Phase 3: OpenSubsonic core (response envelope, error codes 42-44, getOpenSubsonicExtensions) and apiKeyAuthentication extension with tokenInfo, web API key management

internal/web/admin_apikeys_handlers.go

@@ -0,0 +1,44 @@
+package web
+
+import (
+	"net/http"
+
+	"git.noroutes.net/NoRoutes/vibetunes/internal/database"
+)
+
+func (h *Web) handleAdminAPIKeys(w http.ResponseWriter, r *http.Request) {
+	keys, err := database.ListAllAPIKeys(h.DB)
+	if err != nil {
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+	type keyView struct {
+		Key      *database.APIKey
+		Username string
+	}
+	var views []keyView
+	for _, k := range keys {
+		username := k.UserID
+		if u, err := database.GetUserByID(h.DB, k.UserID); err == nil {
+			username = u.Username
+		}
+		views = append(views, keyView{Key: k, Username: username})
+	}
+	h.page(w, r, "admin_api_keys", "admin_api_keys", "API Keys", views)
+}
+
+// handleAdminAPIKeyRevoke lets an admin revoke any user's API key — the
+// self-service /settings/api-keys/{id}/revoke route only allows revoking
+// your own.
+func (h *Web) handleAdminAPIKeyRevoke(w http.ResponseWriter, r *http.Request) {
+	id := r.PathValue("id")
+	if _, err := database.GetAPIKey(h.DB, id); err != nil {
+		http.NotFound(w, r)
+		return
+	}
+	if err := database.RevokeAPIKey(h.DB, id); err != nil {
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+	http.Redirect(w, r, "/admin/api-keys", http.StatusFound)
+}

internal/web/router.go

@@ -96,6 +96,9 @@ func (h *Web) NewRouter() http.Handler {
 	mux.HandleFunc("POST /admin/podcasts/episodes/{id}/download", h.requireAdmin(h.handleAdminPodcastEpisodeDownload))
 	mux.HandleFunc("POST /admin/podcasts/episodes/{id}/delete", h.requireAdmin(h.handleAdminPodcastEpisodeDelete))
 
+	mux.HandleFunc("GET /admin/api-keys", h.requireAdmin(h.handleAdminAPIKeys))
+	mux.HandleFunc("POST /admin/api-keys/{id}/revoke", h.requireAdmin(h.handleAdminAPIKeyRevoke))
+
 	mux.HandleFunc("GET /admin/jukebox", h.requireAdmin(h.handleAdminJukebox))
 	mux.HandleFunc("POST /admin/jukebox/start", h.requireAdmin(h.handleAdminJukeboxStart))
 	mux.HandleFunc("POST /admin/jukebox/stop", h.requireAdmin(h.handleAdminJukeboxStop))

internal/web/settings_handlers.go

@@ -71,12 +71,13 @@ func (h *Web) handleAPIKeyCreate(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	name := r.FormValue("name")
+	clientDescription := r.FormValue("client_description")
 	rawKey, err := auth.GenerateAPIKey()
 	if err != nil {
 		http.Error(w, "internal error", http.StatusInternalServerError)
 		return
 	}
-	if _, err := database.CreateAPIKey(h.DB, user.ID, name, auth.HashAPIKey(rawKey)); err != nil {
+	if _, err := database.CreateAPIKey(h.DB, user.ID, name, auth.HashAPIKey(rawKey), clientDescription); err != nil {
 		http.Error(w, "internal error", http.StatusInternalServerError)
 		return
 	}