| 294 | } |
| 295 | |
| 296 | async fn create_api_key( |
| 297 | &self, |
| 298 | request: Request<api::CreateApiKeyRequest>, |
| 299 | ) -> Result<Response<api::CreateApiKeyResponse>, Status> { |
| 300 | let req_key = match &request.get_ref().api_key { |
| 301 | Some(v) => v, |
| 302 | None => { |
| 303 | return Err(Status::invalid_argument("api_key is missing")); |
| 304 | } |
| 305 | }; |
| 306 | |
| 307 | let tenant_id = if req_key.tenant_id.is_empty() { |
| 308 | None |
| 309 | } else { |
| 310 | Some(Uuid::from_str(&req_key.tenant_id).map_err(|e| e.status())?) |
| 311 | }; |
| 312 | |
| 313 | if req_key.is_admin && tenant_id.is_some() { |
| 314 | return Err(Status::invalid_argument( |
| 315 | "tenant_id can not be set with is_admin set to true", |
| 316 | )); |
| 317 | } |
| 318 | |
| 319 | if !req_key.is_admin && tenant_id.is_none() { |
| 320 | return Err(Status::invalid_argument( |
| 321 | "either is_admin or tenant_id must be set", |
| 322 | )); |
| 323 | } |
| 324 | |
| 325 | self.validator |
| 326 | .validate( |
| 327 | request.extensions(), |
| 328 | validator::ValidateApiKeysAccess::new(validator::Flag::Create, tenant_id), |
| 329 | ) |
| 330 | .await?; |
| 331 | |
| 332 | let ak = api_key::ApiKey { |
| 333 | name: req_key.name.clone(), |
| 334 | is_admin: req_key.is_admin, |
| 335 | tenant_id: tenant_id.map(|u| u.into()), |
| 336 | is_read_only: req_key.is_read_only, |
| 337 | ..Default::default() |
| 338 | }; |
| 339 | |
| 340 | let ak = api_key::create(ak).await.map_err(|e| e.status())?; |
| 341 | let token = claims::AuthClaim::new_for_api_key(&ak.id) |
| 342 | .encode(self.jwt_secret.as_ref()) |
| 343 | .map_err(|e| e.status())?; |
| 344 | |
| 345 | Ok(Response::new(api::CreateApiKeyResponse { |
| 346 | id: ak.id.to_string(), |
| 347 | token, |
| 348 | })) |
| 349 | } |
| 350 | |
| 351 | async fn delete_api_key( |
| 352 | &self, |