captaincodeman / svelte-api-keys Goto Github PK

Cover lots of databases for key storage - use something like Drizzle (?)

There would never be enough tokens available to fulfill the request, so the system should warn when this is detected

Allow updating permissions on existing API keys

Demo doesn't need to be making real http requests, which then require a backend.

It can use the pieces to emulate making requests, which would also allow it to visualize the operation of the token buckets and permission checks.

More importantly, it can then the run completely client-side so it wouldn't require a real back-end and could be run on GitHub Pages.

Example: you have an API route /routes/api/projects/[id]/+server.ts

You could have a permission allowing you access to all projects, such as project:* or you might want a token that only allows access to a specific project, so would have a permission like project:world-domination

Fairly easy to do, but maybe not obvious:

export async function GET({ locals, params }) {
  const { id } = params
  await locals.api.any(`project:*`, `project:${id}`).approve(limit)
  // rest of code
}

Document how to implement API Key Prefixes to indicate usage, similar as Stripe's pk_test_ (prefix can be stripped out via custom fn in key extractor)