Class ApiKeysService

backend/src/api-keys/api-keys.service.ts:21–196

@Injectable()
export class ApiKeysService {
  private readonly logger = new Logger(ApiKeysService.name);

  constructor(
    @Inject(DRIZZLE_TOKEN)
    private readonly db: NodePgDatabase<typeof schema>,
  ) {}

  async create(auth: AuthContext, dto: CreateApiKeyDto) {
    if (!auth.organizationId) {
      throw new InternalServerErrorException('Organization ID missing in context');
    }

    const { key: plainKey, id: keyId } = this.generateKeyWithId();
    const keyHash = await bcrypt.hash(plainKey, 10);

    const [apiKey] = await this.db
      .insert(apiKeys)
      .values({
        name: dto.name,
        description: dto.description,
        keyHash,
        keyPrefix: KEY_PREFIX,
        keyHint: keyId,
        permissions: dto.permissions,
        organizationId: dto.organizationId ?? auth.organizationId,
        createdBy: auth.userId || 'system',
        expiresAt: dto.expiresAt ? new Date(dto.expiresAt) : null,
        rateLimit: dto.rateLimit,
        isActive: true,
      })
      .returning();

    return { apiKey, plainKey };
  }

  async list(auth: AuthContext, query: ListApiKeysQueryDto) {
    if (!auth.organizationId) {
      return [];
    }

    const conditions = [eq(apiKeys.organizationId, auth.organizationId)];

    if (query.isActive !== undefined) {
      conditions.push(eq(apiKeys.isActive, query.isActive));
    }

    return this.db
      .select()
      .from(apiKeys)
      .where(and(...conditions))
      .orderBy(desc(apiKeys.createdAt))
      .limit(query.limit)
      .offset(query.offset);
  }

  async get(auth: AuthContext, id: string) {
    if (!auth.organizationId) {