Module db_api_key 

DB-backed API key authentication DB-backed API key authentication.

Holds API keys in two Postgres tables — ingestion_api_keys and analytics_api_keys (migration v5, rust/ingestion/src/sql_migration.rs) — each row storing only a SHA-256 hash of the key, plus a created_at/created_by/last_used_at/revoked_at/revoked_by audit trail. crate::db_api_key::DbApiKeyAuthProvider validates by hash-indexed lookup behind a short-TTL moka cache.

Structs

DbApiKeyAuthProvider

DB-backed API key authentication provider, bound to one ApiKeyTable.

DbApiKeyConfig

Cache and audit knobs for DbApiKeyAuthProvider, read from env with defaults.

Enums

ApiKeyTable

Which key table a provider (or the management API) is bound to.

Functions

dedicated_key_store_pool

Builds a small, dedicated connection pool for key-store lookups from an existing pool’s options — rather than sharing the caller’s lake pool directly. Inherits the lake pool’s options wholesale (including any after_connect/before_acquire hooks, e.g. the read-only-connection checks in micromegas_ingestion::data_lake_connection), not just its connect options, so a strict or prefer-fallback lake pool’s write-session guarantee carries over to the key store. max_connections(4), acquire_timeout(2s): a credential flood or a DB outage on the key-lookup path can therefore never starve the write path of connections, and a lookup fails fast into its 503 rather than blocking up to sqlx’s default 30s acquire_timeout.

generate_key

256 bits of OS entropy, base64url-nopad, mmk_-prefixed. mmk_ makes minted keys recognizable to secret scanners; it is cosmetic to validation, since hash_key covers the whole string rather than parsing the prefix.

hash_key

SHA-256 of the full key string. The only place a key is hashed; the mint routes (rust/analytics-web-srv/src/ingestion_keys.rs, analytics_keys.rs) and this provider’s lookup go through the same digest definition.

is_read_only_error

True when err’s SQLSTATE is 25006 (cannot execute ... in a read-only transaction) – the code the last_used_at update raises when its connection turned read-only mid-query. A local copy of micromegas_ingestion::data_lake_connection::is_read_only_violation’s check: auth doesn’t depend on ingestion.

key_store_has_live_rows

SELECT EXISTS(SELECT 1 FROM <table> WHERE revoked_at IS NULL) — used by ProviderBuilder::build() (rust/auth/src/default_provider.rs) to decide whether a non-empty key store counts as “auth configured” on its own. A missing relation (e.g. a schema that has not reached migration v5 yet) surfaces as an Err here and must be propagated, never treated as “empty”.