Class ApiKeyManagementService

Namespace

Tharga.Team.Service

Assembly

Tharga.Team.Service.dll

Delegates to IApiKeyAdministrationService and enforces caller-scoped authorization on top: scope enforcement via ScopeProxy<T>, plus owner-scoping for private API keys (resolved from the authenticated principal's claims — not trusting any caller-supplied value).

public class ApiKeyManagementService : IApiKeyManagementService

Inheritance

object

ApiKeyManagementService

Implements

IApiKeyManagementService

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Constructors

ApiKeyManagementService(IApiKeyAdministrationService, IHttpContextAccessor, IOptions<ApiKeyOptions>)

public ApiKeyManagementService(IApiKeyAdministrationService inner, IHttpContextAccessor httpContextAccessor = null, IOptions<ApiKeyOptions> options = null)

Parameters

inner IApiKeyAdministrationService

httpContextAccessor IHttpContextAccessor

options IOptions<ApiKeyOptions>

Methods

CreateKeyAsync(string, string, AccessLevel, string[], string[], DateTime?, IReadOnlyList<Tag>, bool)

Creates a new API key. When ownerScoped is true the key is private to the caller (owner = the caller's team-member key); a caller can only ever mint a key owned by themselves.

public Task<IApiKey> CreateKeyAsync(string teamKey, string name, AccessLevel accessLevel, string[] roles = null, string[] scopeOverrides = null, DateTime? expiryDate = null, IReadOnlyList<Tag> tags = null, bool ownerScoped = false)

Parameters

teamKey string

name string

accessLevel AccessLevel

roles string[]

scopeOverrides string[]

expiryDate DateTime?

tags IReadOnlyList<Tag>

ownerScoped bool

Returns

Task<IApiKey>

Remarks

TeamKeys decides what is allowed: Shared refuses ownerScoped with an InvalidOperationException, and Personal makes every key private whatever ownerScoped says.

DeleteKeyAsync(string, string)

public Task DeleteKeyAsync(string teamKey, string key)

Parameters

teamKey string

key string

Returns

Task

GetKeysAsync(string, PrivateKeyScope, bool)

Returns the team's API keys for the caller. Team-wide keys are always included; owner-scoped ("private", shown as "Personal") keys are included per privateKeys, intersected with the caller's entitlement (owner sees own; an Oversee holder sees all; allowPrivileged additionally lets Administrator/Owner see private keys). Defaults preserve the original team-wide-only behaviour.

public IAsyncEnumerable<IApiKey> GetKeysAsync(string teamKey, PrivateKeyScope privateKeys = PrivateKeyScope.None, bool allowPrivileged = false)

Parameters

teamKey string

privateKeys PrivateKeyScope

allowPrivileged bool

Returns

IAsyncEnumerable<IApiKey>

LockKeyAsync(string, string)

public Task LockKeyAsync(string teamKey, string key)

Parameters

teamKey string

key string

Returns

Task

RefreshKeyAsync(string, string)

public Task<IApiKey> RefreshKeyAsync(string teamKey, string key)

Parameters

teamKey string

key string

Returns

Task<IApiKey>

SetKeyDisabledAsync(string, string, bool)

Disables the key, or enables it again. A disabled key is refused at authentication but keeps its name, scopes, roles, tags and history — the reversible alternative to DeleteKeyAsync(string, string).

public Task SetKeyDisabledAsync(string teamKey, string key, bool disabled)

Parameters

teamKey string

key string

disabled bool

Returns

Task

Remarks

Refreshing a disabled key does not enable it. A refresh mints a new secret; it is not a decision to trust the key again, and the usual reason to refresh is the same suspected leak that prompted the disable.

SetRolesAsync(string, string, string[])

public Task SetRolesAsync(string teamKey, string key, string[] roles)

Parameters

teamKey string

key string

roles string[]

Returns

Task

SetScopeOverridesAsync(string, string, string[])

public Task SetScopeOverridesAsync(string teamKey, string key, string[] scopes)

Parameters

teamKey string

key string

scopes string[]

Returns

Task