feat(api-key): Allow revoking in the future, and enforce the secret key (#6484)

Since there is quite a bit of code here already, I'll do the middleware changes in a separate PR

packages/types/src/api-key/mutations/api-key.ts

@@ -7,12 +7,18 @@ export interface CreateApiKeyDTO {
   // We could add revoked_at as a parameter (or expires_at that gets mapped to revoked_at internally) in order to support expiring tokens
 }
 
+export interface UpsertApiKeyDTO {
+  id?: string
+  title?: string
+  type?: ApiKeyType
+  created_by?: string
+}
+
 export interface UpdateApiKeyDTO {
-  id: string
   title?: string
 }
 
 export interface RevokeApiKeyDTO {
-  id: string
   revoked_by: string
+  revoke_in?: number // Seconds after which the token should be considered revoked
 }

packages/types/src/api-key/service.ts

@@ -2,7 +2,12 @@ import { IModuleService } from "../modules-sdk"
 import { ApiKeyDTO, FilterableApiKeyProps } from "./common"
 import { FindConfig } from "../common"
 import { Context } from "../shared-context"
-import { CreateApiKeyDTO, RevokeApiKeyDTO, UpdateApiKeyDTO } from "./mutations"
+import {
+  CreateApiKeyDTO,
+  RevokeApiKeyDTO,
+  UpdateApiKeyDTO,
+  UpsertApiKeyDTO,
+} from "./mutations"
 
 export interface IApiKeyModuleService extends IModuleService {
   /**
@@ -14,32 +19,57 @@ export interface IApiKeyModuleService extends IModuleService {
   create(data: CreateApiKeyDTO, sharedContext?: Context): Promise<ApiKeyDTO>
 
   /**
-   * Update an api key
-   * @param selector
-   * @param data
-   * @param sharedContext
+   * This method updates existing API keys, or creates new ones if they don't exist.
+   *
+   * @param {UpsertApiKeyDTO[]} data - The attributes to update or create for each API key.
+   * @returns {Promise<ApiKeyDTO[]>} The updated and created API keys.
+   *
+   * @example
+   * {example-code}
    */
-  update(
-    selector: FilterableApiKeyProps,
-    data: Omit<UpdateApiKeyDTO, "id">,
-    sharedContext?: Context
-  ): Promise<ApiKeyDTO[]>
+  upsert(data: UpsertApiKeyDTO[], sharedContext?: Context): Promise<ApiKeyDTO[]>
+
   /**
-   * Update an api key
-   * @param id
-   * @param data
-   * @param sharedContext
+   * This method updates an existing API key, or creates a new one if it doesn't exist.
+   *
+   * @param {UpsertApiKeyDTO} data - The attributes to update or create for the API key.
+   * @returns {Promise<ApiKeyDTO>} The updated or created API key.
+   *
+   * @example
+   * {example-code}
+   */
+  upsert(data: UpsertApiKeyDTO, sharedContext?: Context): Promise<ApiKeyDTO>
+
+  /**
+   * This method updates an existing API key.
+   *
+   * @param {string} id - The API key's ID.
+   * @param {UpdateApiKeyDTO} data - The details to update in the API key.
+   * @param {Context} sharedContext - A context used to share resources, such as transaction manager, between the application and the module.
+   * @returns {Promise<ApiKeyDTO>} The updated API key.
    */
   update(
     id: string,
-    data: Omit<UpdateApiKeyDTO, "id">,
+    data: UpdateApiKeyDTO,
     sharedContext?: Context
   ): Promise<ApiKeyDTO>
+
   /**
-   * Update an api key
-   * @param data
+   * This method updates existing API keys.
+   *
+   * @param {FilterableApiKeyProps} selector - The filters to specify which API keys should be updated.
+   * @param {UpdateApiKeyDTO} data - The details to update in the API keys.
+   * @param {Context} sharedContext - A context used to share resources, such as transaction manager, between the application and the module.
+   * @returns {Promise<ApiKeyDTO[]>} The updated API keys.
+   *
+   * @example
+   * {example-code}
    */
-  update(data: UpdateApiKeyDTO[]): Promise<ApiKeyDTO[]>
+  update(
+    selector: FilterableApiKeyProps,
+    data: UpdateApiKeyDTO,
+    sharedContext?: Context
+  ): Promise<ApiKeyDTO[]>
 
   /**
    * Delete an api key
@@ -93,7 +123,7 @@ export interface IApiKeyModuleService extends IModuleService {
    */
   revoke(
     selector: FilterableApiKeyProps,
-    data: Omit<RevokeApiKeyDTO, "id">,
+    data: RevokeApiKeyDTO,
     sharedContext?: Context
   ): Promise<ApiKeyDTO[]>
   /**
@@ -104,19 +134,17 @@ export interface IApiKeyModuleService extends IModuleService {
    */
   revoke(
     id: string,
-    data: Omit<RevokeApiKeyDTO, "id">,
+    data: RevokeApiKeyDTO,
     sharedContext?: Context
   ): Promise<ApiKeyDTO>
-  /**
-   * Revokes an api key
-   * @param data
-   */
-  revoke(data: RevokeApiKeyDTO[]): Promise<ApiKeyDTO[]>
 
   /**
    * Check the validity of an api key
-   * @param id
+   * @param token
    * @param sharedContext
    */
-  authenticate(id: string, sharedContext?: Context): Promise<boolean>
+  authenticate(
+    token: string,
+    sharedContext?: Context
+  ): Promise<ApiKeyDTO | false>
 }