Class ApiKeyManagementService

Namespace

Tharga.Team.Service

Assembly

Tharga.Team.Service.dll

Delegates to IApiKeyAdministrationService and enforces caller-scoped authorization on top: scope enforcement via ScopeProxy<T>, plus owner-scoping for private API keys (resolved from the authenticated principal's claims — not trusting any caller-supplied value).

public class ApiKeyManagementService : IApiKeyManagementService

Inheritance

object

ApiKeyManagementService

Implements

IApiKeyManagementService

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Constructors

ApiKeyManagementService(IApiKeyAdministrationService, IHttpContextAccessor)

public ApiKeyManagementService(IApiKeyAdministrationService inner, IHttpContextAccessor httpContextAccessor = null)

Parameters

inner IApiKeyAdministrationService

httpContextAccessor IHttpContextAccessor

Methods

CreateKeyAsync(string, string, AccessLevel, string[], string[], DateTime?, IReadOnlyList<Tag>, bool)

Creates a new API key. When ownerScoped is true the key is private to the caller (owner = the caller's team-member key); a caller can only ever mint a key owned by themselves.

public Task<IApiKey> CreateKeyAsync(string teamKey, string name, AccessLevel accessLevel, string[] roles = null, string[] scopeOverrides = null, DateTime? expiryDate = null, IReadOnlyList<Tag> tags = null, bool ownerScoped = false)

Parameters

teamKey string

name string

accessLevel AccessLevel

roles string[]

scopeOverrides string[]

expiryDate DateTime?

tags IReadOnlyList<Tag>

ownerScoped bool

Returns

Task<IApiKey>

DeleteKeyAsync(string, string)

public Task DeleteKeyAsync(string teamKey, string key)

Parameters

teamKey string

key string

Returns

Task

GetKeysAsync(string, PrivateKeyScope, bool)

Returns the team's API keys for the caller. Team-wide keys are always included; owner-scoped ("private") keys are included per privateKeys, intersected with the caller's entitlement (owner sees own; Developer-role sees all; allowPrivileged additionally lets Administrator/Owner see private keys). Defaults preserve the original team-wide-only behaviour.

public IAsyncEnumerable<IApiKey> GetKeysAsync(string teamKey, PrivateKeyScope privateKeys = PrivateKeyScope.None, bool allowPrivileged = false)

Parameters

teamKey string

privateKeys PrivateKeyScope

allowPrivileged bool

Returns

IAsyncEnumerable<IApiKey>

LockKeyAsync(string, string)

public Task LockKeyAsync(string teamKey, string key)

Parameters

teamKey string

key string

Returns

Task

RefreshKeyAsync(string, string)

public Task<IApiKey> RefreshKeyAsync(string teamKey, string key)

Parameters

teamKey string

key string

Returns

Task<IApiKey>

SetKeyDisabledAsync(string, string, bool)

Disables the key, or enables it again. A disabled key is refused at authentication but keeps its name, scopes, roles, tags and history — the reversible alternative to DeleteKeyAsync(string, string).

public Task SetKeyDisabledAsync(string teamKey, string key, bool disabled)

Parameters

teamKey string

key string

disabled bool

Returns

Task

Remarks

Refreshing a disabled key does not enable it. A refresh mints a new secret; it is not a decision to trust the key again, and the usual reason to refresh is the same suspected leak that prompted the disable.

SetRolesAsync(string, string, string[])

public Task SetRolesAsync(string teamKey, string key, string[] roles)

Parameters

teamKey string

key string

roles string[]

Returns

Task

SetScopeOverridesAsync(string, string, string[])

public Task SetScopeOverridesAsync(string teamKey, string key, string[] scopes)

Parameters

teamKey string

key string

scopes string[]

Returns

Task