Method RevokeAPIKey

database/api_key.go:204–258

RevokeAPIKey marks an API key as revoked in the database, preventing its future use. The function updates the is_revoked flag to true and sets the revoked_at timestamp. It also invalidates the cache entry for the revoked key to ensure immediate effect. Only the owner of the API key can revoke it. P

(ctx context.Context, id, ownerID string)

//   - error: Returns ErrAPIKeyNotFound if the key doesn't exist or doesn't belong to the owner,
//     or other database errors if the update operation fails.
func (s *Datasource) RevokeAPIKey(ctx context.Context, id, ownerID string) error {
	// First, get the API key to retrieve its hashed key for cache invalidation
	getQuery := `
		SELECT key
		FROM ledgerforge.api_keys
		WHERE api_key_id = $1 AND owner_id = $2
	`

	var hashedKey string
	err := s.Conn.QueryRowContext(ctx, getQuery, id, ownerID).Scan(&hashedKey)
	if err == sql.ErrNoRows {
		return ErrAPIKeyNotFound
	}
	if err != nil {
		return err
	}

	// Update the API key to mark it as revoked
	updateQuery := `
		UPDATE ledgerforge.api_keys
		SET is_revoked = true, revoked_at = $1
		WHERE api_key_id = $2 AND owner_id = $3
	`

	result, err := s.Conn.ExecContext(ctx, updateQuery, time.Now(), id, ownerID)
	if err != nil {
		return err
	}

	rows, err := result.RowsAffected()
	if err != nil {
		return err
	}

	if rows == 0 {
		return ErrAPIKeyNotFound
	}

	// Invalidate the cache entry for this API key
	// Note: We need to get the key_prefix to invalidate the correct cache entry
	getPrefixQuery := `SELECT key_prefix FROM ledgerforge.api_keys WHERE api_key_id = $1`
	var keyPrefix sql.NullString
	_ = s.Conn.QueryRowContext(ctx, getPrefixQuery, id).Scan(&keyPrefix)

	if keyPrefix.Valid && s.Cache != nil {
		cacheKey := getAPIKeyCacheKey(keyPrefix.String)
		err = s.Cache.Delete(ctx, cacheKey)
		if err != nil {
			// Log the error, but don't fail the revocation
			logrus.WithError(err).Warn("failed to invalidate API key cache")
		}
	}

	return nil
}

// UpdateLastUsed updates the last_used_at timestamp for an API key to the current time.
// This function is typically called during authentication to track API key usage patterns.