Documentation
¶
Overview ¶
Package apikeystore persists the database-managed API keys the platform loads alongside the keys declared in configuration.
It is a facade-internal seam: pkg/platform constructs it and hands the resulting Store to the admin API through its own accessor, so the store has exactly two first-party callers and no business living on the module's supported import surface (docs/library/stability.md). pkg/platform keeps aliases for the two types the admin handler names, so the facade's published contract is unchanged by the move.
Index ¶
- Variables
- type Definition
- type NoopStore
- func (*NoopStore) Create(_ context.Context, _ Definition) error
- func (*NoopStore) Delete(_ context.Context, _ string) error
- func (*NoopStore) HashedKeys(_ context.Context) ([]auth.APIKey, error)
- func (*NoopStore) HoldsKey(_ context.Context, _, _ string) (bool, error)
- func (*NoopStore) List(_ context.Context) ([]Definition, error)
- type PostgresStore
- func (s *PostgresStore) Create(ctx context.Context, def Definition) error
- func (s *PostgresStore) Delete(ctx context.Context, name string) error
- func (s *PostgresStore) HashedKeys(ctx context.Context) ([]auth.APIKey, error)
- func (s *PostgresStore) HoldsKey(ctx context.Context, name, keyHash string) (bool, error)
- func (s *PostgresStore) List(ctx context.Context) ([]Definition, error)
- type Store
Constants ¶
This section is empty.
Variables ¶
var ErrExists = errors.New("api key already exists")
ErrExists is returned when Create is asked for a name the database holds.
var ErrNotFound = errors.New("api key not found")
ErrNotFound is returned when an API key does not exist in the database.
Functions ¶
This section is empty.
Types ¶
type Definition ¶
type Definition struct {
Name string `json:"name"`
KeyHash string `json:"key_hash"`
Email string `json:"email,omitempty"`
Description string `json:"description,omitempty"`
Roles []string `json:"roles"`
ExpiresAt *time.Time `json:"expires_at,omitempty"`
CreatedBy string `json:"created_by"`
CreatedAt time.Time `json:"created_at"`
}
Definition represents a database-managed API key.
type NoopStore ¶
type NoopStore struct{}
NoopStore is a no-op implementation for when no database is available.
func (*NoopStore) Create ¶ added in v1.131.3
func (*NoopStore) Create(_ context.Context, _ Definition) error
Create is a no-op.
func (*NoopStore) HashedKeys ¶ added in v1.131.3
HashedKeys returns nil for the noop store.
type PostgresStore ¶
type PostgresStore struct {
// contains filtered or unexported fields
}
PostgresStore implements Store backed by PostgreSQL.
func NewPostgres ¶
func NewPostgres(db *sql.DB) *PostgresStore
NewPostgres creates a new PostgreSQL-backed API key store.
func (*PostgresStore) Create ¶ added in v1.131.3
func (s *PostgresStore) Create(ctx context.Context, def Definition) error
Create adds an API key definition, or returns ErrExists when the name is taken.
func (*PostgresStore) Delete ¶
func (s *PostgresStore) Delete(ctx context.Context, name string) error
Delete removes an API key definition by name.
func (*PostgresStore) HashedKeys ¶ added in v1.131.3
HashedKeys returns every stored key in the form the authenticator holds.
func (*PostgresStore) HoldsKey ¶ added in v1.131.3
HoldsKey reports whether the key named name is stored with keyHash.
func (*PostgresStore) List ¶
func (s *PostgresStore) List(ctx context.Context) ([]Definition, error)
List returns all API key definitions.
type Store ¶
type Store interface {
auth.HashedKeySource
List(ctx context.Context) ([]Definition, error)
// Create adds a key, returning ErrExists when the name is taken. It never
// replaces a key: two replicas creating one name at once must not both
// succeed with the second write discarding the first key.
Create(ctx context.Context, def Definition) error
Delete(ctx context.Context, name string) error
}
Store manages API key persistence. It is the record of which database-managed keys exist for every replica of a deployment, which is why it is also the auth.HashedKeySource the authenticator confirms keys against.