feat: implement automation key management with middleware and routes for organization API keys, invite improvements

apps/api/src/middlewares/auth-or-automation-key.ts

@@ -0,0 +1,29 @@
+import { Context, Next } from 'hono';
+
+import { authMiddleware } from './auth';
+import { automationKeyMiddleware } from './automation-key';
+
+export const authOrAutomationKeyMiddleware = async (c: Context, next: Next) => {
+  const user = c.get('user');
+  const session = c.get('session');
+
+  if (user && session) {
+    c.set('automationKey', null);
+    await authMiddleware(c, next);
+    return;
+  }
+
+  const authHeader = c.req.header('Authorization');
+
+  if (authHeader?.startsWith('Bearer ')) {
+    return automationKeyMiddleware(c, next);
+  }
+
+  return c.json(
+    {
+      success: false,
+      message: 'Unauthorized: Authentication required (session or automation key)'
+    },
+    401
+  );
+};

apps/api/src/middlewares/automation-key.ts

@@ -0,0 +1,42 @@
+import { Context, Next } from 'hono';
+
+import {
+  authenticateOrganizationApiKeyService,
+  touchOrganizationApiKeyLastUsedService
+} from '@api/services/organization/automation-key';
+
+export const automationKeyMiddleware = async (c: Context, next: Next) => {
+  try {
+    const authHeader = c.req.header('Authorization');
+
+    if (!authHeader || !authHeader.startsWith('Bearer ')) {
+      return c.json(
+        {
+          success: false,
+          error: 'Unauthorized',
+          code: 'UNAUTHORIZED'
+        },
+        401
+      );
+    }
+
+    const apiKey = authHeader.replace('Bearer ', '').trim();
+    const automationKey = await authenticateOrganizationApiKeyService(apiKey);
+
+    c.set('automationKey', automationKey);
+    c.set('orgId', automationKey.organizationId);
+    c.set('actorId', automationKey.createdByProfileId);
+
+    await touchOrganizationApiKeyLastUsedService(automationKey);
+    await next();
+  } catch (error) {
+    return c.json(
+      {
+        success: false,
+        error: error instanceof Error ? error.message : 'Unauthorized',
+        code: 'UNAUTHORIZED'
+      },
+      401
+    );
+  }
+};

apps/api/src/middlewares/org-admin-or-api-key.ts

@@ -0,0 +1,75 @@
+import { Context, Next } from 'hono';
+
+import { ErrorCodes } from '@api/utils/errors';
+import { env } from '@api/config/env';
+import { isUserOrgAdmin } from '@cio/db/queries/organization';
+
+export const orgAdminOrApiKeyMiddleware = async (c: Context, next: Next) => {
+  try {
+    const orgId = c.req.header('cio-org-id');
+
+    if (!orgId) {
+      return c.json(
+        {
+          success: false,
+          error: 'Organization ID is required',
+          code: 'ORG_ID_REQUIRED'
+        },
+        400
+      );
+    }
+
+    const user = c.get('user');
+    const authHeader = c.req.header('Authorization');
+    const apiKey = authHeader?.startsWith('Bearer ') ? authHeader.replace('Bearer ', '').trim() : null;
+    const isApiKeyRequest = Boolean(apiKey && env.PRIVATE_SERVER_KEY && apiKey === env.PRIVATE_SERVER_KEY);
+    const actorId = user?.id ?? c.req.header('x-cio-actor-id');
+
+    if (!actorId) {
+      return c.json(
+        {
+          success: false,
+          error: 'Actor ID is required',
+          code: 'ACTOR_ID_REQUIRED'
+        },
+        400
+      );
+    }
+
+    const isAdmin = await isUserOrgAdmin(orgId, actorId);
+    if (!isAdmin) {
+      return c.json(
+        {
+          success: false,
+          error: 'Only organization admins can perform this action',
+          code: ErrorCodes.ORG_TEAM_NOT_AUTHORIZED
+        },
+        403
+      );
+    }
+
+    if (!user && !isApiKeyRequest) {
+      return c.json(
+        {
+          success: false,
+          error: 'Unauthorized',
+          code: ErrorCodes.UNAUTHORIZED
+        },
+        401
+      );
+    }
+
+    c.set('actorId', actorId);
+    await next();
+  } catch (error) {
+    console.error('Error in orgAdminOrApiKeyMiddleware:', error);
+    return c.json(
+      {
+        success: false,
+        error: 'Failed to verify organization admin status',
+        code: 'ORG_ADMIN_CHECK_FAILED'
+      },
+      500
+    );
+  }
+};

apps/api/src/middlewares/org-admin-or-automation-key.ts

@@ -0,0 +1,85 @@
+import { Context, Next } from 'hono';
+import type { TOrganizationApiKeyScope } from '@cio/utils/validation/organization';
+
+import { ErrorCodes } from '@api/utils/errors';
+import { isUserOrgAdmin } from '@cio/db/queries/organization';
+import { organizationApiKeyHasScopes } from '@api/services/organization/automation-key';
+
+export const orgAdminOrAutomationKeyMiddleware =
+  (requiredScopes: readonly TOrganizationApiKeyScope[] = []) =>
+  async (c: Context, next: Next) => {
+    try {
+      const automationKey = c.get('automationKey');
+
+      if (automationKey) {
+        if (!organizationApiKeyHasScopes(automationKey.scopes ?? [], requiredScopes)) {
+          return c.json(
+            {
+              success: false,
+              error: 'Automation key is missing required scopes',
+              code: ErrorCodes.FORBIDDEN
+            },
+            403
+          );
+        }
+
+        c.set('orgId', automationKey.organizationId);
+        c.set('actorId', automationKey.createdByProfileId);
+
+        await next();
+        return;
+      }
+
+      const user = c.get('user');
+      if (!user) {
+        return c.json(
+          {
+            success: false,
+            error: 'Unauthorized',
+            code: ErrorCodes.UNAUTHORIZED
+          },
+          401
+        );
+      }
+
+      const orgId = c.req.header('cio-org-id');
+
+      if (!orgId) {
+        return c.json(
+          {
+            success: false,
+            error: 'Organization ID is required',
+            code: 'ORG_ID_REQUIRED'
+          },
+          400
+        );
+      }
+
+      const isAdmin = await isUserOrgAdmin(orgId, user.id);
+      if (!isAdmin) {
+        return c.json(
+          {
+            success: false,
+            error: 'Only organization admins can perform this action',
+            code: ErrorCodes.ORG_TEAM_NOT_AUTHORIZED
+          },
+          403
+        );
+      }
+
+      c.set('orgId', orgId);
+      c.set('actorId', user.id);
+
+      await next();
+    } catch (error) {
+      console.error('Error in orgAdminOrAutomationKeyMiddleware:', error);
+      return c.json(
+        {
+          success: false,
+          error: 'Failed to verify organization admin status',
+          code: 'ORG_ADMIN_CHECK_FAILED'
+        },
+        500
+      );
+    }
+  };