Struct ApiKeyStore 

pub struct ApiKeyStore(/* private fields */);

Tenant-scoped API key store.

Handles key generation, SHA-256 hashing, constant-time verification, touch throttling, and delegates storage to the backend. Cheap to clone (wraps Arc).

Example

use modo::auth::apikey::{ApiKeyConfig, ApiKeyStore};

let store = ApiKeyStore::new(db, ApiKeyConfig::default()).unwrap();

Implementations

impl ApiKeyStore

pub fn new(db: Database, config: ApiKeyConfig) -> Result<Self>

Create from the built-in SQLite backend.

Validates config at construction — fails fast on invalid prefix or secret length.

Errors

Returns an error if ApiKeyConfig::validate fails.

pub fn from_backend( backend: Arc<dyn ApiKeyBackend>, config: ApiKeyConfig, ) -> Result<Self>

Create from a custom backend.

Validates config at construction.

Errors

Returns an error if ApiKeyConfig::validate fails.

pub async fn create(&self, req: &CreateKeyRequest) -> Result<ApiKeyCreated>

Create a new API key. Returns the raw token (shown once).

Errors

Returns bad_request if tenant_id or name is empty, or if expires_at is not a valid RFC 3339 timestamp. Propagates backend storage errors.

pub async fn verify(&self, raw_token: &str) -> Result<ApiKeyMeta>

Verify a raw token. Returns metadata if valid.

All failure cases return the same generic unauthorized error to prevent enumeration.

Errors

Returns unauthorized if the token is malformed, not found, revoked, expired, or the hash does not match. Propagates backend lookup errors.

pub async fn revoke(&self, key_id: &str) -> Result<()>

Revoke a key by ID.

Errors

Returns not_found if no key with the given ID exists. Propagates backend errors.

pub async fn list(&self, tenant_id: &str) -> Result<Vec<ApiKeyMeta>>

List all active keys for a tenant (no secrets).

Errors

Propagates backend errors.

pub async fn refresh( &self, key_id: &str, expires_at: Option<&str>, ) -> Result<()>

Update expires_at (refresh/extend a key).

Errors

Returns bad_request if expires_at is not a valid RFC 3339 timestamp. Returns not_found if no key with the given ID exists. Propagates backend errors.

Trait Implementations

impl Clone for ApiKeyStore

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.