apikey

type AdminKeyManager struct {
	// contains filtered or unexported fields
}

type KeyMetadata struct {
	// KeyID is the fully qualified secret identifier: "<namespace>/<name>".
	KeyID       string    `json:"keyId"`
	Namespace   string    `json:"namespace"`
	Role        string    `json:"role"`
	User        string    `json:"user"`
	Team        string    `json:"team"`
	QuotaURL    string    `json:"quotaURL"`
	Description string    `json:"description"`
	IssuedAt    time.Time `json:"issuedAt"`
	ExpiresAt   time.Time `json:"expiresAt"` // zero = never expires
	// SyncSource is "global" when the key was created/synced via ws-proxy.
	// Empty means locally-created or a legacy resource — both are treated as non-global.
	SyncSource string `json:"syncSource,omitempty"`
	// TokenHash is the full SHA-256 hex hash of the raw token, extracted from
	// the Secret data. It is needed for sync (CreateFromHash) but MUST NOT be
	// exposed via any external API — hence json:"-".
	TokenHash string `json:"-"`
	// RawToken is the full opaque token (agbx_...) stored in the Secret's "apikey"
	// data field. Populated only for keys created after plaintext storage was
	// introduced. Empty for legacy keys. MUST NOT be exposed in JSON — json:"-".
	RawToken string `json:"-"`
}

type KeyStore interface {
	// Create generates a new random token, stores its metadata as a K8s Secret,
	// and returns the raw token (shown only once) plus the secret name (KeyID short form).
	Create(ctx context.Context, meta KeyMetadata) (rawToken, keyID string, err error)

	// CreateFromHash writes a Secret using an already-computed tokenHash/hashPrefix
	// (e.g. when importing a key from another cluster). It is idempotent:
	// if the Secret already exists the call returns nil.
	CreateFromHash(ctx context.Context, meta KeyMetadata, tokenHash, hashPrefix string) error

	// Validate resolves rawToken to its KeyMetadata, using an in-memory cache.
	// Returns ErrTokenNotFound if no matching secret exists.
	// Returns ErrTokenExpired if the key has passed its ExpiresAt time.
	Validate(ctx context.Context, rawToken string) (*KeyMetadata, error)

	// List returns all API key metadata.
	List(ctx context.Context) ([]KeyMetadata, error)

	// ListByTeamAndUser returns API key metadata filtered by team and/or user
	// labels. Pass empty strings to skip a filter dimension.
	ListByTeamAndUser(ctx context.Context, team, user string) ([]KeyMetadata, error)

	// Get returns the metadata for the secret identified by keyID (secret name,
	// without namespace prefix).
	Get(ctx context.Context, keyID string) (*KeyMetadata, error)

	// Delete revokes the API key identified by keyID (secret name).
	Delete(ctx context.Context, keyID string) error
}

type SecretKeyStore struct {
	// contains filtered or unexported fields
}

type SecretKeyStoreConfig struct {
	// Client is the Kubernetes client used to read/write Secrets.
	Client client.Client
	// SecretsNamespace is the namespace where API key secrets are stored.
	// Defaults to "agentbox-system" if empty.
	SecretsNamespace string
	// CacheTTL is how long a successful Validate result is cached in memory.
	// Defaults to 1 minute if zero.
	CacheTTL time.Duration
}