feat: sha256:b6b1074be3675c431c1acffa6f76a6cadbcb08c715ab2575e6f43dc5637076fc · gabriel/musehub

feat(auth): add POST /api/auth/keys for secure key rotation

New endpoint: POST /api/auth/keys

Requires two proofs: 1. Authorization: MSign (existing key proves account ownership) 2. Body: challenge_token + public_key_b64 + signature_b64 (new key challenge-response proves new key ownership)

New model: RotateKeyRequest New service fn: add_key_for_identity (reuses challenge verification, adds key to existing identity without creating a new identity record)

Security: neither proof alone is sufficient — MSign without key proof lets an attacker inject a key; key proof without MSign lets an unauthenticated caller add a key to any handle.

Run: muse auth rotate --hub https://localhost:1337

symbols added

symbols modified

dead code introduced

Semantic Changes 14 symbols

~ musehub/api/routes/api/auth.py .py 3 symbols added, 9 symbols modified

+ add_key function async_function add_key L175–216

+ RotateKeyRequest import import RotateKeyRequest L42–42

+ add_key_for_identity import import add_key_for_identity L45–45

~ AuthError

~ CHALLENGE_TTL_SECONDS

~ ChallengeRequest

~ ChallengeResponse

~ VerifyRequest

~ create_challenge

~ get_keys_for_identity

~ revoke_key

~ verify_and_authenticate

~ musehub/models/musehub_auth.py .py 1 symbol added

+ RotateKeyRequest class class RotateKeyRequest L160–189

~ musehub/services/musehub_auth.py .py 1 symbol added

+ add_key_for_identity function async_function add_key_for_identity L362–473

← Older Oldest on task/auth-rotate-endpoint

All commits

Newer → Latest on task/auth-rotate-endpoint

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:b6b1074be3675c431c1acffa6f76a6cadbcb08c715ab2575e6f43dc5637076fc --body "your comment"