Method HandleCreateAPIKey

internal/auth/auth.go:749–820

HandleCreateAPIKey creates a new API key for the authenticated user.

(w http.ResponseWriter, r *http.Request)

// HandleCreateAPIKey creates a new API key for the authenticated user.
func (ua *UserAuth) HandleCreateAPIKey(w http.ResponseWriter, r *http.Request) {
	user := ua.AuthenticateRequest(r)
	if user == nil {
		http.Error(w, "not authenticated", http.StatusUnauthorized)
		return
	}

	var req struct {
		Name      string  `json:"name"`
		ExpiresAt *string `json:"expires_at,omitempty"` // optional ISO 8601 timestamp
		// Scope (Slice 5a) selects the credential's blast radius. Omitted/""
		// defaults to account (backward compatible). "agent" requires Agent to
		// name one of the caller's agents by email; the minted key can act ONLY
		// as that agent.
		Scope string `json:"scope,omitempty"`
		Agent string `json:"agent,omitempty"` // agent email, required when scope=agent
	}
	json.NewDecoder(r.Body).Decode(&req)

	// Parse optional expires_at. Empty string and missing field both mean
	// "never expires" — symmetric with the NULL column default. Malformed
	// or already-past timestamps are client errors, not "use NULL silently."
	var expiresAt *time.Time
	if req.ExpiresAt != nil && *req.ExpiresAt != "" {
		t, err := time.Parse(time.RFC3339, *req.ExpiresAt)
		if err != nil {
			http.Error(w, "expires_at must be an RFC 3339 timestamp", http.StatusBadRequest)
			return
		}
		if !t.After(time.Now()) {
			http.Error(w, "expires_at must be in the future", http.StatusBadRequest)
			return
		}
		expiresAt = &t
	}

	// Default to an account-scoped key (the pre-Slice-5a behavior). When the
	// caller asks for an agent-scoped key, resolve the named agent to its id —
	// CreateScopedAPIKey re-checks ownership, so a wrong/foreign agent is
	// rejected rather than minting an over-broad or cross-tenant key.
	scope := req.Scope
	if scope == "" {
		scope = identity.ScopeAccount
	}
	if !identity.ValidScope(scope) {
		http.Error(w, "scope must be 'account' or 'agent'", http.StatusBadRequest)
		return
	}
	var agentID string
	if scope == identity.ScopeAgent {
		if req.Agent == "" {
			http.Error(w, "agent (email) is required when scope=agent", http.StatusBadRequest)
			return
		}
		ag, err := ua.store.GetAgentByEmail(r.Context(), identity.NormalizeEmail(req.Agent))
		if err != nil || ag == nil || ag.UserID != user.ID {
			http.Error(w, "agent not found", http.StatusBadRequest)
			return