nodedb 0.2.1

Local-first, real-time, edge-to-cloud hybrid database for multi-modal workloads
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61

// SPDX-License-Identifier: BUSL-1.1

//! JWT exchange endpoint: validate JWT, JIT provision user, return `nda_` key.
//!
//! ```text
//! POST /v1/auth/exchange-key
//! Authorization: Bearer <jwt>
//! Content-Type: application/json
//! { "scopes": ["profile:read"], "rate_limit_qps": 100, "expires_days": 30 }
//!
//! Response: { "api_key": "nda_...", "auth_user_id": "...", "expires_in": 2592000 }
//! ```

use axum::extract::State;
use axum::http::HeaderMap;
use axum::response::IntoResponse;

use super::super::auth::{ApiError, AppState, resolve_auth};
use super::super::types::{HttpExchangeKeyRequest, HttpExchangeKeyResponse};

/// `POST /v1/auth/exchange-key` — Exchange a JWT for an `nda_` API key.
pub async fn exchange_key(
    headers: HeaderMap,
    State(state): State<AppState>,
    axum::Json(body): axum::Json<HttpExchangeKeyRequest>,
) -> Result<impl IntoResponse, ApiError> {
    let (identity, _auth_ctx) = resolve_auth(&headers, &state, "http")?;

    let auth_user_id = identity.user_id.to_string();
    let rate_limit_qps = body.rate_limit_qps.unwrap_or(0);
    let rate_limit_burst = body.rate_limit_burst.unwrap_or(0);
    let expires_days = body.expires_days.unwrap_or(0);

    let token = state.shared.auth_api_keys.create_key(
        &auth_user_id,
        identity.tenant_id.as_u64(),
        body.scopes,
        rate_limit_qps,
        rate_limit_burst,
        expires_days,
    );

    let expires_in = if expires_days > 0 {
        expires_days * 86_400
    } else {
        0
    };

    state.shared.audit_record(
        crate::control::security::audit::AuditEvent::AdminAction,
        Some(identity.tenant_id),
        &identity.username,
        &format!("JWT exchanged for auth API key for user '{auth_user_id}'"),
    );

    Ok(axum::Json(HttpExchangeKeyResponse {
        api_key: token,
        auth_user_id,
        expires_in,
    }))
}