Arnaud
8d5787e56e
Splits what was one isDeveloper flag (gating webhooks, API keys, AND BYOK together) into two independent permissions: - isDeveloper (webhooks + self-serve API keys): admin-toggled as before, but now ALSO self-serve -- PATCH /api/v1/users/me/developer-access lets any paid-tier (tier !== "free") user turn it on themselves, no added fee. Free tier still needs an admin grant. Turning it off is always self-serve regardless of tier, since revoking your own access needs no gatekeeping. canSelfServeDeveloperAccess() in lib/permissions.ts is the single check for "is this tier eligible." - isByokEnabled (BYOK AI provider keys): new column, admin-only, no self-serve path at all -- routing real AI provider spend through Epicure on the user's own key warrants a manual admin check-in that webhooks/API access don't need. requireByok() replaces requireDeveloper() on the three ai-keys routes. Migration adds is_byok_enabled and grandfathers in anyone who already has a BYOK key configured (the earlier grandfather migration only covered the combined isDeveloper flag, which BYOK no longer reads). Settings UI: webhooks/API-keys pages show a self-serve "Enable" toggle for paid-tier non-developers instead of the locked notice (still shown to free-tier users), plus a "Disable developer access" link once enabled. Settings -> AI's BYOK section now checks isByokEnabled instead of isDeveloper -- unaffected by the self-serve change, still fully admin-gated. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
19 lines
566 B
TypeScript
19 lines
566 B
TypeScript
import { NextResponse } from "next/server";
|
|
import { db, userAiKeys, eq, and } from "@epicure/db";
|
|
import { requireByok } from "@/lib/api-auth";
|
|
|
|
type Params = { params: Promise<{ provider: string }> };
|
|
|
|
export async function DELETE(_req: Request, { params }: Params) {
|
|
const { session, response } = await requireByok();
|
|
if (response) return response;
|
|
|
|
const { provider } = await params;
|
|
|
|
await db.delete(userAiKeys).where(
|
|
and(eq(userAiKeys.userId, session!.user.id), eq(userAiKeys.provider, provider))
|
|
);
|
|
|
|
return NextResponse.json({ ok: true });
|
|
}
|