add initial api controller

app/models/user.rb

@@ -33,6 +33,8 @@ class User < ApplicationRecord
   has_many :content_change_events,        dependent: :destroy
   has_many :user_content_type_activators, dependent: :destroy
 
+  has_many :api_keys,                     dependent: :destroy
+
   def contributable_universes
     @user_contributable_universes ||= begin
       # todo email confirmation needs to happy for data safety / privacy (only verified emails)
@@ -174,6 +176,13 @@ class User < ApplicationRecord
     username
   end
 
+  def self.from_api_key(key)
+    found_key = ApiKey.includes(:user).find_by(key: key)
+    return nil unless found_key.present?
+
+    found_key.user
+  end
+
   private
 
   # Attributes that are non-public, and should be blacklisted from any public

app/services/api/v1/api_content_service.rb

@@ -0,0 +1,35 @@
+class Api::V1::ApiContentService < Service
+  # e.g. content(api_key: 'test-key', content_type: 'characters')
+  def self.content(api_key:, content_type:)
+    user = User.from_api_key(api_key)
+
+    return "Error: Invalid API Key"      if user.nil?
+    return "Error: Invalid content type" if valid_content_type?(content_type)
+
+    # todo we need to serialize attributes instead of natural model columns
+    user.send(content_type.downcase.pluralize).as_json
+  end
+
+  # todo create
+  def self.create(api_key:, content_type:, attributes_hash:)
+  end
+
+  # todo update
+  def self.update(api_key:, content_type:, content_id:, attributes_hash:)
+  end
+
+  # todo delete
+  def self.delete(api_key:, content_type:, content_id:)
+  end
+
+  # todo list: permission to create
+  # todo list: page turned on
+  # todo link to anonymous account from app?
+
+  private
+
+  def self.valid_content_type?(content_type)
+    Rails.application.config.content_types[:all].map(&:name).include?(content_type.titleize)
+  end
+
+end