73 lines
2.1 KiB
Python
73 lines
2.1 KiB
Python
"""Programmatic API keys. Only admins may create, list, or revoke keys.
|
|
|
|
A key authenticates via the ``X-API-Key`` header and acts as the admin who
|
|
created it. The raw key is returned exactly once, at creation; afterwards only
|
|
its prefix and hash are stored.
|
|
"""
|
|
|
|
from fastapi import APIRouter, Depends, Request
|
|
from sqlalchemy import select
|
|
from sqlalchemy.orm import Session as DbSession
|
|
|
|
from .. import auth
|
|
from ..auth import require_admin
|
|
from ..database import get_db
|
|
from ..errors import APIError
|
|
from ..models import Admin, ApiKey
|
|
from ..schemas import ApiKeyCreate, ApiKeyCreated, ApiKeyOut
|
|
|
|
router = APIRouter(prefix="/apikeys", tags=["apikeys"])
|
|
|
|
|
|
@router.get("", response_model=list[ApiKeyOut])
|
|
def list_api_keys(_: Admin = Depends(require_admin), db: DbSession = Depends(get_db)):
|
|
return db.execute(select(ApiKey).order_by(ApiKey.id.desc())).scalars().all()
|
|
|
|
|
|
@router.post("", response_model=ApiKeyCreated, status_code=201)
|
|
def create_api_key(
|
|
payload: ApiKeyCreate,
|
|
request: Request,
|
|
admin: Admin = Depends(require_admin),
|
|
db: DbSession = Depends(get_db),
|
|
):
|
|
raw = auth.generate_api_key()
|
|
key = ApiKey(
|
|
name=payload.name,
|
|
key_prefix=raw[:8],
|
|
key_hash=auth.hash_api_key(raw),
|
|
created_by=admin.username,
|
|
)
|
|
db.add(key)
|
|
db.commit()
|
|
db.refresh(key)
|
|
auth.record_log(
|
|
db,
|
|
username=admin.username,
|
|
action="create_api_key",
|
|
detail=f"Created API key '{key.name}' ({key.key_prefix}…)",
|
|
request=request,
|
|
)
|
|
return ApiKeyCreated(**ApiKeyOut.model_validate(key).model_dump(), key=raw)
|
|
|
|
|
|
@router.delete("/{key_id}", status_code=204)
|
|
def revoke_api_key(
|
|
key_id: int,
|
|
request: Request,
|
|
admin: Admin = Depends(require_admin),
|
|
db: DbSession = Depends(get_db),
|
|
):
|
|
key = db.get(ApiKey, key_id)
|
|
if key is None:
|
|
raise APIError(status_code=404, detail=f"API key '{key_id}' not found")
|
|
key.revoked = True
|
|
db.commit()
|
|
auth.record_log(
|
|
db,
|
|
username=admin.username,
|
|
action="revoke_api_key",
|
|
detail=f"Revoked API key '{key.name}' ({key.key_prefix}…)",
|
|
request=request,
|
|
)
|