apikey

type APIKey struct {
	ID               id.APIKeyID         `json:"id"`
	AppID            id.AppID            `json:"app_id"`
	EnvID            id.EnvironmentID    `json:"env_id"`
	UserID           id.UserID           `json:"user_id"`
	ServiceAccountID id.ServiceAccountID `json:"service_account_id,omitempty"`
	Name             string              `json:"name"`
	KeyHash          string              `json:"-"`
	KeyPrefix        string              `json:"key_prefix"`
	PublicKey        string              `json:"public_key,omitempty"`
	PublicKeyPrefix  string              `json:"public_key_prefix,omitempty"`
	Scopes           []string            `json:"scopes,omitempty"`
	ExpiresAt        *time.Time          `json:"expires_at,omitempty"`
	LastUsedAt       *time.Time          `json:"last_used_at,omitempty"`
	Revoked          bool                `json:"revoked"`
	CreatedAt        time.Time           `json:"created_at"`
	UpdatedAt        time.Time           `json:"updated_at"`
}

type KeysmithStore struct {
	// contains filtered or unexported fields
}

type Store interface {
	// CreateAPIKey stores a new API key.
	CreateAPIKey(ctx context.Context, key *APIKey) error

	// GetAPIKey returns an API key by ID.
	GetAPIKey(ctx context.Context, keyID id.APIKeyID) (*APIKey, error)

	// GetAPIKeyByPrefix returns an API key by its prefix.
	// Used during authentication to look up the key.
	GetAPIKeyByPrefix(ctx context.Context, appID id.AppID, prefix string) (*APIKey, error)

	// FindByPrefix is the app-agnostic counterpart to GetAPIKeyByPrefix:
	// it resolves a key by prefix alone, used by the introspection endpoint
	// where the caller doesn't know the appID up-front.
	FindByPrefix(ctx context.Context, prefix string) (*APIKey, error)

	// GetAPIKeyByPublicKey returns an API key by its public key.
	GetAPIKeyByPublicKey(ctx context.Context, appID id.AppID, publicKey string) (*APIKey, error)

	// UpdateAPIKey updates an existing API key.
	UpdateAPIKey(ctx context.Context, key *APIKey) error

	// TouchAPIKey records that the key was used at the given instant with
	// a single-column write. The validation path calls it at most once a
	// minute per key, so a busy key costs one small write per minute
	// rather than a full-row rewrite per request.
	TouchAPIKey(ctx context.Context, keyID id.APIKeyID, at time.Time) error

	// DeleteAPIKey permanently deletes an API key.
	DeleteAPIKey(ctx context.Context, keyID id.APIKeyID) error

	// ListAPIKeysByApp lists all API keys for a given app.
	ListAPIKeysByApp(ctx context.Context, appID id.AppID) ([]*APIKey, error)

	// ListAPIKeysByUser lists all API keys for a given user within an app.
	ListAPIKeysByUser(ctx context.Context, appID id.AppID, userID id.UserID) ([]*APIKey, error)
}