InMemoryApiKeyStore
AgentPrism.Core.dllThe default implementation that keeps API keys in process memory.
public sealed class InMemoryApiKeyStore : IApiKeyStoreInheritance
Section titled “Inheritance”Implements
Section titled “Implements”Inherited Members
Section titled “Inherited Members”object.GetType(), object.ToString(), object.Equals(object?), object.Equals(object?, object?), object.ReferenceEquals(object?, object?), object.GetHashCode()
Remarks
Section titled “Remarks”For single-process deployments and tests. UsePostgreSql, or the
SQL Server or SQLite equivalent, replaces it with SqlApiKeyStore.
Constructors
Section titled “Constructors”InMemoryApiKeyStore(TimeProvider?)
Section titled “ InMemoryApiKeyStore(TimeProvider?)”Initializes a new in-memory API key store.
public InMemoryApiKeyStore(TimeProvider? timeProvider = null)Parameters
Section titled “Parameters”timeProvider TimeProvider?
The time provider. Uses TimeProvider.System when omitted.
Methods
Section titled “Methods”CreateAsync(ApiKeyDraft, CancellationToken)
Section titled “ CreateAsync(ApiKeyDraft, CancellationToken)”Generates and stores a new key.
public ValueTask<ApiKeyCreationResult> CreateAsync(ApiKeyDraft draft, CancellationToken cancellationToken = default)Parameters
Section titled “Parameters”draft ApiKeyDraft
The key’s draft.
cancellationToken CancellationToken
The cancellation token.
Returns
Section titled “Returns”ValueTask<ApiKeyCreationResult>
The saved record and the raw key value. The raw value cannot be produced again after this call.
FindByHashAsync(ReadOnlyMemory<byte>, CancellationToken)
Section titled “ FindByHashAsync(ReadOnlyMemory<byte>, CancellationToken)”Looks up a key by its SHA-256 digest.
public ValueTask<ApiKeyRecord?> FindByHashAsync(ReadOnlyMemory<byte> keyHash, CancellationToken cancellationToken = default)Parameters
Section titled “Parameters”keyHash ReadOnlyMemory<byte>
The digest of the presented raw value.
cancellationToken CancellationToken
The cancellation token.
Returns
Section titled “Returns”The record; null if it does not exist.
Remarks
Section titled “Remarks”No tenant filter is applied: the tenant is the OUTPUT of this call, not its INPUT — while authenticating a request, which tenant it belongs to is not yet known. The lookup always goes through the digest; the raw value never enters any query directly.
HasActiveScopeAsync(ApiKeyScope, CancellationToken)
Section titled “ HasActiveScopeAsync(ApiKeyScope, CancellationToken)”Reports whether at least one key exists in the system (in any tenant) that carries the given scope, is not revoked, and has not expired.
public ValueTask<bool> HasActiveScopeAsync(ApiKeyScope scope, CancellationToken cancellationToken = default)Parameters
Section titled “Parameters”scope ApiKeyScope
The scope to look for.
cancellationToken CancellationToken
The cancellation token.
Returns
Section titled “Returns”true if found.
Remarks
Section titled “Remarks”There is deliberately no tenant filter: this is an installation
health check, not specific
to any tenant — it asks whether the system has at least one valid
external:invoke key, so the external surface can be opened
TOGETHER with AllowRemoteAccess.
ListAsync(string, CancellationToken)
Section titled “ ListAsync(string, CancellationToken)”Lists a tenant’s keys. The raw value and digest are not returned.
public ValueTask<IReadOnlyList<ApiKeyRecord>> ListAsync(string tenantId, CancellationToken cancellationToken = default)Parameters
Section titled “Parameters”tenantId string
The tenant identifier.
cancellationToken CancellationToken
The cancellation token.
Returns
Section titled “Returns”ValueTask<IReadOnlyList<ApiKeyRecord>>
The keys, by creation time.
RevokeAsync(string, Guid, CancellationToken)
Section titled “ RevokeAsync(string, Guid, CancellationToken)”Revokes a key. The row is not DELETED; revoked_at is written.
public ValueTask<bool> RevokeAsync(string tenantId, Guid id, CancellationToken cancellationToken = default)Parameters
Section titled “Parameters”tenantId string
The tenant the key is bound to.
id Guid
The key identifier.
cancellationToken CancellationToken
The cancellation token.
Returns
Section titled “Returns”true if the key was found in this tenant and revoked.
TouchLastUsedAsync(Guid, DateTimeOffset, CancellationToken)
Section titled “ TouchLastUsedAsync(Guid, DateTimeOffset, CancellationToken)”Updates the last-used timestamp.
public ValueTask TouchLastUsedAsync(Guid id, DateTimeOffset usedAt, CancellationToken cancellationToken = default)Parameters
Section titled “Parameters”id Guid
The key identifier.
usedAt DateTimeOffset
The usage time.
cancellationToken CancellationToken
The cancellation token.
Returns
Section titled “Returns”The completion task.
Remarks
Section titled “Remarks”There is no tenant filter: the caller (ApiKeyAuthenticator)
has already found the key through its digest and RESOLVED the tenant;
a second check here is unnecessary — the same reason as
IApiKeyStore.FindByHashAsync.