mirror of
https://github.com/RayLabsHQ/gitea-mirror.git
synced 2026-10-03 14:01:50 +02:00
ARUNAVO RAYandGitHub
83dd74dd52
* feat(auth): API keys for programmatic access Adds the @better-auth/api-key plugin so scripts and CI pipelines can call the existing endpoints with an x-api-key header instead of a session cookie. Keys are owned by a user, hashed at rest, prefixed gm_, never expire unless an expiry is chosen, and are not rate limited. A small guard plugin refuses key management calls that arrive with a key, so a leaked key cannot mint or revoke keys. New API Keys section on the Authentication tab with create, show once, copy and revoke. Migration 0017 adds the api_keys table with the validator fixture. docs/API.md documents the header and the calls automation needs. An e2e spec covers create, use, refuse and revoke over HTTP. bun.nix regenerated for the new package. Closes #314 Claude-Session: https://claude.ai/code/session_01Tp9pmi65a8k5jLMQFLf4JX * fix(e2e): send Origin on cookie-authenticated key management calls Better Auth rejects a cookie-authenticated POST without an Origin header (403 MISSING_OR_NULL_ORIGIN). Browsers always send one, the Playwright request context does not, so the spec sets it on the create and delete calls. Also asserts the guard's 403 code and documents the Origin requirement for scripts that manage keys with a session. Claude-Session: https://claude.ai/code/session_01Tp9pmi65a8k5jLMQFLf4JX
28 lines
975 B
SQL
28 lines
975 B
SQL
CREATE TABLE `api_keys` (
|
|
`id` text PRIMARY KEY NOT NULL,
|
|
`config_id` text DEFAULT 'default' NOT NULL,
|
|
`name` text,
|
|
`start` text,
|
|
`prefix` text,
|
|
`key` text NOT NULL,
|
|
`reference_id` text NOT NULL,
|
|
`refill_interval` integer,
|
|
`refill_amount` integer,
|
|
`last_refill_at` integer,
|
|
`enabled` integer DEFAULT true NOT NULL,
|
|
`rate_limit_enabled` integer DEFAULT true NOT NULL,
|
|
`rate_limit_time_window` integer,
|
|
`rate_limit_max` integer,
|
|
`request_count` integer DEFAULT 0 NOT NULL,
|
|
`remaining` integer,
|
|
`last_request` integer,
|
|
`expires_at` integer,
|
|
`created_at` integer DEFAULT (unixepoch()) NOT NULL,
|
|
`updated_at` integer DEFAULT (unixepoch()) NOT NULL,
|
|
`permissions` text,
|
|
`metadata` text,
|
|
FOREIGN KEY (`reference_id`) REFERENCES `users`(`id`) ON UPDATE no action ON DELETE cascade
|
|
);
|
|
--> statement-breakpoint
|
|
CREATE INDEX `idx_api_keys_reference_id` ON `api_keys` (`reference_id`);--> statement-breakpoint
|
|
CREATE INDEX `idx_api_keys_key` ON `api_keys` (`key`); |