apikeystore

package
v1.131.3 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Sep 13, 2026 License: Apache-2.0 Imports: 7 Imported by: 0

Documentation

Overview

Package apikeystore persists the database-managed API keys the platform loads alongside the keys declared in configuration.

It is a facade-internal seam: pkg/platform constructs it and hands the resulting Store to the admin API through its own accessor, so the store has exactly two first-party callers and no business living on the module's supported import surface (docs/library/stability.md). pkg/platform keeps aliases for the two types the admin handler names, so the facade's published contract is unchanged by the move.

Index

Constants

This section is empty.

Variables

View Source
var ErrExists = errors.New("api key already exists")

ErrExists is returned when Create is asked for a name the database holds.

View Source
var ErrNotFound = errors.New("api key not found")

ErrNotFound is returned when an API key does not exist in the database.

Functions

This section is empty.

Types

type Definition

type Definition struct {
	Name        string     `json:"name"`
	KeyHash     string     `json:"key_hash"`
	Email       string     `json:"email,omitempty"`
	Description string     `json:"description,omitempty"`
	Roles       []string   `json:"roles"`
	ExpiresAt   *time.Time `json:"expires_at,omitempty"`
	CreatedBy   string     `json:"created_by"`
	CreatedAt   time.Time  `json:"created_at"`
}

Definition represents a database-managed API key.

type NoopStore

type NoopStore struct{}

NoopStore is a no-op implementation for when no database is available.

func (*NoopStore) Create added in v1.131.3

func (*NoopStore) Create(_ context.Context, _ Definition) error

Create is a no-op.

func (*NoopStore) Delete

func (*NoopStore) Delete(_ context.Context, _ string) error

Delete returns ErrNotFound for the noop store.

func (*NoopStore) HashedKeys added in v1.131.3

func (*NoopStore) HashedKeys(_ context.Context) ([]auth.APIKey, error)

HashedKeys returns nil for the noop store.

func (*NoopStore) HoldsKey added in v1.131.3

func (*NoopStore) HoldsKey(_ context.Context, _, _ string) (bool, error)

HoldsKey reports false: the noop store holds no key.

func (*NoopStore) List

func (*NoopStore) List(_ context.Context) ([]Definition, error)

List returns nil for the noop store.

type PostgresStore

type PostgresStore struct {
	// contains filtered or unexported fields
}

PostgresStore implements Store backed by PostgreSQL.

func NewPostgres

func NewPostgres(db *sql.DB) *PostgresStore

NewPostgres creates a new PostgreSQL-backed API key store.

func (*PostgresStore) Create added in v1.131.3

func (s *PostgresStore) Create(ctx context.Context, def Definition) error

Create adds an API key definition, or returns ErrExists when the name is taken.

func (*PostgresStore) Delete

func (s *PostgresStore) Delete(ctx context.Context, name string) error

Delete removes an API key definition by name.

func (*PostgresStore) HashedKeys added in v1.131.3

func (s *PostgresStore) HashedKeys(ctx context.Context) ([]auth.APIKey, error)

HashedKeys returns every stored key in the form the authenticator holds.

func (*PostgresStore) HoldsKey added in v1.131.3

func (s *PostgresStore) HoldsKey(ctx context.Context, name, keyHash string) (bool, error)

HoldsKey reports whether the key named name is stored with keyHash.

func (*PostgresStore) List

func (s *PostgresStore) List(ctx context.Context) ([]Definition, error)

List returns all API key definitions.

type Store

type Store interface {
	auth.HashedKeySource
	List(ctx context.Context) ([]Definition, error)
	// Create adds a key, returning ErrExists when the name is taken. It never
	// replaces a key: two replicas creating one name at once must not both
	// succeed with the second write discarding the first key.
	Create(ctx context.Context, def Definition) error
	Delete(ctx context.Context, name string) error
}

Store manages API key persistence. It is the record of which database-managed keys exist for every replica of a deployment, which is why it is also the auth.HashedKeySource the authenticator confirms keys against.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL