api-keys-simplified 0.5.1

Secure API key generation and validation library
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114

use api_keys_simplified::{ApiKeyManagerV0, Environment, HashConfig, KeyConfig, KeyStatus};
use api_keys_simplified::{ExposeSecret, SecureStringExt};

#[test]
fn test_custom_entropy() {
    let config = KeyConfig::new().with_entropy(16).unwrap();
    let generator = ApiKeyManagerV0::init(
        "sk",
        config,
        HashConfig::default(),
        std::time::Duration::ZERO,
    )
    .unwrap();
    let key = generator.generate(Environment::test()).unwrap();

    assert!(key.key().len() > 10);
}

#[test]
fn test_without_checksum() {
    let config = KeyConfig::default().disable_checksum();
    let generator = ApiKeyManagerV0::init(
        "pk",
        config,
        HashConfig::default(),
        std::time::Duration::ZERO,
    )
    .unwrap();
    let key = generator.generate(Environment::production()).unwrap();

    // Environment "live" means production, Base64URL can contain underscores and hyphens
    // Key format with dash separator: pk-live-{base64url_data}
    // No checksum, so no dot at the end
    assert!(key.key().expose_secret().starts_with("pk-live-"));
    assert!(
        !key.key().expose_secret().contains('.'),
        "Should not have checksum dot"
    );
}

#[test]
fn test_high_security_preset() {
    let generator = ApiKeyManagerV0::init_high_security_config("sk").unwrap();
    let key = generator.generate(Environment::production()).unwrap();

    assert!(key.key().len() > 50); // Higher entropy = longer key
    assert_eq!(
        generator
            .verify(key.key(), key.expose_hash().hash())
            .unwrap(),
        KeyStatus::Valid
    );
}

#[test]
fn test_balanced_preset() {
    let balanced_gen = ApiKeyManagerV0::init_default_config("sk").unwrap();
    let key = balanced_gen.generate(Environment::production()).unwrap();

    let high_gen = ApiKeyManagerV0::init_high_security_config("sk").unwrap();
    let high = high_gen.generate(Environment::production()).unwrap();

    assert!(key.key().len() < high.key().len());
}

#[test]
fn test_custom_hash_config() {
    let hash_config = HashConfig::custom(8192, 1, 1).unwrap();

    let config = KeyConfig::default();
    let generator =
        ApiKeyManagerV0::init("text", config, hash_config, std::time::Duration::ZERO).unwrap();
    let key = generator.generate(Environment::dev()).unwrap();

    assert_eq!(
        generator
            .verify(key.key(), key.expose_hash().hash())
            .unwrap(),
        KeyStatus::Valid
    );
}

#[test]
fn test_entropy_boundaries() {
    // Minimum entropy
    let config_min = KeyConfig::new().with_entropy(16).unwrap();
    let gen_min = ApiKeyManagerV0::init(
        "min",
        config_min,
        HashConfig::default(),
        std::time::Duration::ZERO,
    )
    .unwrap();
    let key_min = gen_min.generate(Environment::test()).unwrap();
    assert!(!key_min.key().is_empty());

    // Maximum entropy
    let config_max = KeyConfig::new().with_entropy(64).unwrap();
    let gen_max = ApiKeyManagerV0::init(
        "max",
        config_max,
        HashConfig::default(),
        std::time::Duration::ZERO,
    )
    .unwrap();
    let key_max = gen_max.generate(Environment::test()).unwrap();
    assert!(key_max.key().len() > key_min.key().len());
}

#[test]
fn test_invalid_entropy() {
    assert!(KeyConfig::new().with_entropy(8).is_err());
    assert!(KeyConfig::new().with_entropy(128).is_err());
}