *sql.DB (and therefore the same migrations) as the state store.
func (*APIKeyStore) Authenticate ¶
Authenticate reports whether rawToken matches a live (non-revoked) key. On success it returns the key id and bumps last_used_at on a best-effort basis — a failed bump never fails authentication. Implements the APIKeyAuthenticator interface consumed by the api package's BearerAuth.
func (*APIKeyStore) Create ¶
func (s *APIKeyStore) Create(ctx context.Context, label string, now time.Time) (APIKeyRecord, string, error)
Create generates a new API key, stores its hash + metadata, and returns the record together with the raw key. The raw key is returned exactly once and cannot be recovered afterward.
func (*APIKeyStore) List ¶
func (s *APIKeyStore) List(ctx context.Context) ([]APIKeyRecord, error)
List returns metadata for all keys (live and revoked), newest first. It never returns key hashes or raw keys.
Source Files