Add create and last used timestamps for API Keys to the /team API response

[37b]

Current Behavior:

The /team API returns a list of API Keys assigned to a team, but does not provide a timestamp for when each key was created or last accessed. This information is needed to enforce API Key rotation schemas.

...
    "apiKeys": [
      {
        "key": "string"
      }
    ]

Proposed Behavior:

...
    "apiKeys": [
      {
        "key": "string",
        "createdAt": "2021-06-09T18:18:21.710Z",
        "lastUsed": "2021-06-09T18:18:21.710Z"
      }
    ]

[stevespringett]

This enhancement would likely need to be made to alpine.model.ApiKey

[37b]

@stevespringett should I make an enhancement request on that project?

[valentijnscholten]

I suggest to also add a name or description to help recognize / manage key usage.

[raboof]

I see adding the create and last used timestamps has now been reported to the Alpine repo at stevespringett/Alpine#362

I added stevespringett/Alpine#536 for adding a name/description/comment field.

[nscuro]

Do we have anyone with experience in implementing something like this?

I don't believe updating the lastUsed timestamp for each request is feasible, that'd be way too many database transactions. Also, keys can be used by multiple requests concurrently so there's some contention to be expected.

One aspect I've seen being discussed on my surface-level Google search, is what the desired resolution of lastUsed is. Are we looking at seconds, minutes, hours? Would "last used today" / "last used 4 days ago" be sufficient?

@37b What's the MVP to fulfill your requirement?

[37b]

Do we have anyone with experience in implementing something like this?

I don't believe updating the lastUsed timestamp for each request is feasible, that'd be way too many database transactions. Also, keys can be used by multiple requests concurrently so there's some contention to be expected.

One aspect I've seen being discussed on my surface-level Google search, is what the desired resolution of lastUsed is. Are we looking at seconds, minutes, hours? Would "last used today" / "last used 4 days ago" be sufficient?

@37b What's the MVP to fulfill your requirement?

Last used is more of a nice to have to cleanup unused keys as part of general housekeeping. I really need to rotate the keys on a schedule and I can do that based on create time.

[nscuro]

Found a practical solution to track lastUsed timestamps. Raised a PR here: stevespringett/Alpine#537

[github-actions]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.