feat: add api key generation endpint + role authorization

src/routes/v1/apikey.rs

@@ -0,0 +1,59 @@
+use axum::{
+    Json,
+    extract::{Extension, State},
+    http::StatusCode,
+};
+use base64::{Engine as _, engine::general_purpose};
+use rand::RngCore;
+use rand::rngs::OsRng;
+use sha2::{Digest, Sha256};
+use uuid::Uuid;
+
+use crate::dto::api::{CreateApiKeyRequest, CreateApiKeyResponse};
+use crate::middlewares::auth::keycloak::Claims;
+use crate::state::app_state::AppState;
+
+fn generate_api_key() -> String {
+    let mut bytes = [0u8; 32];
+    OsRng.fill_bytes(&mut bytes);
+    general_purpose::URL_SAFE_NO_PAD.encode(bytes)
+}
+
+fn hash_key(key: &str) -> String {
+    let mut hasher = Sha256::new();
+    hasher.update(key.as_bytes());
+    hasher
+        .finalize()
+        .iter()
+        .map(|b| format!("{:02x}", b))
+        .collect()
+}
+
+pub async fn create_api_key(
+    State(state): State<AppState>,
+    Extension(claims): Extension<Claims>,
+    Json(body): Json<CreateApiKeyRequest>,
+) -> Result<Json<CreateApiKeyResponse>, StatusCode> {
+    let raw_key = generate_api_key();
+    let key_hash = hash_key(&raw_key);
+
+    dbg!(&claims);
+
+    let user_id = Uuid::parse_str(&claims.sub).map_err(|_| StatusCode::UNAUTHORIZED)?;
+
+    sqlx::query!(
+        r#"
+        INSERT INTO auth.api_key (key_hash, name, created_by, scopes)
+        VALUES ($1, $2, $3, $4)
+        "#,
+        key_hash,
+        body.name,
+        user_id,
+        &body.scopes
+    )
+    .execute(&state.postgres)
+    .await
+    .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+
+    Ok(Json(CreateApiKeyResponse { api_key: raw_key }))
+}