ti.sil/sourcebot
1
0
Fork 0
mirror of https://github.com/sourcebot-dev/sourcebot.git synced 2025-12-12 04:15:30 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

add env var to restrict api key creation

Browse source
This commit is contained in:
msukkari 2025-10-28 15:27:30 -07:00
parent 336b07d41c
commit f3c2881f96
2 changed files with 14 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
packages/web/src/actions.ts
View file

@ -393,7 +393,16 @@ export const verifyApiKey = async (apiKeyPayload: ApiKeyPayload): Promise<{ apiK
export const createApiKey = async (name: string, domain: string): Promise<{ key: string } | ServiceError> => sew(() =>
withAuth((userId) =>
withOrgMembership(userId, domain, async ({ org }) => {
withOrgMembership(userId, domain, async ({ org, userRole }) => {
if (env.EXPERIMENT_DISABLE_API_KEY_CREATION_FOR_NON_ADMIN_USERS === 'true' && userRole !== OrgRole.OWNER) {
logger.error(`API key creation is disabled for non-admin users. User ${userId} is not an owner.`);
return {
statusCode: StatusCodes.FORBIDDEN,
errorCode: ErrorCode.INSUFFICIENT_PERMISSIONS,
message: "API key creation is disabled for non-admin users.",
} satisfies ServiceError;
}
const existingApiKey = await prisma.apiKey.findFirst({
where: {
createdById: userId,

6
packages/web/src/env.mjs
View file

@ -18,7 +18,7 @@ export const env = createEnv({
// Auth
FORCE_ENABLE_ANONYMOUS_ACCESS: booleanSchema.default('false'),
AUTH_SECRET: z.string(),
AUTH_URL: z.string().url(),
AUTH_CREDENTIALS_LOGIN_ENABLED: booleanSchema.default('true'),
@ -130,10 +130,12 @@ export const env = createEnv({
SOURCEBOT_DEMO_EXAMPLES_PATH: z.string().optional(),
// Experimental Environment Variables
// @note: These environment variables are subject to change at any time and are not garunteed to be backwards compatible.
EXPERIMENT_DISABLE_API_KEY_CREATION_FOR_NON_ADMIN_USERS: booleanSchema.default('false'),
EXPERIMENT_SELF_SERVE_REPO_INDEXING_ENABLED: booleanSchema.default('false'),
// @NOTE: Take care to update actions.ts when changing the name of this.
EXPERIMENT_SELF_SERVE_REPO_INDEXING_GITHUB_TOKEN: z.string().optional(),
EXPERIMENT_EE_PERMISSION_SYNC_ENABLED: booleanSchema.default('false'),
},
// @NOTE: Please make sure of the following: