Struct ApiKeysPlugin 

pub struct ApiKeysPlugin { /* private fields */ }

API Keys plugin. Allows issuing and revoking API keys with scoped permissions.

Keys are stored as SHA-256 hashes only. The raw key is returned exactly once at creation time and is never persisted.

Implementations

impl ApiKeysPlugin

pub fn new() -> Self

pub fn create_key( &self, name: &str, user_id: &str, scopes: Vec<String>, ) -> CreatedApiKey

Create a new API key. Returns a CreatedApiKey containing the raw key. The raw key is not stored; only its SHA-256 hash is retained.

pub fn resolve(&self, key: &str) -> Option<AuthContext>

Resolve an API key to an auth context. Hashes the provided key and performs an O(1) HashMap lookup.

The returned AuthContext is DETACHED from this store — if the key is later revoked, callers holding the context won’t see the change. This matters for middleware/session layers that cache the resolved context across requests. Such callers should also call [is_active] on every request or re-resolve to pick up revocations.

pub fn is_active(&self, key: &str) -> bool

Returns true if the raw key still exists in the store. Use this to validate a cached AuthContext against the current revocation state before trusting it on a subsequent request.

pub fn has_scope(&self, key: &str, scope: &str) -> bool

Check if an API key has a specific scope.

pub fn revoke(&self, key: &str) -> bool

Revoke an API key. The caller must provide the raw key; it is hashed internally to locate the stored entry.

pub fn list_keys(&self, user_id: &str) -> Vec<ApiKey>

List all API keys for a user.

Returns ApiKey entries which contain the hash but not the raw key.

Trait Implementations

impl Plugin for ApiKeysPlugin

fn name(&self) -> &str

Unique name for this plugin.

fn on_request( &self, _method: &str, _path: &str, _auth: &AuthContext, ) -> Result<(), PluginError>

Called on every incoming request (middleware).

fn on_init(&self, _ctx: &PluginContext)

Called once when the plugin is registered.

fn routes(&self) -> Vec<PluginRoute>

Custom API routes this plugin handles.

fn before_insert( &self, _entity: &str, _data: &mut Value, _auth: &AuthContext, ) -> Result<(), PluginError>

Called before an entity insert. Return Err to reject.

fn after_insert( &self, _entity: &str, _id: &str, _data: &Value, _auth: &AuthContext, )

Called after a successful insert.

fn before_update( &self, _entity: &str, _id: &str, _data: &mut Value, _auth: &AuthContext, ) -> Result<(), PluginError>

Called before an entity update. Return Err to reject.

fn after_update( &self, _entity: &str, _id: &str, _data: &Value, _auth: &AuthContext, )

Called after a successful update.

fn before_delete( &self, _entity: &str, _id: &str, _auth: &AuthContext, ) -> Result<(), PluginError>

Called before an entity delete. Return Err to reject.

fn after_delete(&self, _entity: &str, _id: &str, _auth: &AuthContext)

Called after a successful delete.

fn on_request_with_meta( &self, method: &str, path: &str, auth: &AuthContext, _meta: &RequestMeta<'_>, ) -> Result<(), PluginError>

Richer variant of [on_request] that also receives per-request metadata (peer IP today; more fields may be added later). The default implementation delegates to on_request so existing plugins keep working without changes. Plugins that care about IP — notably rate limiting — override this hook.

fn on_session_create(&self, _user_id: &str, _token: &str)

Called when a new session is created.

fn entities(&self) -> Vec<ManifestEntity>

Additional manifest entities this plugin contributes.