feat: refine api key permissions and admin routes

apps/api/internal/httpapi/access_rule_handlers.go

@@ -2,9 +2,11 @@ package httpapi
 
 import (
 	"encoding/json"
+	"errors"
 	"net/http"
 	"strings"
 
+	"github.com/easyai/easyai-ai-gateway/apps/api/internal/auth"
 	"github.com/easyai/easyai-ai-gateway/apps/api/internal/store"
 )
 
@@ -18,6 +20,21 @@ func (s *Server) listAccessRules(w http.ResponseWriter, r *http.Request) {
 	writeJSON(w, http.StatusOK, map[string]any{"items": items})
 }
 
+func (s *Server) listAPIKeyAccessRules(w http.ResponseWriter, r *http.Request) {
+	user, _ := auth.UserFromContext(r.Context())
+	items, err := s.store.ListAPIKeyAccessRules(r.Context(), user)
+	if err != nil {
+		if errors.Is(err, store.ErrLocalUserRequired) {
+			writeError(w, http.StatusBadRequest, err.Error())
+			return
+		}
+		s.logger.Error("list api key access rules failed", "error", err)
+		writeError(w, http.StatusInternalServerError, "list api key access rules failed")
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"items": items})
+}
+
 func (s *Server) createAccessRule(w http.ResponseWriter, r *http.Request) {
 	var input store.AccessRuleInput
 	if err := json.NewDecoder(r.Body).Decode(&input); err != nil {
@@ -60,6 +77,38 @@ func (s *Server) batchAccessRules(w http.ResponseWriter, r *http.Request) {
 	writeJSON(w, http.StatusOK, map[string]any{"items": items})
 }
 
+func (s *Server) batchAPIKeyAccessRules(w http.ResponseWriter, r *http.Request) {
+	user, _ := auth.UserFromContext(r.Context())
+	var input store.AccessRuleBatchInput
+	if err := json.NewDecoder(r.Body).Decode(&input); err != nil {
+		writeError(w, http.StatusBadRequest, "invalid json body")
+		return
+	}
+	if !validAccessRuleBatchInput(input) || input.SubjectType != "api_key" {
+		writeError(w, http.StatusBadRequest, "api key subject, effect and resources are required")
+		return
+	}
+	items, err := s.store.BatchAPIKeyAccessRules(r.Context(), input, user)
+	if err != nil {
+		if errors.Is(err, store.ErrLocalUserRequired) {
+			writeError(w, http.StatusBadRequest, err.Error())
+			return
+		}
+		if store.IsNotFound(err) {
+			writeError(w, http.StatusNotFound, "api key not found")
+			return
+		}
+		if errors.Is(err, store.ErrAccessRuleResourceDenied) {
+			writeError(w, http.StatusForbidden, "resource is not available for current user group")
+			return
+		}
+		s.logger.Error("batch api key access rules failed", "error", err)
+		writeError(w, http.StatusInternalServerError, "batch api key access rules failed")
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"items": items})
+}
+
 func (s *Server) updateAccessRule(w http.ResponseWriter, r *http.Request) {
 	var input store.AccessRuleInput
 	if err := json.NewDecoder(r.Body).Decode(&input); err != nil {