Method CreateScopedAPIKey

internal/identity/store.go:3397–3450

CreateScopedAPIKey issues a fresh API key with an explicit scope (Slice 5a). - ScopeAccount: account-wide admin; agentID must be empty; prefix e2a_acct_. - ScopeAgent: bound to agentID (which must be a non-empty agent owned by the user); prefix e2a_agt_. The key can only act as that one agent. The

(ctx context.Context, userID, name, scope, agentID string, expiresAt *time.Time)

// The visible prefix makes a key's blast radius obvious at a glance, and the DB
// CHECK (scope='agent') == (agent_id IS NOT NULL) backstops the binding.
func (s *Store) CreateScopedAPIKey(ctx context.Context, userID, name, scope, agentID string, expiresAt *time.Time) (*APIKey, error) {
	if !ValidScope(scope) {
		return nil, fmt.Errorf("invalid credential scope %q", scope)
	}
	if scope == ScopeAgent && agentID == "" {
		return nil, fmt.Errorf("agent-scoped key requires an agent_id")
	}
	if scope == ScopeAccount && agentID != "" {
		return nil, fmt.Errorf("account-scoped key must not name an agent")
	}
	// For an agent-scoped key, the named agent must exist and be owned by the
	// same user — otherwise a caller could mint a key bound to someone else's
	// agent (the FK alone wouldn't catch cross-user binding).
	if scope == ScopeAgent {
		owns, err := s.userOwnsAgent(ctx, agentID, userID)
		if err != nil {
			return nil, err
		}
		if !owns {
			return nil, fmt.Errorf("agent %q not found or not owned by user", agentID)
		}
	}

	id := "apk_" + generateID()
	plaintext := generateAPIKey(scope)
	keyHash := hashAPIKey(plaintext)
	// Show the scoped prefix + a few key chars (e.g. "e2a_agt_abcd…").
	prefix := plaintext[:16]
	now := time.Now()
	var agentCol *string
	if scope == ScopeAgent {
		agentCol = &agentID
	}
	ak := &APIKey{
		ID:           id,
		UserID:       userID,
		Name:         name,
		KeyPrefix:    prefix,
		PlaintextKey: plaintext,
		CreatedAt:    now,
		Scope:        scope,
		AgentID:      agentCol,
		ExpiresAt:    expiresAt,
	}
	_, err := s.pool.Exec(ctx,
		`INSERT INTO api_keys (id, user_id, name, key_prefix, key_hash, scope, agent_id, created_at, expires_at)
		 VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)`,
		ak.ID, ak.UserID, ak.Name, ak.KeyPrefix, keyHash, ak.Scope, agentCol, ak.CreatedAt, ak.ExpiresAt,
	)
	if err != nil {
		return nil, err
	}
	return ak, nil
}

// userOwnsAgent reports whether agentID exists and is owned by userID.
func (s *Store) userOwnsAgent(ctx context.Context, agentID, userID string) (bool, error) {