cloacina::dal::unified::api_keys

Rust

API key DAL — Postgres only.

The server uses API keys for authentication. Keys are stored as SHA-256 hashes — plaintext is never persisted. This module provides CRUD operations for the api_keys table.

Structs

struct ApiKeyInfo

pub

Derives: Debug, Clone

Information about an API key (never includes the hash).

Fields

Name	Type	Description
id	uuid::Uuid
name	String
permissions	String
created_at	chrono::DateTime<chrono::Utc>
revoked	bool
tenant_id	Option<String>
is_admin	bool
expires_at	Option<chrono::DateTime<chrono::Utc>>	CLOACI-T-0792: minted-key expiry (None for manual keys = no expiry).
issued_via	Option<String>	CLOACI-T-0792: minted-key provenance (e.g. oidc:<issuer>:<sub> / local:<account_id>; None for manual keys).

struct ApiKeyDAL<'a>

pub

Derives: Clone

DAL for API key operations. Postgres only.

Methods

new

pub

fn new(dal: &'a DAL) -> Self

Source

    pub fn new(dal: &'a DAL) -> Self {
        Self { dal }
    }

create_​key

pub async

async fn create_key(
    &self,
    key_hash: &str,
    name: &str,
    tenant_id: Option<&str>,
    is_admin: bool,
    role: &str,
) -> Result<ApiKeyInfo, ValidationError>

Create a new API key record.

Source

    pub async fn create_key(
        &self,
        key_hash: &str,
        name: &str,
        tenant_id: Option<&str>,
        is_admin: bool,
        role: &str,
    ) -> Result<ApiKeyInfo, ValidationError> {
        crud::create_key(self.dal, key_hash, name, tenant_id, is_admin, role).await
    }

mint_​key

pub async

async fn mint_key(
    &self,
    key_hash: &str,
    name: &str,
    tenant_id: Option<&str>,
    role: &str,
    expires_at: chrono::DateTime<chrono::Utc>,
    issued_via: &str,
) -> Result<ApiKeyInfo, ValidationError>

CLOACI-T-0792: mint a short-TTL, provenance-tagged key (never god-mode).

Source

    pub async fn mint_key(
        &self,
        key_hash: &str,
        name: &str,
        tenant_id: Option<&str>,
        role: &str,
        expires_at: chrono::DateTime<chrono::Utc>,
        issued_via: &str,
    ) -> Result<ApiKeyInfo, ValidationError> {
        crud::mint_key(
            self.dal, key_hash, name, tenant_id, role, expires_at, issued_via,
        )
        .await
    }

validate_​hash

pub async

async fn validate_hash(
    &self,
    key_hash: &str,
) -> Result<Option<ApiKeyInfo>, ValidationError>

Validate a key hash — returns key info if found and not revoked.

Source

    pub async fn validate_hash(
        &self,
        key_hash: &str,
    ) -> Result<Option<ApiKeyInfo>, ValidationError> {
        crud::validate_hash(self.dal, key_hash).await
    }

has_​any_​keys

pub async

async fn has_any_keys(&self) -> Result<bool, ValidationError>

Check if any non-revoked API keys exist.

Source

    pub async fn has_any_keys(&self) -> Result<bool, ValidationError> {
        crud::has_any_keys(self.dal).await
    }

list_​keys

pub async

async fn list_keys(&self) -> Result<Vec<ApiKeyInfo>, ValidationError>

List all API keys (no hashes).

Source

    pub async fn list_keys(&self) -> Result<Vec<ApiKeyInfo>, ValidationError> {
        crud::list_keys(self.dal).await
    }

revoke_​key

pub async

async fn revoke_key(
    &self,
    id: uuid::Uuid,
) -> Result<bool, ValidationError>

Soft-revoke a key. Returns true if found and revoked.

Source

    pub async fn revoke_key(&self, id: uuid::Uuid) -> Result<bool, ValidationError> {
        crud::revoke_key(self.dal, id).await
    }

list_​keys_​for_​tenant

pub async

async fn list_keys_for_tenant(
    &self,
    tenant_id: &str,
) -> Result<Vec<ApiKeyInfo>, ValidationError>

CLOACI-T-0784: list keys scoped to a single tenant (tenant-admin view).

Source

    pub async fn list_keys_for_tenant(
        &self,
        tenant_id: &str,
    ) -> Result<Vec<ApiKeyInfo>, ValidationError> {
        crud::list_keys_for_tenant(self.dal, tenant_id).await
    }

get_​key

pub async

async fn get_key(
    &self,
    id: uuid::Uuid,
) -> Result<Option<ApiKeyInfo>, ValidationError>

CLOACI-T-0784: fetch one key’s info by id (for revoke ownership checks).

Source

    pub async fn get_key(&self, id: uuid::Uuid) -> Result<Option<ApiKeyInfo>, ValidationError> {
        crud::get_key(self.dal, id).await
    }

revoke_​keys_​for_​tenant

pub async

async fn revoke_keys_for_tenant(
    &self,
    tenant_id: &str,
) -> Result<usize, ValidationError>

CLOACI-T-0581: bulk-revoke every still-active key bound to the tenant. Returns the number of rows updated.

Source

    pub async fn revoke_keys_for_tenant(&self, tenant_id: &str) -> Result<usize, ValidationError> {
        crud::revoke_keys_for_tenant(self.dal, tenant_id).await
    }