AY-7219 API keys for non-service users

[martastain]

Currently only service users can use API keys. This is a limitation since service users are not subject to ACL checks.
Allowing normal users to use API keys would allow 3rd party services to access the API with ACL checks (limiting the access to the data).

Premises

• Every user can have one or more API keys
• API key can be created by the user
• API key can be revoked at any time (no JWT :-()
• Expiration date can be set for each API key
• Monitor "last used" timestamp for each API key
• Once saved, the API key is hashed and cannot be retrieved

Implementation

Add apiKeys: dict[identifier, definition] to the user data.

• identifier is a unique string that is used for tracking

• definition is a dictionary with the following keys:

  • key: the actual API key (hashed)
  • preview: beginning****end of the key
  • createdAt: timestamp when the key was created
  • expiresAt: timestamp when the key expires
  • lastUsedAt: timestamp when the key was last used
  • description: a short description of the key

Having an identifier allows the user to revoke the key by its identifier. The key itself is hashed to prevent accidental exposure.

The same mechanism (creating a temporary access token when the API key is used) as for service users can be used for normal users.
Keys are nested quite deep in the user data, so validation could be slightly trickier.

Eventually we could deprecate the current data.apiKey and data.apiKeyPreview fields.