add creation date and expiration date to access keys

src/model/admin_token_table.rs

@@ -113,7 +113,7 @@ impl AdminApiToken {
 		}
 	}
 
-	/// Returns true if this represents a deleted bucket
+	/// Returns true if this represents a deleted admin token
 	pub fn is_deleted(&self) -> bool {
 		self.state.is_deleted()
 	}
@@ -137,6 +137,19 @@ impl AdminApiToken {
 	}
 }
 
+impl AdminApiTokenParams {
+	pub fn is_expired(&self, ts_now: u64) -> bool {
+		match *self.expiration.get() {
+			None => false,
+			Some(exp) => ts_now >= exp,
+		}
+	}
+
+	pub fn has_scope(&self, endpoint: &str) -> bool {
+		self.scope.get().0.iter().any(|x| x == "*" || x == endpoint)
+	}
+}
+
 impl Entry<EmptyKey, String> for AdminApiToken {
 	fn partition_key(&self) -> &EmptyKey {
 		&EmptyKey

src/model/key_table.rs

@@ -2,6 +2,7 @@ use serde::{Deserialize, Serialize};
 
 use garage_util::crdt::{self, Crdt};
 use garage_util::data::*;
+use garage_util::time::now_msec;
 
 use garage_table::{DeletedFilter, EmptyKey, Entry, TableSchema};
 
@@ -48,13 +49,82 @@ mod v08 {
 	impl garage_util::migrate::InitialFormat for Key {}
 }
 
-pub use v08::*;
+mod v2 {
+	use crate::permission::BucketKeyPerm;
+	use garage_util::crdt;
+	use garage_util::data::Uuid;
+	use serde::{Deserialize, Serialize};
+
+	use super::v08;
+
+	/// An api key
+	#[derive(PartialEq, Eq, Clone, Debug, Serialize, Deserialize)]
+	pub struct Key {
+		/// The id of the key (immutable), used as partition key
+		pub key_id: String,
+
+		/// Internal state of the key
+		pub state: crdt::Deletable<KeyParams>,
+	}
+
+	/// Configuration for a key
+	#[derive(PartialEq, Eq, Clone, Debug, Serialize, Deserialize)]
+	pub struct KeyParams {
+		/// Key's creation date, if known (older versions of Garage didn't keep track
+		/// of this information)
+		pub created: Option<u64>,
+		/// The secret_key associated (immutable)
+		pub secret_key: String,
+
+		/// Name for the key
+		pub name: crdt::Lww<String>,
+		/// The optional time of expiration of the key
+		pub expiration: crdt::Lww<Option<u64>>,
+
+		/// Flag to allow users having this key to create buckets
+		pub allow_create_bucket: crdt::Lww<bool>,
+
+		/// If the key is present: it gives some permissions,
+		/// a map of bucket IDs (uuids) to permissions.
+		/// Otherwise no permissions are granted to key
+		pub authorized_buckets: crdt::Map<Uuid, BucketKeyPerm>,
+
+		/// A key can have a local view of buckets names it is
+		/// the only one to see, this is the namespace for these aliases
+		pub local_aliases: crdt::LwwMap<String, Option<Uuid>>,
+	}
+
+	impl garage_util::migrate::Migrate for Key {
+		const VERSION_MARKER: &'static [u8] = b"G2key";
+
+		type Previous = v08::Key;
+
+		fn migrate(old: v08::Key) -> Key {
+			Key {
+				key_id: old.key_id,
+				state: old.state.map(|x| KeyParams {
+					created: None,
+					secret_key: x.secret_key,
+					name: x.name,
+					expiration: crdt::Lww::raw(0, None),
+					allow_create_bucket: x.allow_create_bucket,
+					authorized_buckets: x.authorized_buckets,
+					local_aliases: x.local_aliases,
+				}),
+			}
+		}
+	}
+}
+
+pub use v2::*;
 
 impl KeyParams {
 	fn new(secret_key: &str, name: &str) -> Self {
 		KeyParams {
+			created: Some(now_msec()),
 			secret_key: secret_key.to_string(),
 			name: crdt::Lww::new(name.to_string()),
+			expiration: crdt::Lww::new(None),
 			allow_create_bucket: crdt::Lww::new(false),
 			authorized_buckets: crdt::Map::new(),
 			local_aliases: crdt::LwwMap::new(),
@@ -65,6 +135,7 @@ impl KeyParams {
 impl Crdt for KeyParams {
 	fn merge(&mut self, o: &Self) {
 		self.name.merge(&o.name);
+		self.expiration.merge(&o.expiration);
 		self.allow_create_bucket.merge(&o.allow_create_bucket);
 		self.authorized_buckets.merge(&o.authorized_buckets);
 		self.local_aliases.merge(&o.local_aliases);
@@ -145,6 +216,15 @@ impl Key {
 	}
 }
 
+impl KeyParams {
+	pub fn is_expired(&self, ts_now: u64) -> bool {
+		match *self.expiration.get() {
+			None => false,
+			Some(exp) => ts_now >= exp,
+		}
+	}
+}
+
 impl Entry<EmptyKey, String> for Key {
 	fn partition_key(&self) -> &EmptyKey {
 		&EmptyKey