src/crypto_processing_api/cli.py can mint a key (create-api-key) and revoke
one (revoke-api-key), and there is no way to see what exists. You cannot
revoke what you cannot list — revoke-api-key takes a key_id, and the only
place a key_id was ever shown is the output of create-api-key, months ago,
in a terminal that is gone.
What to build
A list-api-keys subcommand printing one row per key: key_id, name,
scope, created_at, last_used_at, and whether it is revoked or expired.
Constraints
- Never print the key itself, and never print the hash. The plaintext key
does not exist anywhere after creation, which is the point; key_hash is not
secret in theory but is not useful to anyone and belongs nowhere near a
terminal. key_id is the non-secret lookup handle — see the module docstring
at the top of src/crypto_processing_api/core/auth.py.
- Revoked and expired keys should still be listed, marked as such. An operator
auditing who had access needs the history, not just the live set.
- Follow the argparse shape the other subcommands use in
cli.py around lines
168-190.
Nice to have
--include-revoked/--only-active and a --json flag, if it stays small.
Where to start
src/crypto_processing_api/cli.py, the ApiKey model at
src/crypto_processing_api/ledger/models.py:460.
src/crypto_processing_api/cli.pycan mint a key (create-api-key) and revokeone (
revoke-api-key), and there is no way to see what exists. You cannotrevoke what you cannot list —
revoke-api-keytakes akey_id, and the onlyplace a
key_idwas ever shown is the output ofcreate-api-key, months ago,in a terminal that is gone.
What to build
A
list-api-keyssubcommand printing one row per key:key_id,name,scope,created_at,last_used_at, and whether it is revoked or expired.Constraints
does not exist anywhere after creation, which is the point;
key_hashis notsecret in theory but is not useful to anyone and belongs nowhere near a
terminal.
key_idis the non-secret lookup handle — see the module docstringat the top of
src/crypto_processing_api/core/auth.py.auditing who had access needs the history, not just the live set.
cli.pyaround lines168-190.
Nice to have
--include-revoked/--only-activeand a--jsonflag, if it stays small.Where to start
src/crypto_processing_api/cli.py, theApiKeymodel atsrc/crypto_processing_api/ledger/models.py:460.