api: API key authentication with rotation and grace period

Browse Source

- Add ApiKey Prisma model (keyHash, expiresAt, revokedAt)
- Protect /api/v1/* routes with Authorization: Bearer header check in hooks
- create rotateApiKey() utility: normal (48h grace) and emergency (immediate)
- Add Super-only /admin/api-keys page for key rotation with one-time reveal
- Fix roleId check by using parent layout's DB-fetched adminUser
- Add API Keys link to admin sidebar

...

This commit is contained in:

NeilClack

2026-07-08 13:18:19 -05:00

parent 6266be0edf

commit 46b2cdf53d

14 changed files with 1658 additions and 7 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

src/lib/generated/prisma/models/ApiKey.ts

+1177

File diff suppressed because it is too large Load Diff