vocdoni / saas-backend / 28012901941

63%

push

github

feat(apikeys): scoped API keys for organizations

Add API keys so integrators can call the API programmatically without a JWT
session.

Model & storage: a new apiKeys collection (migration 0013) stores only the
SHA-256 hash of each secret plus a display prefix, scopes, creator, timestamps,
optional expiry and a revoked flag. The plaintext secret (vsk_…) is shown once
at creation. The down migration is a no-op (dropping the collection would
destroy live credentials); keys list most-recent-first.

Auth: the authenticator middleware recognizes a Bearer credential with the vsk_
prefix and resolves it against the apiKeys collection instead of parsing a JWT,
loading the key's owning user into the context so all existing per-organization
role checks work unchanged. Last-used time is stamped best-effort.

Authorization (deny-by-default): API keys are accepted only on an explicit
allowlist of integrator/managed-org endpoints; every other endpoint (auth,
password, OAuth, team/invites, tickets, checkout, API-key management itself, …)
rejects API-key auth. Within the allowlist each route requires a scope
(quota:read, managed:read, managed:write, voting:write, members:write) that the
key must hold.

Endpoints (admin only): POST/GET /organizations/{address}/apikeys and
DELETE /organizations/{address}/apikeys/{keyID}.

Tests cover key generation/hashing, scope validation, the route allowlist, the
storage layer, and the full API lifecycle (create → use within scope → rejected
for missing scope / non-allowlisted endpoint → revoke → 401). Swagger regenerated.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

207 of 286 new or added lines in 8 files covered. (72.38%)

9517 of 15364 relevant lines covered (61.94%)

44.13 hits per line