arnaudne
f59a6c5d8a
**API system** - ApiKey model: SHA-256-hashed tokens (gw_<hex>), per-family, scoped - Migration: 20260615210000_api_keys - src/lib/api-auth.ts: verifyApiKey(), hasScope(), generateApiKey(), prepareKey() **V1 endpoints** (all require Bearer gw_ token): - GET /api/v1/babies — list family babies (any read scope) - GET /api/v1/events — query events (events:read), babyId/type/from/to/limit/offset - POST /api/v1/events — log event (events:write), full metadata support - GET /api/v1/growth — growth logs (growth:read) - POST /api/v1/growth — add measurement (growth:write), weight in grams - GET /api/v1/summary — today's counts + sleep + last feed (summary:read) - GET /api/v1/milk — stock lots + totalMl (milk:read) **API key management** - GET /api/api-keys — list keys (session auth) - POST /api/api-keys — create key, returns raw token once (session auth) - DELETE /api/api-keys/[id] — revoke key (session auth) **Documentation** - GET /api/v1/openapi.json — OpenAPI 3.0 spec (CORS open) - GET /api-docs — Swagger UI (CDN, dark themed) **Settings UI** — "Clés API" section: create key with scope checkboxes, copy token banner (shown once), revoke, link to /api-docs Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
46 lines
1.8 KiB
TypeScript
46 lines
1.8 KiB
TypeScript
import { NextResponse } from "next/server";
|
|
import { auth } from "@/lib/auth";
|
|
import { prisma } from "@/lib/prisma";
|
|
import { generateApiKey, prepareKey, API_SCOPES } from "@/lib/api-auth";
|
|
|
|
export async function GET() {
|
|
const session = await auth();
|
|
if (!session?.user?.id) return NextResponse.json({ error: "Non autorisé" }, { status: 401 });
|
|
const familyId = (session.user as { familyId?: string }).familyId;
|
|
if (!familyId) return NextResponse.json({ keys: [] });
|
|
|
|
const keys = await prisma.apiKey.findMany({
|
|
where: { familyId },
|
|
orderBy: { createdAt: "desc" },
|
|
select: { id: true, name: true, keyPrefix: true, scopes: true, lastUsedAt: true, createdAt: true },
|
|
});
|
|
|
|
return NextResponse.json({ keys });
|
|
}
|
|
|
|
export async function POST(req: Request) {
|
|
const session = await auth();
|
|
if (!session?.user?.id) return NextResponse.json({ error: "Non autorisé" }, { status: 401 });
|
|
const familyId = (session.user as { familyId?: string }).familyId;
|
|
if (!familyId) return NextResponse.json({ error: "Famille introuvable" }, { status: 400 });
|
|
|
|
const body = await req.json().catch(() => ({}));
|
|
const { name, scopes } = body;
|
|
|
|
if (!name?.trim()) return NextResponse.json({ error: "name is required" }, { status: 400 });
|
|
|
|
const validScopes = (scopes as string[] | undefined)?.filter((s) => (API_SCOPES as readonly string[]).includes(s));
|
|
if (!validScopes?.length) return NextResponse.json({ error: "At least one valid scope is required" }, { status: 400 });
|
|
|
|
const token = generateApiKey();
|
|
const data = prepareKey(token, name.trim(), familyId, validScopes);
|
|
|
|
const key = await prisma.apiKey.create({
|
|
data,
|
|
select: { id: true, name: true, keyPrefix: true, scopes: true, createdAt: true },
|
|
});
|
|
|
|
// Return the raw token ONCE — it cannot be retrieved again
|
|
return NextResponse.json({ key, token }, { status: 201 });
|
|
}
|