feat: lots of v2 endpoints

apps/agent/fly.production.toml

@@ -1,73 +1,74 @@
+# fly.toml app configuration file generated for unkey-production-agent on 2025-06-09T13:58:09+02:00
+#
+# See https://fly.io/docs/reference/configuration/ for information about how to use this file.
+#
 
 app = 'unkey-production-agent'
 primary_region = 'iad'
 
-[build]
-dockerfile = "Dockerfile"
 [experimental]
-cmd = ["/usr/local/bin/unkey", "agent", "--config=./config.production.json"]
+cmd = ['/usr/local/bin/unkey', 'agent', '--config=./config.production.json']
+
+[build]
+dockerfile = 'Dockerfile'
 
+[deploy]
+strategy = 'canary'
+max_unavailable = 10.0
+
+[env]
+PORT = '8080'
+RPC_PORT = '9095'
+SERF_PORT = '7373'
 
 [http_service]
 internal_port = 8080
-auto_stop_machines = false
-auto_start_machines = false
-min_machines_running = 7
+auto_stop_machines = 'stop'
+auto_start_machines = true
+min_machines_running = 0
 processes = ['app']
 
 [http_service.concurrency]
-type = "requests"
-soft_limit = 100
+type = 'requests'
 hard_limit = 250
+soft_limit = 100
 
-[[http_service.checks]]
-grace_period = "10s"
-interval = "30s"
-method = "GET"
-timeout = "5s"
-path = "/v1/liveness"
-
+[http_service.http_options]
 [http_service.http_options.response]
 pristine = true
 
-# Serf
+[[http_service.checks]]
+interval = '30s'
+timeout = '5s'
+grace_period = '10s'
+method = 'GET'
+path = '/v1/liveness'
+
 [[services]]
+protocol = 'tcp'
 internal_port = 7373
-protocol = "tcp"
+
 [[services.ports]]
-handlers = ["tls"]
 port = 7373
+handlers = ['tls']
 
-
-# RPC
 [[services]]
+protocol = 'tcp'
 internal_port = 9095
-protocol = "tcp"
+
 [[services.ports]]
-handlers = ["tls"]
 port = 9095
+handlers = ['tls']
 
+[[restart]]
+policy = 'always'
+retries = 10
 
 [[vm]]
 memory = '2gb'
 cpu_kind = 'shared'
 cpus = 2
 
-[deploy]
-strategy = "canary"
-max_unavailable = 10
-
-[[restart]]
-policy = "always"
-retries = 10
-
-
-[metrics]
+[[metrics]]
 port = 2112
-path = "/metrics" # default for most prometheus exporters
-
-
-[env]
-PORT = "8080"
-RPC_PORT = "9095"
-SERF_PORT = "7373" # Spells 'serf' on a phone, I'm so funny
+path = '/metrics'

apps/agent/fly.staging.toml

@@ -1,66 +1,70 @@
+# fly.toml app configuration file generated for unkey-agent-dev on 2025-06-09T13:29:12+02:00
+#
+# See https://fly.io/docs/reference/configuration/ for information about how to use this file.
+#
 
 app = 'unkey-agent-dev'
 primary_region = 'iad'
 
-[build]
-dockerfile = "Dockerfile"
 [experimental]
-cmd = ["/usr/local/bin/unkey", "agent", "--config=./config.staging.json"]
+  cmd = ['/usr/local/bin/unkey', 'agent', '--config=./config.staging.json']
+
+[build]
+  dockerfile = 'Dockerfile'
+
+[deploy]
+  strategy = 'canary'
+  max_unavailable = 1.0
+
+[env]
+  PORT = '8080'
+  RPC_PORT = '9095'
+  SERF_PORT = '7373'
 
 [http_service]
-internal_port = 8080
-auto_start_machines = false
-auto_stop_machines = false
-min_machines_running = 3
-processes = ['app']
+  internal_port = 8080
+  auto_stop_machines = 'stop'
+  auto_start_machines = true
+  min_machines_running = 0
+  processes = ['app']
 
-[http_service.concurrency]
-type = "requests"
-soft_limit = 500
-hard_limit = 1000
+  [http_service.concurrency]
+    type = 'requests'
+    hard_limit = 1000
+    soft_limit = 500
 
-[[http_service.checks]]
-grace_period = "10s"
-interval = "30s"
-method = "GET"
-timeout = "5s"
-path = "/v1/liveness"
+  [http_service.http_options]
+    [http_service.http_options.response]
+      pristine = true
 
-[http_service.http_options.response]
-pristine = true
+  [[http_service.checks]]
+    interval = '30s'
+    timeout = '5s'
+    grace_period = '10s'
+    method = 'GET'
+    path = '/v1/liveness'
 
-# Serf
 [[services]]
-internal_port = 7373
-protocol = "tcp"
-[[services.ports]]
-handlers = ["tls"]
-port = 7373
+  protocol = 'tcp'
+  internal_port = 7373
+
+  [[services.ports]]
+    port = 7373
+    handlers = ['tls']
 
-# RPC
 [[services]]
-internal_port = 9095
-protocol = "tcp"
-[[services.ports]]
-handlers = ["tls"]
-port = 9095
+  protocol = 'tcp'
+  internal_port = 9095
 
+  [[services.ports]]
+    port = 9095
+    handlers = ['tls']
 
 [[vm]]
-memory = '1gb'
-cpu_kind = 'shared'
-cpus = 1
-
-[deploy]
-strategy = "canary"
-max_unavailable = 1
-
-[env]
-PORT = "8080"
-RPC_PORT = "9095"
-SERF_PORT = "7373" # Spells 'serf' on a phone, I'm so funny
-
+  memory = '1gb'
+  cpu_kind = 'shared'
+  cpus = 1
 
-[metrics]
-port = 2112
-path = "/metrics" # default for most prometheus exporters
+[[metrics]]
+  port = 2112
+  path = '/metrics'

apps/docs/api-reference/errors-v2/unkey/application/protected_resource.mdx

@@ -20,7 +20,7 @@ description: "Attempt to modify a protected resource"
 
 ## What Happened?
 
-This error occurs when you attempt to modify or delete a resource that is marked as protected in the Unkey system. Protected resources have special status that prevents them from being changed or removed, typically because they are system resources, defaults, or otherwise critical to proper system operation.
+This error occurs when you attempt to modify or delete a resource that is marked as protected in the Unkey system. Protected resources have a special status that prevents them from being changed or removed, typically because they are system resources, defaults, or otherwise critical to proper system operation.
 
 Common scenarios that trigger this error:
 - Attempting to delete a default API or workspace
@@ -69,4 +69,4 @@ curl -X POST https://api.unkey.com/v2/apis.createApi \
 
 ## Related Errors
 - [err:unkey:authorization:forbidden](../authorization/forbidden) - When an operation is not allowed for policy reasons
-- [err:unkey:authorization:insufficient_permissions](../authorization/insufficient_permissions) - When you lack permissions for an operation
+- [err:unkey:authorization:insufficient_permissions](../authorization/insufficient_permissions) - When you lack permissions for an operation

apps/engineering/app/docs/[[...slug]]/page.tsx

@@ -15,9 +15,9 @@ export default async function Page(props: {
 
   if (!page) {
     notFound();
-  }  
+  }
 
-   if (page.slugs.length === 0) {
+  if (page.slugs.length === 0) {
     return (
       <div className="min-h-screen border text-center -mt-16 pt-16 flex items-center w-screen justify-center ">
         <div>

buf.gen.yaml

@@ -0,0 +1,10 @@
+version: v2
+plugins:
+  - remote: buf.build/protocolbuffers/go   
+    out: gen
+    opt: paths=source_relative
+  - remote: buf.build/connectrpc/go:v1.16.2
+    out: gen
+    opt: paths=source_relative
+
+

buf.yaml

@@ -0,0 +1,10 @@
+version: v1
+breaking:
+  use:
+    - FILE
+    - PACKAGE
+    - WIRE
+    - WIRE_JSON
+lint:
+  use:
+    - DEFAULT

go/.golangci.yaml

@@ -35,6 +35,8 @@ linters:
     - usestdlibvars
     - wastedassign
   settings:
+    nestif:
+      min-complexity: 15
     cyclop:
       max-complexity: 30
       package-average: 10

go/Taskfile.yml

@@ -28,12 +28,12 @@ tasks:
     cmds:
       - cmd: echo "Running full tests... this can take more than 30min... run 'task test-unit' for faster tests"
         silent: true
-      - cmd: go test -failfast -timeout=60m -shuffle=on -v -json -p=10 ./... | tparse -all -progress  -smallscreen
+      - cmd: go test -failfast -timeout=60m -shuffle=on -v -json  ./... | tparse -all -progress  -smallscreen
         silent: true
 
   test-unit:
     cmds:
-      - go test -json -race -failfast  -timeout=30m -p=10 ./... | tparse -all -progress  -smallscreen
+      - go test -json -race -failfast  -timeout=30m ./... | tparse -all -progress  -smallscreen
 
   build:
     cmds:

go/apps/api/cancel_test.go

@@ -12,6 +12,7 @@ import (
 	"github.com/unkeyed/unkey/go/pkg/port"
 	"github.com/unkeyed/unkey/go/pkg/testutil/containers"
 	"github.com/unkeyed/unkey/go/pkg/uid"
+	"github.com/unkeyed/unkey/go/pkg/vault/keys"
 )
 
 // TestContextCancellation verifies that the API server responds properly to context cancellation
@@ -28,6 +29,9 @@ func TestContextCancellation(t *testing.T) {
 	// Create a cancellable context
 	ctx, cancel := context.WithCancel(context.Background())
 
+	_, masterKey, err := keys.GenerateMasterKey()
+	require.NoError(t, err)
+
 	// Configure the API server
 	config := api.Config{
 		Platform:                "test",
@@ -41,26 +45,27 @@ func TestContextCancellation(t *testing.T) {
 		DatabasePrimary:         dbDsn,
 		DatabaseReadonlyReplica: "",
 		OtelEnabled:             false,
+		VaultMasterKeys:         []string{masterKey},
 	}
 
 	// Create a channel to receive the result of the Run function
 	resultCh := make(chan error, 1)
 
 	// Start the API server in a goroutine
 	go func() {
-		err := api.Run(ctx, config)
+		runErr := api.Run(ctx, config)
 
-		if err != nil {
+		if runErr != nil {
 			// it's really hard to get this error cause the test fails before we read from the channel
-			t.Logf("Error from run: %s", err.Error())
+			t.Logf("Error from run: %s", runErr.Error())
 		}
-		resultCh <- err
+		resultCh <- runErr
 	}()
 
 	// Wait for the server to start up
 	require.Eventually(t, func() bool {
-		res, err := http.Get(fmt.Sprintf("http://localhost:%d/v2/liveness", httpPort))
-		if err != nil {
+		res, livenessErr := http.Get(fmt.Sprintf("http://localhost:%d/v2/liveness", httpPort))
+		if livenessErr != nil {
 			return false
 		}
 		defer res.Body.Close()
@@ -75,7 +80,7 @@ func TestContextCancellation(t *testing.T) {
 
 	// Wait for the server to shut down and check the result
 	select {
-	case err := <-resultCh:
+	case err = <-resultCh:
 		// The Run function should exit without error when context is canceled
 		require.NoError(t, err, "API server should shut down gracefully when context is canceled")
 		t.Log("API server shut down successfully")
@@ -84,6 +89,6 @@ func TestContextCancellation(t *testing.T) {
 	}
 
 	// Verify the server is no longer responding
-	_, err := http.Get(fmt.Sprintf("http://localhost:%d/v2/liveness", httpPort))
+	_, err = http.Get(fmt.Sprintf("http://localhost:%d/v2/liveness", httpPort))
 	require.Error(t, err, "Server should no longer be responding after shutdown")
 }

go/apps/api/config.go

@@ -53,6 +53,8 @@ type Config struct {
 
 	// TLSConfig provides HTTPS support when set
 	TLSConfig *tls.Config
+
+	VaultMasterKeys []string
 }
 
 func (c Config) Validate() error {