hackatime/app/controllers/api/internal/revocations_controller.rb
nora a1df7eddd1
add admin key revocation endpoint (#747)
* add admin key revocation endpoint

* include key name
2025-12-29 16:35:10 -05:00

34 lines
905 B
Ruby

module Api
module Internal
class RevocationsController < ApplicationController
def create
token = params[:token]
return head 400 unless token.present?
admin_api_key = AdminApiKey.active.find_by(token:)
return render json: { success: false } unless admin_api_key.present?
admin_api_key.revoke!
user = admin_api_key.user
render json: {
success: true,
owner_email: user.email_addresses.first&.email,
key_name: admin_api_key.name
}.compact_blank
end
private def authenticate!
res = authenticate_with_http_token do |token, _|
ActiveSupport::SecurityUtils.secure_compare(token, ENV["HKA_REVOCATION_KEY"])
end
unless res
redirect_to "https://www.youtube.com/watch?v=dQw4w9WgXcQ", allow_other_host: true
end
end
end
end
end