Generate tokens via api key

[logerzerox]

• Implement POST /users/generate-tokens endpoint for secure JWT generation
  • Requires valid API key authentication via X-API-Key header
  • Generates fresh access/refresh token pair with standard expiration
  • Returns wrapped token response matching existing auth flows
• Add comprehensive OpenAPI documentation:
  • Includes cURL example demonstrating API key usage
  • Documents response schema with example values
  • Marks endpoint as authenticated operation in Swagger UI
• Integrates with existing auth infrastructure through auth_wrapper

---

Important

Adds POST /users/generate-tokens endpoint for JWT generation via API key with comprehensive documentation and integration with existing auth infrastructure.

• New Endpoint:
  • Adds POST /users/generate-tokens in users_router.py for JWT generation using API key.
  • Requires X-API-Key header for authentication.
  • Returns access/refresh token pair.
• Documentation:
  • OpenAPI documentation includes cURL example and response schema.
  • Endpoint marked as authenticated in Swagger UI.
• Integration:
  • Uses auth_wrapper for authentication in users_router.py.
  • Implements generate_tokens_via_api_key in auth_service.py and r2r_auth.py.

^{This description was created by for f6ecb6d. It will automatically update as commits are pushed.}

[ellipsis-dev]

❌ Changes requested. Reviewed everything up to f6ecb6d in 3 minutes and 6 seconds

More details

• Looked at 69 lines of code in 3 files
• Skipped 0 files when reviewing.
• Skipped posting 10 drafted comments based on config settings.

1. py/core/providers/auth/r2r_auth.py:705

• Draft comment:
  Consider adding a check to ensure the user is found before generating tokens. For example, if 'user' is None, raise an appropriate exception. This prevents potential runtime errors when accessing 'user.email'.
• Reason this comment was not posted:
  Marked as duplicate.

2. py/core/main/api/v3/users_router.py:55

• Draft comment:
  Ensure that auth_wrapper correctly extracts and validates the 'X-API-Key' header for this endpoint, as it's intended exclusively for API key authentication.
• Reason this comment was not posted:
  Decided after close inspection that this draft comment was likely wrong and/or not actionable: usefulness confidence = 10% vs. threshold = 50%
  This comment is asking for verification rather than pointing out a clear issue. It starts with "Ensure that..." which is a red flag per the rules. The comment is speculative - it's asking to verify something works rather than identifying a specific problem. The auth_wrapper() functionality is likely tested elsewhere and this endpoint is just using the existing authentication mechanism.
  The comment does point to a potential security concern around API key validation, which is important. Maybe there's a real issue here that needs addressing?
  While API key security is important, this comment isn't identifying a specific issue - it's just asking for verification. The auth_wrapper is an existing component being used normally here. If there was a specific security vulnerability, the comment should state it directly.
  Delete this comment. It violates the rule against asking for verification/confirmation and doesn't identify any specific actionable issues. The endpoint is using standard auth mechanisms correctly.

3. py/core/main/services/auth_service.py:332

• Draft comment:
  The new generate_tokens_via_api_key service method is a simple delegation to the provider method. It looks fine.
• Reason this comment was not posted:
  Confidence changes required: 0% <= threshold 50%
  None

4. py/core/main/api/v3/users_router.py:290

• Draft comment:
  Typographical error: In the JavaScript code sample for the verify_email endpoint, the email value is missing quotes. It currently appears as:

  email: [email protected]",

It should be corrected to:

email: "[email protected]",

to ensure it's recognized as a string.

• Reason this comment was not posted:
  Comment was not on a location in the diff, so it can't be submitted as a review comment.

5. py/core/main/api/v3/users_router.py:359

• Draft comment:
  Typographical error: In the JavaScript code sample for the send_verification_email endpoint, the email value is not enclosed in quotes. It appears similar to:

  email: [email protected]",

Please update it to:

email: "[email protected]",

to correctly denote a string.

• Reason this comment was not posted:
  Comment was not on a location in the diff, so it can't be submitted as a review comment.

6. py/core/main/api/v3/users_router.py:425

• Draft comment:
  Typographical error: In the JavaScript code sample for the login endpoint, the email field is missing quotes. It should be:

  email: "[email protected]",

instead of

email: [email protected]",

to correctly represent a string.

• Reason this comment was not posted:
  Comment was not on a location in the diff, so it can't be submitted as a review comment.

7. py/core/main/api/v3/users_router.py:642

• Draft comment:
  Typographical error: In the JavaScript code sample for the request_password_reset endpoint, the email value is not enclosed in quotes. Please change:

  email: [email protected]",

to

email: "[email protected]",

to properly format it as a string.

• Reason this comment was not posted:
  Comment was not on a location in the diff, so it can't be submitted as a review comment.

8. py/core/main/api/v3/users_router.py:697

• Draft comment:
  Typographical error: In the JavaScript code sample for the reset_password endpoint, the property name 'resestToken' is misspelled. It should be corrected to 'resetToken' to accurately reflect the intended parameter name.
• Reason this comment was not posted:
  Comment was not on a location in the diff, so it can't be submitted as a review comment.

9. py/core/main/services/auth_service.py:261

• Draft comment:
  The docstring for get_user_reset_token incorrectly mentions 'verification code' data. It should refer to 'reset token' data to match the method's purpose. Please update it for consistency.
• Reason this comment was not posted:
  Comment was not on a location in the diff, so it can't be submitted as a review comment.

10. py/core/main/services/auth_service.py:314

• Draft comment:
  The docstring for delete_user_api_key lists the parameter 'key_id' as a 'str', yet the method signature specifies it as a UUID. Please update the docstring to reflect the correct type.
• Reason this comment was not posted:
  Comment was not on a location in the diff, so it can't be submitted as a review comment.

Workflow ID: wflow_uZRCI2BomRuNhh5O

---

Want Ellipsis to fix these issues? Tag @ellipsis-dev in a comment. You can customize Ellipsis with 👍 / 👎 feedback, review rules, user-specific overrides, quiet mode, and more.