feat(auth): add admin-managed bot API keys with expiry and revocation

2026-04-03 13:12:29 +00:00
parent 06b1805b92
commit 6998936858
15 changed files with 935 additions and 34 deletions
@@ -323,6 +323,7 @@ Response 201:
    "token_prefix": "abcd1234",
    "permission": "read",
    "token_type": "client",
+    "bot_principal_id": null,
    "expires_at": "2026-05-03T00:00:00Z",
    "last_used_at": null,
    "revoked_at": null,
@@ -353,6 +354,128 @@ Response 204:

 - No content.

+### 6.5 POST /auth/bots
+
+Request:
+
+```bash
+curl -X POST "http://localhost:8000/auth/bots" \
+  -H "Authorization: Bearer <ADMIN_TOKEN>" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "owner_user_id": "user-1",
+    "name": "market-bot",
+    "description": "External trading bot"
+  }'
+```
+
+Response 201:
+
+```json
+{
+  "id": "bot-1",
+  "owner_user_id": "user-1",
+  "name": "market-bot",
+  "description": "External trading bot",
+  "is_active": true,
+  "created_at": "2026-04-03T00:00:00Z",
+  "updated_at": "2026-04-03T00:00:00Z",
+  "deactivated_at": null
+}
+```
+
+### 6.6 GET /auth/bots
+
+Request:
+
+```bash
+curl -X GET "http://localhost:8000/auth/bots?is_active=true" \
+  -H "Authorization: Bearer <ADMIN_TOKEN>"
+```
+
+### 6.7 POST /auth/bots/{bot_id}/tokens
+
+Request:
+
+```bash
+curl -X POST "http://localhost:8000/auth/bots/bot-1/tokens" \
+  -H "Authorization: Bearer <ADMIN_TOKEN>" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "name": "prod-key",
+    "permission": "read",
+    "expires_in_days": 30
+  }'
+```
+
+Response 201:
+
+```json
+{
+  "token": "plain-bot-token",
+  "token_type": "bearer",
+  "auth_token": {
+    "id": "token-2",
+    "user_id": "user-1",
+    "name": "prod-key",
+    "token_prefix": "efgh5678",
+    "permission": "read",
+    "token_type": "bot",
+    "bot_principal_id": "bot-1",
+    "expires_at": "2026-05-03T00:00:00Z",
+    "last_used_at": null,
+    "revoked_at": null,
+    "created_at": "2026-04-03T00:00:00Z"
+  }
+}
+```
+
+### 6.8 GET /auth/bots/{bot_id}/tokens
+
+Request:
+
+```bash
+curl -X GET "http://localhost:8000/auth/bots/bot-1/tokens" \
+  -H "Authorization: Bearer <ADMIN_TOKEN>"
+```
+
+### 6.9 DELETE /auth/bots/{bot_id}/tokens/{token_id}
+
+Request:
+
+```bash
+curl -X DELETE "http://localhost:8000/auth/bots/bot-1/tokens/token-2" \
+  -H "Authorization: Bearer <ADMIN_TOKEN>"
+```
+
+Response 204:
+
+- No content.
+
+### 6.10 DELETE /auth/bots/{bot_id}
+
+Request:
+
+```bash
+curl -X DELETE "http://localhost:8000/auth/bots/bot-1" \
+  -H "Authorization: Bearer <ADMIN_TOKEN>"
+```
+
+Response 200:
+
+```json
+{
+  "id": "bot-1",
+  "owner_user_id": "user-1",
+  "name": "market-bot",
+  "description": "External trading bot",
+  "is_active": false,
+  "created_at": "2026-04-03T00:00:00Z",
+  "updated_at": "2026-04-03T01:00:00Z",
+  "deactivated_at": "2026-04-03T01:00:00Z"
+}
+```
+
 ## 7. Users

 All user management endpoints require an admin token.