return the key in the response to the POST /api-key request

Author: briskt

apikey.go

@@ -438,7 +438,12 @@ func (a *App) CreateApiKey(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	jsonResponse(w, nil, http.StatusNoContent)
+	response := map[string]string{
+		"email":      key.Email,
+		"id":         key.Key,
+		"created_at": time.Unix(int64(key.CreatedAt)/1000, 0).UTC().Format(time.RFC3339),
+	}
+	jsonResponse(w, response, http.StatusOK)
 }
 
 // RotateApiKey facilitates the rotation of API Keys. All data in webauthn and totp tables that is encrypted by the old

apikey_test.go

@@ -308,7 +308,7 @@ func (ms *MfaSuite) TestCreateApiKey() {
 			body: map[string]interface{}{
 				"email": exampleEmail,
 			},
-			wantStatus: http.StatusNoContent,
+			wantStatus: http.StatusOK,
 		},
 		{
 			name:       "missing email",
@@ -332,6 +332,16 @@ func (ms *MfaSuite) TestCreateApiKey() {
 			}
 
 			ms.Equal(tt.wantStatus, res.Status, fmt.Sprintf("CreateApiKey response: %s", res.Body))
+
+			var response struct {
+				Email     string    `json:"email"`
+				ID        string    `json:"id"`
+				CreatedAt time.Time `json:"created_at"`
+			}
+			ms.NoError(json.Unmarshal(res.Body, &response))
+			ms.Equal(exampleEmail, response.Email)
+			ms.Regexp("^[0-9a-z]{40}$", response.ID)
+			ms.WithinDuration(time.Now().UTC(), response.CreatedAt, time.Minute)
 		})
 	}
 }

openapi.yaml

@@ -364,8 +364,27 @@ paths:
                   required: true
                   example: [email protected]
       responses:
-        204:
+        200:
           description: New API key created
+          content:
+            application/json:
+              schema:
+                properties:
+                  email:
+                    type: string
+                    description: email
+                    required: true
+                    example: "[email protected]"
+                  id:
+                    type: string
+                    description: id
+                    required: true
+                    example: "0123456789abcdef0123456789abcdef01234567"
+                  created_at:
+                    type: string
+                    description: created_at
+                    required: true
+                    example: "2006-01-02T15:04:05Z"
         400:
           description: Bad Request
           content: