Christian Krakau-Louis
138 lines
4.1 KiB
Python
138 lines
4.1 KiB
Python
"""Admin API token management endpoints."""
|
|
|
|
from typing import List, Optional
|
|
|
|
from fastapi import APIRouter, Depends, HTTPException, Request, status
|
|
from pydantic import BaseModel, Field
|
|
from sqlalchemy.orm import Session
|
|
|
|
from app.core.database import get_db
|
|
from app.core.security import require_admin_auth
|
|
from app.models.api_token import APIToken
|
|
from app.services.api_tokens import (
|
|
PUBLIC_READ_SCOPES,
|
|
create_api_token,
|
|
revoke_api_token,
|
|
token_to_dict,
|
|
)
|
|
from app.services.workspace_audit import record_workspace_audit_log
|
|
from app.services.workspaces import assign_default_workspace_to_unscoped_rows
|
|
|
|
router = APIRouter()
|
|
|
|
|
|
class APITokenCreateRequest(BaseModel):
|
|
"""Request body for creating a scoped API token."""
|
|
|
|
name: str = Field(..., min_length=1, max_length=120)
|
|
scopes: List[str] = Field(default_factory=lambda: sorted(PUBLIC_READ_SCOPES))
|
|
|
|
|
|
class APITokenResponse(BaseModel):
|
|
"""API-safe token metadata."""
|
|
|
|
id: int
|
|
name: str
|
|
key_prefix: str
|
|
scopes: List[str]
|
|
active: bool
|
|
created_at: str
|
|
last_used_at: Optional[str] = None
|
|
last_used_ip: Optional[str] = None
|
|
usage_count: int
|
|
revoked_at: Optional[str] = None
|
|
|
|
|
|
class APITokenCreateResponse(BaseModel):
|
|
"""New token response. The secret is returned once."""
|
|
|
|
token: str
|
|
metadata: APITokenResponse
|
|
|
|
|
|
class APITokenListResponse(BaseModel):
|
|
"""List of API token metadata rows."""
|
|
|
|
tokens: List[APITokenResponse]
|
|
available_scopes: List[str]
|
|
|
|
|
|
@router.get("", response_model=APITokenListResponse)
|
|
async def list_api_tokens(
|
|
db: Session = Depends(get_db),
|
|
_auth: dict = Depends(require_admin_auth),
|
|
):
|
|
"""List API token metadata without exposing raw secrets or hashes."""
|
|
rows = db.query(APIToken).order_by(APIToken.created_at.desc(), APIToken.id.desc()).all()
|
|
return APITokenListResponse(
|
|
tokens=[APITokenResponse(**token_to_dict(row)) for row in rows],
|
|
available_scopes=sorted(PUBLIC_READ_SCOPES),
|
|
)
|
|
|
|
|
|
@router.post("", response_model=APITokenCreateResponse, status_code=status.HTTP_201_CREATED)
|
|
async def create_public_api_token(
|
|
payload: APITokenCreateRequest,
|
|
request: Request,
|
|
db: Session = Depends(get_db),
|
|
_auth: dict = Depends(require_admin_auth),
|
|
):
|
|
"""Create a scoped API token for read-only automation."""
|
|
workspace = assign_default_workspace_to_unscoped_rows(db)
|
|
try:
|
|
created = create_api_token(db, name=payload.name, scopes=payload.scopes)
|
|
except ValueError as exc:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
|
|
detail=str(exc),
|
|
) from exc
|
|
record_workspace_audit_log(
|
|
db,
|
|
workspace=workspace,
|
|
action="api_token.created",
|
|
entity_type="api_token",
|
|
entity_id=created.token.id,
|
|
entity_name=created.token.name,
|
|
details={
|
|
"scopes": sorted(created.token.scopes.split(",")),
|
|
"key_prefix": created.token.key_prefix,
|
|
},
|
|
auth_context=_auth,
|
|
request=request,
|
|
commit=True,
|
|
)
|
|
return APITokenCreateResponse(
|
|
token=created.secret,
|
|
metadata=APITokenResponse(**token_to_dict(created.token)),
|
|
)
|
|
|
|
|
|
@router.delete("/{token_id}", status_code=status.HTTP_200_OK)
|
|
async def revoke_public_api_token(
|
|
token_id: int,
|
|
request: Request,
|
|
db: Session = Depends(get_db),
|
|
_auth: dict = Depends(require_admin_auth),
|
|
):
|
|
"""Revoke a scoped API token."""
|
|
workspace = assign_default_workspace_to_unscoped_rows(db)
|
|
token = db.query(APIToken).filter(APIToken.id == token_id).first()
|
|
if not revoke_api_token(db, token_id):
|
|
raise HTTPException(
|
|
status_code=status.HTTP_404_NOT_FOUND,
|
|
detail="API token not found",
|
|
)
|
|
record_workspace_audit_log(
|
|
db,
|
|
workspace=workspace,
|
|
action="api_token.revoked",
|
|
entity_type="api_token",
|
|
entity_id=token_id,
|
|
entity_name=token.name if token else None,
|
|
details={"key_prefix": token.key_prefix if token else None},
|
|
auth_context=_auth,
|
|
request=request,
|
|
commit=True,
|
|
)
|
|
return {"revoked": True}
|