d2de49a591
Implements API key authentication for all rdev endpoints:
## Database (internal/db)
- Auto-migrating postgres connection
- Embedded SQL migrations via go:embed
- api_keys table with scopes, expiration, project restrictions
## Auth Package (internal/auth)
- Key generation: rdev_sk_<prefix>_<random> format
- Scopes: projects:read, projects:execute, keys:read, keys:write, admin
- SHA-256 key hashing (secrets never stored)
- Expiration options: 30d, 60d, 90d, 1y, never
- Middleware skips /health, /ready, /docs, /openapi.json
## Key Management API
- GET /keys - List keys (keys:read)
- POST /keys - Create key (keys:write)
- GET /keys/{id} - Get key details (keys:read)
- DELETE /keys/{id} - Revoke key (keys:write)
## Environment Variables
- DB_HOST, DB_PORT, DB_USER, DB_PASSWORD, DB_NAME
- RDEV_ADMIN_KEY - Super admin key for bootstrapping
Version bumped to 0.5.0.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
31 lines
1.5 KiB
SQL
31 lines
1.5 KiB
SQL
-- API Keys table for rdev authentication
|
|
CREATE TABLE IF NOT EXISTS api_keys (
|
|
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
|
name VARCHAR(255) NOT NULL,
|
|
key_hash VARCHAR(64) NOT NULL UNIQUE,
|
|
key_prefix VARCHAR(8) NOT NULL,
|
|
scopes TEXT[] NOT NULL DEFAULT '{}',
|
|
project_ids TEXT[] DEFAULT NULL,
|
|
created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
|
|
expires_at TIMESTAMPTZ,
|
|
last_used_at TIMESTAMPTZ,
|
|
revoked_at TIMESTAMPTZ,
|
|
created_by VARCHAR(255)
|
|
);
|
|
|
|
-- Index for key lookup (most common operation)
|
|
CREATE INDEX IF NOT EXISTS idx_api_keys_key_hash ON api_keys(key_hash);
|
|
|
|
-- Index for listing active keys
|
|
CREATE INDEX IF NOT EXISTS idx_api_keys_active ON api_keys(revoked_at) WHERE revoked_at IS NULL;
|
|
|
|
-- Index for cleanup of expired keys
|
|
CREATE INDEX IF NOT EXISTS idx_api_keys_expires ON api_keys(expires_at) WHERE expires_at IS NOT NULL;
|
|
|
|
COMMENT ON TABLE api_keys IS 'API keys for authenticating rdev API requests';
|
|
COMMENT ON COLUMN api_keys.key_hash IS 'SHA-256 hash of the full API key';
|
|
COMMENT ON COLUMN api_keys.key_prefix IS 'First 8 chars of key for identification (rdev_sk_XXXXXXXX)';
|
|
COMMENT ON COLUMN api_keys.scopes IS 'Array of permission scopes: projects:read, projects:execute, keys:read, keys:write, admin';
|
|
COMMENT ON COLUMN api_keys.project_ids IS 'NULL = all projects, otherwise array of allowed project IDs';
|
|
COMMENT ON COLUMN api_keys.created_by IS 'admin or UUID of key that created this key';
|