Normalize management token prefixes

apps/aether-gateway/src/handlers/shared/api_keys.rs

@@ -26,7 +26,7 @@ fn api_key_placeholder_display_with_prefix(prefix: &str) -> String {
     format!("{prefix}-****")
 }
 
-fn generate_gateway_api_key_plaintext_with_prefix(prefix: &str) -> String {
+fn generate_gateway_secret_random_part() -> String {
     let mut random = String::with_capacity(API_KEY_RANDOM_LEN);
     while random.len() < API_KEY_RANDOM_LEN {
         for byte in uuid::Uuid::new_v4().as_bytes() {
@@ -37,7 +37,18 @@ fn generate_gateway_api_key_plaintext_with_prefix(prefix: &str) -> String {
             }
         }
     }
-    format!("{prefix}-{random}")
+    random
+}
+
+pub(crate) fn generate_gateway_secret_plaintext(prefix: &str, separator: &str) -> String {
+    format!(
+        "{prefix}{separator}{}",
+        generate_gateway_secret_random_part()
+    )
+}
+
+fn generate_gateway_api_key_plaintext_with_prefix(prefix: &str) -> String {
+    generate_gateway_secret_plaintext(prefix, "-")
 }
 
 pub(crate) fn configured_api_key_prefix() -> String {
@@ -84,7 +95,8 @@ pub(crate) fn normalize_optional_api_key_concurrent_limit(
 mod tests {
     use super::{
         api_key_placeholder_display_with_prefix, configured_api_key_prefix_from_lookup,
-        generate_gateway_api_key_plaintext_with_prefix, masked_gateway_api_key_display,
+        generate_gateway_api_key_plaintext_with_prefix, generate_gateway_secret_plaintext,
+        masked_gateway_api_key_display,
     };
 
     #[test]
@@ -114,6 +126,17 @@ mod tests {
             .all(|ch| ch.is_ascii_alphanumeric()));
     }
 
+    #[test]
+    fn generates_plaintext_secret_with_custom_separator() {
+        let value = generate_gateway_secret_plaintext("ae", "-");
+        assert!(value.starts_with("ae-"));
+        assert_eq!(value.len(), 3 + 32);
+        assert!(value
+            .trim_start_matches("ae-")
+            .chars()
+            .all(|ch| ch.is_ascii_alphanumeric()));
+    }
+
     #[test]
     fn uses_configured_prefix_in_placeholder_display() {
         assert_eq!(

apps/aether-gateway/src/handlers/shared/mod.rs

@@ -16,7 +16,8 @@ pub(crate) use self::admin_proxy::{
 };
 pub(crate) use self::api_keys::{
     api_key_placeholder_display, configured_api_key_prefix, generate_gateway_api_key_plaintext,
-    masked_gateway_api_key_display, normalize_optional_api_key_concurrent_limit,
+    generate_gateway_secret_plaintext, masked_gateway_api_key_display,
+    normalize_optional_api_key_concurrent_limit,
 };
 pub(crate) use self::catalog::{
     build_admin_provider_key_response, decrypt_catalog_secret_with_fallbacks,