Arnaud
0062220d8e
New keys can be created as "Full access" (default, unchanged) or "Read-only" — read-only keys can only make GET/HEAD/OPTIONS requests, enforced once in requireSessionOrApiKey (lib/api-auth.ts) rather than in every route, since a route has no way to know a request came from a scoped key without that check. Existing keys default to full access — no behavior change for anyone who doesn't opt in. Also included in this migration: the chat_messages table for the next commit (chat history persistence) — generated together since both touched packages/db/src/schema/users.ts in the same pass. Verified locally: created both a read-only and a full-access key, confirmed GET succeeds and POST 403s on the read-only key, confirmed POST still works on the full-access key, and checked the scope badges render correctly in the real Settings → API Keys UI.
70 lines
1.9 KiB
TypeScript
70 lines
1.9 KiB
TypeScript
import { NextRequest, NextResponse } from "next/server";
|
|
import crypto from "node:crypto";
|
|
import { z } from "zod";
|
|
import { db, apiKeys, eq, sql } from "@epicure/db";
|
|
import { requireSession } from "@/lib/api-auth";
|
|
|
|
const CreateApiKeyBody = z.object({
|
|
name: z.string().min(1).max(100),
|
|
scope: z.enum(["full", "read"]).default("full"),
|
|
});
|
|
|
|
export async function GET() {
|
|
const { session, response } = await requireSession();
|
|
if (response) return response;
|
|
|
|
const rows = await db
|
|
.select({
|
|
id: apiKeys.id,
|
|
name: apiKeys.name,
|
|
scope: apiKeys.scope,
|
|
lastUsedAt: apiKeys.lastUsedAt,
|
|
createdAt: apiKeys.createdAt,
|
|
})
|
|
.from(apiKeys)
|
|
.where(eq(apiKeys.userId, session!.user.id));
|
|
|
|
return NextResponse.json(rows);
|
|
}
|
|
|
|
export async function POST(req: NextRequest) {
|
|
const { session, response } = await requireSession();
|
|
if (response) return response;
|
|
|
|
const body = await req.json() as unknown;
|
|
const parsed = CreateApiKeyBody.safeParse(body);
|
|
if (!parsed.success) {
|
|
return NextResponse.json(
|
|
{ error: "Validation error", issues: parsed.error.issues },
|
|
{ status: 400 }
|
|
);
|
|
}
|
|
|
|
const [row] = await db
|
|
.select({ count: sql<number>`count(*)::int` })
|
|
.from(apiKeys)
|
|
.where(eq(apiKeys.userId, session!.user.id));
|
|
if ((row?.count ?? 0) >= 10) {
|
|
return NextResponse.json({ error: "API key limit reached (max 10)" }, { status: 403 });
|
|
}
|
|
|
|
const rawKey = "ek_" + crypto.randomBytes(32).toString("hex");
|
|
const keyHash = crypto.createHash("sha256").update(rawKey).digest("hex");
|
|
const id = crypto.randomUUID();
|
|
const now = new Date();
|
|
|
|
await db.insert(apiKeys).values({
|
|
id,
|
|
userId: session!.user.id,
|
|
name: parsed.data.name,
|
|
keyHash,
|
|
scope: parsed.data.scope,
|
|
createdAt: now,
|
|
});
|
|
|
|
return NextResponse.json(
|
|
{ id, name: parsed.data.name, scope: parsed.data.scope, key: rawKey, createdAt: now.toISOString() },
|
|
{ status: 201 }
|
|
);
|
|
}
|