Nick SzaunigandClaude Opus 5.5
445fb3b94b
Integrations such as the Wabenhain shop sync no longer need a service account with a password (and without MFA). An admin creates a key under Verwaltung > Automatisierung > API-Schlüssel. - Key format ack_<8>_<43>; only its SHA-256 hash is stored, the key is shown exactly once. Optional expiry, "last used" timestamp, revocation takes effect immediately; create/revoke are audit-logged without the key. - A key is not a user: JwtAuthGuard sets request.apiKey, PermissionsGuard admits it only to routes whose permission is among its scopes and never to user-only routes. Scopes come from a short allowlist (shop-sync:read). - Managing keys requires the new permission api-keys:manage. - Keys are excluded from backups on purpose; a restore means issuing a new key. Additive migration (new table). Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
13 lines
386 B
TypeScript
13 lines
386 B
TypeScript
import { Global, Module } from '@nestjs/common';
|
|
import { ApiKeysController } from './api-keys.controller';
|
|
import { ApiKeysService } from './api-keys.service';
|
|
|
|
// Global: the app-wide auth guards need ApiKeysService to recognise keys.
|
|
@Global()
|
|
@Module({
|
|
controllers: [ApiKeysController],
|
|
providers: [ApiKeysService],
|
|
exports: [ApiKeysService],
|
|
})
|
|
export class ApiKeysModule {}
|