Splits what was one isDeveloper flag (gating webhooks, API keys, AND
BYOK together) into two independent permissions:
- isDeveloper (webhooks + self-serve API keys): admin-toggled as
before, but now ALSO self-serve -- PATCH /api/v1/users/me/developer-access
lets any paid-tier (tier !== "free") user turn it on themselves, no
added fee. Free tier still needs an admin grant. Turning it off is
always self-serve regardless of tier, since revoking your own
access needs no gatekeeping. canSelfServeDeveloperAccess() in
lib/permissions.ts is the single check for "is this tier eligible."
- isByokEnabled (BYOK AI provider keys): new column, admin-only, no
self-serve path at all -- routing real AI provider spend through
Epicure on the user's own key warrants a manual admin check-in that
webhooks/API access don't need. requireByok() replaces
requireDeveloper() on the three ai-keys routes.
Migration adds is_byok_enabled and grandfathers in anyone who already
has a BYOK key configured (the earlier grandfather migration only
covered the combined isDeveloper flag, which BYOK no longer reads).
Settings UI: webhooks/API-keys pages show a self-serve "Enable"
toggle for paid-tier non-developers instead of the locked notice
(still shown to free-tier users), plus a "Disable developer access"
link once enabled. Settings -> AI's BYOK section now checks
isByokEnabled instead of isDeveloper -- unaffected by the self-serve
change, still fully admin-gated.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Webhooks, self-serve API keys, and BYOK AI provider keys had zero
access gating -- any logged-in user, any tier. Adds users.isDeveloper
(boolean, admin-toggled in admin/users/[id] alongside role/tier),
checked via a single hasDeveloperAccess() (lib/permissions.ts) so a
future subscription-tier auto-grant is a one-line change there, not
a redesign across call sites.
requireDeveloper() (lib/api-auth.ts) wraps requireSession() with a
fresh isDeveloper check (same reasoning as requireAdmin re-querying
role: session.user's cookieCache can be up to 5 minutes stale) and
replaces requireSession in all 8 gated routes: webhooks CRUD +
deliveries + redeliver, api-keys CRUD, ai-keys CRUD.
Settings UI: the sidebar hides API Keys/Webhooks nav entries for
non-developers; those pages and the BYOK section of Settings -> AI
show a locked notice instead of the manager component when accessed
directly.
Migration grandfathers in anyone who already has a webhook, API key,
or BYOK key row -- ships as a new gate on existing features, not a
silent lockout of active integrations.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Arnaud