Skip to content

Add a list-api-keys CLI command #3

Description

@OliverD25

src/crypto_processing_api/cli.py can mint a key (create-api-key) and revoke
one (revoke-api-key), and there is no way to see what exists. You cannot
revoke what you cannot list
revoke-api-key takes a key_id, and the only
place a key_id was ever shown is the output of create-api-key, months ago,
in a terminal that is gone.

What to build

A list-api-keys subcommand printing one row per key: key_id, name,
scope, created_at, last_used_at, and whether it is revoked or expired.

Constraints

  • Never print the key itself, and never print the hash. The plaintext key
    does not exist anywhere after creation, which is the point; key_hash is not
    secret in theory but is not useful to anyone and belongs nowhere near a
    terminal. key_id is the non-secret lookup handle — see the module docstring
    at the top of src/crypto_processing_api/core/auth.py.
  • Revoked and expired keys should still be listed, marked as such. An operator
    auditing who had access needs the history, not just the live set.
  • Follow the argparse shape the other subcommands use in cli.py around lines
    168-190.

Nice to have

--include-revoked/--only-active and a --json flag, if it stays small.

Where to start

src/crypto_processing_api/cli.py, the ApiKey model at
src/crypto_processing_api/ledger/models.py:460.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions