vocdoni / saas-backend / 28095266962

63%

Build Type

push

github

Committed by web-flow

Commit Message

feat(apikeys): restrict API key creation to integrator organizations (#547)

* feat(apikeys): restrict API key creation to integrator organizations

API keys were intended as an integrator capability — every assignable scope
(quota:read, managed:read/write, voting:write, members:write) is
integrator-oriented, and integrators use keys to drive their managed orgs.
But createAPIKeyHandler only checked admin role with no integrator guard, so
an admin of a managed or plain org could mint working keys.

Add an IsIntegrator guard right after the admin check, returning
ErrNotAnIntegrator (403) otherwise. This also closes the orphan apiKeys-rows
gap for the upcoming DELETE managed-org cascade: once non-integrator orgs
cannot mint keys, deleting a managed org cannot leave orphaned rows behind.

* fix(apikeys): validate address param and document 404 in swagger

Address Copilot review feedback on #547:

- Validate the {address} path param up front with common.IsHexAddress and
  return 400 (ErrMalformedURLParam) on malformed input. common.HexToAddress
  silently maps a bad value to the zero address, which otherwise surfaced as
  a confusing 401/404; matches the integratorAddressFromRequest pattern.
- Document the 404 (ErrOrganizationNotFound) the new org lookup can return,
  in both swag annotations and the regenerated docs/swagger.yaml.
- Cover the malformed-address path in TestAPIKeysRequireIntegrator.

* docs(apikeys): clarify integrator guard comment

Address Copilot review feedback on #547: the previous comment implied
managed/plain orgs are always rejected, but the real guard is
!subscriptions.IsIntegrator(org), which also admits an org enabled as an
integrator via an IntegratorLimits override. Reword the comment to match
the actual condition.

Coverage Stats

12 of 18 new or added lines in 1 file covered. (66.67%)

210 existing lines in 9 files now uncovered.

9559 of 15484 relevant lines covered (61.73%)

44.26 hits per line