Add API key authentication with scopes and rotation for service-to-service callers

[thlpkee20-wq]

Description

Service-to-service callers currently reuse user JWTs. Add a first-class API key system with scopes, expiration, rotation overlap window, and per-key rate limits.

Requirements and context

• Must be secure, tested, and documented
• Should be efficient and easy to review
• Relevant code: src/middleware/auth.ts, src/db/repositories/
• Keys must be stored hashed; only prefix exposed to admin views

Suggested execution

• Fork the repo and create a branch
• git checkout -b feat/api-keys
• Implement changes
  • Add api_keys table with hashed secret and scopes
  • Add middleware accepting Authorization: ApiKey ...
  • Add admin CRUD with rotation overlap
• Validate security and correctness assumptions

Test and commit

• Run tests
  • npm test
• Cover edge cases
  • Scope escalation attempt, rotation overlap, revoked key
• Include test output and notes

Example commit message

feat: scoped API keys with rotation

Guidelines

• Minimum 95 percent test coverage
• Clear documentation
• Timeframe: 96 hours

[jesutobaadedejidev]

I would like to work on this issue. Do assign it to me

[estyemma]

@estyemma has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Please Revora
I’m a full-stack and smart contract developer eager to contribute to this task, learn from the community, and deliver meaningful value. I'd love the opportunity to work on this!

ℹ️ Repo Maintainers: To accept this application, review their application or assign @estyemma to this issue.

[Zainab5970]

@Zainab5970 has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

please can i work on the issue

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Zainab5970 to this issue.

[Fatimasanusi]

@Fatimasanusi has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

I would like to work on this issue

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Fatimasanusi to this issue.

[Eyanus]

@Eyanus has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Hello Maintainers,

I’d like to work on this issue. I understand the requirements and I’m confident I can implement a clean and reliable solution following the project’s standards, including proper testing.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Eyanus to this issue.