Function ValidateAPIKey

core/http/auth/apikeys.go:77–98

ValidateAPIKey looks up an API key by hashing the plaintext and searching the database. Returns the key record if found, or an error. Updates LastUsed on successful validation.

(db *gorm.DB, plaintext, hmacSecret string)

// the database. Returns the key record if found, or an error.
// Updates LastUsed on successful validation.
func ValidateAPIKey(db *gorm.DB, plaintext, hmacSecret string) (*UserAPIKey, error) {
	hash := HashAPIKey(plaintext, hmacSecret)

	var key UserAPIKey
	if err := db.Preload("User").Where("key_hash = ?", hash).First(&key).Error; err != nil {
		return nil, fmt.Errorf("invalid API key")
	}

	if key.ExpiresAt != nil && time.Now().After(*key.ExpiresAt) {
		return nil, fmt.Errorf("API key expired")
	}

	if key.User.Status != StatusActive {
		return nil, fmt.Errorf("user account is not active")
	}

	// Update LastUsed
	now := time.Now()
	db.Model(&key).Update("last_used", now)

	return &key, nil
}

// ListAPIKeys returns all API keys for the given user (without plaintext).
func ListAPIKeys(db *gorm.DB, userID string) ([]UserAPIKey, error) {