Feature: add api key auth #204

tafaust · 2025-10-04T12:40:31Z

Warning: this PR is based on top off #202 (I can remove that dependency though)

Solves #182

Screenshots:

Overview:

Create new API key modal (respects tanstack query):

Overview:

tafaust · 2025-10-06T10:33:27Z

@0xfurai please review :)

codecov · 2025-10-09T00:55:05Z

Codecov Report

❌ Patch coverage is 0% with 690 lines in your changes missing coverage. Please review.
✅ Project coverage is 18.61%. Comparing base (1336d6c) to head (2b8bad0).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
apps/server/src/modules/api_key/api_key.service.go	0.00%	185 Missing ⚠️
...er/src/modules/api_key/api_key.mongo.repository.go	0.00%	140 Missing ⚠️
...rver/src/modules/api_key/api_key.sql.repository.go	0.00%	119 Missing ⚠️
...s/server/src/modules/api_key/api_key.controller.go	0.00%	118 Missing ⚠️
apps/server/src/modules/api_key/middleware.go	0.00%	28 Missing ⚠️
apps/server/src/modules/middleware/auth_chain.go	0.00%	23 Missing ⚠️
apps/server/src/modules/api_key/api_key.route.go	0.00%	20 Missing ⚠️
apps/server/src/modules/api_key/api_key.dto.go	0.00%	17 Missing ⚠️
apps/server/src/modules/api_key/api_key.utils.go	0.00%	12 Missing ⚠️
...ps/server/src/modules/middleware/middleware.dig.go	0.00%	9 Missing ⚠️
... and 11 more

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #204      +/-   ##
==========================================
- Coverage   19.31%   18.61%   -0.70%     
==========================================
  Files         170      181      +11     
  Lines       18144    18826     +682     
==========================================
  Hits         3504     3504              
- Misses      14479    15161     +682     
  Partials      161      161

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

0xfurai · 2025-10-09T02:39:41Z

Wow this is huge effort! Could you please remove dependency if possible.

tafaust · 2025-10-09T03:19:24Z

Wow this is huge effort! Could you please remove dependency if possible.

Yes, no problem. :)

tafaust · 2025-10-09T06:49:24Z

Rebased on main of this repository. FYI @0xfurai

0xfurai

wow! this is huge PR, thanks again. I have left couple of comments, most of them minor but the api keys validation is important to address.

Waiting for updates 😉

apps/server/src/modules/api_key/api_key.controller.go

apps/web/src/app/security/components/api-keys.tsx

tafaust · 2025-10-10T10:43:04Z

@0xfurai the // MARK: ... comments show in the vscode code minimap which helps navigate large files quickly.

tafaust · 2025-10-11T11:18:21Z

FYI I didn't test HEAD.

tafaust · 2025-10-11T18:04:43Z

Not sure why the codecov checks are failing. Is it because of the line coverage decreasing?

apps/web/src/app/security/components/api-keys.tsx

apps/server/src/modules/api_key/api_key.mongo.repository.go

0xfurai · 2025-10-11T19:17:19Z

Not sure why the codecov checks are failing. Is it because of the line coverage decreasing?

codecov only failing, thats fine

tafaust · 2025-10-11T19:19:53Z

@0xfurai FYI I can test and rebase onto main when the asdf PR is merged.

0xfurai · 2025-10-11T19:24:42Z

@0xfurai FYI I can test and rebase onto main when the asdf PR is merged.

done, go ahead

- Add complete API key CRUD operations with validation - Implement unified AuthChain middleware for consistent authentication - Add API key management endpoints with proper error handling - Enhance database schema for API key storage and relationships - Add comprehensive validation for API key creation and updates - Implement multi-language localization support for API key management - Remove unused authentication methods and streamline middleware - Add proper field validation and required field enforcement This implementation provides a robust foundation for API key-based authentication across the Peekaping monitoring platform.

…ferences - Remove user_id from API key model and related database schema - Update API key service and repository methods to eliminate user_id dependency - Refactor controller methods to handle API key operations without user context

- Eliminate FindByKeyHash method from both MongoDB and SQL repository implementations - Update repository interfaces to reflect the removal of the FindByKeyHash method

- Update error responses in CreateAPIKey, GetAPIKeys, GetAPIKey, UpdateAPIKey, and DeleteAPIKey methods to return specific error messages instead of generic ones. - Log a warning when an API key is not found in the Delete method of the service layer.

- Implement validation in CreateAPIKey and UpdateAPIKey methods to ensure expiration date is not in the past and max usage count is greater than 0. - Remove redundant validation logic from the service layer, centralizing it in the controller for clean boundary separation.

- Eliminate the FindAll method from the SQLRepositoryImpl, streamlining the API key management logic. - This change simplifies the repository interface and focuses on essential operations.

- Update API key generation to include its unique ID for each key, improving traceability. - Refactor validation logic to parse the API key token, extracting the ID and actual key for verification. - Simplify the validation process by reducing the number of database queries needed to validate an API key. - Ensure that the actual key is securely hashed and stored, while the token includes the ID and key in a structured format.

- Update API key display key generation to use ApiKeyPrefix for consistency. - Modify middleware to check for ApiKeyPrefix instead of hardcoded values in authorization logic. - Enhance error handling in authentication methods to utilize http.StatusUnauthorized for clarity.

…ount - Update validation logic in the API key creation schema to ensure expiration date is a valid future date. - Refine max usage count validation to enforce that it is a positive integer. - Add additional validation checks before submission to provide immediate feedback on errors.

- Replace separate state variables for new token and newly created key ID with a single object to streamline state management. - Update related functions to utilize the new state structure for improved clarity and maintainability. - Ensure UI components reflect changes in the consolidated state.

- Introduce a new CreateAPIKeyModal component to streamline the API key creation process. - Replace the previous dialog implementation with a more modular approach, enhancing code readability and maintainability. - Update the APIKeys component to utilize the new modal, improving user experience by managing state and success callbacks more effectively.

- Introduce a DeleteConfirmationModal component to confirm API key deletions, enhancing user experience and preventing accidental deletions. - Update the APIKeys component to manage the delete confirmation state and handle deletion logic more effectively. - Refactor the handleDelete function to trigger the confirmation modal with the appropriate API key details.

- Remove JSON tags and validation constraints from CreateRequest and UpdateRequest types.

- Change the Alert component in the APIKeys to use a success variant for better visual feedback. - Modify the styling of the token display to enhance readability and user experience.

- Introduce translations for the delete confirmation dialog related to API keys in various languages, enhancing internationalization support. - Languages updated include Arabic, Belarusian, Bulgarian, Czech, Danish, German, Greek, English, Spanish, Estonian, Basque, Persian, Finnish, French, Irish, Hebrew, Croatian, Hungarian, Indonesian, Italian, Japanese, Georgian, Korean, Lithuanian, Norwegian, Dutch, Polish, Portuguese, Romanian, Slovenian, Serbian (Cyrillic and Latin), Swedish, Thai, Turkish, Ukrainian, Urdu, Uzbek, Vietnamese, Cantonese, Simplified Chinese, Traditional Chinese, and more.

tafaust · 2025-10-11T20:44:58Z

New screenshots:

Delete Modal with i18n
Success alert
Final testing

- Refactor API key creation process to generate keys in three phases: initial record creation, key generation, and record update with key details. - Introduce new methods for updating key hash and display key in both MongoDB and SQL repositories. - Enhance the service layer to handle key generation and parsing, improving overall API key management. - Remove redundant utility functions related to key generation and hashing, consolidating logic within the service layer for better maintainability.

- Adjust the validation logic in isValidAPIKeyFormat to allow for a longer key length, accommodating base64 encoding requirements. - Ensure the prefix check uses the length of ApiKeyPrefix for improved accuracy.

- Change last_used and expires_at columns to TIMESTAMPTZ for better timezone handling. - Allow key_hash and display_key to be NULL initially to support two-phase creation process. - Update created_at and updated_at columns to TIMESTAMPTZ for consistency.

- Remove redundant JWT and API key authentication methods, consolidating logic into the AllAuth method. - Enhance logging for missing authorization headers and successful authentication attempts. - Introduce clear type and constructor comments for better code organization.

0xfurai · 2025-10-11T21:25:24Z

LGTM, thanks for contribution!

tafaust force-pushed the feature/182-api-key branch from bf65290 to f2dc1c7 Compare October 7, 2025 06:24

tafaust force-pushed the feature/182-api-key branch from f2dc1c7 to e56c516 Compare October 9, 2025 06:48

0xfurai requested changes Oct 10, 2025

View reviewed changes

0xfurai reviewed Oct 11, 2025

View reviewed changes

apps/web/src/app/security/components/api-keys.tsx Outdated Show resolved Hide resolved

0xfurai reviewed Oct 11, 2025

View reviewed changes

apps/server/src/modules/api_key/api_key.mongo.repository.go Outdated Show resolved Hide resolved

tafaust and others added 14 commits October 11, 2025 21:28

refactor(api_key): remove FindByKeyHash method from repositories

9a0d0e3

- Eliminate FindByKeyHash method from both MongoDB and SQL repository implementations - Update repository interfaces to reflect the removal of the FindByKeyHash method

refactor(api_key): remove FindAll method from SQL repository

29075e2

- Eliminate the FindAll method from the SQLRepositoryImpl, streamlining the API key management logic. - This change simplifies the repository interface and focuses on essential operations.

refactor(api_key): remove index on display_key in API keys table

da3fe14

refactor(api_key): simplify CreateRequest and UpdateRequest structures

671acf4

- Remove JSON tags and validation constraints from CreateRequest and UpdateRequest types.

tafaust added 2 commits October 11, 2025 21:28

fix(api_key): update success alert styling in APIKeys component

7024855

- Change the Alert component in the APIKeys to use a success variant for better visual feedback. - Modify the styling of the token display to enhance readability and user experience.

refactor(api_key): move modals to their own component files

09ac4cc

tafaust force-pushed the feature/182-api-key branch from 4e1115e to 09ac4cc Compare October 11, 2025 19:28

tafaust added 4 commits October 11, 2025 22:46

fix(api_key): update API key format validation logic

4bca959

- Adjust the validation logic in isValidAPIKeyFormat to allow for a longer key length, accommodating base64 encoding requirements. - Ensure the prefix check uses the length of ApiKeyPrefix for improved accuracy.

tafaust requested a review from 0xfurai October 11, 2025 21:11

0xfurai merged commit 0ad9871 into 0xfurai:main Oct 11, 2025
7 of 9 checks passed

Feature: add api key auth #204

Feature: add api key auth #204

Uh oh!

Conversation

tafaust commented Oct 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Screenshots:

Uh oh!

tafaust commented Oct 6, 2025

Uh oh!

codecov bot commented Oct 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

0xfurai commented Oct 9, 2025

Uh oh!

tafaust commented Oct 9, 2025

Uh oh!

tafaust commented Oct 9, 2025

Uh oh!

0xfurai left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

tafaust commented Oct 10, 2025

Uh oh!

tafaust commented Oct 11, 2025

Uh oh!

tafaust commented Oct 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

0xfurai commented Oct 11, 2025

Uh oh!

tafaust commented Oct 11, 2025

Uh oh!

0xfurai commented Oct 11, 2025

Uh oh!

tafaust commented Oct 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

0xfurai commented Oct 11, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

tafaust commented Oct 4, 2025 •

edited

Loading

codecov bot commented Oct 9, 2025 •

edited

Loading

tafaust commented Oct 11, 2025 •

edited

Loading

tafaust commented Oct 11, 2025 •

edited

Loading