authkit/service_service_key.go

package authkit

import (
	"context"
	"errors"
	"time"

	"git.juancwu.dev/juancwu/errx"
	"github.com/google/uuid"
)

// IssueServiceKeyParams is the input shape for IssueServiceKey. Abilities
// are slugs that must already exist in authkit_abilities — issue fails with
// ErrAbilityNotFound if any slug is unknown. TTL is optional; nil means
// non-expiring.
type IssueServiceKeyParams struct {
	Name      string
	Abilities []string
	TTL       *time.Duration
}

// IssueServiceKey mints a fresh service token. Plaintext is returned exactly
// once (show-once); only the SHA-256 hash is persisted. Each ability slug is
// resolved to its row before insertion, so the service key carries a
// well-defined set of abilities even after later slug renames or deletes.
func (a *Auth) IssueServiceKey(ctx context.Context, params IssueServiceKeyParams) (string, *ServiceKey, error) {
	const op = "authkit.Auth.IssueServiceKey"
	if params.Name == "" {
		return "", nil, errx.New(op, "Name is required")
	}
	abilityIDs := make([]uuid.UUID, 0, len(params.Abilities))
	resolved := make([]string, 0, len(params.Abilities))
	seen := map[string]struct{}{}
	for _, slug := range params.Abilities {
		if _, dup := seen[slug]; dup {
			continue
		}
		seen[slug] = struct{}{}
		ab, err := a.storeGetAbilityBySlug(ctx, slug)
		if err != nil {
			if errors.Is(err, ErrAbilityNotFound) {
				return "", nil, errx.Wrapf(op, ErrAbilityNotFound, "ability %q is not registered", slug)
			}
			return "", nil, errx.Wrap(op, err)
		}
		abilityIDs = append(abilityIDs, ab.ID)
		resolved = append(resolved, ab.Slug)
	}
	plaintext, hash, err := MintOpaqueSecret(a.cfg.Random, prefixServiceKey)
	if err != nil {
		return "", nil, errx.Wrap(op, err)
	}
	now := a.now()
	k := &ServiceKey{
		IDHash:    hash,
		Name:      params.Name,
		Abilities: resolved,
		CreatedAt: now,
	}
	if params.TTL != nil {
		exp := now.Add(*params.TTL)
		k.ExpiresAt = &exp
	}
	if err := a.storeCreateServiceKey(ctx, k, abilityIDs); err != nil {
		return "", nil, errx.Wrap(op, err)
	}
	return plaintext, k, nil
}

// AuthenticateServiceKey validates a service token and returns the stored
// *ServiceKey with its abilities resolved.
func (a *Auth) AuthenticateServiceKey(ctx context.Context, plaintext string) (*ServiceKey, error) {
	const op = "authkit.Auth.AuthenticateServiceKey"
	hash, ok := ParseOpaqueSecret(prefixServiceKey, plaintext)
	if !ok {
		return nil, errx.Wrap(op, ErrServiceKeyInvalid)
	}
	k, err := a.storeGetServiceKey(ctx, hash)
	if err != nil {
		return nil, errx.Wrap(op, err)
	}
	now := a.now()
	if k.RevokedAt != nil {
		return nil, errx.Wrap(op, ErrServiceKeyInvalid)
	}
	if k.ExpiresAt != nil && !k.ExpiresAt.After(now) {
		return nil, errx.Wrap(op, ErrServiceKeyInvalid)
	}
	_ = a.storeTouchServiceKey(ctx, hash, now)
	return k, nil
}

// RevokeServiceKey marks a service token revoked. Idempotent on
// already-revoked keys.
func (a *Auth) RevokeServiceKey(ctx context.Context, plaintext string) error {
	const op = "authkit.Auth.RevokeServiceKey"
	hash, ok := ParseOpaqueSecret(prefixServiceKey, plaintext)
	if !ok {
		return errx.Wrap(op, ErrServiceKeyInvalid)
	}
	if err := a.storeRevokeServiceKey(ctx, hash, a.now()); err != nil {
		return errx.Wrap(op, err)
	}
	return nil
}

// ListServiceKeys returns every service token, including revoked and
// expired ones, ordered by creation time descending.
func (a *Auth) ListServiceKeys(ctx context.Context) ([]*ServiceKey, error) {
	const op = "authkit.Auth.ListServiceKeys"
	out, err := a.storeListServiceKeys(ctx)
	if err != nil {
		return nil, errx.Wrap(op, err)
	}
	return out, nil
}