Protect content manipulation with API keys - Githubissues

deconst / content-service

An API for storing, indexing and retrieving documentation

MIT License

4 stars 9 forks source link

Protect content manipulation with API keys #28

Closed smashwilson closed 9 years ago

smashwilson commented 9 years ago

Protect requests that manipulate content by requiring an API key.

[x] Accept an admin key from the process' environment.
[x] Introduce a /keys endpoint to issue and revoke API keys.
[x] Create restify middleware to assert that the current request has a valid API key and respond appropriately otherwise.
[x] Create middleware to assert that the current request has an admin key.
[x] Require a valid key to store or delete metadata envelopes.
[x] Document the new endpoints and behavior in the README.

The foundation for deconst/deconst-docs#15.

smashwilson commented 9 years ago

API keys: implemented.

Note that this will break everything until I can make the preparers set Authorization properly.