1445043649
110 lines
3.9 KiB
Python
110 lines
3.9 KiB
Python
"""API key management endpoints (Stage 1 PR4).
|
|
|
|
Owner/admin mint / list / revoke API keys for a service account in the
|
|
caller's workspace. The plaintext token is returned exactly once, at
|
|
create time; list responses never include plaintext or the hash. The
|
|
target service account must belong to the caller's workspace, else 404.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
from datetime import datetime
|
|
from typing import Literal
|
|
|
|
from fastapi import APIRouter, Depends, HTTPException, Response
|
|
from pydantic import BaseModel, Field
|
|
|
|
from app.gateway.authz import require_workspace_admin
|
|
from deerflow.auth.tokens import generate_api_key
|
|
from deerflow.persistence.api_key import ApiKeyRepository
|
|
from deerflow.persistence.service_account import ServiceAccountRepository
|
|
from deerflow.runtime.workspace_context import get_current_workspace
|
|
|
|
router = APIRouter(prefix="/api/v1/api-keys", tags=["api-keys"])
|
|
|
|
|
|
class CreateApiKeyRequest(BaseModel):
|
|
service_account_id: str
|
|
name: str = Field(..., min_length=1, max_length=64)
|
|
scopes: str = Field(default="")
|
|
env: Literal["live", "test"] = "live"
|
|
expires_at: datetime | None = None
|
|
|
|
|
|
def get_api_key_repo() -> ApiKeyRepository:
|
|
from deerflow.persistence.engine import get_session_factory
|
|
|
|
sf = get_session_factory()
|
|
if sf is None:
|
|
raise HTTPException(status_code=503, detail="persistence backend not available")
|
|
return ApiKeyRepository(sf)
|
|
|
|
|
|
def get_service_account_repo() -> ServiceAccountRepository:
|
|
from deerflow.persistence.engine import get_session_factory
|
|
|
|
sf = get_session_factory()
|
|
if sf is None:
|
|
raise HTTPException(status_code=503, detail="persistence backend not available")
|
|
return ServiceAccountRepository(sf)
|
|
|
|
|
|
def _current_workspace_id() -> str:
|
|
ws = get_current_workspace()
|
|
if ws is None:
|
|
raise HTTPException(status_code=403, detail="no workspace in context")
|
|
return str(ws.id)
|
|
|
|
|
|
async def _require_sa_in_workspace(sa_id: str, sa_repo: ServiceAccountRepository) -> dict:
|
|
sa = await sa_repo.get(sa_id)
|
|
if sa is None or sa["workspace_id"] != _current_workspace_id():
|
|
raise HTTPException(status_code=404, detail="service account not found")
|
|
return sa
|
|
|
|
|
|
@router.post("", status_code=201, dependencies=[Depends(require_workspace_admin)])
|
|
async def create_api_key(
|
|
body: CreateApiKeyRequest,
|
|
key_repo: ApiKeyRepository = Depends(get_api_key_repo),
|
|
sa_repo: ServiceAccountRepository = Depends(get_service_account_repo),
|
|
):
|
|
sa = await _require_sa_in_workspace(body.service_account_id, sa_repo)
|
|
if sa["status"] != "active":
|
|
raise HTTPException(status_code=409, detail="service account is not active")
|
|
gen = generate_api_key(body.env)
|
|
created = await key_repo.create(
|
|
service_account_id=body.service_account_id,
|
|
key_prefix=gen.prefix,
|
|
key_hash=gen.key_hash,
|
|
name=body.name,
|
|
scopes=body.scopes,
|
|
expires_at=body.expires_at,
|
|
)
|
|
# plaintext returned exactly once; never persisted, never re-served.
|
|
return {**created, "plaintext": gen.plaintext}
|
|
|
|
|
|
@router.get("", dependencies=[Depends(require_workspace_admin)])
|
|
async def list_api_keys(
|
|
service_account_id: str,
|
|
key_repo: ApiKeyRepository = Depends(get_api_key_repo),
|
|
sa_repo: ServiceAccountRepository = Depends(get_service_account_repo),
|
|
):
|
|
await _require_sa_in_workspace(service_account_id, sa_repo)
|
|
return await key_repo.list_by_service_account(service_account_id)
|
|
|
|
|
|
@router.delete("/{key_id}", status_code=204, dependencies=[Depends(require_workspace_admin)])
|
|
async def revoke_api_key(
|
|
key_id: str,
|
|
key_repo: ApiKeyRepository = Depends(get_api_key_repo),
|
|
sa_repo: ServiceAccountRepository = Depends(get_service_account_repo),
|
|
):
|
|
key = await key_repo.get(key_id)
|
|
if key is None:
|
|
raise HTTPException(status_code=404, detail="api key not found")
|
|
await _require_sa_in_workspace(key["service_account_id"], sa_repo)
|
|
await key_repo.revoke(key_id)
|
|
return Response(status_code=204)
|