api key feature flag

crates/schema/public/enums/src/by_table/users/user_feature_flag.rs

@@ -19,6 +19,7 @@ pub enum UserFeatureFlag {
   /// (For now, it's hidden until we get an NSFW filter.)
   ExploreMedia,
 
+
   /// Access to studio features
   Studio,
 
@@ -44,6 +45,10 @@ pub enum UserFeatureFlag {
   /// Access to the referrals program
   #[serde(rename = "referrals")]
   ReferralsProgram,
+
+  /// Access to API key creation
+  #[serde(rename = "api_key")]
+  ApiKey,
 }
 
 // TODO(bt, 2022-12-21): This desperately needs MySQL integration tests!
@@ -63,6 +68,7 @@ impl UserFeatureFlag {
       Self::HappyHorse => "hh",
       Self::HappyHorseRateLimit => "hh_rl",
       Self::ReferralsProgram => "referrals",
+      Self::ApiKey => "api_key",
     }
   }
 
@@ -76,6 +82,7 @@ impl UserFeatureFlag {
       "hh" => Ok(Self::HappyHorse),
       "hh_rl" => Ok(Self::HappyHorseRateLimit),
       "referrals" => Ok(Self::ReferralsProgram),
+      "api_key" => Ok(Self::ApiKey),
       _ => Err(format!("invalid value: {:?}", value)),
     }
   }
@@ -90,6 +97,7 @@ impl UserFeatureFlag {
       Self::HappyHorse => "Happy Horse (no Rate Limit)",
       Self::HappyHorseRateLimit => "Happy Horse (with Rate Limit)",
       Self::ReferralsProgram => "Referrals Program",
+      Self::ApiKey => "API Keys",
     }
   }
 
@@ -103,6 +111,7 @@ impl UserFeatureFlag {
       Self::HappyHorse => "Access to Happy Horse (without a rate limit - dangerous)",
       Self::HappyHorseRateLimit => "Access to Happy Horse (with a rate limit)",
       Self::ReferralsProgram => "Access to the referrals program",
+      Self::ApiKey => "Access to API key creation",
     }
   }
 
@@ -118,6 +127,7 @@ impl UserFeatureFlag {
       Self::HappyHorse,
       Self::HappyHorseRateLimit,
       Self::ReferralsProgram,
+      Self::ApiKey,
     ])
   }
 }
@@ -140,6 +150,7 @@ mod tests {
       assert_serialization(UserFeatureFlag::HappyHorse, "hh");
       assert_serialization(UserFeatureFlag::HappyHorseRateLimit, "hh_rl");
       assert_serialization(UserFeatureFlag::ReferralsProgram, "referrals");
+      assert_serialization(UserFeatureFlag::ApiKey, "api_key");
     }
 
     #[test]
@@ -152,6 +163,7 @@ mod tests {
       assert_eq!(UserFeatureFlag::HappyHorse.to_str(), "hh");
       assert_eq!(UserFeatureFlag::HappyHorseRateLimit.to_str(), "hh_rl");
       assert_eq!(UserFeatureFlag::ReferralsProgram.to_str(), "referrals");
+      assert_eq!(UserFeatureFlag::ApiKey.to_str(), "api_key");
     }
 
     #[test]
@@ -164,13 +176,14 @@ mod tests {
       assert_eq!(UserFeatureFlag::from_str("hh").unwrap(), UserFeatureFlag::HappyHorse);
       assert_eq!(UserFeatureFlag::from_str("hh_rl").unwrap(), UserFeatureFlag::HappyHorseRateLimit);
       assert_eq!(UserFeatureFlag::from_str("referrals").unwrap(), UserFeatureFlag::ReferralsProgram);
+      assert_eq!(UserFeatureFlag::from_str("api_key").unwrap(), UserFeatureFlag::ApiKey);
       assert!(UserFeatureFlag::from_str("foo").is_err());
     }
 
     #[test]
     fn all_variants() {
       let mut variants = UserFeatureFlag::all_variants();
-      assert_eq!(variants.len(), 8);
+      assert_eq!(variants.len(), 9);
       assert_eq!(variants.pop_first(), Some(UserFeatureFlag::ExploreMedia));
       assert_eq!(variants.pop_first(), Some(UserFeatureFlag::Studio));
       assert_eq!(variants.pop_first(), Some(UserFeatureFlag::Upload3d));
@@ -179,6 +192,7 @@ mod tests {
       assert_eq!(variants.pop_first(), Some(UserFeatureFlag::HappyHorse));
       assert_eq!(variants.pop_first(), Some(UserFeatureFlag::HappyHorseRateLimit));
       assert_eq!(variants.pop_first(), Some(UserFeatureFlag::ReferralsProgram));
+      assert_eq!(variants.pop_first(), Some(UserFeatureFlag::ApiKey));
       assert_eq!(variants.pop_first(), None);
     }
   }

crates/service/web/storyteller_web/src/http_server/endpoints/api_keys/create_api_key_handler.rs

@@ -10,6 +10,7 @@ use http_server_common::request::get_request_ip::get_request_ip;
 use mysql_queries::queries::api_keys::insert_api_key::{insert_api_key, InsertApiKeyArgs};
 
 use crate::http_server::common_responses::common_web_error::CommonWebError;
+use crate::http_server::session::lookup::user_session_feature_flags::UserSessionFeatureFlags;
 use crate::http_server::web_utils::user_session::require_user_session::require_user_session;
 use crate::state::server_state::ServerState;
 use crate::util::generate_api_key::generate_api_key;
@@ -29,6 +30,7 @@ const MAX_DESCRIPTION_LEN: usize = 512;
     (status = 200, body = CreateApiKeySuccessResponse),
     (status = 400, body = CommonWebError),
     (status = 401, body = CommonWebError),
+    (status = 403, body = CommonWebError),
     (status = 500, body = CommonWebError),
   ),
 )]
@@ -44,6 +46,14 @@ pub async fn create_api_key_handler(
 
   let user_session = require_user_session(&http_request, &server_state.session_checker, &mut *conn).await?;
 
+  // API key creation is gated behind the `api_key` feature flag.
+  let feature_flags = UserSessionFeatureFlags::new(user_session.maybe_feature_flags.as_deref());
+
+  if !feature_flags.can_create_api_key() {
+    warn!("User {:?} attempted to create an API key without the api_key feature flag", user_session.user_token.as_str());
+    return Err(CommonWebError::Forbidden);
+  }
+
   let name = request.name.trim().to_string();
 
   let maybe_description = request.maybe_description.as_ref().map(|s| s.trim().to_string());

crates/service/web/storyteller_web/src/http_server/session/lookup/user_session_feature_flags.rs

@@ -101,6 +101,10 @@ impl UserSessionFeatureFlags {
   pub fn can_use_referrals_program(&self) -> bool {
     self.feature_flags.contains(&UserFeatureFlag::ReferralsProgram)
   }
+
+  pub fn can_create_api_key(&self) -> bool {
+    self.feature_flags.contains(&UserFeatureFlag::ApiKey)
+  }
 }
 
 #[cfg(test)]