Struct ApiKeyPlugin 

pub struct ApiKeyPlugin { /* private fields */ }

API Key management plugin.

Implementations

impl ApiKeyPlugin

pub async fn delete_all_expired_api_keys( &self, ctx: &AuthContext<impl AuthSchema>, ) -> DeleteExpiredApiKeysResponse

Force cleanup across owners/configurations, updating the same global automatic-cleanup timestamp and awaiting deletion despite the throttle.

impl ApiKeyPlugin

pub fn verify_endpoint( input: &ApiKeyVerificationInput, ) -> AuthResult<ServerEndpoint<ApiKeyVerificationOutput>>

Verify and consume usage through the installed logical endpoint pipeline.

Errors

Returns an error if input serialization fails.

pub const fn delete_all_expired_endpoint() -> ServerEndpoint<DeleteExpiredApiKeysResponse>

pub fn create_endpoint( body: &CreateKeyRequest, ) -> AuthResult<ServerEndpoint<CreateKeyResponse>>

Create a key through installed hooks and actual server/client context policy.

Errors

Returns an error if input serialization fails.

pub fn update_endpoint( body: &UpdateKeyRequest, ) -> AuthResult<ServerEndpoint<ApiKeyView>>

Update through installed hooks and owner checks after patched-body validation.

Errors

Returns an error if input serialization fails.

pub fn get_endpoint( query: &GetKeyQuery, ) -> AuthResult<ServerEndpoint<ApiKeyView>>

Read an owned key through installed hooks without exposing its secret.

Errors

Returns an error if query serialization fails.

pub fn delete_endpoint( body: &DeleteKeyRequest, ) -> AuthResult<ServerEndpoint<DeleteKeyResponse>>

Delete an owned key through installed hooks and authenticated policy.

Errors

Returns an error if body serialization fails.

pub fn list_endpoint( query: &ListKeysQuery, ) -> AuthResult<ServerEndpoint<ListKeysResponse>>

List visible keys through installed hooks and authenticated ownership policy.

Errors

Returns an error if query serialization fails.

impl ApiKeyPlugin

pub async fn create_key( &self, ctx: &AuthContext<impl AuthSchema>, body: &CreateKeyRequest, ) -> AuthResult<CreateKeyResponse>

Create a key on behalf of body.user_id from trusted server code. Organization configurations still require the user’s organization permission.

Errors

Returns errors from input validation, permission checks, or API-key storage.

pub async fn update_key( &self, ctx: &AuthContext<impl AuthSchema>, body: &UpdateKeyRequest, ) -> AuthResult<ApiKeyView>

Update a key on behalf of body.user_id from trusted server code. The caller must authorize access before invoking this server-only method.

Errors

Returns errors from input validation, permission checks, or API-key storage.

impl ApiKeyPlugin

pub async fn verify_api_key( &self, input: &VerifyApiKey<'_>, ctx: &AuthContext<impl AuthSchema>, ) -> Result<ApiKeyView, ApiKeyVerificationError>

Verify a machine credential without a user session or public HTTP endpoint.

A successful verification consumes quota and a rate-limit slot. Permissions and configuration mismatches do not consume usage. The returned key omits the plaintext credential and stored hash.

Without config_id, lookup uses the default configuration’s hashing setting. Validation then uses the configuration that issued the key.

Errors

Returns an error if verification hooks or storage operations fail.

pub async fn verify_api_key_with_request( &self, input: &VerifyApiKey<'_>, request: &AuthRequest, ctx: &AuthContext<impl AuthSchema>, ) -> Result<ApiKeyView, ApiKeyVerificationError>

Verify with the actual caller request available to trusted predicates. This performs the same server-only verification operation as verify_api_key.

Errors

Propagates verification-hook or storage errors for the supplied request.

impl ApiKeyPlugin

pub fn configuration(self, config: ApiKeyConfig) -> Self

Register an additional named configuration.

Upstream allows several api-key configurations side by side, each with its own config_id, ownership model and limits.

impl ApiKeyPlugin

Builder for ApiKeyPlugin powered by the bon crate.

Usage:

use alibi_plugins::api_key::{ApiKeyPlugin, RateLimitDefaults};
let plugin = ApiKeyPlugin::builder()
    .key_length(48)
    .prefix("ba_".to_string())
    .enable_metadata(true)
    .rate_limit(RateLimitDefaults { enabled: true, time_window: 60_000.0, max_requests: 5.0 })
    .build();

pub fn with_config(config: ApiKeyConfig) -> Self

pub fn builder() -> ApiKeyPluginBuilder

Trait Implementations

impl<S: AuthSchema> AuthPlugin<S> for ApiKeyPlugin

fn name(&self) -> &'static str

Plugin name - should be unique

fn routes(&self) -> Vec<AuthRoute>

Routes that this plugin handles

fn on_request<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, req: &'life1 AuthRequest, ctx: &'life2 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = AuthResult<Option<AuthResponse>>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Called for each request - return Some(response) to handle, None to pass through

fn static_openapi_metadata(&self) -> PluginOpenApiMetadata

Base declarations for documentation without an initialized auth instance.

fn openapi_metadata(&self, ctx: &AuthInitContext<S>) -> PluginOpenApiMetadata

Documentation annotations collected after all plugins initialize. Override this hook for custom endpoints and model field policies.

fn on_init<'life0, 'life1, 'async_trait>( &'life0 self, _ctx: &'life1 mut AuthInitContext<S>, ) -> Pin<Box<dyn Future<Output = AuthResult<()>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Called when the plugin is initialized

fn server_endpoints(&self) -> Vec<EndpointDefinition>

Trusted operations available through host dispatch, independently of HTTP visibility.

fn endpoint_hooks(&self) -> Vec<&dyn EndpointHook<S>>

Installed logical-call hooks, in this plugin’s registration order.

fn validate_endpoint( &self, call: &EndpointCall, _ctx: &AuthContext<S>, ) -> AuthResult<EndpointInput>

Validate actual input after all before-hook patches have been applied.

fn on_endpoint<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, call: &'life1 EndpointCall, ctx: &'life2 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = AuthResult<EndpointResponse>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Execute a registered operation with validated handler-phase context.

fn before_request<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, req: &'life1 AuthRequest, ctx: &'life2 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = AuthResult<Option<BeforeRequestAction>>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Called after route matching and before endpoint dispatch.

fn rate_limits(&self) -> Vec<PluginRateLimit>

Ordered rate-limit policies supplied by this installed plugin.

fn allowed_media_types(&self, _route: &AuthRoute) -> Vec<&'static str>

Media types accepted before request hooks and endpoint dispatch. An empty list disables the media restriction for an application-owned endpoint.

fn origin_check_skip_paths(&self) -> Vec<&'static str>

Protocol callback prefixes whose verified state replaces browser origin admission.

fn session_fields(&self) -> IndexMap<String, FieldConfig>

Session field policies contributed by this registered plugin.

fn user_fields(&self) -> IndexMap<String, FieldConfig>

fn account_fields(&self) -> IndexMap<String, FieldConfig>

fn on_http_request<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, _req: &'life1 AuthRequest, _ctx: &'life2 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = Result<Option<AuthResponse>, AuthError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, Self: 'async_trait,

Inspect the original physical HTTP request before routing, body parsing, origin validation and endpoint hooks. Disabled paths and transport/rate limiting middleware run first. Returning a response stops dispatch and later plugin hooks. Server-only endpoint calls do not invoke this hook.

fn on_http_request_action<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, req: &'life1 AuthRequest, ctx: &'life2 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = Result<Option<HttpRequestAction>, AuthError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, Self: 'async_trait,

Inspect or replace the physical request. The default preserves existing on_http_request implementations. Request-local configuration has already been resolved from the incoming request, matching the Source HTTP handler.

fn on_http_response<'life0, 'life1, 'life2, 'life3, 'async_trait>( &'life0 self, _req: &'life1 AuthRequest, _ctx: &'life2 AuthContext<S>, _response: &'life3 AuthResponse, ) -> Pin<Box<dyn Future<Output = Result<Option<AuthResponse>, AuthError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, 'life3: 'async_trait, Self: 'async_trait,

Observe the routed HTTP response before transport middleware (including CORS). Hooks run in registration order; the first replacement stops this chain. Early HTTP request-hook responses skip this stage. Errors escape dispatch; they cannot reverse writes already committed by an endpoint.

fn on_http_endpoint<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, req: &'life1 AuthRequest, ctx: &'life2 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = Result<Option<HttpEndpointResponse>, AuthError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, Self: 'async_trait,

Dispatch the resolved HTTP endpoint. Existing plugins return logical values through on_request; plugins returning a native raw response can override this method to bypass the endpoint after-hook pipeline.

fn after_request<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, _req: &'life1 AuthRequest, _ctx: &'life2 AuthContext<S>, response: AuthResponse, ) -> Pin<Box<dyn Future<Output = Result<AuthResponse, AuthError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, Self: 'async_trait,

Transform a completed response, including redirects and rejections.

fn on_user_created<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, _user: &'life1 <S as AuthSchema>::User, _ctx: &'life2 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = Result<(), AuthError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, Self: 'async_trait,

Called after a user is created

fn on_session_created<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, _session: &'life1 <S as AuthSchema>::Session, _ctx: &'life2 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = Result<(), AuthError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, Self: 'async_trait,

Called after a session is created

fn on_user_deleted<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, _user_id: &'life1 str, _ctx: &'life2 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = Result<(), AuthError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, Self: 'async_trait,

Called before a user is deleted

fn on_session_deleted<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, _session_token: &'life1 str, _ctx: &'life2 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = Result<(), AuthError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, Self: 'async_trait,

Called before a session is deleted

impl Clone for ApiKeyPlugin

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ApiKeyPlugin

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<S: AuthSchema> EndpointHook<S> for ApiKeyPlugin

fn matches_before( &self, call: &EndpointCall, ctx: &AuthContext<S>, ) -> AuthResult<bool>

Matchers observe raw logical context, before middleware normalization.

fn before<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, call: &'life1 EndpointCall, ctx: &'life2 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = AuthResult<Option<BeforeEndpointAction>>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Errors

fn matches_after( &self, _call: &EndpointCall, _ctx: &AuthContext<S>, _response: &EndpointResponse, ) -> Result<bool, AuthError>

Errors

fn after<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, _call: &'life1 EndpointCall, _ctx: &'life2 AuthContext<S>, response: EndpointResponse, ) -> Pin<Box<dyn Future<Output = Result<EndpointResponse, AuthError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, Self: 'async_trait,

Errors