authkit: initial shared auth module

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

keys.go

@@ -0,0 +1,51 @@
+package authkit
+
+import (
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+)
+
+var servicePrefixes = map[string]string{
+	"bot":            "bot",
+	"server-manager": "sm",
+	"portal":         "ptl",
+	"addon":          "adn",
+	"mc-wrapper":     "mcw",
+	"gate-waker":     "gwk",
+	"cloud-svc":      "cld",
+}
+
+// PrefixFor returns the key prefix for a service name.
+func PrefixFor(service string) (string, bool) {
+	p, ok := servicePrefixes[service]
+	return p, ok
+}
+
+// GenerateAPIKey mints a new API key for the given service.
+// Returns plaintext, sha256-hex hash, and the first-8-char prefix.
+// Unknown service or crypto/rand failure returns a non-nil error.
+func GenerateAPIKey(service string) (plaintext, hash, prefix string, err error) {
+	pfx, ok := servicePrefixes[service]
+	if !ok {
+		return "", "", "", fmt.Errorf("authkit: unknown service %q", service)
+	}
+
+	var raw [24]byte
+	if _, err := rand.Read(raw[:]); err != nil {
+		return "", "", "", fmt.Errorf("authkit: crypto/rand: %w", err)
+	}
+
+	hexPart := hex.EncodeToString(raw[:])
+	plaintext = pfx + "_" + hexPart
+	hash = HashKey(plaintext)
+	prefix = plaintext[:8]
+	return plaintext, hash, prefix, nil
+}
+
+// HashKey returns the sha256 hex digest of plaintext.
+func HashKey(plaintext string) string {
+	sum := sha256.Sum256([]byte(plaintext))
+	return hex.EncodeToString(sum[:])
+}