Struct ApiKeyStore

pub struct ApiKeyStore { /* private fields */ }

In-memory API key store. Persists to JSON.

Implementations

impl ApiKeyStore

pub fn new() -> Self

pub fn load_from_file(path: impl AsRef<Path>) -> Result<Self>

Load from a JSON file. Missing file → empty store.

pub fn reload_from_file(&self, path: impl AsRef<Path>) -> Result<()>

Atomically replace the in-memory key set from a complete persisted snapshot. A parse or I/O failure leaves the currently active set untouched, so a partial secret projection cannot erase valid keys.

pub fn save_to_file(&self, path: impl AsRef<Path>) -> Result<()>

Save to a JSON file.

pub fn create( &self, prefix: impl Into<String>, scopes: Vec<String>, ttl: Option<Duration>, ) -> Result<(ApiKey, String)>

Create a new key. Returns the key record and the raw secret string (the caller must surface it to the user once; we never store the raw).

Errors

Returns AuthError::Other if Argon2 fails (extremely rare; only happens on out-of-memory).

Examples

use agentguard_auth::ApiKeyStore;
use std::time::Duration;
let store = ApiKeyStore::new();
let (key, raw) = store.create("ag_live", vec!["read".into()], Some(Duration::from_secs(3600))).unwrap();
assert_eq!(key.prefix, "ag_live");
// Surface `raw` to the user once. It looks like: ag_live_<uuid>_<base64>

pub fn create_bound( &self, prefix: impl Into<String>, scopes: Vec<String>, ttl: Option<Duration>, identity: ApiKeyIdentity, ) -> Result<(ApiKey, String)>

Create a key bound to one Cedar subject and optional tenant. Decision routes accept only identity-bound keys and require the authorize scope (or *).

pub fn verify(&self, raw: &str) -> Result<ApiKey>

Verify a raw API key string. Returns a cloned ApiKey on success.

Format: <prefix>:<id>:<base64url-secret>. The : separator ensures the parse is unambiguous even when the prefix or secret contain _ (which is in the base64url alphabet).

pub fn revoke(&self, id: &str) -> Result<()>

Revoke a key by id.

pub fn list(&self) -> Vec<ApiKey>

List all keys (no secrets).

Trait Implementations

impl Debug for ApiKeyStore

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for ApiKeyStore

fn default() -> ApiKeyStore

Returns the “default value” for a type.