9fd11afa00
Validate X-API-Key against a DB-backed, self-managed key store in addition
to the static Infisical keys, so new consumers (e.g. gsc_admin) no longer
require a rebuild. Keys carry scopes (e.g. {ldap:read}); the required scope
is derived per-request from path + method and enforced by ScopeEnforce.
Static Infisical keys keep an implicit wildcard scope (no regression).
- service/apikey.go: DB store (admin.api_keys, SHA-256 hashes only), 30s
validation cache, generate/list/revoke. EnsureSchema is existence-first
(to_regclass) so a least-privilege DB role starts cleanly when the table
is provisioned out-of-band; startup is non-fatal if the store is absent.
- handler/apikeys.go + routes: POST/GET/DELETE /api/v1/admin/api-keys.
- middleware/apikey.go: APIKeyWithValidator + Principal + ScopeEnforce.
- pkg/types/scopes.go: scope vocabulary + matching.
- migrations/002_api_keys.sql.
Also restore cmd/server/main.go, which the `.gitignore` `server` pattern
was silently excluding (it matched cmd/server/); anchored that pattern and
`gsc-ops-api` to the repo root so only the built binaries are ignored.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
28 lines
1.2 KiB
SQL
28 lines
1.2 KiB
SQL
-- 002_api_keys.sql
|
|
-- Dynamic, self-managed API keys for ops-api consumers.
|
|
--
|
|
-- ops-api validates the X-API-Key header against (a) the static keys loaded
|
|
-- from Infisical and (b) the active rows in this table. New consumers can be
|
|
-- minted at runtime via POST /api/v1/admin/api-keys — no rebuild required.
|
|
--
|
|
-- Applied automatically at startup by APIKeyService.EnsureSchema(); kept here
|
|
-- as the canonical record. Only the SHA-256 hash of each key is stored; the
|
|
-- plaintext is returned exactly once at creation time.
|
|
|
|
-- `scopes` limits which calls a key may make (e.g. {ldap:read}); the static
|
|
-- Infisical keys carry an implicit wildcard. See pkg/types/scopes.go.
|
|
|
|
CREATE TABLE IF NOT EXISTS admin.api_keys (
|
|
id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
|
|
name text NOT NULL UNIQUE,
|
|
key_hash text NOT NULL UNIQUE,
|
|
key_prefix text NOT NULL,
|
|
scopes text[] NOT NULL DEFAULT '{}',
|
|
active boolean NOT NULL DEFAULT true,
|
|
created_at timestamptz NOT NULL DEFAULT now(),
|
|
last_used_at timestamptz,
|
|
created_by text
|
|
);
|
|
|
|
CREATE INDEX IF NOT EXISTS idx_api_keys_active ON admin.api_keys (active) WHERE active;
|