Phase 3: OpenSubsonic core (response envelope, error codes 42-44, getOpenSubsonicExtensions) and apiKeyAuthentication extension with tokenInfo, web API key management

internal/web/admin_apikeys_handlers.go

@@ -0,0 +1,44 @@
+package web
+
+import (
+	"net/http"
+
+	"git.noroutes.net/NoRoutes/vibetunes/internal/database"
+)
+
+func (h *Web) handleAdminAPIKeys(w http.ResponseWriter, r *http.Request) {
+	keys, err := database.ListAllAPIKeys(h.DB)
+	if err != nil {
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+	type keyView struct {
+		Key      *database.APIKey
+		Username string
+	}
+	var views []keyView
+	for _, k := range keys {
+		username := k.UserID
+		if u, err := database.GetUserByID(h.DB, k.UserID); err == nil {
+			username = u.Username
+		}
+		views = append(views, keyView{Key: k, Username: username})
+	}
+	h.page(w, r, "admin_api_keys", "admin_api_keys", "API Keys", views)
+}
+
+// handleAdminAPIKeyRevoke lets an admin revoke any user's API key — the
+// self-service /settings/api-keys/{id}/revoke route only allows revoking
+// your own.
+func (h *Web) handleAdminAPIKeyRevoke(w http.ResponseWriter, r *http.Request) {
+	id := r.PathValue("id")
+	if _, err := database.GetAPIKey(h.DB, id); err != nil {
+		http.NotFound(w, r)
+		return
+	}
+	if err := database.RevokeAPIKey(h.DB, id); err != nil {
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+	http.Redirect(w, r, "/admin/api-keys", http.StatusFound)
+}