IApiKeyStore
AgentPrism.Abstractions.dllThe store for per-tenant API keys.
public interface IApiKeyStoreRemarks
Section titled “Remarks”A second identity source alongside the static bearer token, bound to a tenant and carrying a scope; it does not replace the static token.
Methods
Section titled “Methods”CreateAsync(ApiKeyDraft, CancellationToken)
Section titled “ CreateAsync(ApiKeyDraft, CancellationToken)”Generates and stores a new key.
ValueTask<ApiKeyCreationResult> CreateAsync(ApiKeyDraft draft, CancellationToken cancellationToken = default)Parameters
Section titled “Parameters”draft ApiKeyDraft
The key’s draft.
cancellationToken CancellationToken
The cancellation token.
Returns
Section titled “Returns”ValueTask<ApiKeyCreationResult>
The saved record and the raw key value. The raw value cannot be produced again after this call.
FindByHashAsync(ReadOnlyMemory<byte>, CancellationToken)
Section titled “ FindByHashAsync(ReadOnlyMemory<byte>, CancellationToken)”Looks up a key by its SHA-256 digest.
ValueTask<ApiKeyRecord?> FindByHashAsync(ReadOnlyMemory<byte> keyHash, CancellationToken cancellationToken = default)Parameters
Section titled “Parameters”keyHash ReadOnlyMemory<byte>
The digest of the presented raw value.
cancellationToken CancellationToken
The cancellation token.
Returns
Section titled “Returns”The record; null if it does not exist.
Remarks
Section titled “Remarks”No tenant filter is applied: the tenant is the OUTPUT of this call, not its INPUT — while authenticating a request, which tenant it belongs to is not yet known. The lookup always goes through the digest; the raw value never enters any query directly.
HasActiveScopeAsync(ApiKeyScope, CancellationToken)
Section titled “ HasActiveScopeAsync(ApiKeyScope, CancellationToken)”Reports whether at least one key exists in the system (in any tenant) that carries the given scope, is not revoked, and has not expired.
ValueTask<bool> HasActiveScopeAsync(ApiKeyScope scope, CancellationToken cancellationToken = default)Parameters
Section titled “Parameters”scope ApiKeyScope
The scope to look for.
cancellationToken CancellationToken
The cancellation token.
Returns
Section titled “Returns”true if found.
Remarks
Section titled “Remarks”There is deliberately no tenant filter: this is an installation
health check, not specific
to any tenant — it asks whether the system has at least one valid
external:invoke key, so the external surface can be opened
TOGETHER with AllowRemoteAccess.
ListAsync(string, CancellationToken)
Section titled “ ListAsync(string, CancellationToken)”Lists a tenant’s keys. The raw value and digest are not returned.
ValueTask<IReadOnlyList<ApiKeyRecord>> ListAsync(string tenantId, CancellationToken cancellationToken = default)Parameters
Section titled “Parameters”tenantId string
The tenant identifier.
cancellationToken CancellationToken
The cancellation token.
Returns
Section titled “Returns”ValueTask<IReadOnlyList<ApiKeyRecord>>
The keys, by creation time.
RevokeAsync(string, Guid, CancellationToken)
Section titled “ RevokeAsync(string, Guid, CancellationToken)”Revokes a key. The row is not DELETED; revoked_at is written.
ValueTask<bool> RevokeAsync(string tenantId, Guid id, CancellationToken cancellationToken = default)Parameters
Section titled “Parameters”tenantId string
The tenant the key is bound to.
id Guid
The key identifier.
cancellationToken CancellationToken
The cancellation token.
Returns
Section titled “Returns”true if the key was found in this tenant and revoked.
TouchLastUsedAsync(Guid, DateTimeOffset, CancellationToken)
Section titled “ TouchLastUsedAsync(Guid, DateTimeOffset, CancellationToken)”Updates the last-used timestamp.
ValueTask TouchLastUsedAsync(Guid id, DateTimeOffset usedAt, CancellationToken cancellationToken = default)Parameters
Section titled “Parameters”id Guid
The key identifier.
usedAt DateTimeOffset
The usage time.
cancellationToken CancellationToken
The cancellation token.
Returns
Section titled “Returns”The completion task.
Remarks
Section titled “Remarks”There is no tenant filter: the caller (ApiKeyAuthenticator)
has already found the key through its digest and RESOLVED the tenant;
a second check here is unnecessary — the same reason as
IApiKeyStore.FindByHashAsync.