feat: add ingest-only mode for caller-provided API keys

Author: pratik50

src/apikeys.rs

@@ -30,25 +30,25 @@ use serde::Deserialize;
 /// Request body for creating a new API key. `roles` is a set of role names
 /// that must already exist in the tenant; permissions for the backing user
 /// are derived from these roles (same flow as native/OAuth users).
-/// `providedApiKey` lets a caller register their own key; omitting it preserves
+/// `apiKey` lets a caller register their own key; omitting it preserves
 /// the existing server-generated key behavior.
 #[derive(Debug, Deserialize)]
-#[serde(rename_all = "camelCase")]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct CreateApiKeyRequest {
     pub key_name: String,
     #[serde(default)]
     pub roles: HashSet<String>,
-    pub provided_api_key: Option<String>,
+    pub api_key: Option<String>,
+    /// Helm uses this mode to request the server-managed global ingest role.
+    #[serde(default)]
+    pub ingestor_only: bool,
 }
 
-/// Reject short or malformed caller-supplied credentials before persisting them.
-pub fn validate_provided_api_key(value: &str) -> Result<(), ApiKeyError> {
-    if !(32..=256).contains(&value.len())
-        || !value
-            .bytes()
-            .all(|byte| byte.is_ascii_alphanumeric() || byte == b'-' || byte == b'_')
-    {
-        return Err(ApiKeyError::InvalidProvidedApiKey);
+/// Require a hyphenated UUID v4, allowing either letter case.
+pub fn validate_api_key(value: &str) -> Result<(), ApiKeyError> {
+    let uuid = uuid::Uuid::parse_str(value).map_err(|_| ApiKeyError::InvalidApiKey)?;
+    if value.len() != 36 || uuid.get_version_num() != 4 {
+        return Err(ApiKeyError::InvalidApiKey);
     }
     Ok(())
 }
@@ -64,8 +64,11 @@ pub enum ApiKeyError {
     #[error("API key value is already registered")]
     DuplicateApiKey,
 
-    #[error("providedApiKey must be 32-256 ASCII letters, digits, hyphens, or underscores")]
-    InvalidProvidedApiKey,
+    #[error("apiKey must be a UUID v4 in 8-4-4-4-12 format")]
+    InvalidApiKey,
+
+    #[error("ingestorOnly cannot be combined with roles")]
+    IngestorOnlyWithRoles,
 
     #[error("Unauthorized: {0}")]
     Unauthorized(String),
@@ -90,7 +93,9 @@ impl actix_web::ResponseError for ApiKeyError {
             ApiKeyError::DuplicateKeyName(_) | ApiKeyError::DuplicateApiKey => {
                 actix_web::http::StatusCode::CONFLICT
             }
-            ApiKeyError::InvalidProvidedApiKey => actix_web::http::StatusCode::BAD_REQUEST,
+            ApiKeyError::InvalidApiKey | ApiKeyError::IngestorOnlyWithRoles => {
+                actix_web::http::StatusCode::BAD_REQUEST
+            }
             ApiKeyError::Unauthorized(_) => actix_web::http::StatusCode::FORBIDDEN,
             ApiKeyError::RevocationSyncFailed(_) => {
                 actix_web::http::StatusCode::SERVICE_UNAVAILABLE

src/handlers/http/apikeys.rs

@@ -6,14 +6,14 @@ use serde::{Deserialize, Serialize};
 use ulid::Ulid;
 
 use crate::{
-    apikeys::{ApiKeyError, CreateApiKeyRequest, validate_provided_api_key},
+    apikeys::{ApiKeyError, CreateApiKeyRequest, validate_api_key as validate_api_key_value},
     handlers::http::{
         modal::utils::rbac_utils::{get_metadata, put_metadata},
         rbac::{RBACError, UPDATE_LOCK},
     },
     parseable::DEFAULT_TENANT,
     rbac::{
-        Users,
+        GLOBAL_INGESTOR_ROLE, Users,
         map::{roles, users},
         user::{User, UserType},
     },
@@ -172,9 +172,18 @@ pub async fn create_api_key(
 
     let guard = UPDATE_LOCK.lock().await;
 
-    // Reject any role names that don't exist in this tenant while holding the
-    // update lock so a concurrent role update cannot invalidate the check.
-    validate_roles(&body.roles, &tenant_id)?;
+    // Helm's ingest-only mode uses an internal role. Explicit roles retain
+    // the existing UI/API behavior and cannot be mixed with this mode.
+    let assigned_roles = if body.ingestor_only {
+        if !body.roles.is_empty() {
+            return Err(ApiKeyError::IngestorOnlyWithRoles);
+        }
+        HashSet::from([GLOBAL_INGESTOR_ROLE.to_string()])
+    } else {
+        // Hold the update lock while checking user-defined roles.
+        validate_roles(&body.roles, &tenant_id)?;
+        body.roles
+    };
 
     // Duplicate key-name detection inside the same tenant.
     let existing = collect_tenant_api_keys(&tenant_id);
@@ -187,9 +196,9 @@ pub async fn create_api_key(
     }
 
     let key_id = Ulid::new();
-    let api_key_value = if let Some(provided_api_key) = body.provided_api_key {
-        validate_provided_api_key(&provided_api_key)?;
-        provided_api_key
+    let api_key_value = if let Some(api_key) = body.api_key {
+        validate_api_key_value(&api_key)?;
+        api_key
     } else {
         generate_api_key_value()
     };
@@ -204,7 +213,7 @@ pub async fn create_api_key(
         key_id,
         api_key_value,
         body.key_name,
-        body.roles,
+        assigned_roles,
         created_by,
         tenant_id.clone(),
     );

src/rbac/mod.rs

@@ -45,6 +45,9 @@ use self::role::{Permission, RoleBuilder};
 use self::user::UserType;
 
 pub const EXPIRY_DURATION: Duration = Duration::hours(1);
+/// Reserved, server-managed role for Helm's ingest-only API keys.
+/// This name is outside the user-defined role-name grammar.
+pub const GLOBAL_INGESTOR_ROLE: &str = "__global_ingestor__";
 
 #[derive(PartialEq, Debug)]
 pub enum Response {
@@ -397,6 +400,10 @@ pub struct UsersPrism {
 pub fn roles_to_permission(roles: Vec<String>, tenant_id: &str) -> Vec<Permission> {
     let mut perms = HashSet::new();
     for role in &roles {
+        if role == GLOBAL_INGESTOR_ROLE {
+            perms.insert(Permission::Resource(Action::Ingest, None));
+            continue;
+        }
         let role_map = &map::roles();
         if let Some(roles) = role_map.get(tenant_id)
             && let Some(privilege_list) = roles.get(role)
@@ -410,3 +417,17 @@ pub fn roles_to_permission(roles: Vec<String>, tenant_id: &str) -> Vec<Permissio
     }
     perms.into_iter().collect()
 }
+
+#[cfg(test)]
+mod global_ingestor_tests {
+    use super::*;
+
+    #[test]
+    fn internal_ingestor_role_grants_only_global_ingest() {
+        let permissions = roles_to_permission(vec![GLOBAL_INGESTOR_ROLE.to_string()], "tenant");
+        assert_eq!(
+            permissions,
+            vec![Permission::Resource(Action::Ingest, None)]
+        );
+    }
+}