diff --git a/admin-frontend/src/App.tsx b/admin-frontend/src/App.tsx index ecef079..a418e8c 100644 --- a/admin-frontend/src/App.tsx +++ b/admin-frontend/src/App.tsx @@ -4,9 +4,10 @@ import Login from "./components/Login"; import ProductList from "./components/ProductList"; import ProductDetail from "./components/ProductDetail"; import SubmissionsPage from "./components/SubmissionsPage"; -import { Inbox, LogOut, Package } from "lucide-react"; +import ApiKeysPage from "./components/ApiKeysPage"; +import { Inbox, KeyRound, LogOut, Package } from "lucide-react"; -type Tab = "products" | "submissions"; +type Tab = "products" | "submissions" | "keys"; type View = { name: "list" } | { name: "detail"; id: string }; export default function App() { @@ -99,6 +100,16 @@ export default function App() { )} +
@@ -112,7 +123,9 @@ export default function App() {
- {tab === "submissions" ? ( + {tab === "keys" ? ( + + ) : tab === "submissions" ? ( ) : view.name === "list" ? ( setView({ name: "detail", id })} /> diff --git a/admin-frontend/src/api.ts b/admin-frontend/src/api.ts index fe2f69c..d3010dc 100644 --- a/admin-frontend/src/api.ts +++ b/admin-frontend/src/api.ts @@ -123,4 +123,18 @@ export const api = { method: "POST", body: JSON.stringify({ note }), }), + listApiKeys: () => + request<{ items: import("./types").ApiKey[] }>("/keys"), + createApiKey: (body: { + name: string; + owner_email?: string; + tier?: string; + rate_limit_per_min?: number; + }) => + request<{ key: string; item: import("./types").ApiKey; warning: string }>( + "/keys", + { method: "POST", body: JSON.stringify(body) }, + ), + revokeApiKey: (id: string) => + request<{ status: string }>(`/keys/${id}`, { method: "DELETE" }), }; diff --git a/admin-frontend/src/components/ApiKeysPage.tsx b/admin-frontend/src/components/ApiKeysPage.tsx new file mode 100644 index 0000000..de9272a --- /dev/null +++ b/admin-frontend/src/components/ApiKeysPage.tsx @@ -0,0 +1,278 @@ +import { useEffect, useState } from "react"; +import { api, ApiError } from "../api"; +import type { ApiKey } from "../types"; +import { Copy, KeyRound, Plus, Trash2 } from "lucide-react"; + +const TIERS = [ + { key: "free", label: "免费 (free)", rate: 120 }, + { key: "partner", label: "合作方 (partner)", rate: 600 }, + { key: "internal", label: "内部 (internal)", rate: 6000 }, +]; + +function tierLabel(tier: string): string { + return TIERS.find((t) => t.key === tier)?.label ?? tier; +} + +export default function ApiKeysPage() { + const [rows, setRows] = useState([]); + const [error, setError] = useState(""); + const [creating, setCreating] = useState(false); + const [newKey, setNewKey] = useState(null); + + async function load() { + setError(""); + try { + const res = await api.listApiKeys(); + setRows(res.items); + } catch (e) { + setError(e instanceof ApiError ? e.message : "加载失败"); + } + } + + useEffect(() => { + load(); + }, []); + + async function revoke(id: string, name: string) { + if (!confirm(`确认吊销密钥「${name}」?使用该密钥的请求将立即被拒绝。`)) return; + try { + await api.revokeApiKey(id); + await load(); + } catch (e) { + setError(e instanceof ApiError ? e.message : "操作失败"); + } + } + + return ( +
+
+
+

+ API 密钥 +

+

+ 公开 API 免费只读,匿名也可调用(低额度)。签发密钥可获得更高速率上限并归属用量。 +

+
+ +
+ + {error && ( +
{error}
+ )} + + {newKey && ( +
+
+ 密钥已生成,请立即复制保存——它只显示这一次。 +
+
+ + {newKey} + + + +
+
+ )} + + {creating && ( + setCreating(false)} + onCreated={(plaintext) => { + setCreating(false); + setNewKey(plaintext); + load(); + }} + /> + )} + +
+ + + + + + + + + + + + + + {rows.length === 0 ? ( + + + + ) : ( + rows.map((k) => ( + + + + + + + + + + )) + )} + +
名称前缀级别速率/分钟用量(今日/累计)状态
+ 暂无密钥 +
+ {k.name} + {k.owner_email && ( + {k.owner_email} + )} + + {k.key_prefix}… + {tierLabel(k.tier)}{k.rate_limit_per_min} + {k.usage.today} / {k.usage.total} + + {k.revoked_at ? ( + + 已吊销 + + ) : ( + + 启用中 + + )} + + {!k.revoked_at && ( + + )} +
+
+
+ ); +} + +function CreateKeyForm({ + onClose, + onCreated, +}: { + onClose: () => void; + onCreated: (plaintext: string) => void; +}) { + const [name, setName] = useState(""); + const [ownerEmail, setOwnerEmail] = useState(""); + const [tier, setTier] = useState("free"); + const [rate, setRate] = useState(120); + const [busy, setBusy] = useState(false); + const [error, setError] = useState(""); + + function pickTier(t: string) { + setTier(t); + const def = TIERS.find((x) => x.key === t); + if (def) setRate(def.rate); + } + + async function submit() { + if (!name.trim()) { + setError("名称不能为空"); + return; + } + setBusy(true); + setError(""); + try { + const res = await api.createApiKey({ + name: name.trim(), + owner_email: ownerEmail.trim() || undefined, + tier, + rate_limit_per_min: rate, + }); + onCreated(res.key); + } catch (e) { + setError(e instanceof ApiError ? e.message : "创建失败"); + } finally { + setBusy(false); + } + } + + return ( +
+

签发新密钥

+ {error &&
{error}
} +
+ + + + +
+
+ + +
+
+ ); +} diff --git a/admin-frontend/src/types.ts b/admin-frontend/src/types.ts index a07aeae..558857a 100644 --- a/admin-frontend/src/types.ts +++ b/admin-frontend/src/types.ts @@ -137,6 +137,25 @@ export interface SubmissionDetail { existing_product?: ProductDetail; } +export interface ApiKeyUsage { + total: number; + today: number; + last_used_at?: number | null; +} + +export interface ApiKey { + id: string; + name: string; + key_prefix: string; + owner_email: string | null; + tier: string; + rate_limit_per_min: number; + revoked_at: string | null; + created_by: string | null; + created_at: string; + usage: ApiKeyUsage; +} + export const FIELD_LABELS: Record = { name: "名称", gtin: "条码", diff --git a/api/cmd/admin/main.go b/api/cmd/admin/main.go index bbfd04d..c79fa4c 100644 --- a/api/cmd/admin/main.go +++ b/api/cmd/admin/main.go @@ -17,6 +17,7 @@ import ( "github.com/baicai2026-baicai/goods/api/internal/adminstore" "github.com/baicai2026-baicai/goods/api/internal/adminweb" "github.com/baicai2026-baicai/goods/api/internal/auth" + "github.com/baicai2026-baicai/goods/api/internal/ratelimit" ) func getenv(key, fallback string) string { @@ -69,7 +70,9 @@ func main() { } authn := auth.New(username, passwordHash, secret, 12*time.Hour) - h := adminhandler.New(adminstore.New(pool), authn, basePath, adminweb.Dist()) + usage := ratelimit.New(getenv("OPENGOODS_REDIS_URL", "redis://localhost:6379/0")) + h := adminhandler.New(adminstore.New(pool), authn, basePath, adminweb.Dist()). + WithUsage(usage) srv := &http.Server{ Addr: addr, diff --git a/api/cmd/server/main.go b/api/cmd/server/main.go index 9fad0a0..8e713cf 100644 --- a/api/cmd/server/main.go +++ b/api/cmd/server/main.go @@ -12,6 +12,7 @@ import ( "github.com/baicai2026-baicai/goods/api/internal/config" "github.com/baicai2026-baicai/goods/api/internal/handler" "github.com/baicai2026-baicai/goods/api/internal/publicweb" + "github.com/baicai2026-baicai/goods/api/internal/ratelimit" "github.com/baicai2026-baicai/goods/api/internal/store" ) @@ -31,7 +32,12 @@ func main() { log.Printf("warning: database not reachable at startup: %v", err) } - h := handler.New(store.New(pool), publicweb.Dist()) + limiter := ratelimit.New(cfg.RedisURL) + if !limiter.Enabled() { + log.Print("warning: Redis not configured; public API rate limiting disabled") + } + h := handler.New(store.New(pool), publicweb.Dist()). + WithRateLimit(limiter, cfg.AnonRateLimitPerMin) srv := &http.Server{ Addr: cfg.Addr, diff --git a/api/go.mod b/api/go.mod index 3e73b12..5ca4a41 100644 --- a/api/go.mod +++ b/api/go.mod @@ -5,13 +5,17 @@ go 1.23.4 require ( github.com/go-chi/chi/v5 v5.1.0 github.com/jackc/pgx/v5 v5.7.2 + github.com/redis/go-redis/v9 v9.18.0 golang.org/x/crypto v0.31.0 ) require ( + github.com/cespare/xxhash/v2 v2.3.0 // indirect + github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect github.com/jackc/pgpassfile v1.0.0 // indirect github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect github.com/jackc/puddle/v2 v2.2.2 // indirect + go.uber.org/atomic v1.11.0 // indirect golang.org/x/sync v0.10.0 // indirect golang.org/x/text v0.21.0 // indirect ) diff --git a/api/go.sum b/api/go.sum index 1dd57d8..d82ea74 100644 --- a/api/go.sum +++ b/api/go.sum @@ -1,6 +1,14 @@ +github.com/bsm/ginkgo/v2 v2.12.0 h1:Ny8MWAHyOepLGlLKYmXG4IEkioBysk6GpaRTLC8zwWs= +github.com/bsm/ginkgo/v2 v2.12.0/go.mod h1:SwYbGRRDovPVboqFv0tPTcG1sN61LM1Z4ARdbAV9g4c= +github.com/bsm/gomega v1.27.10 h1:yeMWxP2pV2fG3FgAODIY8EiRE3dy0aeFYt4l7wh6yKA= +github.com/bsm/gomega v1.27.10/go.mod h1:JyEr/xRbxbtgWNi8tIEVPUYZ5Dzef52k01W3YH0H+O0= +github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs= +github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= +github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/rVNCu3HqELle0jiPLLBs70cWOduZpkS1E78= +github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc= github.com/go-chi/chi/v5 v5.1.0 h1:acVI1TYaD+hhedDJ3r54HyA6sExp3HfXq7QWEEY/xMw= github.com/go-chi/chi/v5 v5.1.0/go.mod h1:DslCQbL2OYiznFReuXYUmQ2hGd1aDpCnlMNITLSKoi8= github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM= @@ -11,13 +19,21 @@ github.com/jackc/pgx/v5 v5.7.2 h1:mLoDLV6sonKlvjIEsV56SkWNCnuNv531l94GaIzO+XI= github.com/jackc/pgx/v5 v5.7.2/go.mod h1:ncY89UGWxg82EykZUwSpUKEfccBGGYq1xjrOpsbsfGQ= github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo= github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4= +github.com/klauspost/cpuid/v2 v2.0.9 h1:lgaqFMSdTdQYdZ04uHyN2d/eKdOMyi2YLSvlQIBFYa4= +github.com/klauspost/cpuid/v2 v2.0.9/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg= github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= +github.com/redis/go-redis/v9 v9.18.0 h1:pMkxYPkEbMPwRdenAzUNyFNrDgHx9U+DrBabWNfSRQs= +github.com/redis/go-redis/v9 v9.18.0/go.mod h1:k3ufPphLU5YXwNTUcCRXGxUoF1fqxnhFQmscfkCoDA0= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.8.1 h1:w7B6lhMri9wdJUVmEZPGGhZzrYTPvgJArz7wNPgYKsk= github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4= +github.com/zeebo/xxh3 v1.0.2 h1:xZmwmqxHZA8AI603jOQ0tMqmBr9lPeFwGg6d+xy9DC0= +github.com/zeebo/xxh3 v1.0.2/go.mod h1:5NWz9Sef7zIDm2JHfFlcQvNekmcEl9ekUZQQKCYaDcA= +go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE= +go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0= golang.org/x/crypto v0.31.0 h1:ihbySMvVjLAeSH1IbfcRTkD/iNscyz8rGzjF/E5hV6U= golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk= golang.org/x/sync v0.10.0 h1:3NQrjDixjgGwUOCaF8w2+VYHv0Ve/vGYSbdkTa98gmQ= diff --git a/api/internal/adminhandler/apikey.go b/api/internal/adminhandler/apikey.go new file mode 100644 index 0000000..c2ff509 --- /dev/null +++ b/api/internal/adminhandler/apikey.go @@ -0,0 +1,70 @@ +package adminhandler + +import ( + "encoding/json" + "net/http" + "strings" + + "github.com/go-chi/chi/v5" + + "github.com/baicai2026-baicai/goods/api/internal/adminstore" + "github.com/baicai2026-baicai/goods/api/internal/auth" + "github.com/baicai2026-baicai/goods/api/internal/ratelimit" +) + +// apiKeyView is an issued key plus its usage counters. +type apiKeyView struct { + adminstore.APIKeyRow + Usage ratelimit.UsageStat `json:"usage"` +} + +// ListAPIKeys returns all issued keys with usage stats merged in. +func (h *Handler) ListAPIKeys(w http.ResponseWriter, r *http.Request) { + keys, err := h.store.ListAPIKeys(r.Context()) + if h.handleErr(w, err) { + return + } + views := make([]apiKeyView, 0, len(keys)) + for _, k := range keys { + v := apiKeyView{APIKeyRow: k} + if h.usage != nil { + v.Usage = h.usage.Usage(r.Context(), k.ID) + } + views = append(views, v) + } + writeJSON(w, http.StatusOK, map[string]any{"items": views}) +} + +// CreateAPIKey issues a new key and returns its plaintext exactly once. +func (h *Handler) CreateAPIKey(w http.ResponseWriter, r *http.Request) { + var in adminstore.APIKeyInput + if err := json.NewDecoder(r.Body).Decode(&in); err != nil { + writeError(w, http.StatusBadRequest, "bad_request", "invalid body") + return + } + if strings.TrimSpace(in.Name) == "" { + writeError(w, http.StatusBadRequest, "bad_request", "名称不能为空") + return + } + if in.Tier != "" && in.Tier != "free" && in.Tier != "partner" && in.Tier != "internal" { + writeError(w, http.StatusBadRequest, "bad_request", "tier 取值无效") + return + } + plaintext, row, err := h.store.CreateAPIKey(r.Context(), in, auth.UserFrom(r.Context())) + if h.handleErr(w, err) { + return + } + writeJSON(w, http.StatusCreated, map[string]any{ + "key": plaintext, + "item": row, + "warning": "请立即复制保存此密钥,它只显示这一次,无法再次查看。", + }) +} + +// RevokeAPIKey disables a key. Subsequent requests with it are rejected. +func (h *Handler) RevokeAPIKey(w http.ResponseWriter, r *http.Request) { + if err := h.store.RevokeAPIKey(r.Context(), chi.URLParam(r, "id")); h.handleErr(w, err) { + return + } + writeJSON(w, http.StatusOK, map[string]string{"status": "revoked"}) +} diff --git a/api/internal/adminhandler/handler.go b/api/internal/adminhandler/handler.go index 3eb7e3f..29b6846 100644 --- a/api/internal/adminhandler/handler.go +++ b/api/internal/adminhandler/handler.go @@ -16,6 +16,7 @@ import ( "github.com/baicai2026-baicai/goods/api/internal/adminstore" "github.com/baicai2026-baicai/goods/api/internal/auth" "github.com/baicai2026-baicai/goods/api/internal/gtin" + "github.com/baicai2026-baicai/goods/api/internal/ratelimit" ) // Handler holds the admin dependencies. @@ -25,6 +26,7 @@ type Handler struct { basePath string spa fs.FS submitLimit *rateLimiter + usage *ratelimit.Limiter } // New constructs an admin Handler. basePath is e.g. "/ping" (no trailing slash). @@ -39,6 +41,13 @@ func New(store *adminstore.Store, authn *auth.Authenticator, basePath string, sp } } +// WithUsage attaches a Redis-backed limiter used to read per-key usage counters +// for the API-key management view. Optional; without it usage shows as zero. +func (h *Handler) WithUsage(l *ratelimit.Limiter) *Handler { + h.usage = l + return h +} + // Router builds the HTTP handler. func (h *Handler) Router() http.Handler { r := chi.NewRouter() @@ -73,6 +82,10 @@ func (h *Handler) Router() http.Handler { r.Get("/api/submissions/{id}", h.GetSubmission) r.Post("/api/submissions/{id}/approve", h.ApproveSubmission) r.Post("/api/submissions/{id}/reject", h.RejectSubmission) + + r.Get("/api/keys", h.ListAPIKeys) + r.Post("/api/keys", h.CreateAPIKey) + r.Delete("/api/keys/{id}", h.RevokeAPIKey) }) r.Handle("/*", http.HandlerFunc(h.serveSPA)) diff --git a/api/internal/adminstore/apikey.go b/api/internal/adminstore/apikey.go new file mode 100644 index 0000000..c5336ed --- /dev/null +++ b/api/internal/adminstore/apikey.go @@ -0,0 +1,130 @@ +package adminstore + +import ( + "context" + "errors" + "strings" + "time" + + "github.com/jackc/pgx/v5/pgconn" + + "github.com/baicai2026-baicai/goods/api/internal/apikey" +) + +// APIKeyRow is an admin-facing view of an issued API key (never the secret). +type APIKeyRow struct { + ID string `json:"id"` + Name string `json:"name"` + KeyPrefix string `json:"key_prefix"` + OwnerEmail *string `json:"owner_email"` + Tier string `json:"tier"` + RateLimitPerMin int `json:"rate_limit_per_min"` + RevokedAt *string `json:"revoked_at"` + CreatedBy *string `json:"created_by"` + CreatedAt string `json:"created_at"` +} + +// APIKeyInput holds the fields accepted when issuing a key. +type APIKeyInput struct { + Name string `json:"name"` + OwnerEmail string `json:"owner_email"` + Tier string `json:"tier"` + RateLimitPerMin int `json:"rate_limit_per_min"` +} + +// CreateAPIKey issues a new key, returning the one-time plaintext alongside the +// stored row. Only the SHA-256 hash and a short display prefix are persisted. +func (s *Store) CreateAPIKey(ctx context.Context, in APIKeyInput, createdBy string) (plaintext string, row APIKeyRow, err error) { + tier := in.Tier + if tier == "" { + tier = "free" + } + rate := in.RateLimitPerMin + if rate <= 0 { + rate = 120 + } + var owner *string + if e := strings.TrimSpace(in.OwnerEmail); e != "" { + owner = &e + } + + key, hash, prefix, err := apikey.Generate() + if err != nil { + return "", row, err + } + + var revoked, created *time.Time + var createdByOut *string + err = s.pool.QueryRow(ctx, ` +INSERT INTO api_key (name, key_prefix, key_hash, owner_email, tier, rate_limit_per_min, created_by) +VALUES ($1, $2, $3, $4, $5, $6, $7) +RETURNING id, name, key_prefix, owner_email, tier, rate_limit_per_min, revoked_at, created_by, created_at`, + strings.TrimSpace(in.Name), prefix, hash, owner, tier, rate, createdBy, + ).Scan(&row.ID, &row.Name, &row.KeyPrefix, &row.OwnerEmail, &row.Tier, + &row.RateLimitPerMin, &revoked, &createdByOut, &created) + if err != nil { + return "", row, err + } + row.CreatedBy = createdByOut + if created != nil { + row.CreatedAt = created.Format(time.RFC3339) + } + return key, row, nil +} + +// ListAPIKeys returns all keys (active first, newest first). +func (s *Store) ListAPIKeys(ctx context.Context) ([]APIKeyRow, error) { + rows, err := s.pool.Query(ctx, ` +SELECT id, name, key_prefix, owner_email, tier, rate_limit_per_min, revoked_at, created_by, created_at +FROM api_key +ORDER BY (revoked_at IS NULL) DESC, created_at DESC`) + if err != nil { + return nil, err + } + defer rows.Close() + out := []APIKeyRow{} + for rows.Next() { + var r APIKeyRow + var revoked, created *time.Time + if err := rows.Scan(&r.ID, &r.Name, &r.KeyPrefix, &r.OwnerEmail, &r.Tier, + &r.RateLimitPerMin, &revoked, &r.CreatedBy, &created); err != nil { + return nil, err + } + if revoked != nil { + v := revoked.Format(time.RFC3339) + r.RevokedAt = &v + } + if created != nil { + r.CreatedAt = created.Format(time.RFC3339) + } + out = append(out, r) + } + return out, rows.Err() +} + +// RevokeAPIKey marks a key revoked. Revoking an already-revoked or missing key +// returns ErrNotFound. +func (s *Store) RevokeAPIKey(ctx context.Context, id string) error { + tag, err := s.pool.Exec(ctx, + "UPDATE api_key SET revoked_at = now() WHERE id = $1 AND revoked_at IS NULL", id) + if err != nil { + if isInvalidUUID(err) { + return ErrNotFound + } + return err + } + if tag.RowsAffected() == 0 { + return ErrNotFound + } + return nil +} + +// isInvalidUUID reports whether err is a Postgres invalid-UUID-text error, +// which happens when a non-UUID id is supplied. +func isInvalidUUID(err error) bool { + var pgErr *pgconn.PgError + if errors.As(err, &pgErr) { + return pgErr.Code == "22P02" + } + return false +} diff --git a/api/internal/apikey/apikey.go b/api/internal/apikey/apikey.go new file mode 100644 index 0000000..3f8b959 --- /dev/null +++ b/api/internal/apikey/apikey.go @@ -0,0 +1,49 @@ +// Package apikey handles generation and hashing of public-API keys. +// +// A key looks like "og_live_". Only the SHA-256 hash is ever persisted; +// the plaintext is returned once at creation time and cannot be recovered. +package apikey + +import ( + "crypto/rand" + "crypto/sha256" + "encoding/base64" + "encoding/hex" + "strings" +) + +// Prefix is the human-readable scheme prefix every key carries. +const Prefix = "og_live_" + +// prefixLen is how many leading characters (including Prefix) are stored in +// api_key.key_prefix for identifying a key without revealing its secret. +const prefixLen = 12 + +// Generate returns a new random key (plaintext), its SHA-256 hash, and a short +// display prefix. The plaintext must be shown to the caller exactly once. +func Generate() (key, hash, displayPrefix string, err error) { + buf := make([]byte, 24) + if _, err = rand.Read(buf); err != nil { + return "", "", "", err + } + // URL-safe, no padding => stable, copy-pasteable token body. + body := base64.RawURLEncoding.EncodeToString(buf) + key = Prefix + body + hash = Hash(key) + displayPrefix = key + if len(displayPrefix) > prefixLen { + displayPrefix = displayPrefix[:prefixLen] + } + return key, hash, displayPrefix, nil +} + +// Hash returns the hex-encoded SHA-256 of a key, used for storage and lookup. +func Hash(key string) string { + sum := sha256.Sum256([]byte(strings.TrimSpace(key))) + return hex.EncodeToString(sum[:]) +} + +// Looks like a key issued by this service (cheap pre-check before hashing). +func IsWellFormed(key string) bool { + return strings.HasPrefix(key, Prefix) && len(key) > len(Prefix)+8 +} diff --git a/api/internal/apikey/apikey_test.go b/api/internal/apikey/apikey_test.go new file mode 100644 index 0000000..99a2eed --- /dev/null +++ b/api/internal/apikey/apikey_test.go @@ -0,0 +1,60 @@ +package apikey + +import "testing" + +func TestGenerate(t *testing.T) { + key, hash, prefix, err := Generate() + if err != nil { + t.Fatalf("Generate: %v", err) + } + if !IsWellFormed(key) { + t.Fatalf("generated key not well-formed: %q", key) + } + if Hash(key) != hash { + t.Fatalf("Hash(key) != returned hash") + } + if len(prefix) != prefixLen || key[:prefixLen] != prefix { + t.Fatalf("prefix %q not a %d-char prefix of key %q", prefix, prefixLen, key) + } + if len(hash) != 64 { + t.Fatalf("hash not hex sha-256: %q", hash) + } +} + +func TestGenerateUnique(t *testing.T) { + seen := map[string]bool{} + for i := 0; i < 100; i++ { + k, _, _, err := Generate() + if err != nil { + t.Fatal(err) + } + if seen[k] { + t.Fatalf("duplicate key generated: %q", k) + } + seen[k] = true + } +} + +func TestHashStableAndTrimmed(t *testing.T) { + if Hash("og_live_abc") != Hash(" og_live_abc ") { + t.Fatal("Hash should ignore surrounding whitespace") + } + if Hash("a") == Hash("b") { + t.Fatal("distinct inputs must hash differently") + } +} + +func TestIsWellFormed(t *testing.T) { + cases := map[string]bool{ + "og_live_abcdefghijkl": true, // body longer than 8 chars + "og_live_": false, // empty body + "og_live_abc": false, // body too short + "nope_abcdefghijkl": false, // wrong prefix + "": false, + } + for in, want := range cases { + if got := IsWellFormed(in); got != want { + t.Errorf("IsWellFormed(%q) = %v, want %v", in, got, want) + } + } +} diff --git a/api/internal/config/config.go b/api/internal/config/config.go index 6bfe038..8d5e00e 100644 --- a/api/internal/config/config.go +++ b/api/internal/config/config.go @@ -2,26 +2,38 @@ package config import ( "os" + "strconv" ) // Config holds runtime configuration for the OpenGoods API server. // Values are read from environment variables with sensible defaults so the // server can boot in a local Docker Compose setup without extra configuration. type Config struct { - Addr string - DatabaseURL string - RedisURL string + Addr string + DatabaseURL string + RedisURL string + AnonRateLimitPerMin int } // Load reads configuration from the environment. func Load() Config { return Config{ - Addr: getenv("OPENGOODS_ADDR", ":8080"), - DatabaseURL: getenv("OPENGOODS_DATABASE_URL", "postgres://opengoods:opengoods@localhost:5432/opengoods?sslmode=disable"), - RedisURL: getenv("OPENGOODS_REDIS_URL", "redis://localhost:6379/0"), + Addr: getenv("OPENGOODS_ADDR", ":8080"), + DatabaseURL: getenv("OPENGOODS_DATABASE_URL", "postgres://opengoods:opengoods@localhost:5432/opengoods?sslmode=disable"), + RedisURL: getenv("OPENGOODS_REDIS_URL", "redis://localhost:6379/0"), + AnonRateLimitPerMin: getenvInt("OPENGOODS_ANON_RATE_LIMIT_PER_MIN", 60), } } +func getenvInt(key string, fallback int) int { + if v, ok := os.LookupEnv(key); ok && v != "" { + if n, err := strconv.Atoi(v); err == nil && n > 0 { + return n + } + } + return fallback +} + func getenv(key, fallback string) string { if v, ok := os.LookupEnv(key); ok && v != "" { return v diff --git a/api/internal/handler/handler.go b/api/internal/handler/handler.go index 7f50eae..d899761 100644 --- a/api/internal/handler/handler.go +++ b/api/internal/handler/handler.go @@ -15,6 +15,7 @@ import ( "github.com/go-chi/chi/v5" "github.com/go-chi/chi/v5/middleware" + "github.com/baicai2026-baicai/goods/api/internal/ratelimit" "github.com/baicai2026-baicai/goods/api/internal/store" ) @@ -24,17 +25,35 @@ const APIVersion = "v1" const ( defaultPageSize = 20 maxPageSize = 100 + + // defaultAnonLimit is the per-minute request budget for unauthenticated + // callers (identified by client IP) when none is configured. + defaultAnonLimit = 60 ) // Handler holds dependencies shared by the HTTP routes. type Handler struct { - store *store.Store - spa fs.FS + store *store.Store + spa fs.FS + limiter *ratelimit.Limiter + anonLimit int } // New constructs a Handler backed by the given store. spa may be nil (JSON-only). +// Rate limiting is disabled until WithRateLimit is called. func New(s *store.Store, spa fs.FS) *Handler { - return &Handler{store: s, spa: spa} + return &Handler{store: s, spa: spa, anonLimit: defaultAnonLimit} +} + +// WithRateLimit attaches a Redis-backed limiter and the anonymous per-minute +// budget, enabling rate limiting + usage tracking on the public API routes. +// A non-positive anonPerMin keeps the default. +func (h *Handler) WithRateLimit(l *ratelimit.Limiter, anonPerMin int) *Handler { + h.limiter = l + if anonPerMin > 0 { + h.anonLimit = anonPerMin + } + return h } // Router builds the top-level HTTP handler with middleware and routes mounted. @@ -47,6 +66,7 @@ func (h *Handler) Router() http.Handler { r.Get("/healthz", h.Healthz) r.Route("/api/"+APIVersion, func(r chi.Router) { + r.Use(h.rateLimit) r.Route("/products", func(r chi.Router) { r.Get("/barcode/{gtin}", h.ProductByBarcode) r.Get("/search", h.SearchProducts) diff --git a/api/internal/handler/middleware.go b/api/internal/handler/middleware.go new file mode 100644 index 0000000..d9d4abe --- /dev/null +++ b/api/internal/handler/middleware.go @@ -0,0 +1,90 @@ +package handler + +import ( + "context" + "errors" + "net" + "net/http" + "strconv" + "strings" + "time" + + "github.com/baicai2026-baicai/goods/api/internal/apikey" + "github.com/baicai2026-baicai/goods/api/internal/store" +) + +type ctxKey int + +const apiKeyIDKey ctxKey = 0 + +// rateLimit authenticates an optional API key and enforces a per-minute budget +// on the public API. Anonymous callers are limited by client IP at a lower +// budget; a valid key raises the budget and attributes usage. An API key that +// is present but invalid or revoked is rejected with 401. Rate-limit headers +// are set on every response; over-budget callers get 429 + Retry-After. +func (h *Handler) rateLimit(next http.Handler) http.Handler { + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + id := "ip:" + clientIP(r) + limit := h.anonLimit + keyID := "" + + if raw := presentedKey(r); raw != "" { + if !apikey.IsWellFormed(raw) { + writeError(w, r, http.StatusUnauthorized, "invalid_api_key", "API key 格式无效") + return + } + k, err := h.store.APIKeyByHash(r.Context(), apikey.Hash(raw)) + if errors.Is(err, store.ErrNotFound) { + writeError(w, r, http.StatusUnauthorized, "invalid_api_key", "API key 无效或已吊销") + return + } + if err != nil { + writeError(w, r, http.StatusInternalServerError, "internal_error", "internal server error") + return + } + keyID = k.ID + limit = k.RateLimitPerMin + id = "key:" + k.ID + } + + res := h.limiter.Allow(r.Context(), id, limit, time.Minute) + w.Header().Set("X-RateLimit-Limit", strconv.Itoa(res.Limit)) + w.Header().Set("X-RateLimit-Remaining", strconv.Itoa(res.Remaining)) + w.Header().Set("X-RateLimit-Reset", strconv.FormatInt(res.ResetUnix, 10)) + if !res.Allowed { + retry := res.ResetUnix - time.Now().Unix() + if retry < 1 { + retry = 1 + } + w.Header().Set("Retry-After", strconv.FormatInt(retry, 10)) + writeError(w, r, http.StatusTooManyRequests, "rate_limited", "请求过于频繁,请稍后再试") + return + } + + if keyID != "" { + h.limiter.RecordUsage(r.Context(), keyID) + next.ServeHTTP(w, r.WithContext(context.WithValue(r.Context(), apiKeyIDKey, keyID))) + return + } + next.ServeHTTP(w, r) + }) +} + +// presentedKey extracts an API key from the X-API-Key header or a Bearer token. +func presentedKey(r *http.Request) string { + if v := strings.TrimSpace(r.Header.Get("X-API-Key")); v != "" { + return v + } + if v := r.Header.Get("Authorization"); strings.HasPrefix(v, "Bearer ") { + return strings.TrimSpace(strings.TrimPrefix(v, "Bearer ")) + } + return "" +} + +// clientIP returns the caller IP, preferring chi's RealIP-normalized RemoteAddr. +func clientIP(r *http.Request) string { + if host, _, err := net.SplitHostPort(r.RemoteAddr); err == nil { + return host + } + return r.RemoteAddr +} diff --git a/api/internal/handler/middleware_db_test.go b/api/internal/handler/middleware_db_test.go new file mode 100644 index 0000000..cecb445 --- /dev/null +++ b/api/internal/handler/middleware_db_test.go @@ -0,0 +1,120 @@ +package handler + +import ( + "context" + "fmt" + "net/http" + "net/http/httptest" + "os" + "testing" + "time" + + "github.com/jackc/pgx/v5/pgxpool" + + "github.com/baicai2026-baicai/goods/api/internal/apikey" + "github.com/baicai2026-baicai/goods/api/internal/ratelimit" + "github.com/baicai2026-baicai/goods/api/internal/store" +) + +// newRateLimitedHandler builds a handler backed by the test DB and a live Redis +// limiter, plus a freshly issued API key with the given per-minute limit. It +// skips when either backend is unavailable. +func newRateLimitedHandler(t *testing.T, keyLimit int) (h *Handler, plaintextKey string) { + t.Helper() + dsn := os.Getenv("OPENGOODS_DATABASE_URL") + if dsn == "" { + dsn = "postgres://opengoods:opengoods@localhost:5432/opengoods?sslmode=disable" + } + ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second) + defer cancel() + pool, err := pgxpool.New(ctx, dsn) + if err != nil { + t.Skipf("no database: %v", err) + } + if err := pool.Ping(ctx); err != nil { + pool.Close() + t.Skipf("database not reachable: %v", err) + } + var hasTable bool + if err := pool.QueryRow(ctx, "SELECT to_regclass('public.api_key') IS NOT NULL").Scan(&hasTable); err != nil || !hasTable { + pool.Close() + t.Skip("migrations not applied (api_key missing)") + } + + redisURL := os.Getenv("OPENGOODS_REDIS_URL") + if redisURL == "" { + redisURL = "redis://localhost:6379/0" + } + limiter := ratelimit.New(redisURL) + pingCtx, pingCancel := context.WithTimeout(context.Background(), time.Second) + defer pingCancel() + if err := limiter.Ping(pingCtx); err != nil { + pool.Close() + t.Skipf("redis not reachable: %v", err) + } + + key, hash, prefix, err := apikey.Generate() + if err != nil { + pool.Close() + t.Fatal(err) + } + name := fmt.Sprintf("test-key-%d", time.Now().UnixNano()) + if _, err := pool.Exec(context.Background(), + `INSERT INTO api_key (name, key_prefix, key_hash, rate_limit_per_min) VALUES ($1,$2,$3,$4)`, + name, prefix, hash, keyLimit); err != nil { + pool.Close() + t.Fatalf("insert api_key: %v", err) + } + t.Cleanup(func() { + _, _ = pool.Exec(context.Background(), "DELETE FROM api_key WHERE key_hash=$1", hash) + pool.Close() + }) + + return New(store.New(pool), nil).WithRateLimit(limiter, 60), key +} + +func TestRateLimitHeadersAndKeyAuth(t *testing.T) { + h, key := newRateLimitedHandler(t, 100) + req := httptest.NewRequest(http.MethodGet, "/api/"+APIVersion+"/categories", nil) + req.Header.Set("X-API-Key", key) + rec := httptest.NewRecorder() + h.Router().ServeHTTP(rec, req) + + if rec.Code != http.StatusOK { + t.Fatalf("status = %d, body = %s", rec.Code, rec.Body.String()) + } + if got := rec.Header().Get("X-RateLimit-Limit"); got != "100" { + t.Fatalf("X-RateLimit-Limit = %q, want 100 (key limit)", got) + } + if rec.Header().Get("X-RateLimit-Remaining") == "" { + t.Fatal("missing X-RateLimit-Remaining header") + } +} + +func TestInvalidKeyRejected(t *testing.T) { + h, _ := newRateLimitedHandler(t, 100) + req := httptest.NewRequest(http.MethodGet, "/api/"+APIVersion+"/categories", nil) + req.Header.Set("X-API-Key", "og_live_thiskeydoesnotexist123456") + rec := httptest.NewRecorder() + h.Router().ServeHTTP(rec, req) + if rec.Code != http.StatusUnauthorized { + t.Fatalf("status = %d, want 401; body = %s", rec.Code, rec.Body.String()) + } +} + +func TestRateLimitExceeded(t *testing.T) { + h, key := newRateLimitedHandler(t, 1) + do := func() int { + req := httptest.NewRequest(http.MethodGet, "/api/"+APIVersion+"/categories", nil) + req.Header.Set("X-API-Key", key) + rec := httptest.NewRecorder() + h.Router().ServeHTTP(rec, req) + return rec.Code + } + if code := do(); code != http.StatusOK { + t.Fatalf("first request status = %d, want 200", code) + } + if code := do(); code != http.StatusTooManyRequests { + t.Fatalf("second request status = %d, want 429", code) + } +} diff --git a/api/internal/ratelimit/ratelimit.go b/api/internal/ratelimit/ratelimit.go new file mode 100644 index 0000000..0ef6f3c --- /dev/null +++ b/api/internal/ratelimit/ratelimit.go @@ -0,0 +1,132 @@ +// Package ratelimit provides a Redis-backed fixed-window rate limiter and +// lightweight per-key usage counters for the public API. +// +// All state lives in Redis so it is shared across API replicas and visible to +// the admin console, and so the public server keeps its read-only contract +// against PostgreSQL. Every operation fails open: if Redis is unavailable the +// limiter allows the request rather than taking the API down. +package ratelimit + +import ( + "context" + "fmt" + "log" + "time" + + "github.com/redis/go-redis/v9" +) + +// Limiter throttles callers and records usage. A nil-backed Limiter (when Redis +// could not be configured) disables limiting and usage tracking. +type Limiter struct { + rdb *redis.Client +} + +// Result describes the outcome of an Allow check and the headers to surface. +type Result struct { + Allowed bool + Limit int + Remaining int + ResetUnix int64 +} + +// UsageStat is the aggregated usage for a single API key. +type UsageStat struct { + Total int64 `json:"total"` + Today int64 `json:"today"` + LastUsedAt *int64 `json:"last_used_at,omitempty"` +} + +// New builds a Limiter from a redis:// URL. On a parse error it logs and returns +// a fail-open limiter (Redis disabled) so the server still boots. +func New(redisURL string) *Limiter { + opt, err := redis.ParseURL(redisURL) + if err != nil { + log.Printf("ratelimit: invalid redis url %q: %v (rate limiting disabled)", redisURL, err) + return &Limiter{} + } + return &Limiter{rdb: redis.NewClient(opt)} +} + +// Enabled reports whether a Redis backend is configured. +func (l *Limiter) Enabled() bool { return l != nil && l.rdb != nil } + +// Ping verifies the Redis backend is reachable. Returns an error if disabled or +// unreachable. +func (l *Limiter) Ping(ctx context.Context) error { + if !l.Enabled() { + return redis.ErrClosed + } + return l.rdb.Ping(ctx).Err() +} + +// Allow records a hit for id within a fixed window and reports whether the +// caller is under limit. Fails open (Allowed=true) on any Redis error. +func (l *Limiter) Allow(ctx context.Context, id string, limit int, window time.Duration) Result { + reset := func() int64 { + win := int64(window / time.Second) + if win < 1 { + win = 1 + } + return (time.Now().Unix()/win + 1) * win + } + if !l.Enabled() { + return Result{Allowed: true, Limit: limit, Remaining: limit, ResetUnix: reset()} + } + win := int64(window / time.Second) + if win < 1 { + win = 1 + } + bucket := time.Now().Unix() / win + key := fmt.Sprintf("rl:%s:%d", id, bucket) + + n, err := l.rdb.Incr(ctx, key).Result() + if err != nil { + return Result{Allowed: true, Limit: limit, Remaining: limit, ResetUnix: (bucket + 1) * win} + } + if n == 1 { + l.rdb.Expire(ctx, key, time.Duration(win)*time.Second) + } + remaining := limit - int(n) + if remaining < 0 { + remaining = 0 + } + return Result{ + Allowed: int(n) <= limit, + Limit: limit, + Remaining: remaining, + ResetUnix: (bucket + 1) * win, + } +} + +// RecordUsage increments total/daily counters and stamps last-used for a key. +// Best-effort: errors are ignored. +func (l *Limiter) RecordUsage(ctx context.Context, keyID string) { + if !l.Enabled() || keyID == "" { + return + } + now := time.Now() + day := now.Format("20060102") + pipe := l.rdb.Pipeline() + pipe.Incr(ctx, "usage:total:"+keyID) + dayKey := "usage:day:" + keyID + ":" + day + pipe.Incr(ctx, dayKey) + pipe.Expire(ctx, dayKey, 90*24*time.Hour) + pipe.Set(ctx, "usage:last:"+keyID, now.Unix(), 0) + _, _ = pipe.Exec(ctx) +} + +// Usage reads aggregated usage for a key. Returns a zero-value stat on error. +func (l *Limiter) Usage(ctx context.Context, keyID string) UsageStat { + var st UsageStat + if !l.Enabled() || keyID == "" { + return st + } + day := time.Now().Format("20060102") + st.Total, _ = l.rdb.Get(ctx, "usage:total:"+keyID).Int64() + st.Today, _ = l.rdb.Get(ctx, "usage:day:"+keyID+":"+day).Int64() + if v, err := l.rdb.Get(ctx, "usage:last:"+keyID).Int64(); err == nil { + st.LastUsedAt = &v + } + return st +} diff --git a/api/internal/ratelimit/ratelimit_test.go b/api/internal/ratelimit/ratelimit_test.go new file mode 100644 index 0000000..d224c60 --- /dev/null +++ b/api/internal/ratelimit/ratelimit_test.go @@ -0,0 +1,94 @@ +package ratelimit + +import ( + "context" + "fmt" + "os" + "testing" + "time" +) + +// TestDisabledFailsOpen verifies that a Limiter without a Redis backend allows +// all requests and reports usage as zero rather than erroring. +func TestDisabledFailsOpen(t *testing.T) { + l := New("not-a-valid-url") // parse error => disabled + if l.Enabled() { + t.Fatal("expected limiter to be disabled for invalid url") + } + res := l.Allow(context.Background(), "x", 1, time.Minute) + if !res.Allowed || res.Remaining != 1 { + t.Fatalf("disabled limiter must fail open: %+v", res) + } + // Must not panic and must return zero usage. + l.RecordUsage(context.Background(), "k1") + if u := l.Usage(context.Background(), "k1"); u.Total != 0 { + t.Fatalf("disabled usage should be zero, got %+v", u) + } +} + +// TestNilReceiverSafe ensures a nil *Limiter is safe to use (handler default). +func TestNilReceiverSafe(t *testing.T) { + var l *Limiter + if l.Enabled() { + t.Fatal("nil limiter must report disabled") + } + res := l.Allow(context.Background(), "x", 5, time.Minute) + if !res.Allowed { + t.Fatal("nil limiter must fail open") + } + l.RecordUsage(context.Background(), "k") + _ = l.Usage(context.Background(), "k") +} + +func testLimiter(t *testing.T) *Limiter { + t.Helper() + url := os.Getenv("OPENGOODS_REDIS_URL") + if url == "" { + url = "redis://localhost:6379/0" + } + l := New(url) + if !l.Enabled() { + t.Skip("redis not configured") + } + ctx, cancel := context.WithTimeout(context.Background(), time.Second) + defer cancel() + if err := l.rdb.Ping(ctx).Err(); err != nil { + t.Skipf("redis not reachable: %v", err) + } + return l +} + +func TestAllowFixedWindow(t *testing.T) { + l := testLimiter(t) + ctx := context.Background() + id := fmt.Sprintf("test:%d", time.Now().UnixNano()) + + for i := 1; i <= 2; i++ { + if res := l.Allow(ctx, id, 2, time.Minute); !res.Allowed { + t.Fatalf("request %d should be allowed: %+v", i, res) + } + } + res := l.Allow(ctx, id, 2, time.Minute) + if res.Allowed { + t.Fatalf("3rd request over limit 2 should be denied: %+v", res) + } + if res.Remaining != 0 { + t.Fatalf("remaining should be 0 when over limit, got %d", res.Remaining) + } +} + +func TestRecordAndReadUsage(t *testing.T) { + l := testLimiter(t) + ctx := context.Background() + key := fmt.Sprintf("usagekey:%d", time.Now().UnixNano()) + + l.RecordUsage(ctx, key) + l.RecordUsage(ctx, key) + u := l.Usage(ctx, key) + if u.Total != 2 || u.Today != 2 { + t.Fatalf("expected total=2 today=2, got %+v", u) + } + if u.LastUsedAt == nil { + t.Fatal("expected last-used timestamp to be set") + } +} diff --git a/api/internal/store/store.go b/api/internal/store/store.go index f5d02ae..645f1a9 100644 --- a/api/internal/store/store.go +++ b/api/internal/store/store.go @@ -305,6 +305,30 @@ func (s *Store) ListCategories(ctx context.Context) ([]Category, error) { return out, rows.Err() } +// APIKey is the minimal metadata the public API needs to authorize a caller. +type APIKey struct { + ID string + Name string + RateLimitPerMin int +} + +// APIKeyByHash returns the active (non-revoked) key matching a SHA-256 hash, +// or ErrNotFound if no such active key exists. +func (s *Store) APIKeyByHash(ctx context.Context, hash string) (*APIKey, error) { + var k APIKey + err := s.pool.QueryRow(ctx, + `SELECT id, name, rate_limit_per_min + FROM api_key WHERE key_hash = $1 AND revoked_at IS NULL`, hash, + ).Scan(&k.ID, &k.Name, &k.RateLimitPerMin) + if errors.Is(err, pgx.ErrNoRows) { + return nil, ErrNotFound + } + if err != nil { + return nil, err + } + return &k, nil +} + // Source describes a data source with its license and trust weight. type Source struct { ID string `json:"id"` diff --git a/migrations/0008_api_key.down.sql b/migrations/0008_api_key.down.sql new file mode 100644 index 0000000..1c5e233 --- /dev/null +++ b/migrations/0008_api_key.down.sql @@ -0,0 +1 @@ +DROP TABLE IF EXISTS api_key; diff --git a/migrations/0008_api_key.up.sql b/migrations/0008_api_key.up.sql new file mode 100644 index 0000000..f3fbc04 --- /dev/null +++ b/migrations/0008_api_key.up.sql @@ -0,0 +1,24 @@ +-- API keys for the public read-only API. Keys grant higher rate limits and let +-- usage be attributed to a caller; the API itself stays free and read-only. +-- Only the SHA-256 hash of a key is stored; the plaintext is shown once at +-- creation time. Keys are issued/revoked from the admin console. The public +-- server only ever SELECTs from this table (request counting lives in Redis), +-- preserving its read-only contract against PostgreSQL. +CREATE TABLE IF NOT EXISTS api_key ( + id UUID PRIMARY KEY DEFAULT gen_random_uuid(), + name TEXT NOT NULL, + key_prefix VARCHAR(20) NOT NULL, -- shown for identification, e.g. og_live_AbC1 + key_hash TEXT NOT NULL UNIQUE, -- hex SHA-256 of the full key + owner_email TEXT, + tier VARCHAR(16) NOT NULL DEFAULT 'free', + rate_limit_per_min INT NOT NULL DEFAULT 120, + revoked_at TIMESTAMPTZ, + created_by TEXT, + created_at TIMESTAMPTZ NOT NULL DEFAULT now(), + CONSTRAINT api_key_tier_chk CHECK (tier IN ('free', 'partner', 'internal')), + CONSTRAINT api_key_rate_chk CHECK (rate_limit_per_min > 0) +); + +-- Fast lookup of active keys by their hash on every authenticated request. +CREATE INDEX IF NOT EXISTS idx_api_key_active_hash + ON api_key (key_hash) WHERE revoked_at IS NULL;