more platform

auth/apikey.go

@@ -0,0 +1,166 @@
+package auth
+
+import (
+	"crypto/rand"
+	"crypto/sha256"
+	"crypto/subtle"
+	"encoding/base64"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"os"
+	"path/filepath"
+	"sync"
+	"time"
+)
+
+// APIKey is the stored record for a minted key. Only the SHA-256 of the
+// full key string is kept; the key itself is shown exactly once at mint
+// time. SHA-256 (not argon2/bcrypt) is sufficient because keys are 192-bit
+// random secrets, not low-entropy passwords.
+type APIKey struct {
+	ID        string    `json:"id"`
+	Name      string    `json:"name"`
+	Hash      string    `json:"hash"` // hex sha256 of the full key string
+	Scopes    []string  `json:"scopes,omitempty"`
+	CreatedAt time.Time `json:"createdAt"`
+}
+
+// ErrKeyNotFound is returned by Revoke for an unknown key id.
+var ErrKeyNotFound = errors.New("auth: api key not found")
+
+// KeyStore is a file-backed set of API keys (<file> is JSON, written
+// atomically). Volume is tiny — a handful of integration keys — so a flat
+// file beats dragging key records into the event-sourced graph store.
+type KeyStore struct {
+	path string
+	mu   sync.Mutex
+	keys []APIKey
+}
+
+// OpenKeyStore loads (or initializes) the key store at path.
+func OpenKeyStore(path string) (*KeyStore, error) {
+	s := &KeyStore{path: path}
+	raw, err := os.ReadFile(path)
+	if errors.Is(err, os.ErrNotExist) {
+		return s, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	if err := json.Unmarshal(raw, &s.keys); err != nil {
+		return nil, fmt.Errorf("auth: parse %s: %w", path, err)
+	}
+	return s, nil
+}
+
+// Mint creates a key with the given display name and scopes, persists its
+// hash, and returns the full key string — the only time it is available.
+func (s *KeyStore) Mint(name string, scopes []string) (key string, rec APIKey, err error) {
+	idBytes := make([]byte, 4)
+	secret := make([]byte, 24)
+	if _, err = rand.Read(idBytes); err != nil {
+		return "", APIKey{}, err
+	}
+	if _, err = rand.Read(secret); err != nil {
+		return "", APIKey{}, err
+	}
+	id := hex.EncodeToString(idBytes)
+	key = "gck_" + id + "_" + base64.RawURLEncoding.EncodeToString(secret)
+	rec = APIKey{
+		ID:        id,
+		Name:      name,
+		Hash:      hashKey(key),
+		Scopes:    scopes,
+		CreatedAt: time.Now().UTC(),
+	}
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.keys = append(s.keys, rec)
+	if err := s.saveLocked(); err != nil {
+		s.keys = s.keys[:len(s.keys)-1]
+		return "", APIKey{}, err
+	}
+	return key, rec, nil
+}
+
+// Revoke deletes the key with the given id.
+func (s *KeyStore) Revoke(id string) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	for i, k := range s.keys {
+		if k.ID == id {
+			s.keys = append(s.keys[:i], s.keys[i+1:]...)
+			return s.saveLocked()
+		}
+	}
+	return ErrKeyNotFound
+}
+
+// List returns the stored key records. Callers serving them over HTTP
+// should strip Hash themselves — it isn't secret-bearing, but is also not
+// a client concern.
+func (s *KeyStore) List() []APIKey {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	out := make([]APIKey, len(s.keys))
+	copy(out, s.keys)
+	return out
+}
+
+// lookup finds the record whose hash matches the presented key.
+func (s *KeyStore) lookup(presented string) (APIKey, bool) {
+	h := []byte(hashKey(presented))
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	for _, k := range s.keys {
+		if subtle.ConstantTimeCompare(h, []byte(k.Hash)) == 1 {
+			return k, true
+		}
+	}
+	return APIKey{}, false
+}
+
+// saveLocked writes the store atomically (tmp + rename). Callers hold s.mu.
+func (s *KeyStore) saveLocked() error {
+	raw, err := json.MarshalIndent(s.keys, "", "  ")
+	if err != nil {
+		return err
+	}
+	if err := os.MkdirAll(filepath.Dir(s.path), 0o755); err != nil {
+		return err
+	}
+	tmp := s.path + ".tmp"
+	if err := os.WriteFile(tmp, raw, 0o600); err != nil {
+		return err
+	}
+	return os.Rename(tmp, s.path)
+}
+
+func hashKey(key string) string {
+	sum := sha256.Sum256([]byte(key))
+	return hex.EncodeToString(sum[:])
+}
+
+// APIKeyAuth authenticates requests carrying `X-API-Key: <key>` against a
+// KeyStore. The Principal's Subject is the key id and its Scopes are the
+// scopes the key was minted with.
+type APIKeyAuth struct {
+	Keys *KeyStore
+}
+
+var _ Authenticator = APIKeyAuth{}
+
+func (a APIKeyAuth) Authenticate(r *http.Request) (*Principal, error) {
+	presented := r.Header.Get("X-API-Key")
+	if presented == "" {
+		return nil, ErrNoCredentials
+	}
+	rec, ok := a.Keys.lookup(presented)
+	if !ok {
+		return nil, errors.New("auth: invalid api key")
+	}
+	return &Principal{Subject: rec.ID, Scopes: rec.Scopes, Kind: KindAPIKey}, nil
+}