Add api keys

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
2025-11-03 09:15:14 +01:00
parent 845652c382
commit 5212d0c18f
47 changed files with 6009 additions and 3648 deletions
--- a/pkg/coredata/api_key_membership.go
+++ b/pkg/coredata/api_key_membership.go
@@ -0,0 +1,180 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"context"
+	"fmt"
+	"maps"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+	"go.gearno.de/kit/pg"
+	"go.probo.inc/probo/pkg/gid"
+)
+
+type (
+	UserAPIKeyMembership struct {
+		ID               gid.GID   `db:"id"`
+		UserAPIKeyID     gid.GID   `db:"auth_user_api_key_id"`
+		MembershipID     gid.GID   `db:"membership_id"`
+		Role             APIRole   `db:"role"`
+		OrganizationID   gid.GID   `db:"organization_id"`
+		OrganizationName string    `db:"organization_name"`
+		CreatedAt        time.Time `db:"created_at"`
+		UpdatedAt        time.Time `db:"updated_at"`
+	}
+
+	UserAPIKeyMemberships []*UserAPIKeyMembership
+)
+
+func (a *UserAPIKeyMembership) Insert(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+INSERT INTO
+    authz_api_keys_memberships (id, tenant_id, auth_user_api_key_id, membership_id, role, created_at, updated_at)
+VALUES (
+    @id,
+    @tenant_id,
+    @auth_user_api_key_id,
+    @membership_id,
+    @role,
+    @created_at,
+    @updated_at
+)
+`
+
+	args := pgx.StrictNamedArgs{
+		"id":                   a.ID,
+		"tenant_id":            scope.GetTenantID(),
+		"auth_user_api_key_id": a.UserAPIKeyID,
+		"membership_id":        a.MembershipID,
+		"role":                 a.Role,
+		"created_at":           a.CreatedAt,
+		"updated_at":           a.UpdatedAt,
+	}
+
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot insert user api key membership: %w", err)
+	}
+
+	return nil
+}
+
+func (a *UserAPIKeyMemberships) LoadByUserAPIKeyID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	userAPIKeyID gid.GID,
+) error {
+	q := `
+SELECT
+    akm.id,
+    akm.auth_user_api_key_id,
+    akm.membership_id,
+    akm.role,
+    akm.created_at,
+    akm.updated_at,
+    m.organization_id,
+    o.name as organization_name
+FROM
+    authz_api_keys_memberships akm
+JOIN
+    authz_memberships m ON akm.membership_id = m.id
+JOIN
+    organizations o ON m.organization_id = o.id
+WHERE
+    akm.auth_user_api_key_id = @auth_user_api_key_id
+    AND m.%s
+ORDER BY akm.created_at DESC
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"auth_user_api_key_id": userAPIKeyID,
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query user api key memberships: %w", err)
+	}
+
+	memberships, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[UserAPIKeyMembership])
+	if err != nil {
+		return fmt.Errorf("cannot collect user api key memberships: %w", err)
+	}
+
+	*a = memberships
+
+	return nil
+}
+
+func (a *UserAPIKeyMembership) Delete(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+DELETE FROM
+    authz_api_keys_memberships
+WHERE
+    id = @id
+    AND %s
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"id": a.ID,
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot delete user api key membership: %w", err)
+	}
+
+	return nil
+}
+
+func DeleteAllUserAPIKeyMembershipsByUserAPIKeyID(
+	ctx context.Context,
+	conn pg.Conn,
+	userAPIKeyID gid.GID,
+) error {
+	q := `
+DELETE FROM
+    authz_api_keys_memberships
+WHERE
+    auth_user_api_key_id = @auth_user_api_key_id
+`
+
+	args := pgx.StrictNamedArgs{
+		"auth_user_api_key_id": userAPIKeyID,
+	}
+
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot delete user api key memberships: %w", err)
+	}
+
+	return nil
+}
--- a/pkg/coredata/api_role.go
+++ b/pkg/coredata/api_role.go
@@ -0,0 +1,54 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"database/sql/driver"
+	"fmt"
+)
+
+type APIRole string
+
+const (
+	APIRoleFull APIRole = "FULL"
+)
+
+func (r APIRole) String() string {
+	return string(r)
+}
+
+func (r *APIRole) Scan(value any) error {
+	var s string
+	switch v := value.(type) {
+	case string:
+		s = v
+	case []byte:
+		s = string(v)
+	default:
+		return fmt.Errorf("unsupported type for APIRole: %T", value)
+	}
+
+	switch s {
+	case "FULL":
+		*r = APIRoleFull
+	default:
+		return fmt.Errorf("invalid APIRole value: %q", s)
+	}
+	return nil
+}
+
+func (r APIRole) Value() (driver.Value, error) {
+	return r.String(), nil
+}
--- a/pkg/coredata/entity_type_reg.go
+++ b/pkg/coredata/entity_type_reg.go
@@ -64,4 +64,6 @@ const (
 	SlackMessageEntityType
 	TrustCenterFileEntityType
 	SAMLConfigurationEntityType
+	UserAPIKeyEntityType
+	UserAPIKeyMembershipEntityType
 )
--- a/pkg/coredata/migrations/20251031T152957Z.sql
+++ b/pkg/coredata/migrations/20251031T152957Z.sql
@@ -0,0 +1,26 @@
+CREATE TYPE authz_api_role AS ENUM ('FULL');
+
+CREATE TABLE auth_user_api_keys (
+    id TEXT PRIMARY KEY,
+    user_id TEXT NOT NULL REFERENCES users(id) ON UPDATE CASCADE ON DELETE CASCADE,
+    name TEXT NOT NULL,
+    expires_at TIMESTAMP WITH TIME ZONE NOT NULL,
+    created_at TIMESTAMP WITH TIME ZONE NOT NULL,
+    updated_at TIMESTAMP WITH TIME ZONE NOT NULL
+);
+
+CREATE INDEX auth_user_api_keys_user_id_idx ON auth_user_api_keys(user_id);
+
+CREATE TABLE authz_api_keys_memberships (
+    id TEXT PRIMARY KEY,
+    tenant_id TEXT NOT NULL,
+    auth_user_api_key_id TEXT NOT NULL REFERENCES auth_user_api_keys(id) ON UPDATE CASCADE ON DELETE CASCADE,
+    membership_id TEXT NOT NULL REFERENCES authz_memberships(id) ON UPDATE CASCADE ON DELETE CASCADE,
+    role authz_api_role NOT NULL,
+    created_at TIMESTAMP WITH TIME ZONE NOT NULL,
+    updated_at TIMESTAMP WITH TIME ZONE NOT NULL,
+    UNIQUE(auth_user_api_key_id, membership_id)
+);
+
+CREATE INDEX authz_api_keys_memberships_auth_user_api_key_id_idx ON authz_api_keys_memberships(auth_user_api_key_id);
+CREATE INDEX authz_api_keys_memberships_membership_id_idx ON authz_api_keys_memberships(membership_id);
--- a/pkg/coredata/organization.go
+++ b/pkg/coredata/organization.go
@@ -21,10 +21,10 @@ import (
 	"maps"
 	"time"

-	"go.probo.inc/probo/pkg/gid"
-	"go.probo.inc/probo/pkg/page"
 	"github.com/jackc/pgx/v5"
 	"go.gearno.de/kit/pg"
+	"go.probo.inc/probo/pkg/gid"
+	"go.probo.inc/probo/pkg/page"
 )

 type (
@@ -161,7 +161,7 @@ FROM
 INNER JOIN
 	user_org ON organizations.id = user_org.organization_id
 WHERE
-	%S
+	%s
 	AND %s
 `

@@ -237,6 +237,60 @@ ORDER BY
 	return nil
 }

+func (o *Organizations) LoadAllByUserAPIKeyID(
+	ctx context.Context,
+	conn pg.Conn,
+	userAPIKeyID gid.GID,
+) error {
+	q := `
+WITH user_api_key_org AS (
+	SELECT
+		am.organization_id
+	FROM
+		authz_api_keys_memberships akm
+	INNER JOIN
+		authz_memberships am ON akm.membership_id = am.id
+	WHERE
+		akm.auth_user_api_key_id = @auth_user_api_key_id
+)
+SELECT
+	tenant_id,
+    id,
+    name,
+    description,
+    website_url,
+    email,
+    headquarter_address,
+    custom_domain_id,
+    logo_file_id,
+    horizontal_logo_file_id,
+    created_at,
+    updated_at
+FROM
+	organizations
+INNER JOIN
+	user_api_key_org ON organizations.id = user_api_key_org.organization_id
+ORDER BY
+	name ASC
+`
+
+	args := pgx.StrictNamedArgs{"auth_user_api_key_id": userAPIKeyID}
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query organizations: %w", err)
+	}
+
+	organizations, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[Organization])
+	if err != nil {
+		return fmt.Errorf("cannot collect organizations: %w", err)
+	}
+
+	*o = organizations
+
+	return nil
+}
+
 func (o *Organization) Insert(
 	ctx context.Context,
 	conn pg.Conn,
--- a/pkg/coredata/user_api_key.go
+++ b/pkg/coredata/user_api_key.go
@@ -0,0 +1,210 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+	"go.gearno.de/kit/pg"
+	"go.probo.inc/probo/pkg/gid"
+)
+
+type (
+	UserAPIKey struct {
+		ID        gid.GID   `db:"id"`
+		UserID    gid.GID   `db:"user_id"`
+		Name      string    `db:"name"`
+		ExpiresAt time.Time `db:"expires_at"`
+		CreatedAt time.Time `db:"created_at"`
+		UpdatedAt time.Time `db:"updated_at"`
+	}
+
+	UserAPIKeys []*UserAPIKey
+
+	ErrUserAPIKeyNotFound struct {
+		Identifier string
+	}
+)
+
+func (e ErrUserAPIKeyNotFound) Error() string {
+	return fmt.Sprintf("user api key not found: %q", e.Identifier)
+}
+
+func (a *UserAPIKey) LoadByID(
+	ctx context.Context,
+	conn pg.Conn,
+	apiKeyID gid.GID,
+) error {
+	q := `
+SELECT
+    id,
+    user_id,
+    name,
+    expires_at,
+    created_at,
+    updated_at
+FROM
+    auth_user_api_keys
+WHERE
+    id = @api_key_id
+LIMIT 1;
+`
+
+	args := pgx.StrictNamedArgs{"api_key_id": apiKeyID}
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query user api key: %w", err)
+	}
+
+	apiKey, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[UserAPIKey])
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return &ErrUserAPIKeyNotFound{Identifier: apiKeyID.String()}
+		}
+
+		return fmt.Errorf("cannot collect user api key: %w", err)
+	}
+
+	*a = apiKey
+
+	return nil
+}
+
+func (a *UserAPIKeys) LoadByUserID(
+	ctx context.Context,
+	conn pg.Conn,
+	userID gid.GID,
+) error {
+	q := `
+SELECT
+    id,
+    user_id,
+    name,
+    expires_at,
+    created_at,
+    updated_at
+FROM
+    auth_user_api_keys
+WHERE
+    user_id = @user_id
+ORDER BY created_at DESC;
+`
+
+	args := pgx.StrictNamedArgs{"user_id": userID}
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query user api keys: %w", err)
+	}
+
+	apiKeys, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[UserAPIKey])
+	if err != nil {
+		return fmt.Errorf("cannot collect user api keys: %w", err)
+	}
+
+	*a = apiKeys
+
+	return nil
+}
+
+func (a *UserAPIKey) Insert(
+	ctx context.Context,
+	conn pg.Conn,
+) error {
+	q := `
+INSERT INTO
+    auth_user_api_keys (id, user_id, name, expires_at, created_at, updated_at)
+VALUES (
+    @api_key_id,
+    @user_id,
+    @name,
+    @expires_at,
+    @created_at,
+    @updated_at
+)
+`
+
+	args := pgx.StrictNamedArgs{
+		"api_key_id": a.ID,
+		"user_id":    a.UserID,
+		"name":       a.Name,
+		"expires_at": a.ExpiresAt,
+		"created_at": a.CreatedAt,
+		"updated_at": a.UpdatedAt,
+	}
+
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot insert user api key: %w", err)
+	}
+
+	return nil
+}
+
+func (a *UserAPIKey) Update(
+	ctx context.Context,
+	conn pg.Conn,
+) error {
+	q := `
+UPDATE
+    auth_user_api_keys
+SET
+    name = @name,
+    expires_at = @expires_at,
+    updated_at = @updated_at
+WHERE
+    id = @api_key_id
+`
+
+	args := pgx.StrictNamedArgs{
+		"api_key_id": a.ID,
+		"name":       a.Name,
+		"expires_at": a.ExpiresAt,
+		"updated_at": a.UpdatedAt,
+	}
+
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot update user api key: %w", err)
+	}
+
+	return nil
+}
+
+func (a *UserAPIKey) Delete(
+	ctx context.Context,
+	conn pg.Conn,
+) error {
+	q := `
+DELETE FROM
+    auth_user_api_keys
+WHERE
+    id = @api_key_id
+`
+
+	args := pgx.StrictNamedArgs{"api_key_id": a.ID}
+
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot delete user api key: %w", err)
+	}
+
+	return nil
+}