Authentication & Access Control

// Called during workspace member removal
await supabaseAdmin.auth.admin.signOut(userId, 'global');

export async function DELETE(req: NextRequest) {
  // First: establish workspace and role from the authenticated user
  const { workspaceId, role } = await requireSettingsAccess(req, ['owner', 'admin']);
  // Only owners and admins reach this point
  // ...
}

// Key creation — hash before storing
const rawKey = generateSecureToken();
const hashedKey = sha256(rawKey);
const keyPrefix = rawKey.slice(0, 8); // stored for display identification

await db.insert(apiKeys).values({
  workspaceId,
  hashedKey,
  prefix: keyPrefix,
  expiresAt: options.expiresAt ?? null,
  createdBy: userId,
});

// Return the raw key once — never stored again
return { key: rawKey, prefix: keyPrefix };

import { timingSafeEqual } from 'crypto';

function validateApiKey(providedKey: string, storedHash: string): boolean {
  const providedHash = sha256(providedKey);
  const a = Buffer.from(providedHash, 'hex');
  const b = Buffer.from(storedHash, 'hex');

  if (a.length !== b.length) return false;
  return timingSafeEqual(a, b);
}

if (key.expiresAt && key.expiresAt < new Date()) {
  throw new UnauthorizedError('API key has expired');
}

// A developer in workspace A cannot delete workspace B's keys
await db.delete(apiKeys)
  .where(
    and(
      eq(apiKeys.id, keyId),
      eq(apiKeys.workspaceId, workspaceId) // derived from auth, not request body
    )
  );