External/SnapOtter
1
0
Fork 0
mirror of https://github.com/snapotter-hq/SnapOtter.git synced 2026-08-03 07:46:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

feat: add permission checks and admin override to API key routes

Browse Source 
Replace requireAuth with requirePermission(apikeys:own). Admin users
with apikeys:all can see and delete any user's keys.
This commit is contained in:
Siddharth Kumar Sah
2026-04-10 21:25:30 +08:00
parent af7f57d52f
commit d776680f2d
2 changed files with 121 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/api/src/routes/api-keys.ts
+19 -10
View File
@@ -6,16 +6,18 @@
* DELETE /api/v1/api-keys/:id — Delete an API key
*/
import { randomBytes, randomUUID } from "node:crypto";
import type { Role } from "@stirling-image/shared";
import { and, eq } from "drizzle-orm";
import type { FastifyInstance, FastifyReply, FastifyRequest } from "fastify";
import { db, schema } from "../db/index.js";
import { auditLog } from "../lib/audit.js";
import { computeKeyPrefix, hashPassword, requireAuth } from "../plugins/auth.js";
import { hasPermission, requirePermission } from "../permissions.js";
import { computeKeyPrefix, hashPassword } from "../plugins/auth.js";
export async function apiKeyRoutes(app: FastifyInstance): Promise<void> {
// POST /api/v1/api-keys — Generate a new API key
app.post("/api/v1/api-keys", async (request: FastifyRequest, reply: FastifyReply) => {
const user = requireAuth(request, reply);
const user = requirePermission("apikeys:own")(request, reply);
if (!user) return;
const body = request.body as { name?: string } | null;
@@ -57,19 +59,21 @@ export async function apiKeyRoutes(app: FastifyInstance): Promise<void> {
// GET /api/v1/api-keys — List user's API keys (never returns the key itself)
app.get("/api/v1/api-keys", async (request: FastifyRequest, reply: FastifyReply) => {
const user = requireAuth(request, reply);
const user = requirePermission("apikeys:own")(request, reply);
if (!user) return;
const keys = db
const canSeeAll = hasPermission(user.role as Role, "apikeys:all");
const query = db
.select({
id: schema.apiKeys.id,
name: schema.apiKeys.name,
createdAt: schema.apiKeys.createdAt,
lastUsedAt: schema.apiKeys.lastUsedAt,
})
.from(schema.apiKeys)
.where(eq(schema.apiKeys.userId, user.id))
.all();
.from(schema.apiKeys);
const keys = canSeeAll ? query.all() : query.where(eq(schema.apiKeys.userId, user.id)).all();
return reply.send({
apiKeys: keys.map((k) => ({
@@ -85,16 +89,21 @@ export async function apiKeyRoutes(app: FastifyInstance): Promise<void> {
app.delete(
"/api/v1/api-keys/:id",
async (request: FastifyRequest<{ Params: { id: string } }>, reply: FastifyReply) => {
const user = requireAuth(request, reply);
const user = requirePermission("apikeys:own")(request, reply);
if (!user) return;
const { id } = request.params;
// Ensure the key belongs to the requesting user
// Admin can delete any key; regular users can only delete their own
const canDeleteAll = hasPermission(user.role as Role, "apikeys:all");
const existing = db
.select()
.from(schema.apiKeys)
.where(and(eq(schema.apiKeys.id, id), eq(schema.apiKeys.userId, user.id)))
.where(
canDeleteAll
? eq(schema.apiKeys.id, id)
: and(eq(schema.apiKeys.id, id), eq(schema.apiKeys.userId, user.id)),
)
.get();
if (!existing) {