feat: add teams and API keys modules with CRUD and key hashing

Author: truthixify

src/app.module.ts

@@ -3,6 +3,8 @@ import { ConfigModule } from '@nestjs/config';
 import { HealthModule } from './health/health.module';
 import { StorageModule } from './storage/storage.module';
 import { AuthModule } from './auth/auth.module';
+import { TeamsModule } from './teams/teams.module';
+import { KeysModule } from './keys/keys.module';
 import configuration from './config/configuration';
 
 @Module({
@@ -13,6 +15,8 @@ import configuration from './config/configuration';
     }),
     StorageModule,
     AuthModule,
+    TeamsModule,
+    KeysModule,
     HealthModule,
   ],
 })

src/keys/keys.controller.ts

@@ -0,0 +1,41 @@
+import { Controller, Get, Post, Patch, Delete, Param, Body, UseGuards } from '@nestjs/common';
+import { KeysService } from './keys.service';
+import { JwtAuthGuard } from '../auth/guards/jwt-auth.guard';
+import { TeamRoleGuard, TeamRole } from '../auth/guards/team-role.guard';
+
+@Controller('teams/:id/keys')
+@UseGuards(JwtAuthGuard, TeamRoleGuard)
+export class KeysController {
+  constructor(private readonly keysService: KeysService) {}
+
+  @Get()
+  @TeamRole('member')
+  list(@Param('id') teamId: string) {
+    return this.keysService.listForTeam(teamId);
+  }
+
+  @Post()
+  @TeamRole('admin')
+  create(
+    @Param('id') teamId: string,
+    @Body() body: { name: string; environment?: 'live' | 'test' },
+  ) {
+    return this.keysService.create(teamId, body.name, body.environment);
+  }
+
+  @Patch(':keyId')
+  @TeamRole('admin')
+  update(
+    @Param('id') teamId: string,
+    @Param('keyId') keyId: string,
+    @Body() body: { name: string },
+  ) {
+    return this.keysService.updateName(teamId, keyId, body.name);
+  }
+
+  @Delete(':keyId')
+  @TeamRole('admin')
+  revoke(@Param('id') teamId: string, @Param('keyId') keyId: string) {
+    return this.keysService.revoke(teamId, keyId);
+  }
+}

src/keys/keys.module.ts

@@ -0,0 +1,16 @@
+import { Module } from '@nestjs/common';
+import { TypeOrmModule } from '@nestjs/typeorm';
+import { KeysController } from './keys.controller';
+import { KeysService } from './keys.service';
+import { ApiKeyEntity } from '../storage/entities/api-key.entity';
+import { TeamEntity } from '../storage/entities/team.entity';
+import { TeamMemberEntity } from '../storage/entities/team-member.entity';
+import { PlanEntity } from '../storage/entities/plan.entity';
+
+@Module({
+  imports: [TypeOrmModule.forFeature([ApiKeyEntity, TeamEntity, TeamMemberEntity, PlanEntity])],
+  controllers: [KeysController],
+  providers: [KeysService],
+  exports: [KeysService],
+})
+export class KeysModule {}

src/keys/keys.service.ts

@@ -0,0 +1,89 @@
+import { Injectable, NotFoundException, ForbiddenException } from '@nestjs/common';
+import { InjectRepository } from '@nestjs/typeorm';
+import { Repository } from 'typeorm';
+import { createHash, randomBytes } from 'crypto';
+import { ApiKeyEntity } from '../storage/entities/api-key.entity';
+import { TeamEntity } from '../storage/entities/team.entity';
+import { PlanEntity } from '../storage/entities/plan.entity';
+
+@Injectable()
+export class KeysService {
+  constructor(
+    @InjectRepository(ApiKeyEntity)
+    private readonly apiKeyRepo: Repository<ApiKeyEntity>,
+    @InjectRepository(TeamEntity)
+    private readonly teamRepo: Repository<TeamEntity>,
+    @InjectRepository(PlanEntity)
+    private readonly planRepo: Repository<PlanEntity>,
+  ) {}
+
+  async listForTeam(teamId: string) {
+    const keys = await this.apiKeyRepo.find({
+      where: { teamId },
+      order: { createdAt: 'DESC' },
+    });
+    return keys.map((k) => ({
+      id: k.id,
+      name: k.name,
+      keyPrefix: k.keyPrefix,
+      environment: k.environment,
+      lastUsedAt: k.lastUsedAt,
+      expiresAt: k.expiresAt,
+      revoked: k.revoked,
+      createdAt: k.createdAt,
+    }));
+  }
+
+  async create(teamId: string, name: string, environment: 'live' | 'test' = 'live') {
+    const team = await this.teamRepo.findOneBy({ id: teamId });
+    if (!team) throw new NotFoundException('Team not found');
+
+    const plan = await this.planRepo.findOneBy({ id: team.plan });
+    if (plan && plan.maxApiKeys !== -1) {
+      const count = await this.apiKeyRepo.count({ where: { teamId, revoked: false } });
+      if (count >= plan.maxApiKeys) {
+        throw new ForbiddenException('API key limit reached for your plan');
+      }
+    }
+
+    const prefix = environment === 'live' ? 'wraith_live_' : 'wraith_test_';
+    const rawKey = prefix + randomBytes(32).toString('base64url');
+    const keyHash = createHash('sha256').update(rawKey).digest('hex');
+    const keyPrefix = rawKey.slice(0, 8);
+
+    const apiKey = await this.apiKeyRepo.save(
+      this.apiKeyRepo.create({
+        teamId,
+        name,
+        keyPrefix,
+        keyHash,
+        environment,
+        revoked: false,
+      }),
+    );
+
+    return {
+      id: apiKey.id,
+      name: apiKey.name,
+      environment: apiKey.environment,
+      key: rawKey,
+      keyPrefix: apiKey.keyPrefix,
+      createdAt: apiKey.createdAt,
+    };
+  }
+
+  async updateName(teamId: string, keyId: string, name: string) {
+    const key = await this.apiKeyRepo.findOne({ where: { id: keyId, teamId } });
+    if (!key) throw new NotFoundException('API key not found');
+    key.name = name;
+    return this.apiKeyRepo.save(key);
+  }
+
+  async revoke(teamId: string, keyId: string) {
+    const key = await this.apiKeyRepo.findOne({ where: { id: keyId, teamId } });
+    if (!key) throw new NotFoundException('API key not found');
+    key.revoked = true;
+    await this.apiKeyRepo.save(key);
+    return { revoked: true };
+  }
+}

src/teams/teams.controller.ts

@@ -0,0 +1,72 @@
+import { Controller, Get, Post, Patch, Delete, Param, Body, UseGuards } from '@nestjs/common';
+import { TeamsService } from './teams.service';
+import { JwtAuthGuard } from '../auth/guards/jwt-auth.guard';
+import { TeamRoleGuard, TeamRole } from '../auth/guards/team-role.guard';
+import { CurrentDeveloper } from '../auth/decorators/current-developer.decorator';
+
+@Controller('teams')
+@UseGuards(JwtAuthGuard)
+export class TeamsController {
+  constructor(private readonly teamsService: TeamsService) {}
+
+  @Get()
+  list(@CurrentDeveloper() dev: { id: string }) {
+    return this.teamsService.listForDeveloper(dev.id);
+  }
+
+  @Post()
+  create(@CurrentDeveloper() dev: { id: string }, @Body() body: { name: string; slug?: string }) {
+    return this.teamsService.create(dev.id, body.name, body.slug);
+  }
+
+  @Get(':id')
+  @UseGuards(TeamRoleGuard)
+  @TeamRole('member')
+  getById(@Param('id') id: string) {
+    return this.teamsService.getById(id);
+  }
+
+  @Patch(':id')
+  @UseGuards(TeamRoleGuard)
+  @TeamRole('admin')
+  update(@Param('id') id: string, @Body() body: { name?: string; slug?: string }) {
+    return this.teamsService.update(id, body);
+  }
+
+  @Delete(':id')
+  delete(@Param('id') id: string, @CurrentDeveloper() dev: { id: string }) {
+    return this.teamsService.delete(id, dev.id);
+  }
+
+  @Get(':id/members')
+  @UseGuards(TeamRoleGuard)
+  @TeamRole('member')
+  listMembers(@Param('id') id: string) {
+    return this.teamsService.listMembers(id);
+  }
+
+  @Post(':id/members')
+  @UseGuards(TeamRoleGuard)
+  @TeamRole('admin')
+  addMember(@Param('id') id: string, @Body() body: { email: string; role?: string }) {
+    return this.teamsService.addMember(id, body.email, body.role);
+  }
+
+  @Patch(':id/members/:memberId')
+  @UseGuards(TeamRoleGuard)
+  @TeamRole('admin')
+  updateMemberRole(
+    @Param('id') id: string,
+    @Param('memberId') memberId: string,
+    @Body() body: { role: string },
+  ) {
+    return this.teamsService.updateMemberRole(id, memberId, body.role);
+  }
+
+  @Delete(':id/members/:memberId')
+  @UseGuards(TeamRoleGuard)
+  @TeamRole('admin')
+  removeMember(@Param('id') id: string, @Param('memberId') memberId: string) {
+    return this.teamsService.removeMember(id, memberId);
+  }
+}

src/teams/teams.module.ts

@@ -0,0 +1,15 @@
+import { Module } from '@nestjs/common';
+import { TypeOrmModule } from '@nestjs/typeorm';
+import { TeamsController } from './teams.controller';
+import { TeamsService } from './teams.service';
+import { TeamEntity } from '../storage/entities/team.entity';
+import { TeamMemberEntity } from '../storage/entities/team-member.entity';
+import { DeveloperEntity } from '../storage/entities/developer.entity';
+
+@Module({
+  imports: [TypeOrmModule.forFeature([TeamEntity, TeamMemberEntity, DeveloperEntity])],
+  controllers: [TeamsController],
+  providers: [TeamsService],
+  exports: [TeamsService],
+})
+export class TeamsModule {}

src/teams/teams.service.ts

@@ -0,0 +1,131 @@
+import {
+  Injectable,
+  NotFoundException,
+  ForbiddenException,
+  ConflictException,
+} from '@nestjs/common';
+import { InjectRepository } from '@nestjs/typeorm';
+import { Repository } from 'typeorm';
+import { randomBytes } from 'crypto';
+import { TeamEntity } from '../storage/entities/team.entity';
+import { TeamMemberEntity } from '../storage/entities/team-member.entity';
+import { DeveloperEntity } from '../storage/entities/developer.entity';
+
+@Injectable()
+export class TeamsService {
+  constructor(
+    @InjectRepository(TeamEntity)
+    private readonly teamRepo: Repository<TeamEntity>,
+    @InjectRepository(TeamMemberEntity)
+    private readonly memberRepo: Repository<TeamMemberEntity>,
+    @InjectRepository(DeveloperEntity)
+    private readonly developerRepo: Repository<DeveloperEntity>,
+  ) {}
+
+  async listForDeveloper(developerId: string) {
+    const memberships = await this.memberRepo.find({
+      where: { developerId },
+      relations: ['team'],
+    });
+    return memberships.map((m) => ({ ...m.team, role: m.role }));
+  }
+
+  async create(developerId: string, name: string, slug?: string) {
+    const finalSlug = slug || name.replace(/[^a-z0-9-]/gi, '-').toLowerCase();
+    const existing = await this.teamRepo.findOneBy({ slug: finalSlug });
+    if (existing) {
+      throw new ConflictException('Slug already taken');
+    }
+
+    const team = await this.teamRepo.save(
+      this.teamRepo.create({
+        name,
+        slug: finalSlug + '-' + randomBytes(3).toString('hex'),
+        ownerId: developerId,
+        plan: 'free',
+      }),
+    );
+
+    await this.memberRepo.save(
+      this.memberRepo.create({
+        teamId: team.id,
+        developerId,
+        role: 'owner',
+      }),
+    );
+
+    return team;
+  }
+
+  async getById(teamId: string) {
+    const team = await this.teamRepo.findOneBy({ id: teamId });
+    if (!team) throw new NotFoundException('Team not found');
+    return team;
+  }
+
+  async update(teamId: string, updates: { name?: string; slug?: string }) {
+    const team = await this.getById(teamId);
+    if (updates.slug) {
+      const existing = await this.teamRepo.findOneBy({ slug: updates.slug });
+      if (existing && existing.id !== teamId) {
+        throw new ConflictException('Slug already taken');
+      }
+    }
+    Object.assign(team, updates);
+    return this.teamRepo.save(team);
+  }
+
+  async delete(teamId: string, developerId: string) {
+    const team = await this.getById(teamId);
+    if (team.ownerId !== developerId) {
+      throw new ForbiddenException('Only the owner can delete a team');
+    }
+    await this.teamRepo.remove(team);
+    return { deleted: true };
+  }
+
+  async listMembers(teamId: string) {
+    return this.memberRepo.find({
+      where: { teamId },
+      relations: ['developer'],
+    });
+  }
+
+  async addMember(teamId: string, email: string, role: string = 'member') {
+    const developer = await this.developerRepo.findOneBy({ email });
+    if (!developer) throw new NotFoundException('Developer not found');
+
+    const existing = await this.memberRepo.findOne({
+      where: { teamId, developerId: developer.id },
+    });
+    if (existing) throw new ConflictException('Already a member');
+
+    return this.memberRepo.save(
+      this.memberRepo.create({
+        teamId,
+        developerId: developer.id,
+        role,
+      }),
+    );
+  }
+
+  async updateMemberRole(teamId: string, memberId: string, role: string) {
+    const member = await this.memberRepo.findOne({
+      where: { id: memberId, teamId },
+    });
+    if (!member) throw new NotFoundException('Member not found');
+    if (member.role === 'owner') throw new ForbiddenException('Cannot change owner role');
+    member.role = role;
+    return this.memberRepo.save(member);
+  }
+
+  async removeMember(teamId: string, memberId: string) {
+    const member = await this.memberRepo.findOne({
+      where: { id: memberId, teamId },
+    });
+    if (!member) throw new NotFoundException('Member not found');
+    if (member.role === 'owner') throw new ForbiddenException('Cannot remove the owner');
+    await this.memberRepo.remove(member);
+    return { removed: true };
+  }
+}