feat(api-key): Allow revoking in the future, and enforce the secret key (#6484)

Since there is quite a bit of code here already, I'll do the middleware changes in a separate PR

packages/api-key/integration-tests/__tests__/api-key-module-service.spec.ts

@@ -137,6 +137,27 @@ moduleIntegrationTestRunner({
           )
         })
 
+        it("should be able to revoke a key in the future", async function () {
+          const now = Date.parse("2021-01-01T00:00:00Z")
+          const hourInSec = 3600
+          jest.useFakeTimers().setSystemTime(now)
+
+          const createdKey = await service.create(createSecretKeyFixture)
+          const revokedKey = await service.revoke(createdKey.id, {
+            revoked_by: "test",
+            revoke_in: hourInSec,
+          })
+
+          expect(revokedKey).toEqual(
+            expect.objectContaining({
+              revoked_by: "test",
+              revoked_at: new Date(now + hourInSec * 1000),
+            })
+          )
+
+          jest.useRealTimers()
+        })
+
         it("should do nothing if the revokal list is empty", async function () {
           const firstApiKey = await service.create(createSecretKeyFixture)
           let revokedKeys = await service.revoke([])
@@ -204,6 +225,54 @@ moduleIntegrationTestRunner({
         })
       })
 
+      describe("authenticating with API keys", () => {
+        it("should authenticate a secret key successfully", async function () {
+          const createdApiKey = await service.create(createSecretKeyFixture)
+          const authenticated = await service.authenticate(createdApiKey.token)
+
+          expect(authenticated).toBeTruthy()
+          expect(authenticated.title).toEqual(createSecretKeyFixture.title)
+        })
+        it("should authenticate with a token to be revoked in the future", async function () {
+          const createdApiKey = await service.create(createSecretKeyFixture)
+
+          // We simulate setting the revoked_at in the future here
+          jest.useFakeTimers().setSystemTime(new Date().setFullYear(3000))
+          await service.revoke(createdApiKey.id, {
+            revoked_by: "test",
+          })
+          jest.useRealTimers()
+
+          const authenticated = await service.authenticate(createdApiKey.token)
+          expect(authenticated).toBeTruthy()
+          expect(authenticated.title).toEqual(createdApiKey.title)
+        })
+
+        it("should not authenticate a publishable key", async function () {
+          const createdApiKey = await service.create(
+            createPublishableKeyFixture
+          )
+          const authenticated = await service.authenticate(createdApiKey.token)
+
+          expect(authenticated).toBeFalsy()
+        })
+        it("should not authenticate with a non-existent token", async function () {
+          const createdApiKey = await service.create(createSecretKeyFixture)
+          const authenticated = await service.authenticate("some-token")
+
+          expect(authenticated).toBeFalsy()
+        })
+        it("should not authenticate with a revoked token", async function () {
+          const createdApiKey = await service.create(createSecretKeyFixture)
+          await service.revoke(createdApiKey.id, {
+            revoked_by: "test",
+          })
+          const authenticated = await service.authenticate(createdApiKey.token)
+
+          expect(authenticated).toBeFalsy()
+        })
+      })
+
       describe("retrieving API keys", () => {
         it("should successfully return all existing api keys", async function () {
           await service.create([