add virtual api key schema and crud endpoints

server/middlewares/index.ts

@@ -30,6 +30,7 @@ export * from "./verifyDomainAccess";
 export * from "./verifyAiProviderAccess";
 export * from "./verifyAiModelAccess";
 export * from "./verifyAiBudgetAccess";
+export * from "./verifyVirtualApiKeyAccess";
 export * from "./verifyUserIsOrgOwner";
 export * from "./verifyUserFromResourceSession";
 export * from "./verifySiteResourceAccess";

server/middlewares/integration/index.ts

@@ -20,3 +20,4 @@ export * from "./verifyApiKeyAiProviderAccess";
 export * from "./verifyApiKeyAiModelAccess";
 export * from "./verifyApiKeyResourcePolicyAccess";
 export * from "./verifyApiKeySiteProvisioningKeyAccess";
+export * from "./verifyVirtualApiKeyAccess";

server/middlewares/integration/verifyVirtualApiKeyAccess.ts

@@ -0,0 +1,87 @@
+import { Request, Response, NextFunction } from "express";
+import { apiKeyOrg, db, virtualApiKeys } from "@server/db";
+import { and, eq } from "drizzle-orm";
+import createHttpError from "http-errors";
+import HttpCode from "@server/types/HttpCode";
+import { getFirstString } from "@server/lib/requestParams";
+
+export async function verifyApiKeyVirtualApiKeyAccess(
+    req: Request,
+    res: Response,
+    next: NextFunction
+) {
+    try {
+        const apiKey = req.apiKey;
+        const virtualApiKeyId = getFirstString(req.params.virtualApiKeyId);
+
+        if (!apiKey) {
+            return next(
+                createHttpError(HttpCode.UNAUTHORIZED, "Key not authenticated")
+            );
+        }
+
+        if (!virtualApiKeyId) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "Invalid virtual API key ID"
+                )
+            );
+        }
+
+        const [key] = await db
+            .select()
+            .from(virtualApiKeys)
+            .where(eq(virtualApiKeys.virtualApiKeyId, virtualApiKeyId))
+            .limit(1);
+
+        if (!key || key.kind !== "manual") {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `Virtual API key with ID ${virtualApiKeyId} not found`
+                )
+            );
+        }
+
+        if (apiKey.isRoot) {
+            req.virtualApiKey = key;
+            return next();
+        }
+
+        const orgId = key.orgId;
+
+        if (!req.apiKeyOrg || req.apiKeyOrg.orgId !== orgId) {
+            const apiKeyOrgRes = await db
+                .select()
+                .from(apiKeyOrg)
+                .where(
+                    and(
+                        eq(apiKeyOrg.apiKeyId, apiKey.apiKeyId),
+                        eq(apiKeyOrg.orgId, orgId)
+                    )
+                )
+                .limit(1);
+            req.apiKeyOrg = apiKeyOrgRes[0];
+        }
+
+        if (!req.apiKeyOrg) {
+            return next(
+                createHttpError(
+                    HttpCode.FORBIDDEN,
+                    "Key does not have access to this organization"
+                )
+            );
+        }
+
+        req.virtualApiKey = key;
+        return next();
+    } catch (error) {
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                "Error verifying virtual API key access"
+            )
+        );
+    }
+}

server/middlewares/verifyVirtualApiKeyAccess.ts

@@ -0,0 +1,101 @@
+import { Request, Response, NextFunction } from "express";
+import { db, userOrgs, virtualApiKeys } from "@server/db";
+import { and, eq } from "drizzle-orm";
+import createHttpError from "http-errors";
+import HttpCode from "@server/types/HttpCode";
+import { checkOrgAccessPolicy } from "#dynamic/lib/checkOrgAccessPolicy";
+import { getUserOrgRoleIds } from "@server/lib/userOrgRoles";
+import { getFirstString } from "@server/lib/requestParams";
+
+export async function verifyVirtualApiKeyAccess(
+    req: Request,
+    res: Response,
+    next: NextFunction
+) {
+    try {
+        const userId = req.user!.userId;
+        const virtualApiKeyId = getFirstString(req.params.virtualApiKeyId);
+
+        if (!userId) {
+            return next(
+                createHttpError(HttpCode.UNAUTHORIZED, "User not authenticated")
+            );
+        }
+
+        if (!virtualApiKeyId) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "Invalid virtual API key ID"
+                )
+            );
+        }
+
+        const [key] = await db
+            .select()
+            .from(virtualApiKeys)
+            .where(eq(virtualApiKeys.virtualApiKeyId, virtualApiKeyId))
+            .limit(1);
+
+        if (!key || key.kind !== "manual") {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `Virtual API key with ID ${virtualApiKeyId} not found`
+                )
+            );
+        }
+
+        const orgId = key.orgId;
+
+        if (!req.userOrg || req.userOrg.orgId !== orgId) {
+            const userOrgRole = await db
+                .select()
+                .from(userOrgs)
+                .where(
+                    and(eq(userOrgs.userId, userId), eq(userOrgs.orgId, orgId))
+                )
+                .limit(1);
+            req.userOrg = userOrgRole[0];
+        }
+
+        if (!req.userOrg) {
+            return next(
+                createHttpError(
+                    HttpCode.FORBIDDEN,
+                    "User does not have access to this organization"
+                )
+            );
+        }
+
+        if (req.orgPolicyAllowed === undefined && req.userOrg.orgId) {
+            const policyCheck = await checkOrgAccessPolicy({
+                orgId: req.userOrg.orgId,
+                userId,
+                session: req.session
+            });
+            req.orgPolicyAllowed = policyCheck.allowed;
+            if (!policyCheck.allowed || policyCheck.error) {
+                return next(
+                    createHttpError(
+                        HttpCode.FORBIDDEN,
+                        "" + (policyCheck.error || "Unknown error")
+                    )
+                );
+            }
+        }
+
+        req.userOrgId = orgId;
+        req.userOrgRoleIds = await getUserOrgRoleIds(req.userOrg.userId, orgId);
+        req.virtualApiKey = key;
+
+        return next();
+    } catch (error) {
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                "Error verifying virtual API key access"
+            )
+        );
+    }
+}