arnaudne/Epicure
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

feat: self-serve developer access for paid tiers, split BYOK into its own permission (v0.72.0)

Browse Source 
Splits what was one isDeveloper flag (gating webhooks, API keys, AND
BYOK together) into two independent permissions:

- isDeveloper (webhooks + self-serve API keys): admin-toggled as
  before, but now ALSO self-serve -- PATCH /api/v1/users/me/developer-access
  lets any paid-tier (tier !== "free") user turn it on themselves, no
  added fee. Free tier still needs an admin grant. Turning it off is
  always self-serve regardless of tier, since revoking your own
  access needs no gatekeeping. canSelfServeDeveloperAccess() in
  lib/permissions.ts is the single check for "is this tier eligible."

- isByokEnabled (BYOK AI provider keys): new column, admin-only, no
  self-serve path at all -- routing real AI provider spend through
  Epicure on the user's own key warrants a manual admin check-in that
  webhooks/API access don't need. requireByok() replaces
  requireDeveloper() on the three ai-keys routes.

Migration adds is_byok_enabled and grandfathers in anyone who already
has a BYOK key configured (the earlier grandfather migration only
covered the combined isDeveloper flag, which BYOK no longer reads).

Settings UI: webhooks/API-keys pages show a self-serve "Enable"
toggle for paid-tier non-developers instead of the locked notice
(still shown to free-tier users), plus a "Disable developer access"
link once enabled. Settings -> AI's BYOK section now checks
isByokEnabled instead of isDeveloper -- unaffected by the self-serve
change, still fully admin-gated.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Arnaud
2026-07-23 09:31:04 +02:00
parent eb99faf655
commit 8d5787e56e
27 changed files with 6338 additions and 68 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/web/components/admin/user-editor.tsx
+12 -3
View File
@@ -18,12 +18,14 @@ interface UserEditorProps {
currentRole: "user" | "moderator" | "admin";
currentTier: "free" | "pro" | "family";
currentIsDeveloper: boolean;
currentIsByokEnabled: boolean;
}
export function UserEditor({ userId, currentRole, currentTier, currentIsDeveloper }: UserEditorProps) {
export function UserEditor({ userId, currentRole, currentTier, currentIsDeveloper, currentIsByokEnabled }: UserEditorProps) {
const [role, setRole] = useState<"user" | "moderator" | "admin">(currentRole);
const [tier, setTier] = useState<"free" | "pro" | "family">(currentTier);
const [isDeveloper, setIsDeveloper] = useState(currentIsDeveloper);
const [isByokEnabled, setIsByokEnabled] = useState(currentIsByokEnabled);
const [saving, setSaving] = useState(false);
async function handleSave() {
@@ -32,7 +34,7 @@ export function UserEditor({ userId, currentRole, currentTier, currentIsDevelope
const res = await fetch(`/api/v1/admin/users/${userId}`, {
method: "PATCH",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({ role, tier, isDeveloper }),
body: JSON.stringify({ role, tier, isDeveloper, isByokEnabled }),
});
if (!res.ok) {
const data = await res.json().catch(() => ({}));
@@ -79,10 +81,17 @@ export function UserEditor({ userId, currentRole, currentTier, currentIsDevelope
<div className="flex items-center justify-between gap-3 rounded-lg border p-3 max-w-md">
<div>
<Label htmlFor="developer-switch">Developer access</Label>
<p className="text-xs text-muted-foreground">Enables webhooks, self-serve API keys, and BYOK AI provider keys.</p>
<p className="text-xs text-muted-foreground">Enables webhooks and self-serve API keys. Users on a paid tier can also self-enable this.</p>
</div>
<Switch id="developer-switch" checked={isDeveloper} onCheckedChange={setIsDeveloper} />
</div>
<div className="flex items-center justify-between gap-3 rounded-lg border p-3 max-w-md">
<div>
<Label htmlFor="byok-switch">BYOK access</Label>
<p className="text-xs text-muted-foreground">Enables bring-your-own AI provider keys. Admin-only, no self-serve.</p>
</div>
<Switch id="byok-switch" checked={isByokEnabled} onCheckedChange={setIsByokEnabled} />
</div>
<div>
<Button onClick={handleSave} disabled={saving}>
{saving ? "Saving…" : "Save Changes"}