Struct ApiKeyStore 

pub struct ApiKeyStore { /* private fields */ }

In-memory store for API keys with Argon2 hashing.

Validation uses a two-stage lookup: a fast SHA-256 prefix narrows the candidate set to (usually) one entry, avoiding a linear Argon2 scan that would otherwise take O(N * ~100ms) and create a CPU-exhaustion denial-of-service vector.

**** Rate limiting is applied per key prefix, so brute-force attempts targeting one key cannot lock out unrelated keys. A global counter provides an additional safety net against distributed attacks.

Implementations

impl ApiKeyStore

pub fn new() -> Self

Create a new empty key store.

pub fn key_exists(&self, name: &str) -> bool

Check whether a key with the given name is registered (not revoked).

This is an O(1) lookup that avoids the expensive Argon2 re-hash performed by validate. Use this for runtime revocation checks when the key has already been authenticated.

pub fn create_key( &mut self, name: &str, expires_at: Option<u64>, ) -> Result<String, AuthError>

Create a new API key with the given name and optional expiry.

Returns the raw key string that should be given to the user. The store only keeps the Argon2 hash.

pub fn bind_namespaces(&mut self, name: &str, namespaces: Vec<String>) -> bool

Confine an existing key to a set of namespaces.

An empty list leaves the key unrestricted. Returns false when no key of that name is stored.

pub fn set_admin(&mut self, name: &str, admin: bool) -> bool

Grant or revoke the administrative capability on an existing key.

Returns false when no key of that name is stored.

pub fn authenticate(&self, token: &str) -> Result<AuthContext, AuthError>

Authenticate token and build the context it grants.

The one place an API key becomes an AuthContext. chronixd has a second key store for keys minted at run time, and it assembled the context by hand from three accessors — so when the credential grew a roles list, a key created through POST /admin/auth/keys carried none of it and every role-based policy silently stopped matching for exactly those keys. Three accessors are three chances to forget the fourth.

Errors

Whatever validate returns.

pub fn entry(&self, name: &str) -> Option<&ApiKeyEntry>

The stored entry for name, if any.

The whole record, so a caller that must persist a key change writes exactly what the store holds rather than reassembling it from four accessors — which is the mistake that lost roles once already.

pub fn set_roles(&mut self, name: &str, roles: Vec<String>) -> bool

Assign the Cedar roles an existing key carries.

Returns false when no key of that name is stored.

pub fn roles(&self, name: &str) -> Vec<String>

The Cedar roles a key carries.

pub fn is_admin(&self, name: &str) -> bool

Whether a key carries the administrative capability.

pub fn namespaces_for(&self, name: &str) -> &[String]

The namespaces a key is confined to; empty means unrestricted.

pub fn unconfined_keys(&self) -> Vec<&str>

Names of keys that may act in any namespace.

A multi-tenant server refuses to start while this is non-empty: an unconfined key is the whole isolation boundary gone, and it fails open, so nothing in normal operation would reveal it.

pub fn add_entry(&mut self, entry: ApiKeyEntry)

Add a pre-hashed key entry (for loading from config).

Note: pre-hashed entries are not indexed by prefix and will only be found via the fallback linear Argon2 scan. Use register_plaintext when the raw key is available.

pub fn register_plaintext( &mut self, name: &str, raw_key: &str, expires_at: Option<u64>, ) -> Result<(), AuthError>

Register a plaintext key (hashing it with Argon2).

Used to pre-configure keys from server configuration files where the raw key is specified in cleartext.

Errors

Returns an error if a key with the same name already exists.

pub fn validate(&self, raw_key: &str) -> Result<String, AuthError>

Validate a raw API key against the store.

Uses a two-stage strategy:

1. Fast path – look up the SHA-256 prefix of raw_key in the prefix index and Argon2-verify only the (usually ≤ 1) matching candidates. This covers keys created via create_key and register_plaintext.
2. Fallback – if no indexed candidate matched, fall back to a linear Argon2 scan for entries loaded via add_entry (pre-hashed, no prefix).

Returns the key name on success.

pub fn revoke(&mut self, name: &str) -> bool

Revoke a key by name.

Also cleans up the prefix index. Stale prefix entries from pre-hashed keys (added via add_entry) are harmless — they simply won’t find a matching keys entry during validation.

pub fn list_keys(&self) -> Vec<&str>

List all key names.

pub fn len(&self) -> usize

Get the number of stored keys.

pub fn is_empty(&self) -> bool

Check if the store is empty.

Trait Implementations

impl Clone for ApiKeyStore

fn clone(&self) -> ApiKeyStore

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ApiKeyStore

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for ApiKeyStore

fn default() -> Self

Returns the “default value” for a type.