api_keys 0.3.0 → 0.4.1

data/lib/api_keys/configuration.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "active_support/core_ext/numeric/time"
+require "active_support/core_ext/string/inflections"
 require "active_support/security_utils"
 
 module ApiKeys
@@ -9,51 +10,68 @@ module ApiKeys
   class Configuration
     # Default empty callback proc
     DEFAULT_CALLBACK = ->(_context){}.freeze
+    DEFAULT_PARENT_CONTROLLER = "::ApplicationController"
 
     # == Accessors ==
 
     # Core Authentication
-    attr_accessor :header, :query_param
+    attr_reader :header, :query_param
 
     # Token Generation
-    attr_accessor :token_prefix, :token_length, :token_alphabet
+    attr_reader :token_prefix, :token_length, :token_alphabet
 
     # Storage & Verification
-    attr_accessor :hash_strategy, :secure_compare_proc, :key_store_adapter, :policy_provider
+    attr_reader :hash_strategy
+    attr_reader :secure_compare_proc
+    attr_accessor :key_store_adapter, :policy_provider
 
     # Engine Configuration
-    attr_accessor :parent_controller
+    attr_reader :parent_controller
 
     # Owner Context Configuration
-    attr_accessor :current_owner_method, :authenticate_owner_method
+    attr_reader :current_owner_method, :authenticate_owner_method
 
     # Optional Behaviors
-    attr_accessor :default_max_keys_per_owner, :require_key_name
-    attr_accessor :expire_after, :default_scopes, :track_requests_count
+    attr_reader :default_max_keys_per_owner, :require_key_name
+    attr_reader :expire_after, :default_scopes, :track_requests_count
 
     # Performance
-    attr_accessor :cache_ttl
+    attr_reader :cache_ttl, :stats_update_interval
 
     # Security
-    attr_accessor :https_only_production, :https_strict_mode
+    attr_reader :https_only_production, :https_strict_mode
 
     # Tenant Resolution
-    attr_accessor :tenant_resolver
+    attr_reader :tenant_resolver
 
     # Callbacks (Placeholders for future extension)
-    attr_accessor :before_authentication, :after_authentication
+    attr_reader :before_authentication, :after_authentication
 
     # Background Job Queues
-    attr_accessor :stats_job_queue, :callbacks_job_queue
+    attr_reader :stats_job_queue, :callbacks_job_queue
 
     # Global Async Toggle
-    attr_accessor :enable_async_operations
+    attr_reader :enable_async_operations
 
     # Engine UI Configuration
     attr_accessor :return_url, :return_text
 
+    # Dashboard Content Security Policy
+    #
+    # @!attribute [rw] dashboard_content_security_policy
+    #   @return [Symbol, false, nil] Which Content-Security-Policy the mounted
+    #     dashboard declares for its own pages.
+    #     - `:default` (default) — hardened but host-compatible: same-origin
+    #       scripts, styles, and fonts are allowed alongside the engine's
+    #       per-request nonce, so a host layout's asset tags keep working.
+    #     - `:strict` — nonce-only: `default-src 'none'` with no source
+    #       expression for scripts or styles. Requires a host layout that
+    #       serves no un-nonced assets on engine pages.
+    #     - `false` / `nil` — declare nothing and leave the host policy alone.
+    attr_reader :dashboard_content_security_policy
+
     # Debugging
-    attr_accessor :debug_logging
+    attr_reader :debug_logging
 
     # Key Types & Environments (Stripe-style publishable/secret keys)
     #
@@ -96,25 +114,328 @@ module ApiKeys
     #     If false (default), dashboard only shows keys matching current_environment.
     #   @example
     #     config.dashboard_allow_cross_environment = false
-    attr_accessor :environments, :current_environment, :strict_environment_isolation,
-                  :default_key_type, :dashboard_allow_cross_environment
+    attr_reader :environments, :current_environment, :strict_environment_isolation,
+                :default_key_type, :dashboard_allow_cross_environment
 
     # Custom writer for key_types that validates prefix uniqueness
     attr_reader :key_types
 
+    VALID_HASH_STRATEGIES = %i[sha256 bcrypt].freeze
+    VALID_TOKEN_ALPHABETS = %i[base58 hex].freeze
+    VALID_DASHBOARD_CONTENT_SECURITY_POLICIES = [:default, :strict, false, nil].freeze
+    TOKEN_LENGTH_RANGE = (16..64)
+    MAX_CONFIGURED_SCOPES = 100
+    CONFIG_NAME_PATTERN = /\A[a-zA-Z0-9_-]{1,64}\z/
+    HTTP_HEADER_PATTERN = /\A[!#$%&'*+\-.^_`|~0-9A-Za-z]{1,128}\z/
+    QUERY_PARAM_PATTERN = /\A[a-zA-Z0-9_.~-]{1,128}\z/
+    METHOD_NAME_PATTERN = /\A[a-zA-Z_]\w*[!?]?\z/
+    CONSTANT_NAME_PATTERN = /\A(?:::)?[A-Z]\w*(?:::[A-Z]\w*)*\z/
+    BOOLEAN_SETTINGS = %i[
+      require_key_name track_requests_count https_only_production https_strict_mode
+      enable_async_operations debug_logging strict_environment_isolation
+      dashboard_allow_cross_environment
+    ].freeze
+
+    def header=(value)
+      unless value.nil? || (value.is_a?(String) && value.match?(HTTP_HEADER_PATTERN))
+        raise ArgumentError, "header must be nil or a valid HTTP header name of at most 128 characters"
+      end
+
+      @header = value&.dup&.freeze
+    end
+
+    def query_param=(value)
+      unless value.nil? || (value.is_a?(String) && value.match?(QUERY_PARAM_PATTERN))
+        raise ArgumentError, "query_param must be nil or a safe parameter name of at most 128 characters"
+      end
+
+      @query_param = value&.dup&.freeze
+    end
+
+    def default_max_keys_per_owner=(value)
+      unless value.nil? || (value.is_a?(Integer) && value >= 0)
+        raise ArgumentError, "default_max_keys_per_owner must be a non-negative Integer or nil"
+      end
+
+      @default_max_keys_per_owner = value
+    end
+
+    def expire_after=(value)
+      unless value.nil?
+        seconds = value.to_f if value.respond_to?(:to_f)
+        valid = value.respond_to?(:from_now) && seconds&.finite? && seconds.positive?
+        raise ArgumentError, "expire_after must be a positive duration or nil" unless valid
+      end
+
+      @expire_after = value
+    end
+
+    def default_scopes=(value)
+      unless value.is_a?(Array) && value.length <= MAX_CONFIGURED_SCOPES && value.all? { |scope| valid_scope_name?(scope) }
+        raise ArgumentError, "default_scopes must be a bounded Array of safe scope strings"
+      end
+
+      @default_scopes = deep_copy_and_freeze(value.uniq)
+    end
+
+    def cache_ttl=(value)
+      unless value.nil?
+        seconds = value.to_f if value.respond_to?(:to_f)
+        valid = (value.is_a?(Numeric) || value.respond_to?(:from_now)) && seconds&.finite? && !seconds.negative?
+        raise ArgumentError, "cache_ttl must be a finite non-negative duration/number or nil" unless valid
+      end
+
+      @cache_ttl = value
+    end
+
+    def stats_update_interval=(value)
+      unless value.nil?
+        seconds = value.to_f if value.respond_to?(:to_f)
+        valid = (value.is_a?(Numeric) || value.respond_to?(:from_now)) && seconds&.finite? && !seconds.negative?
+        raise ArgumentError, "stats_update_interval must be a finite non-negative duration/number or nil" unless valid
+      end
+
+      @stats_update_interval = value
+    end
+
+    def parent_controller=(value)
+      valid = value.is_a?(Class) || (value.is_a?(String) && value.match?(CONSTANT_NAME_PATTERN))
+      raise ArgumentError, "parent_controller must be a controller Class or a valid constant name" unless valid
+
+      @parent_controller = value.is_a?(String) ? value.dup.freeze : value
+      @parent_controller_explicitly_configured = true
+    end
+
+    def parent_controller_class
+      candidate = if !@parent_controller_explicitly_configured && defined?(ApiKeys::Engine) &&
+                     ApiKeys::Engine.config.parent_controller.present?
+                    ApiKeys::Engine.config.parent_controller
+                  else
+                    parent_controller
+                  end
+      candidate.is_a?(Class) ? candidate : candidate.constantize
+    end
+
+    BOOLEAN_SETTINGS.each do |setting|
+      define_method("#{setting}=") do |value|
+        raise ArgumentError, "#{setting} must be true or false" unless value == true || value == false
+
+        instance_variable_set("@#{setting}", value)
+      end
+    end
+
+    def before_authentication=(value)
+      validate_callback!(value, :before_authentication)
+      @before_authentication = value
+    end
+
+    def after_authentication=(value)
+      validate_callback!(value, :after_authentication)
+      @after_authentication = value
+    end
+
+    def tenant_resolver=(value)
+      raise ArgumentError, "tenant_resolver must be callable" unless value.respond_to?(:call)
+
+      @tenant_resolver = value
+    end
+
+    def secure_compare_proc=(value)
+      raise ArgumentError, "secure_compare_proc must be callable" unless value.respond_to?(:call)
+
+      @secure_compare_proc = value
+    end
+
+    def stats_job_queue=(value)
+      @stats_job_queue = validate_queue_name!(value, :stats_job_queue)
+    end
+
+    def callbacks_job_queue=(value)
+      @callbacks_job_queue = validate_queue_name!(value, :callbacks_job_queue)
+    end
+
+    def current_owner_method=(value)
+      @current_owner_method = validate_method_name!(value, :current_owner_method)
+    end
+
+    def authenticate_owner_method=(value)
+      @authenticate_owner_method = validate_method_name!(value, :authenticate_owner_method)
+    end
+
+    def current_environment=(value)
+      unless value.nil? || value.respond_to?(:call) || valid_config_name?(value)
+        raise ArgumentError, "current_environment must be callable, a safe String/Symbol, or nil"
+      end
+
+      @current_environment = value
+    end
+
+    def default_key_type=(value)
+      unless value.nil? || valid_config_name?(value)
+        raise ArgumentError, "default_key_type must be a safe String/Symbol or nil"
+      end
+
+      @default_key_type = value
+    end
+
+    def token_prefix=(value)
+      unless value.is_a?(String) || value.respond_to?(:call)
+        raise ArgumentError, "token_prefix must be a String or callable object"
+      end
+
+      validate_resolved_prefix!(value) if value.is_a?(String)
+      @token_prefix = value
+    end
+
+    def resolved_token_prefix
+      value = @token_prefix.respond_to?(:call) ? @token_prefix.call : @token_prefix
+      validate_resolved_prefix!(value)
+      value
+    end
+
+    def token_length=(value)
+      unless value.is_a?(Integer) && TOKEN_LENGTH_RANGE.cover?(value)
+        raise ArgumentError, "token_length must be an Integer between #{TOKEN_LENGTH_RANGE.begin} and #{TOKEN_LENGTH_RANGE.end}"
+      end
+
+      @token_length = value
+    end
+
+    def token_alphabet=(value)
+      unless VALID_TOKEN_ALPHABETS.include?(value)
+        raise ArgumentError, "token_alphabet must be one of: #{VALID_TOKEN_ALPHABETS.join(', ')}"
+      end
+
+      @token_alphabet = value
+    end
+
+    # Selects the Content-Security-Policy the dashboard declares for its own pages.
+    # `true` is accepted as an alias for `:default`; Strings are normalized to Symbols.
+    def dashboard_content_security_policy=(value)
+      normalized = case value
+                   when true then :default
+                   when String then value.to_sym
+                   else value
+                   end
+
+      unless VALID_DASHBOARD_CONTENT_SECURITY_POLICIES.include?(normalized)
+        raise ArgumentError,
+              "dashboard_content_security_policy must be :default, :strict, false, or nil"
+      end
+
+      @dashboard_content_security_policy = normalized
+    end
+
+    def hash_strategy=(value)
+      unless VALID_HASH_STRATEGIES.include?(value)
+        raise ArgumentError, "hash_strategy must be one of: #{VALID_HASH_STRATEGIES.join(', ')}"
+      end
+
+      @hash_strategy = value
+    end
+
     # Sets the key types configuration with prefix collision validation.
     # @param value [Hash] Key type definitions
     # @raise [ArgumentError] If multiple key types share the same prefix
     def key_types=(value)
-      validate_key_type_prefixes!(value) if value.is_a?(Hash) && value.any?
-      @key_types = value
+      raise ArgumentError, "key_types must be a Hash" unless value.is_a?(Hash)
+
+      validate_key_types!(value)
+      validate_composite_prefixes!(value, @environments || {})
+      @key_types = deep_copy_and_freeze(value)
+    end
+
+    def environments=(value)
+      raise ArgumentError, "environments must be a Hash" unless value.is_a?(Hash)
+
+      value.each do |name, environment_config|
+        validate_config_name!(name, "environment")
+        raise ArgumentError, "Environment '#{name}' configuration must be a Hash" unless environment_config.is_a?(Hash)
+
+        segment = environment_config[:prefix_segment]
+        validate_config_name!(segment, "environment prefix segment") unless segment.nil?
+      end
+      validate_duplicate_config_names!(value, "environment")
+      validate_composite_prefixes!(@key_types || {}, value)
+      @environments = deep_copy_and_freeze(value)
     end
 
     private
 
+    def validate_resolved_prefix!(prefix)
+      valid = prefix.is_a?(String) && prefix.present? && prefix.valid_encoding? && prefix.bytesize <= 64 &&
+        prefix.each_codepoint.none? { |codepoint| codepoint <= 0x20 || codepoint == 0x7f }
+      return if valid
+
+      raise ArgumentError, "token_prefix must resolve to a non-blank string of at most 64 bytes without whitespace or control characters"
+    rescue ArgumentError
+      raise ArgumentError, "token_prefix must resolve to a non-blank string of at most 64 bytes without whitespace or control characters"
+    end
+
+    def validate_key_types!(key_types_hash)
+      validate_duplicate_config_names!(key_types_hash, "key type")
+
+      key_types_hash.each do |name, type_config|
+        validate_config_name!(name, "key type")
+        raise ArgumentError, "Key type '#{name}' configuration must be a Hash" unless type_config.is_a?(Hash)
+
+        validate_config_name!(type_config[:prefix], "key type prefix")
+        permissions = type_config[:permissions]
+        unless permissions == :all || permissions.is_a?(Array)
+          raise ArgumentError, "Key type '#{name}' permissions must be :all or an Array of strings"
+        end
+        if permissions.is_a?(Array) && permissions.length > MAX_CONFIGURED_SCOPES
+          raise ArgumentError, "Key type '#{name}' permissions cannot contain more than #{MAX_CONFIGURED_SCOPES} entries"
+        end
+        if permissions.is_a?(Array) && permissions.any? { |permission| !valid_scope_name?(permission) }
+          raise ArgumentError, "Key type '#{name}' permissions must contain only non-blank strings of at most 128 bytes"
+        end
+
+        %i[revocable public].each do |setting|
+          next unless type_config.key?(setting)
+          next if [true, false].include?(type_config[setting])
+
+          raise ArgumentError, "Key type '#{name}' #{setting} must be true or false"
+        end
+
+        limit = type_config[:limit]
+        if !limit.nil? && (!limit.is_a?(Integer) || limit <= 0)
+          raise ArgumentError, "Key type '#{name}' limit must be a positive Integer or nil"
+        end
+
+        next unless type_config[:public] == true
+
+        unless type_config[:revocable] == false
+          raise ArgumentError, "Public key type '#{name}' must explicitly set revocable: false"
+        end
+        unless permissions.is_a?(Array) && permissions.any?
+          raise ArgumentError, "Public key type '#{name}' must have a finite, non-empty permissions list"
+        end
+      end
+
+      validate_key_type_prefixes!(key_types_hash)
+    end
+
+    def validate_config_name!(value, label)
+      return if valid_config_name?(value)
+
+      raise ArgumentError, "#{label} must contain only letters, numbers, underscores, or hyphens (1-64 characters)"
+    end
+
+    def valid_config_name?(value)
+      (value.is_a?(String) || value.is_a?(Symbol)) && value.to_s.match?(CONFIG_NAME_PATTERN)
+    end
+
+    def valid_scope_name?(value)
+      value.is_a?(String) && value.present? && value.valid_encoding? && value.bytesize <= 128 &&
+        value.each_codepoint.none? { |codepoint| codepoint <= 0x20 || codepoint == 0x7f }
+    rescue ArgumentError
+      false
+    end
+
     # Validates that all key type prefixes are unique to prevent token collision
     def validate_key_type_prefixes!(key_types_hash)
-      prefixes = key_types_hash.map { |_type, config| config[:prefix] }.compact
+      prefixes = key_types_hash.map { |_type, config| config[:prefix].to_s }.compact
       duplicates = prefixes.group_by(&:itself).select { |_k, v| v.size > 1 }.keys
 
       if duplicates.any?
@@ -122,6 +443,65 @@ module ApiKeys
       end
     end
 
+    def validate_duplicate_config_names!(configuration, label)
+      duplicates = configuration.keys.map(&:to_s).group_by(&:itself).select { |_name, names| names.length > 1 }.keys
+      return if duplicates.empty?
+
+      raise ArgumentError, "#{label} names must be unique after string normalization: #{duplicates.join(', ')}"
+    end
+
+    def validate_composite_prefixes!(key_types, environments)
+      return if key_types.empty?
+
+      environment_entries = environments.empty? ? [[nil, {}]] : environments.to_a
+      combinations = key_types.flat_map do |type_name, type_config|
+        environment_entries.map do |environment_name, environment_config|
+          segment = environment_config[:prefix_segment]
+          prefix = segment.nil? ? "#{type_config[:prefix]}_" : "#{type_config[:prefix]}_#{segment}_"
+          [prefix, "#{type_name}/#{environment_name || 'default'}"]
+        end
+      end
+      collisions = combinations.group_by(&:first).select { |_prefix, entries| entries.length > 1 }
+      return if collisions.empty?
+
+      details = collisions.map { |prefix, entries| "#{prefix} (#{entries.map(&:last).join(', ')})" }.join("; ")
+      raise ArgumentError, "Key type/environment prefixes must be unique: #{details}"
+    end
+
+    def validate_callback!(value, setting)
+      raise ArgumentError, "#{setting} must be a Proc" unless value.is_a?(Proc)
+    end
+
+    def validate_queue_name!(value, setting)
+      unless (value.is_a?(String) || value.is_a?(Symbol)) && value.to_s.match?(/\A[a-zA-Z0-9_-]{1,128}\z/)
+        raise ArgumentError, "#{setting} must be a safe String or Symbol"
+      end
+
+      value
+    end
+
+    def validate_method_name!(value, setting)
+      unless value.nil? || ((value.is_a?(String) || value.is_a?(Symbol)) && value.to_s.match?(METHOD_NAME_PATTERN))
+        raise ArgumentError, "#{setting} must be a valid method name or nil"
+      end
+
+      value
+    end
+
+    def deep_copy_and_freeze(value)
+      copied = case value
+               when Hash
+                 value.to_h { |key, nested_value| [deep_copy_and_freeze(key), deep_copy_and_freeze(nested_value)] }
+               when Array
+                 value.map { |nested_value| deep_copy_and_freeze(nested_value) }
+               when String
+                 value.dup
+               else
+                 value
+               end
+      copied.freeze
+    end
+
     public
 
     # == Initialization ==
@@ -154,7 +534,8 @@ module ApiKeys
       @policy_provider = "ApiKeys::BasePolicy" # Default authorization policy class name
 
       # Engine Configuration
-      @parent_controller = '::ApplicationController'
+      @parent_controller = DEFAULT_PARENT_CONTROLLER
+      @parent_controller_explicitly_configured = false
 
       # Owner Context Configuration
       @current_owner_method = :current_user # Default to current_user for backward compatibility
@@ -164,14 +545,15 @@ module ApiKeys
       @default_max_keys_per_owner = nil # No global key limit per owner
       @require_key_name = false # Don't require names for keys globally
       @expire_after = nil # Keys do not expire by default (e.g., 90.days)
-      @default_scopes = [] # No default scopes assigned globally
+      @default_scopes = [].freeze # No default scopes assigned globally
 
       # Performance
       @cache_ttl = 5.seconds # Good balance: fast revocation, mostly-cached – still allows most repeated requests to benefit from cache
+      @stats_update_interval = 1.minute # Debounce last_used_at writes unless exact request counting is enabled
 
       # Security
       @https_only_production = true # Warn if used over HTTP in production
-      @https_strict_mode = false # Don't raise error, just warn
+      @https_strict_mode = true # Fail closed if a production request is not HTTPS
 
       # Background Job Queues
       @stats_job_queue = :default
@@ -191,6 +573,12 @@ module ApiKeys
       @return_url = "/" # Default fallback path
       @return_text = "‹ Home" # Default link text
 
+      # Dashboard Content Security Policy
+      # Hardened, but compatible with a normal host layout: same-origin scripts,
+      # styles, and fonts load, and the engine's inline blocks stay nonce-gated.
+      # Use :strict for the nonce-only policy, or false/nil to declare nothing.
+      @dashboard_content_security_policy = :default
+
       # Debugging
       @debug_logging = false # Disable debug logging by default (warn and error get logged regardless of this)
 
@@ -198,8 +586,8 @@ module ApiKeys
       @tenant_resolver = ->(api_key) { api_key.owner if api_key.respond_to?(:owner) }
 
       # Key Types & Environments (default to empty/disabled for backwards compatibility)
-      @key_types = {}  # Empty = feature disabled, legacy behavior
-      @environments = {}  # Empty = no environment-based prefixes
+      @key_types = {}.freeze  # Empty = feature disabled, legacy behavior
+      @environments = {}.freeze  # Empty = no environment-based prefixes
       @current_environment = -> { :default }  # Default environment detection
       @strict_environment_isolation = false  # Don't enforce environment isolation by default
       @default_key_type = nil  # No default key type (must be specified explicitly)

data/lib/api_keys/engine.rb

@@ -8,20 +8,11 @@ module ApiKeys
   class Engine < ::Rails::Engine
     isolate_namespace ApiKeys
 
-    # Allows configuring the parent controller for the engine's controllers
-    # Defaults to ::ApplicationController, assuming a standard Rails app structure.
-    config.parent_controller = '::ApplicationController'
-
-    # Ensure our models load first
-    config.autoload_paths << File.expand_path("../models", __dir__)
-    config.autoload_paths << File.expand_path("../models/concerns", __dir__)
-
-    # Set up autoloading paths
-    initializer "api_keys.autoload", before: :set_autoload_paths do |app|
-      app.config.autoload_paths << root.join("lib")
-      app.config.autoload_paths << root.join("lib/api_keys/models")
-      app.config.autoload_paths << root.join("lib/api_keys/models/concerns")
-    end
+    # Backward-compatible fallback for applications that used the old internal
+    # Engine config directly. New applications should configure
+    # ApiKeys.configuration.parent_controller; an explicit public configuration
+    # value takes precedence over this fallback.
+    config.parent_controller = nil
 
     # Add has_api_keys method to ActiveRecord::Base
     initializer "api_keys.active_record" do
@@ -38,12 +29,6 @@ module ApiKeys
     initializer "api_keys.model_attributes" do
       ActiveSupport.on_load(:active_record) do
         ApiKeys::ApiKey.class_eval do
-          # Define JSON attributes for ApiKey model
-          # Ensure the ApiKey model class is loaded before reopening
-          # Use require_dependency for development/test, rely on autoloading in production
-          # Or simply let Zeitwerk handle loading if structure is correct.
-          require_dependency "api_keys/models/api_key" if defined?(Rails) && !Rails.env.production?
-
           # == JSON Attribute Casting ==
           # Make the gem work in any database (postgres, sqlite3, mysql...)
           # Configure the right json-like attributes for the different databases

data/lib/api_keys/form_builder_extensions.rb

@@ -110,7 +110,8 @@ module ApiKeys
     #   - :masked [String] The masked token (e.g., "sk_live_••••abc")
     #   - :full [String, nil] The full token (only for viewable public keys)
     #   - :viewable [Boolean] Whether the full token can be displayed
-    #   - :type [Symbol] The key type (:publishable, :secret, or nil)
+    #   - :type [Symbol, String, nil] A known built-in type is a Symbol; custom
+    #     untrusted values remain Strings so they are never interned as Symbols.
     #   - :environment [String, nil] The environment (e.g., "live", "test")
     #
     # @example
@@ -127,13 +128,22 @@ module ApiKeys
         masked: object.masked_token,
         full: object.viewable_token,
         viewable: object.respond_to?(:public_key_type?) && object.public_key_type?,
-        type: object.key_type&.to_sym,
+        type: safe_key_type(object.key_type),
         environment: object.environment
       }
     end
 
     private
 
+    def safe_key_type(value)
+      case value.to_s
+      when "publishable" then :publishable
+      when "secret" then :secret
+      when "" then nil
+      else value.to_s
+      end
+    end
+
     def resolve_checked_scopes(scopes, checked)
       case checked
       when :all

data/lib/api_keys/helpers/expiration_options.rb

@@ -24,7 +24,7 @@ module ApiKeys
         { label: "60 days", value: "60_days", days: 60 },
         { label: "90 days", value: "90_days", days: 90 },
         { label: "1 year", value: "365_days", days: 365 }
-      ].freeze
+      ].map(&:freeze).freeze
 
       class << self
         # Returns options suitable for a Rails select helper.
@@ -65,9 +65,13 @@ module ApiKeys
         #   ExpirationOptions.parse("30_days")  # => 30.days.from_now
         #   ExpirationOptions.parse("no_expiration")  # => nil
         #   ExpirationOptions.parse(nil)  # => nil
-        #   ExpirationOptions.parse("invalid")  # => nil
+        #   ExpirationOptions.parse("invalid")  # => raises ArgumentError
         #
         def parse(preset)
+          return nil if preset.nil? || preset == ""
+          unless preset.is_a?(String) && preset.valid_encoding? && preset.bytesize <= 32
+            raise ArgumentError, "Invalid API key expiration preset"
+          end
           return nil if preset.blank? || preset == "no_expiration"
 
           # Try to extract days from the preset string (e.g., "30_days" => 30)
@@ -81,7 +85,7 @@ module ApiKeys
           known = DEFAULT_PRESETS.find { |p| p[:value] == preset }
           return known[:days].days.from_now if known && known[:days]
 
-          nil
+          raise ArgumentError, "Invalid API key expiration preset"
         end
 
         # Returns the default preset value (useful for form defaults)
@@ -102,6 +106,10 @@ module ApiKeys
         end
 
         def build_custom_presets(days_list, include_no_expiration)
+          unless days_list.is_a?(Array) && days_list.all? { |days| days.is_a?(Integer) && days.between?(1, 3650) }
+            raise ArgumentError, "Expiration presets must be an array of integers between 1 and 3650"
+          end
+
           options = []
 
           if include_no_expiration