8659a58eb2
* auth: generate_api_key() mints pic_<base32(32 bytes)>, splits the
indexed 8-char prefix, and Argon2-hashes the body. Adds the
data-encoding workspace dep for unpadded base32.
* api_keys_api: POST /api/v1/admin/api-keys (mint, returns raw_token
exactly once), GET (caller's own, no raw), DELETE {id} (caller's
own; 404 deliberately covers both 'missing' and 'not yours').
Mint validation rejects bound keys carrying instance:* scopes (422).
* AdminsState gains the api keys repo; PATCH set_active(false) now
expires every active key for that user alongside session wipe —
Phase 3.5 deactivation symmetry.
* picloud lib wires PostgresApiKeyRepository through AuthDeps into
AdminsState + ApiKeysState; api_keys_router merges into the
guarded_admin layer.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
34 lines
673 B
TOML
34 lines
673 B
TOML
[package]
|
|
name = "picloud-manager-core"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
rust-version.workspace = true
|
|
license.workspace = true
|
|
|
|
[lints]
|
|
workspace = true
|
|
|
|
[dependencies]
|
|
picloud-shared.workspace = true
|
|
picloud-orchestrator-core.workspace = true
|
|
|
|
async-trait.workspace = true
|
|
axum.workspace = true
|
|
serde.workspace = true
|
|
serde_json.workspace = true
|
|
thiserror.workspace = true
|
|
tracing.workspace = true
|
|
uuid.workspace = true
|
|
chrono.workspace = true
|
|
sqlx.workspace = true
|
|
url.workspace = true
|
|
|
|
argon2.workspace = true
|
|
rand.workspace = true
|
|
sha2.workspace = true
|
|
base64.workspace = true
|
|
data-encoding.workspace = true
|
|
|
|
[dev-dependencies]
|
|
tokio.workspace = true
|