feat: support typed API keys with global reader access

Author: pratik50

src/apikeys.rs

@@ -32,16 +32,22 @@ use serde::Deserialize;
 /// are derived from these roles (same flow as native/OAuth users).
 /// `apiKey` lets a caller register their own key; omitting it preserves
 /// the existing server-generated key behavior.
+#[derive(Debug, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "lowercase")]
+pub enum ApiKeyType {
+    Ingestor,
+    Query,
+}
+
 #[derive(Debug, Deserialize)]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct CreateApiKeyRequest {
     pub key_name: String,
     #[serde(default)]
     pub roles: HashSet<String>,
     pub api_key: Option<String>,
-    /// Helm uses this mode to request the server-managed global ingest role.
-    #[serde(default)]
-    pub ingestor_only: bool,
+    /// Omit for the existing UI/API flow that assigns explicit roles.
+    pub api_key_type: Option<ApiKeyType>,
 }
 
 /// Require a hyphenated UUID v4, allowing either letter case.
@@ -67,8 +73,8 @@ pub enum ApiKeyError {
     #[error("apiKey must be a UUID v4 in 8-4-4-4-12 format")]
     InvalidApiKey,
 
-    #[error("ingestorOnly cannot be combined with roles")]
-    IngestorOnlyWithRoles,
+    #[error("apiKeyType cannot be combined with roles")]
+    ApiKeyTypeWithRoles,
 
     #[error("Unauthorized: {0}")]
     Unauthorized(String),
@@ -93,7 +99,7 @@ impl actix_web::ResponseError for ApiKeyError {
             ApiKeyError::DuplicateKeyName(_) | ApiKeyError::DuplicateApiKey => {
                 actix_web::http::StatusCode::CONFLICT
             }
-            ApiKeyError::InvalidApiKey | ApiKeyError::IngestorOnlyWithRoles => {
+            ApiKeyError::InvalidApiKey | ApiKeyError::ApiKeyTypeWithRoles => {
                 actix_web::http::StatusCode::BAD_REQUEST
             }
             ApiKeyError::Unauthorized(_) => actix_web::http::StatusCode::FORBIDDEN,
@@ -107,3 +113,31 @@ impl actix_web::ResponseError for ApiKeyError {
         }
     }
 }
+
+#[cfg(test)]
+mod request_tests {
+    use super::{ApiKeyType, CreateApiKeyRequest};
+
+    #[test]
+    fn typed_keys_and_existing_role_requests_deserialize() {
+        let ingestor: CreateApiKeyRequest =
+            serde_json::from_str(r#"{"keyName":"ingest-key","apiKeyType":"ingestor"}"#).unwrap();
+        assert_eq!(ingestor.api_key_type, Some(ApiKeyType::Ingestor));
+
+        let query: CreateApiKeyRequest =
+            serde_json::from_str(r#"{"keyName":"query-key","apiKeyType":"query"}"#).unwrap();
+        assert_eq!(query.api_key_type, Some(ApiKeyType::Query));
+
+        let ui: CreateApiKeyRequest =
+            serde_json::from_str(r#"{"keyName":"ui-key","roles":["reader-role"]}"#).unwrap();
+        assert_eq!(ui.api_key_type, None);
+        assert!(ui.roles.contains("reader-role"));
+
+        assert!(
+            serde_json::from_str::<CreateApiKeyRequest>(
+                r#"{"keyName":"old-key","ingestorOnly":true}"#
+            )
+            .is_err()
+        );
+    }
+}

src/handlers/http/apikeys.rs

@@ -6,14 +6,16 @@ use serde::{Deserialize, Serialize};
 use ulid::Ulid;
 
 use crate::{
-    apikeys::{ApiKeyError, CreateApiKeyRequest, validate_api_key as validate_api_key_value},
+    apikeys::{
+        ApiKeyError, ApiKeyType, CreateApiKeyRequest, validate_api_key as validate_api_key_value,
+    },
     handlers::http::{
         modal::utils::rbac_utils::{get_metadata, put_metadata},
         rbac::{RBACError, UPDATE_LOCK},
     },
     parseable::DEFAULT_TENANT,
     rbac::{
-        GLOBAL_INGESTOR_ROLE, Users,
+        GLOBAL_INGESTOR_ROLE, GLOBAL_QUERIER_ROLE, Users,
         map::{roles, users},
         user::{User, UserType},
     },
@@ -172,17 +174,24 @@ pub async fn create_api_key(
 
     let guard = UPDATE_LOCK.lock().await;
 
-    // Helm's ingest-only mode uses an internal role. Explicit roles retain
-    // the existing UI/API behavior and cannot be mixed with this mode.
-    let assigned_roles = if body.ingestor_only {
-        if !body.roles.is_empty() {
-            return Err(ApiKeyError::IngestorOnlyWithRoles);
+    // Typed keys get server-managed roles; the existing UI/API flow keeps
+    // assigning explicit roles when apiKeyType is omitted.
+    let assigned_roles = match body.api_key_type {
+        Some(api_key_type) => {
+            if !body.roles.is_empty() {
+                return Err(ApiKeyError::ApiKeyTypeWithRoles);
+            }
+            let role = match api_key_type {
+                ApiKeyType::Ingestor => GLOBAL_INGESTOR_ROLE,
+                ApiKeyType::Query => GLOBAL_QUERIER_ROLE,
+            };
+            HashSet::from([role.to_string()])
+        }
+        None => {
+            // Hold the update lock while checking user-defined roles.
+            validate_roles(&body.roles, &tenant_id)?;
+            body.roles
         }
-        HashSet::from([GLOBAL_INGESTOR_ROLE.to_string()])
-    } else {
-        // Hold the update lock while checking user-defined roles.
-        validate_roles(&body.roles, &tenant_id)?;
-        body.roles
     };
 
     // Duplicate key-name detection inside the same tenant.

src/rbac/mod.rs

@@ -41,13 +41,15 @@ use crate::rbac::user::User;
 use crate::utils::get_tenant_id_from_key;
 
 use self::map::SessionKey;
-use self::role::{Permission, RoleBuilder};
+use self::role::{ParseableResourceType, Permission, RoleBuilder, model::DefaultPrivilege};
 use self::user::UserType;
 
 pub const EXPIRY_DURATION: Duration = Duration::hours(1);
 /// Reserved, server-managed role for Helm's ingest-only API keys.
 /// This name is outside the user-defined role-name grammar.
 pub const GLOBAL_INGESTOR_ROLE: &str = "__global_ingestor__";
+/// Reserved, server-managed role with the existing reader privilege on all datasets.
+pub const GLOBAL_QUERIER_ROLE: &str = "__global_querier__";
 
 #[derive(PartialEq, Debug)]
 pub enum Response {
@@ -404,6 +406,15 @@ pub fn roles_to_permission(roles: Vec<String>, tenant_id: &str) -> Vec<Permissio
             perms.insert(Permission::Resource(Action::Ingest, None));
             continue;
         }
+        if role == GLOBAL_QUERIER_ROLE {
+            perms.extend(
+                RoleBuilder::from(&DefaultPrivilege::Reader {
+                    resource: Some(ParseableResourceType::Stream("*".to_string())),
+                })
+                .build(),
+            );
+            continue;
+        }
         let role_map = &map::roles();
         if let Some(roles) = role_map.get(tenant_id)
             && let Some(privilege_list) = roles.get(role)
@@ -419,7 +430,7 @@ pub fn roles_to_permission(roles: Vec<String>, tenant_id: &str) -> Vec<Permissio
 }
 
 #[cfg(test)]
-mod global_ingestor_tests {
+mod global_api_key_role_tests {
     use super::*;
 
     #[test]
@@ -430,4 +441,17 @@ mod global_ingestor_tests {
             vec![Permission::Resource(Action::Ingest, None)]
         );
     }
+
+    #[test]
+    fn internal_querier_role_has_reader_access_to_all_datasets() {
+        let permissions = roles_to_permission(vec![GLOBAL_QUERIER_ROLE.to_string()], "tenant");
+        let all_datasets = Some(ParseableResourceType::Stream("*".to_string()));
+        assert!(permissions.contains(&Permission::Resource(Action::Query, all_datasets.clone())));
+        assert!(permissions.contains(&Permission::Resource(Action::ListStream, all_datasets)));
+        assert!(!permissions.iter().any(|permission| matches!(
+            permission,
+            Permission::Resource(Action::Ingest | Action::All, _)
+                | Permission::Unit(Action::DeleteStream | Action::PutRole)
+        )));
+    }
 }