feat: Add throwIfNoAccessToApiKey guard function (boxyhq#1366)

Author: ukrocks007

lib/guards/team-api-key.ts

@@ -0,0 +1,20 @@
+import { getApiKeyById } from 'models/apiKey';
+import { ApiError } from '../errors';
+
+export const throwIfNoAccessToApiKey = async (
+  apiKeyId: string,
+  teamId: string
+) => {
+  const apiKey = await getApiKeyById(apiKeyId);
+
+  if (!apiKey) {
+    throw new ApiError(404, 'API key not found');
+  }
+
+  if (teamId !== apiKey.teamId) {
+    throw new ApiError(
+      403,
+      'You do not have permission to delete this API key'
+    );
+  }
+};

models/apiKey.ts

@@ -64,3 +64,15 @@ export const getApiKey = async (apiKey: string) => {
     },
   });
 };
+
+export const getApiKeyById = async (id: string) => {
+  return prisma.apiKey.findUnique({
+    where: {
+      id,
+    },
+    select: {
+      id: true,
+      teamId: true,
+    },
+  });
+};

pages/api/teams/[slug]/api-keys/[apiKeyId].ts

@@ -6,6 +6,7 @@ import { recordMetric } from '@/lib/metrics';
 import env from '@/lib/env';
 import { ApiError } from '@/lib/errors';
 import { deleteApiKeySchema, validateWithSchema } from '@/lib/zod';
+import { throwIfNoAccessToApiKey } from '@/lib/guards/team-api-key';
 
 export default async function handler(
   req: NextApiRequest,
@@ -44,6 +45,8 @@ const handleDELETE = async (req: NextApiRequest, res: NextApiResponse) => {
 
   const { apiKeyId } = validateWithSchema(deleteApiKeySchema, req.query);
 
+  await throwIfNoAccessToApiKey(apiKeyId, user.team.id);
+
   await deleteApiKey(apiKeyId);
 
   recordMetric('apikey.removed');

pages/api/teams/[slug]/webhooks/[endpointId].ts

@@ -38,8 +38,8 @@ export default async function handler(
         });
     }
   } catch (err: any) {
-    const message = err.message || 'Something went wrong';
-    const status = err.status || 500;
+    const message = err?.body?.detail || err.message || 'Something went wrong';
+    const status = err.status || err.code || 500;
 
     res.status(status).json({ error: { message } });
   }
@@ -98,6 +98,8 @@ const handlePUT = async (req: NextApiRequest, res: NextApiResponse) => {
   if (eventTypes.length > 0) {
     data['filterTypes'] = eventTypes;
   }
+  // Checks if the webhook exists or throws an error
+  await findWebhook(app.id, endpointId);
 
   const webhook = await updateWebhook(app.id, endpointId, data);