feat: refine api key permissions and admin routes

apps/api/internal/store/platform_models.go

@@ -48,13 +48,27 @@ func (s *Store) ReplacePlatformModels(ctx context.Context, platformID string, in
 	}
 
 	if len(keptIDs) == 0 {
-		if _, err := tx.Exec(ctx, `DELETE FROM platform_models WHERE platform_id = $1::uuid`, platformID); err != nil {
+		if _, err := tx.Exec(ctx, `
+WITH deleted AS (
+  DELETE FROM platform_models
+  WHERE platform_id = $1::uuid
+  RETURNING id
+)
+DELETE FROM gateway_access_rules
+WHERE resource_type = 'platform_model'
+  AND resource_id IN (SELECT id FROM deleted)`, platformID); err != nil {
 			return nil, err
 		}
 	} else if _, err := tx.Exec(ctx, `
-DELETE FROM platform_models
-WHERE platform_id = $1::uuid
-  AND NOT (id::text = ANY($2::text[]))`, platformID, keptIDs); err != nil {
+WITH deleted AS (
+  DELETE FROM platform_models
+  WHERE platform_id = $1::uuid
+    AND NOT (id::text = ANY($2::text[]))
+  RETURNING id
+)
+DELETE FROM gateway_access_rules
+WHERE resource_type = 'platform_model'
+  AND resource_id IN (SELECT id FROM deleted)`, platformID, keptIDs); err != nil {
 		return nil, err
 	}
 
@@ -224,14 +238,25 @@ RETURNING id::text, platform_id::text, COALESCE(base_model_id::text, ''), model_
 }
 
 func (s *Store) DeletePlatformModel(ctx context.Context, id string) error {
-	result, err := s.pool.Exec(ctx, `DELETE FROM platform_models WHERE id = $1::uuid`, id)
+	tx, err := s.pool.Begin(ctx)
+	if err != nil {
+		return err
+	}
+	defer tx.Rollback(ctx)
+
+	result, err := tx.Exec(ctx, `DELETE FROM platform_models WHERE id = $1::uuid`, id)
 	if err != nil {
 		return err
 	}
 	if result.RowsAffected() == 0 {
 		return pgx.ErrNoRows
 	}
-	return nil
+	if _, err := tx.Exec(ctx, `
+DELETE FROM gateway_access_rules
+WHERE resource_type = 'platform_model' AND resource_id = $1::uuid`, id); err != nil {
+		return err
+	}
+	return tx.Commit(ctx)
 }
 
 func (s *Store) lookupBaseModel(ctx context.Context, q platformModelQuerier, id string, canonicalKey string, modelName string) (modelCatalogSnapshot, error) {