Files
Arnaud eb99faf655 feat: developer access permission gates webhooks/API keys/BYOK (v0.71.0)
Webhooks, self-serve API keys, and BYOK AI provider keys had zero
access gating -- any logged-in user, any tier. Adds users.isDeveloper
(boolean, admin-toggled in admin/users/[id] alongside role/tier),
checked via a single hasDeveloperAccess() (lib/permissions.ts) so a
future subscription-tier auto-grant is a one-line change there, not
a redesign across call sites.

requireDeveloper() (lib/api-auth.ts) wraps requireSession() with a
fresh isDeveloper check (same reasoning as requireAdmin re-querying
role: session.user's cookieCache can be up to 5 minutes stale) and
replaces requireSession in all 8 gated routes: webhooks CRUD +
deliveries + redeliver, api-keys CRUD, ai-keys CRUD.

Settings UI: the sidebar hides API Keys/Webhooks nav entries for
non-developers; those pages and the BYOK section of Settings -> AI
show a locked notice instead of the manager component when accessed
directly.

Migration grandfathers in anyone who already has a webhook, API key,
or BYOK key row -- ships as a new gate on existing features, not a
silent lockout of active integrations.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-22 09:49:07 +02:00

103 lines
3.9 KiB
TypeScript

import type { Metadata } from "next";
import { headers } from "next/headers";
import { auth } from "@/lib/auth/server";
import { db, userAiKeys, userModelPrefs, users, tierDefinitions, userUsage, eq, and } from "@epicure/db";
import { UNLIMITED, getRecipeCount, getStorageUsedMb } from "@/lib/tiers";
import { ByokManager } from "@/components/settings/byok-manager";
import { ModelPrefsForm } from "@/components/settings/model-prefs-form";
import { UsageQuotaSection } from "@/components/settings/usage-quota-section";
import { DeveloperLockedNotice } from "@/components/settings/developer-locked-notice";
import { getMessages, formatMessage } from "@/lib/i18n/server";
export const metadata: Metadata = {};
export default async function AiSettingsPage() {
const session = await auth.api.getSession({ headers: await headers() });
if (!session) return null;
const m = getMessages((session.user as { locale?: string }).locale);
const currentMonth = new Date().toISOString().slice(0, 7);
const [aiKeys, modelPrefs, dbUser] = await Promise.all([
db.query.userAiKeys.findMany({
where: eq(userAiKeys.userId, session.user.id),
columns: { provider: true },
}),
db.query.userModelPrefs.findFirst({
where: eq(userModelPrefs.userId, session.user.id),
}),
// Tier comes from the DB, not the (up to 5-minute-stale) session cookie
// cache, so a just-changed tier's limits show up immediately here.
db.query.users.findFirst({ where: eq(users.id, session.user.id), columns: { tier: true, isDeveloper: true } }),
]);
const [tierDef, usage, recipeCount, storageUsedMb] = await Promise.all([
db.query.tierDefinitions.findFirst({ where: eq(tierDefinitions.tier, dbUser?.tier ?? "free") }),
db.query.userUsage.findFirst({ where: and(eq(userUsage.userId, session.user.id), eq(userUsage.month, currentMonth)) }),
getRecipeCount(session.user.id),
getStorageUsedMb(session.user.id),
]);
const asLimit = (n: number | undefined) => (n === undefined || n === UNLIMITED ? null : n);
const usageMetrics = [
{
label: m.settings.usage.aiCalls,
used: usage?.aiCallsUsed ?? 0,
limit: asLimit(tierDef?.aiCallsPerMonth),
unlimitedLabel: m.settings.usage.unlimited,
},
{
label: m.settings.usage.recipes,
used: recipeCount,
limit: asLimit(tierDef?.maxRecipes),
unlimitedLabel: m.settings.usage.unlimited,
},
{
label: m.settings.usage.storage,
used: storageUsedMb,
limit: asLimit(tierDef?.storageMb),
unit: " MB",
unlimitedLabel: m.settings.usage.unlimited,
},
];
return (
<div className="space-y-8">
<section className="rounded-xl border p-6 space-y-4">
<div>
<h2 className="font-semibold text-lg">{m.settings.usage.title}</h2>
<p className="text-sm text-muted-foreground mt-1">
{formatMessage(m.settings.usage.description, { month: currentMonth })}
</p>
</div>
<UsageQuotaSection metrics={usageMetrics} />
</section>
<section className="rounded-xl border p-6 space-y-4">
<div>
<h2 className="font-semibold text-lg">{m.settings.byok.title}</h2>
<p className="text-sm text-muted-foreground mt-1">
{m.settings.byok.description}
</p>
</div>
{dbUser?.isDeveloper ? (
<ByokManager initialKeys={aiKeys.map((k) => k.provider)} />
) : (
<DeveloperLockedNotice message={m.settings.developerLockedNotice} />
)}
</section>
<section className="rounded-xl border p-6 space-y-4">
<div>
<h2 className="font-semibold text-lg">{m.settings.modelPrefs.title}</h2>
<p className="text-sm text-muted-foreground mt-1">
{m.settings.modelPrefs.description}
</p>
</div>
<ModelPrefsForm initialPrefs={modelPrefs ?? null} />
</section>
</div>
);
}