fix: correct rate-limit response shape in withApiKey middleware

src/hooks/acl/use-organization-acl.ts

@@ -0,0 +1,10 @@
+"use client";
+
+import type { MemberWithUser } from "@/db/schemas/organization";
+import { computeOrganizationPermissions } from "@/lib/acl/organization-acl";
+
+export const useOrganizationPermissions = (
+	activeMember: MemberWithUser | null,
+) => {
+	return computeOrganizationPermissions(activeMember);
+};

src/hooks/acl/use-system-acl.ts

@@ -0,0 +1,8 @@
+"use client";
+
+import type { User } from "@/db/schemas/user";
+import { computeSystemPermissions } from "@/lib/acl/system-acl";
+
+export const useSystemPermissions = (user: User | null) => {
+	return computeSystemPermissions(user);
+};

src/lib/acl/role.ts

@@ -0,0 +1,2 @@
+export type SystemRole = "superadmin" | "admin" | "user";
+export type OrganizationRole = "owner" | "admin" | "member";

src/lib/acl/system-acl.ts

@@ -0,0 +1,60 @@
+import type { User } from "@/db/schemas/user";
+import type { SystemRole } from "@/lib/acl/role";
+
+export type SystemPermissions = {
+	role: SystemRole | null;
+
+	isSuperAdmin: boolean;
+	isAdmin: boolean;
+	isUser: boolean;
+
+	canAccessSystem: boolean;
+
+	canCreateUser: boolean;
+	canUpdateUser: boolean;
+	canDeleteUser: boolean;
+
+	canAssignSuperAdmin: boolean;
+	canAssignAdmin: boolean;
+	canAssignUser: boolean;
+
+	canCreateOrganization: boolean;
+	canDeleteOrganization: boolean;
+	canUpdateOrganization: boolean;
+
+	canManageOrganizationUsers: boolean;
+};
+
+export const computeSystemPermissions = (
+	user: User | null,
+): SystemPermissions => {
+	const role = (user?.role as SystemRole) ?? null;
+
+	const isSuperAdmin = role === "superadmin";
+	const isAdmin = role === "admin";
+	const isUser = role === "user";
+
+	return {
+		role,
+
+		isSuperAdmin,
+		isAdmin,
+		isUser,
+
+		canAccessSystem: isSuperAdmin,
+
+		canCreateUser: isSuperAdmin || isAdmin,
+		canUpdateUser: isSuperAdmin || isAdmin,
+		canDeleteUser: isSuperAdmin || isAdmin,
+
+		canAssignSuperAdmin: isSuperAdmin,
+		canAssignAdmin: isSuperAdmin || isAdmin,
+		canAssignUser: isSuperAdmin || isAdmin,
+
+		canCreateOrganization: isSuperAdmin,
+		canDeleteOrganization: isSuperAdmin,
+		canUpdateOrganization: isSuperAdmin || isAdmin,
+
+		canManageOrganizationUsers: isSuperAdmin || isAdmin,
+	};
+};

src/lib/api-v1/middleware.ts

@@ -35,6 +35,13 @@ export function withApiKey(handler: ApiKeyHandler) {
       const result = await auth.api.verifyApiKey({ body: { key } });
 
       if (!result?.valid || !result?.key) {
+
+        if (result.error?.code === "RATE_LIMITED") {
+          return NextResponse.json(
+            { error: result.error.message, details: (result.error as any).details ?? null },
+            { status: 429 }
+          );
+        }
         return NextResponse.json(
           { error: "Invalid or expired API key" },
           { status: 401 }