juancwu/authkit
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
0 releases 3 tags
  • v0.2.0 7f1db871bc

    Cut user-owned API keys; redesign subject model

    Ghost released this 2026-04-26 20:29:17 +00:00 | 3 commits to main since this release

    Removes the APIKey primitive entirely (Auth.IssueAPIKey/AuthenticateAPIKey/
    RevokeAPIKey, APIKeyStore, Deps.APIKeys, Stores.APIKeys, Tables.APIKeys,
    ErrAPIKeyInvalid, AuthMethodAPIKey, Principal.{APIKeyID, Abilities, HasAbility},
    prefixAPIKey, RequireAPIKey, and the 6 SQL templates). Migration
    0003_drop_api_keys.sql hard-drops authkit_api_keys.

    The new subject model: *Principal carries identity only (sessions, JWTs);
    *ServiceKey is the only abilities-bearing credential and gains a
    HasAbility(name) method. RequireAbility now reads *ServiceKey from context
    (user principals 403 by design). RequireRole/RequirePermission stay
    Principal-only. New RequireServiceKey + ServiceKeyFrom + MustServiceKey,
    and a heterogeneous RequireAnyOrServiceKey for routes that accept either.
    RequireAny is now Principal-only (default [Session, JWT]).

    Adds 7 middleware tests (auth, revoked, ability accept/reject across
    subjects, role rejects service key, RequireAnyOrServiceKey both paths) and
    1 (*ServiceKey).HasAbility unit test. Existing API-key tests deleted.

    Co-Authored-By: Claude Opus 4.7 (1M context) noreply@anthropic.com

    Downloads