Arnaud
8d5787e56e
Splits what was one isDeveloper flag (gating webhooks, API keys, AND BYOK together) into two independent permissions: - isDeveloper (webhooks + self-serve API keys): admin-toggled as before, but now ALSO self-serve -- PATCH /api/v1/users/me/developer-access lets any paid-tier (tier !== "free") user turn it on themselves, no added fee. Free tier still needs an admin grant. Turning it off is always self-serve regardless of tier, since revoking your own access needs no gatekeeping. canSelfServeDeveloperAccess() in lib/permissions.ts is the single check for "is this tier eligible." - isByokEnabled (BYOK AI provider keys): new column, admin-only, no self-serve path at all -- routing real AI provider spend through Epicure on the user's own key warrants a manual admin check-in that webhooks/API access don't need. requireByok() replaces requireDeveloper() on the three ai-keys routes. Migration adds is_byok_enabled and grandfathers in anyone who already has a BYOK key configured (the earlier grandfather migration only covered the combined isDeveloper flag, which BYOK no longer reads). Settings UI: webhooks/API-keys pages show a self-serve "Enable" toggle for paid-tier non-developers instead of the locked notice (still shown to free-tier users), plus a "Disable developer access" link once enabled. Settings -> AI's BYOK section now checks isByokEnabled instead of isDeveloper -- unaffected by the self-serve change, still fully admin-gated. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
61 lines
1.8 KiB
TypeScript
61 lines
1.8 KiB
TypeScript
import { NextResponse } from "next/server";
|
|
import { z } from "zod";
|
|
import { db, userAiKeys, eq, and } from "@epicure/db";
|
|
import { requireByok } from "@/lib/api-auth";
|
|
import { encrypt } from "@/lib/encrypt";
|
|
import { applyRateLimit } from "@/lib/rate-limit";
|
|
|
|
const VALID_PROVIDERS = ["openai", "anthropic", "openrouter", "ollama"] as const;
|
|
|
|
const PostSchema = z.object({
|
|
provider: z.enum(VALID_PROVIDERS),
|
|
apiKey: z.string().min(1).max(500),
|
|
});
|
|
|
|
export async function GET() {
|
|
const { session, response } = await requireByok();
|
|
if (response) return response;
|
|
|
|
const keys = await db.query.userAiKeys.findMany({
|
|
where: eq(userAiKeys.userId, session!.user.id),
|
|
columns: { provider: true, createdAt: true },
|
|
});
|
|
|
|
return NextResponse.json({ keys });
|
|
}
|
|
|
|
export async function POST(req: Request) {
|
|
const { session, response } = await requireByok();
|
|
if (response) return response;
|
|
|
|
const limited = await applyRateLimit(`rl:ai-keys:${session!.user.id}`, 5, 3600);
|
|
if (limited) return limited;
|
|
|
|
const body = PostSchema.safeParse(await req.json());
|
|
if (!body.success) return NextResponse.json({ error: "Validation error", issues: body.error.issues }, { status: 400 });
|
|
|
|
const { provider, apiKey } = body.data;
|
|
const userId = session!.user.id;
|
|
|
|
const existing = await db.query.userAiKeys.findFirst({
|
|
where: and(eq(userAiKeys.userId, userId), eq(userAiKeys.provider, provider)),
|
|
});
|
|
|
|
const encryptedKey = encrypt(apiKey);
|
|
|
|
if (existing) {
|
|
await db.update(userAiKeys)
|
|
.set({ encryptedKey })
|
|
.where(and(eq(userAiKeys.userId, userId), eq(userAiKeys.provider, provider)));
|
|
} else {
|
|
await db.insert(userAiKeys).values({
|
|
id: crypto.randomUUID(),
|
|
userId,
|
|
provider,
|
|
encryptedKey,
|
|
});
|
|
}
|
|
|
|
return NextResponse.json({ ok: true });
|
|
}
|