Repository navigation
feat(auth): wire and validate API key auth end-to-end, close Bug #24 - #40
Merged
Merged
Conversation
- Add VALID_SCOPES constant to validation.py; CreateAPIKeyRequest validator now rejects unknown/arbitrary scopes with 422 (Bug #24) - Scope enforcement already wired via require_scopes on project endpoints; regression tests now unconditionally assert 403 for under-scoped keys - API keys default to NO expiration (null); previous silent 1-year default removed — users can now supply a specific date or leave blank for forever - Form date-picker replaces preset dropdown: radio 'No expiration' (default) or 'Set expiration date' with a date input (YYYY-MM-DD) - JSON API supports expires_at ISO string or null/omitted for no expiry - Record last_used_at on every successful API key authentication (best-effort) - Migration 010: add last_used_at column (nullable DateTime) to api_keys - Add VALID_SCOPES to api_key model comment and bump key_hash comment to SHA-256 - Rewrite tests/integration/test_api_key_scopes.py with full scope/expiry/ revocation coverage (11 tests replacing placeholder) - Close Bug #24 in BUGS.md; update CHANGELOG under [Unreleased / v1.0.0-rc.1]
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Completes the last 1.0.0 scope item: fully wired and validated API key authentication/authorization, closing Bug #24.
Changes
Bug #24 — Scope validation (fixed)
VALID_SCOPESconstant fromvalidation.py;CreateAPIKeyRequestPydantic validator now rejects any unknown scope with 422 — arbitrary values likeadmin,superuserare blocked at creationrequire_scopesdependency was already wired on project endpoints — tests now unconditionally assert 403 for keys lacking the required scope (previously soft-conditional, so the test never actually enforced anything)Expiration — user choice (no more silent default)
expires_at = null) — the previous undocumented 1-year default is goneexpires_at(ISO 8601) or omit/null for neverlast_used_attrackingapi_keysmodel gains alast_used_at(nullable DateTime) column_get_user_id_from_api_keyinauth.pyupdates it on every successful authentication (best-effort — auth not blocked if update fails)Tests
tests/integration/test_api_key_scopes.pywith 11 real tests covering: valid/invalid scope creation, read/write scope enforcement, revocation, no-expiry nullability, future/past expiry, andlast_used_attests/validation/test_api_key_validation.py: scope rejection now asserts 422; insufficient-scope usage now asserts 403 unconditionally; no-expiry key assertsexpires_atis nullChecklist