Create initial route for generating an API key

bryphe-coder · bryphe-coder · commit 6c50b85a129d · 2022-02-16T01:09:15.000Z
diff --git a/coderd/coderd.go b/coderd/coderd.go
@@ -36,6 +36,13 @@ func New(options *Options) http.Handler {
 		})
 		r.Post("/login", api.postLogin)
 		r.Post("/logout", api.postLogout)
+		r.Route("/api-keys", func(r chi.Router) {
+			r.Use(
+				httpmw.ExtractAPIKey(options.Database, nil),
+			)
+			r.Post("/", api.postApiKey)
+		})
+
 		// Used for setup.
 		r.Get("/user", api.user)
 		r.Post("/user", api.postUser)
diff --git a/coderd/users.go b/coderd/users.go
@@ -55,6 +55,11 @@ type LoginWithPasswordResponse struct {
 	SessionToken string `json:"session_token" validate:"required"`
 }
 
+// GenerateAPIKeyResponse contains an API key for a user.
+type GenerateAPIKeyResponse struct {
+	Key string `json:"key"`
+}
+
 // Returns whether the initial user has been created or not.
 func (api *api) user(rw http.ResponseWriter, r *http.Request) {
 	userCount, err := api.Database.GetUserCount(r.Context())
@@ -312,6 +317,43 @@ func (api *api) postLogin(rw http.ResponseWriter, r *http.Request) {
 	})
 }
 
+// Creates a new API key, used for logging in via the CLI
+func (api *api) postApiKey(rw http.ResponseWriter, r *http.Request) {
+	apiKey := httpmw.APIKey(r)
+	userID := apiKey.UserID
+
+	keyID, keySecret, err := generateAPIKeyIDSecret()
+	if err != nil {
+		httpapi.Write(rw, http.StatusInternalServerError, httpapi.Response{
+			Message: fmt.Sprintf("generate api key parts: %s", err.Error()),
+		})
+		return
+	}
+	hashed := sha256.Sum256([]byte(keySecret))
+
+	_, err = api.Database.InsertAPIKey(r.Context(), database.InsertAPIKeyParams{
+		ID:           keyID,
+		UserID:       userID,
+		ExpiresAt:    database.Now().AddDate(1, 0, 0), // Expire after 1 year (same as v1)
+		CreatedAt:    database.Now(),
+		UpdatedAt:    database.Now(),
+		HashedSecret: hashed[:],
+		LoginType:    database.LoginTypeBuiltIn,
+	})
+	if err != nil {
+		httpapi.Write(rw, http.StatusInternalServerError, httpapi.Response{
+			Message: fmt.Sprintf("insert api key: %s", err.Error()),
+		})
+		return
+	}
+
+	// This format is consumed by the APIKey middleware.
+	generatedApiKey := fmt.Sprintf("%s-%s", keyID, keySecret)
+
+	render.Status(r, http.StatusCreated)
+	render.JSON(rw, r, GenerateAPIKeyResponse{Key: generatedApiKey})
+}
+
 // Clear the user's session cookie
 func (*api) postLogout(rw http.ResponseWriter, r *http.Request) {
 	// Get a blank token cookie
