Feat: Tambahkan unit & integration tests untuk lifecycle API key

app/Http/Controllers/Api/ApiKeyController.php

@@ -0,0 +1,79 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Http\Controllers\Controller;
+use App\Http\Requests\Api\StoreApiKeyRequest;
+use App\Models\ApiKey;
+use App\Services\KeyService;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+
+class ApiKeyController extends Controller
+{
+    public function __construct(
+        private readonly KeyService $keyService,
+    ) {
+    }
+
+    public function index(Request $request): JsonResponse
+    {
+        $apiKeys = ApiKey::where('user_id', $request->user()->id)
+            ->orderBy('created_at', 'desc')
+            ->get();
+
+        return response()->json([
+            'data' => $apiKeys,
+        ]);
+    }
+
+    public function store(StoreApiKeyRequest $request): JsonResponse
+    {
+        $result = $this->keyService->create($request->validated(), $request->user()->id);
+
+        return response()->json([
+            'data' => [
+                'api_key' => $result['api_key'],
+                'raw_key' => $result['raw_key'],
+            ],
+            'message' => 'API key created successfully',
+        ], 201);
+    }
+
+    public function show(Request $request, ApiKey $apiKey): JsonResponse
+    {
+        if ($apiKey->user_id !== $request->user()->id) {
+            return response()->json(['message' => 'Forbidden'], 403);
+        }
+
+        return response()->json([
+            'data' => $apiKey,
+        ]);
+    }
+
+    public function revoke(Request $request, ApiKey $apiKey): JsonResponse
+    {
+        if ($apiKey->user_id !== $request->user()->id) {
+            return response()->json(['message' => 'Forbidden'], 403);
+        }
+
+        $this->keyService->revoke($apiKey->id, $request->user()->id);
+
+        return response()->json([
+            'message' => 'API key revoked successfully',
+        ]);
+    }
+
+    public function destroy(Request $request, ApiKey $apiKey): JsonResponse
+    {
+        if ($apiKey->user_id !== $request->user()->id) {
+            return response()->json(['message' => 'Forbidden'], 403);
+        }
+
+        $this->keyService->revoke($apiKey->id, $request->user()->id);
+
+        return response()->json([
+            'message' => 'API key deleted successfully',
+        ]);
+    }
+}

app/Http/Middleware/ApiKeyMiddleware.php

@@ -0,0 +1,45 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\Services\KeyService;
+use Closure;
+use Illuminate\Http\Request;
+
+class ApiKeyMiddleware
+{
+    public function __construct(
+        private readonly KeyService $keyService,
+    ) {
+    }
+
+    public function handle(Request $request, Closure $next, ?string $scope = null)
+    {
+        $rawKey = $request->bearerToken();
+
+        if (empty($rawKey)) {
+            return response()->json([
+                'message' => 'Missing API key',
+            ], 401);
+        }
+
+        $result = $this->keyService->validate($rawKey, $scope);
+
+        if (!$result['valid']) {
+            $statusCode = match ($result['status'] ?? 'invalid') {
+                'revoked', 'disabled', 'insufficient_scope' => 403,
+                'expired' => 403,
+                default => 401,
+            };
+
+            return response()->json([
+                'message' => $result['message'] ?? 'Invalid API key',
+                'status' => $result['status'] ?? 'invalid',
+            ], $statusCode);
+        }
+
+        $request->merge(['api_key' => $result['api_key']]);
+
+        return $next($request);
+    }
+}

app/Http/Requests/Api/StoreApiKeyRequest.php

@@ -0,0 +1,23 @@
+<?php
+
+namespace App\Http\Requests\Api;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+class StoreApiKeyRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    public function rules(): array
+    {
+        return [
+            'name' => 'required|string|max:255',
+            'scopes' => 'nullable|array',
+            'scopes.*' => 'string|max:100',
+            'expires_at' => 'nullable|date|after:now',
+        ];
+    }
+}

app/Models/ApiKey.php

@@ -0,0 +1,75 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Illuminate\Database\Eloquent\Relations\HasMany;
+use Illuminate\Support\Str;
+
+class ApiKey extends Model
+{
+    use HasFactory;
+
+    protected $fillable = [
+        'user_id',
+        'name',
+        'key',
+        'key_prefix',
+        'scopes',
+        'expires_at',
+        'last_used_at',
+        'status',
+    ];
+
+    protected $casts = [
+        'scopes' => 'array',
+        'expires_at' => 'datetime',
+        'last_used_at' => 'datetime',
+    ];
+
+    public const STATUS_ACTIVE = 'active';
+    public const STATUS_REVOKED = 'revoked';
+    public const STATUS_DISABLED = 'disabled';
+    public const STATUS_EXPIRED = 'expired';
+
+    public function user(): BelongsTo
+    {
+        return $this->belongsTo(User::class);
+    }
+
+    public function auditLogs(): HasMany
+    {
+        return $this->hasMany(ApiKeyAuditLog::class);
+    }
+
+    public function isActive(): bool
+    {
+        return $this->status === self::STATUS_ACTIVE;
+    }
+
+    public function isExpired(): bool
+    {
+        return $this->expires_at !== null && $this->expires_at->isPast();
+    }
+
+    public function hasScope(string $scope): bool
+    {
+        if (empty($this->scopes)) {
+            return true;
+        }
+
+        return in_array($scope, $this->scopes, true);
+    }
+
+    public static function generateKey(): string
+    {
+        return 'opendk_' . Str::random(32) . '_' . Str::random(16);
+    }
+
+    public static function generateKeyPrefix(string $key): string
+    {
+        return substr($key, 0, 12) . '...';
+    }
+}

app/Models/ApiKeyAuditLog.php

@@ -0,0 +1,36 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+
+class ApiKeyAuditLog extends Model
+{
+    protected $table = 'api_key_audit_logs';
+
+    protected $fillable = [
+        'api_key_id',
+        'user_id',
+        'action',
+        'payload',
+        'ip_address',
+        'user_agent',
+        'success',
+    ];
+
+    protected $casts = [
+        'payload' => 'array',
+        'success' => 'boolean',
+    ];
+
+    public function apiKey(): BelongsTo
+    {
+        return $this->belongsTo(ApiKey::class);
+    }
+
+    public function user(): BelongsTo
+    {
+        return $this->belongsTo(User::class);
+    }
+}