api_keys 0.2.1 → 0.4.0

data/lib/api_keys/services/token_generator.rb

@@ -7,13 +7,25 @@ module ApiKeys
   module Services
     # Generates secure, random API tokens according to configured settings.
     class TokenGenerator
+      MIN_RANDOM_BYTES = 16
+      MAX_RANDOM_BYTES = 64
+      MAX_PREFIX_BYTESIZE = 64
+
       # Generates a new token string.
       #
       # @param length [Integer] The desired byte length of the random part (before encoding).
       # @param prefix [String] The prefix to prepend to the token.
       # @param alphabet [Symbol] The encoding alphabet (:base58 or :hex).
       # @return [String] The generated token including the prefix.
-      def self.call(length: ApiKeys.configuration.token_length, prefix: ApiKeys.configuration.token_prefix.call, alphabet: ApiKeys.configuration.token_alphabet)
+      def self.call(length: nil, prefix: nil, alphabet: nil)
+        length ||= ApiKeys.configuration.token_length
+        prefix ||= ApiKeys.configuration.resolved_token_prefix
+        alphabet ||= ApiKeys.configuration.token_alphabet
+
+        validate_length!(length)
+        validate_prefix!(prefix)
+        validate_alphabet!(alphabet)
+
         random_bytes = SecureRandom.bytes(length)
 
         random_part = case alphabet
@@ -27,6 +39,34 @@ module ApiKeys
 
         "#{prefix}#{random_part}"
       end
+
+      def self.validate_length!(length)
+        return if length.is_a?(Integer) && length.between?(MIN_RANDOM_BYTES, MAX_RANDOM_BYTES)
+
+        raise ArgumentError,
+          "Token length must be an Integer between #{MIN_RANDOM_BYTES} and #{MAX_RANDOM_BYTES} random bytes."
+      end
+
+      def self.validate_prefix!(prefix)
+        valid = prefix.is_a?(String) && prefix.present? && prefix.valid_encoding? &&
+          prefix.bytesize <= MAX_PREFIX_BYTESIZE &&
+          prefix.each_codepoint.none? { |codepoint| codepoint <= 0x20 || codepoint == 0x7f }
+        return if valid
+
+        raise ArgumentError,
+          "Token prefix must be a non-blank string of at most #{MAX_PREFIX_BYTESIZE} bytes without whitespace or control characters."
+      rescue ArgumentError
+        raise ArgumentError,
+          "Token prefix must be a non-blank string of at most #{MAX_PREFIX_BYTESIZE} bytes without whitespace or control characters."
+      end
+
+      def self.validate_alphabet!(alphabet)
+        return if %i[base58 hex].include?(alphabet)
+
+        raise ArgumentError, "Unsupported token alphabet: #{alphabet}. Use :base58 or :hex."
+      end
+
+      private_class_method :validate_length!, :validate_prefix!, :validate_alphabet!
     end
   end
 end

data/lib/api_keys/tenant_resolution.rb

@@ -15,8 +15,6 @@ module ApiKeys
       alias_method :current_api_key_tenant, :current_api_tenant
       alias_method :current_api_account, :current_api_tenant
       alias_method :current_api_key_account, :current_api_tenant
-      alias_method :current_api_owner, :current_api_tenant
-      alias_method :current_api_key_owner, :current_api_tenant
     end
 
     # Returns the tenant associated with the current API key.
@@ -31,9 +29,11 @@ module ApiKeys
 
       resolver = ApiKeys.configuration.tenant_resolver
       @current_api_tenant = resolver&.call(current_api_key)
-    rescue StandardError => e
+    rescue StandardError => error
       # Log error but don't break the request if resolver fails
-      Rails.logger.error "[ApiKeys] Tenant resolution failed: #{e.message}" if defined?(Rails.logger)
+      if defined?(Rails) && Rails.respond_to?(:logger) && Rails.logger
+        Rails.logger.error "[ApiKeys] Tenant resolution failed (#{error.class})."
+      end
       @current_api_tenant = nil
     end
   end

data/lib/api_keys/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module ApiKeys
-  VERSION = "0.2.1"
+  VERSION = "0.4.0"
 end

data/lib/api_keys.rb

@@ -53,12 +53,24 @@ end
 
 require "api_keys/version"
 require "api_keys/configuration" # Defines the ApiKeys::Configuration class
+require "api_keys/errors" # Error classes for key types feature
 
 # Files that might depend on ApiKeys.configuration being available
 require "api_keys/controller" # This can lead to loading jobs, etc.
 require "api_keys/models/concerns/has_api_keys"
 require "api_keys/models/api_key"
 
+# Helpers for integrators building custom UIs
+require "api_keys/helpers/token_session"
+require "api_keys/helpers/expiration_options"
+require "api_keys/helpers/view_helpers"
+require "api_keys/form_builder_extensions"
+
+# Top-level aliases for cleaner API (ApiKeys::TokenSession instead of ApiKeys::Helpers::TokenSession)
+ApiKeys::TokenSession = ApiKeys::Helpers::TokenSession
+ApiKeys::ExpirationOptions = ApiKeys::Helpers::ExpirationOptions
+ApiKeys::ViewHelpers = ApiKeys::Helpers::ViewHelpers
+
 # Rails integration (Engine)
 # The Engine might also access ApiKeys.configuration during its initialization.
 require "api_keys/engine" if defined?(Rails)

data/lib/generators/api_keys/add_authentication_index_generator.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+require "rails/generators/base"
+require "rails/generators/active_record"
+
+module ApiKeys
+  module Generators
+    # Adds the bounded bcrypt authentication lookup index to existing installs.
+    class AddAuthenticationIndexGenerator < Rails::Generators::Base
+      include ActiveRecord::Generators::Migration
+
+      source_root File.expand_path("templates", __dir__)
+
+      def self.next_migration_number(dirname)
+        number = current_migration_number(dirname) + 1
+        ActiveRecord::Migration.next_migration_number(number)
+      end
+
+      def create_migration_file
+        migration_template "add_authentication_index_to_api_keys.rb.erb",
+                           File.join(db_migrate_path, "add_authentication_index_to_api_keys.rb")
+      end
+
+      def display_post_install_message
+        say "\n🔐 API key authentication index migration created.", :green
+        say "Run `rails db:migrate` before deploying bcrypt authentication changes."
+      end
+
+      private
+
+      def migration_version
+        "[#{ActiveRecord::VERSION::MAJOR}.#{ActiveRecord::VERSION::MINOR}]"
+      end
+    end
+  end
+end

data/lib/generators/api_keys/add_key_types_generator.rb

@@ -0,0 +1,68 @@
+# frozen_string_literal: true
+
+require "rails/generators/base"
+require "rails/generators/active_record"
+
+module ApiKeys
+  module Generators
+    # Rails generator for adding key_type and environment columns to the api_keys table.
+    # This generator is for existing installations that want to enable the key types feature.
+    class AddKeyTypesGenerator < Rails::Generators::Base
+      include ActiveRecord::Generators::Migration
+
+      source_root File.expand_path("templates", __dir__)
+
+      # Implement the required interface for Rails::Generators::Migration.
+      def self.next_migration_number(dirname)
+        next_migration_number = current_migration_number(dirname) + 1
+        ActiveRecord::Migration.next_migration_number(next_migration_number)
+      end
+
+      # Creates the migration file using the template.
+      def create_migration_file
+        migration_template "add_key_types_to_api_keys.rb.erb",
+                           File.join(db_migrate_path, "add_key_types_to_api_keys.rb")
+      end
+
+      # Displays helpful information to the user after installation.
+      def display_post_install_message
+        say "\n🔑 Key types migration created!", :green
+        say "\nNext steps:"
+        say "  1. Run `rails db:migrate` to add the key_type and environment columns."
+        say "\n  2. Configure key types in `config/initializers/api_keys.rb`:"
+        say "       ApiKeys.configure do |config|"
+        say "         config.key_types = {"
+        say "           publishable: {"
+        say "             prefix: 'pk',"
+        say "             permissions: %w[read validate],"
+        say "             revocable: false,"
+        say "             limit: 1"
+        say "           },"
+        say "           secret: {"
+        say "             prefix: 'sk',"
+        say "             permissions: :all"
+        say "           }"
+        say "         }"
+        say ""
+        say "         config.environments = {"
+        say "           test: { prefix_segment: 'test' },"
+        say "           live: { prefix_segment: 'live' }"
+        say "         }"
+        say ""
+        say "         config.current_environment = -> { Rails.env.production? ? :live : :test }"
+        say "         config.strict_environment_isolation = true"
+        say "       end"
+        say "\n  3. Create typed API keys:"
+        say "       user.create_api_key!(name: 'My Key', key_type: :publishable)"
+        say "       user.create_api_key!(name: 'Admin Key', key_type: :secret)"
+        say "\nSee the api_keys README for detailed usage and examples.", :cyan
+      end
+
+      private
+
+      def migration_version
+        "[#{ActiveRecord::VERSION::STRING.to_f}]"
+      end
+    end
+  end
+end

data/lib/generators/api_keys/templates/add_authentication_index_to_api_keys.rb.erb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+class AddAuthenticationIndexToApiKeys < ActiveRecord::Migration<%= migration_version %>
+  INDEX_NAME = "index_api_keys_authentication_lookup"
+  COLUMNS = %i[prefix last4 digest_algorithm].freeze
+
+  disable_ddl_transaction!
+
+  def up
+    return if index_exists?(:api_keys, COLUMNS, name: INDEX_NAME)
+
+    options = { name: INDEX_NAME }
+    options[:algorithm] = :concurrently if connection.adapter_name.downcase.include?("postgres")
+    add_index :api_keys, COLUMNS, **options
+  end
+
+  def down
+    return unless index_exists?(:api_keys, COLUMNS, name: INDEX_NAME)
+
+    options = { name: INDEX_NAME }
+    options[:algorithm] = :concurrently if connection.adapter_name.downcase.include?("postgres")
+    remove_index :api_keys, **options
+  end
+
+  private
+
+  def migration_version
+    major = ActiveRecord::VERSION::MAJOR
+    minor = ActiveRecord::VERSION::MINOR
+    major >= 5 ? "[#{major}.#{minor}]" : ""
+  end
+end

data/lib/generators/api_keys/templates/add_key_types_to_api_keys.rb.erb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+# Migration to add key_type and environment columns to the api_keys table.
+# This enables the Stripe-style publishable/secret key types feature.
+#
+# Run this migration if you're upgrading from a version of api_keys that
+# didn't have key types support.
+class AddKeyTypesToApiKeys < ActiveRecord::Migration<%= migration_version %>
+  def change
+    add_column :api_keys, :key_type, :string
+    add_column :api_keys, :environment, :string
+
+    add_index :api_keys, :key_type
+    add_index :api_keys, :environment
+    add_index :api_keys, [:owner_type, :owner_id, :key_type, :environment],
+              name: "index_api_keys_owner_type_env"
+  end
+end

data/lib/generators/api_keys/templates/create_api_keys_table.rb.erb

@@ -42,6 +42,12 @@ class CreateApiKeysTable < ActiveRecord::Migration<%= migration_version %>
       # Timestamp when the key was revoked (null means active)
       t.datetime :revoked_at
 
+      # Key type identifier (e.g., "publishable", "secret") for Stripe-style key types
+      t.string :key_type
+
+      # Environment identifier (e.g., "test", "live") for environment isolation
+      t.string :environment
+
       t.timestamps
 
       # Critical index for authentication performance
@@ -49,15 +55,17 @@ class CreateApiKeysTable < ActiveRecord::Migration<%= migration_version %>
 
       # Index to optimize prefix-based lookups (especially for bcrypt)
       t.index [:prefix, :digest_algorithm], name: "index_api_keys_on_prefix_and_digest_algorithm"
+      t.index [:prefix, :last4, :digest_algorithm], name: "index_api_keys_authentication_lookup"
 
       # Optional indexes
       t.index :prefix
       t.index :last4 # Index potentially useful for UI lookups/filtering by masked token
-      t.index :owner_id if foreign_key_type # Index owner_id only if it's a separate column
-      t.index :owner_type if foreign_key_type # Index owner_type only if it's a separate column
       t.index :expires_at
       t.index :revoked_at
       t.index :last_used_at
+      t.index :key_type
+      t.index :environment
+      t.index [:owner_type, :owner_id, :key_type, :environment], name: "index_api_keys_owner_type_env"
     end
   end
 
@@ -97,4 +105,4 @@ class CreateApiKeysTable < ActiveRecord::Migration<%= migration_version %>
       ""
     end
   end
-end 
+end