Arnaud
8d5787e56e
Splits what was one isDeveloper flag (gating webhooks, API keys, AND BYOK together) into two independent permissions: - isDeveloper (webhooks + self-serve API keys): admin-toggled as before, but now ALSO self-serve -- PATCH /api/v1/users/me/developer-access lets any paid-tier (tier !== "free") user turn it on themselves, no added fee. Free tier still needs an admin grant. Turning it off is always self-serve regardless of tier, since revoking your own access needs no gatekeeping. canSelfServeDeveloperAccess() in lib/permissions.ts is the single check for "is this tier eligible." - isByokEnabled (BYOK AI provider keys): new column, admin-only, no self-serve path at all -- routing real AI provider spend through Epicure on the user's own key warrants a manual admin check-in that webhooks/API access don't need. requireByok() replaces requireDeveloper() on the three ai-keys routes. Migration adds is_byok_enabled and grandfathers in anyone who already has a BYOK key configured (the earlier grandfather migration only covered the combined isDeveloper flag, which BYOK no longer reads). Settings UI: webhooks/API-keys pages show a self-serve "Enable" toggle for paid-tier non-developers instead of the locked notice (still shown to free-tier users), plus a "Disable developer access" link once enabled. Settings -> AI's BYOK section now checks isByokEnabled instead of isDeveloper -- unaffected by the self-serve change, still fully admin-gated. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
77 lines
2.9 KiB
TypeScript
77 lines
2.9 KiB
TypeScript
import type { Metadata } from "next";
|
|
import { headers } from "next/headers";
|
|
import Link from "next/link";
|
|
import { ExternalLink } from "lucide-react";
|
|
import { auth } from "@/lib/auth/server";
|
|
import { db, apiKeys, users, eq } from "@epicure/db";
|
|
import { ApiKeysManager } from "@/components/settings/api-keys-manager";
|
|
import { DeveloperLockedNotice } from "@/components/settings/developer-locked-notice";
|
|
import { DeveloperAccessToggle } from "@/components/settings/developer-access-toggle";
|
|
import { DisableDeveloperAccessButton } from "@/components/settings/disable-developer-access-button";
|
|
import { canSelfServeDeveloperAccess } from "@/lib/permissions";
|
|
import { getMessages } from "@/lib/i18n/server";
|
|
|
|
export const metadata: Metadata = {};
|
|
|
|
export default async function ApiKeysPage() {
|
|
const session = await auth.api.getSession({ headers: await headers() });
|
|
if (!session) return null;
|
|
const m = getMessages((session.user as { locale?: string }).locale);
|
|
|
|
const dbUser = (await db.select({ isDeveloper: users.isDeveloper, tier: users.tier }).from(users).where(eq(users.id, session.user.id)).limit(1))[0];
|
|
|
|
const keys = dbUser?.isDeveloper
|
|
? await db
|
|
.select({
|
|
id: apiKeys.id,
|
|
name: apiKeys.name,
|
|
scope: apiKeys.scope,
|
|
lastUsedAt: apiKeys.lastUsedAt,
|
|
createdAt: apiKeys.createdAt,
|
|
})
|
|
.from(apiKeys)
|
|
.where(eq(apiKeys.userId, session.user.id))
|
|
: [];
|
|
|
|
return (
|
|
<div className="space-y-8">
|
|
<section className="rounded-xl border p-6 space-y-4">
|
|
<div>
|
|
<h2 className="font-semibold text-lg">{m.settings.apiKeysPage.title}</h2>
|
|
<p className="text-sm text-muted-foreground mt-1">
|
|
{m.settings.apiKeysPage.description}
|
|
</p>
|
|
<Link
|
|
href="/docs"
|
|
target="_blank"
|
|
className="inline-flex items-center gap-1 text-sm text-primary hover:underline mt-2"
|
|
>
|
|
<ExternalLink className="h-3.5 w-3.5" />
|
|
{m.settings.apiKeysPage.docsLink}
|
|
</Link>
|
|
</div>
|
|
{!dbUser?.isDeveloper && dbUser && canSelfServeDeveloperAccess(dbUser) && (
|
|
<DeveloperAccessToggle message={m.settings.developerSelfServeNotice} />
|
|
)}
|
|
{!dbUser?.isDeveloper && (!dbUser || !canSelfServeDeveloperAccess(dbUser)) && (
|
|
<DeveloperLockedNotice message={m.settings.developerLockedNotice} />
|
|
)}
|
|
{dbUser?.isDeveloper && (
|
|
<>
|
|
<ApiKeysManager
|
|
initialKeys={keys.map((k) => ({
|
|
id: k.id,
|
|
name: k.name,
|
|
scope: k.scope,
|
|
lastUsedAt: k.lastUsedAt ? k.lastUsedAt.toISOString() : null,
|
|
createdAt: k.createdAt.toISOString(),
|
|
}))}
|
|
/>
|
|
<DisableDeveloperAccessButton />
|
|
</>
|
|
)}
|
|
</section>
|
|
</div>
|
|
);
|
|
}
|