62 lines
2.6 KiB
JavaScript
62 lines
2.6 KiB
JavaScript
const express = require('express');
|
|
const crypto = require('crypto');
|
|
const { requireRole } = require('../middleware/auth');
|
|
const { hashSecret, maskSecret } = require('../utils/security');
|
|
|
|
const createApiKeysRouter = ({ pool }) => {
|
|
const router = express.Router();
|
|
|
|
router.get('/api-keys', requireRole(['admin', 'super_admin']), async (req, res) => {
|
|
try {
|
|
const { tenantId } = req.query;
|
|
const effectiveTenantId = req.user.role === 'super_admin' ? tenantId : req.user.tenant_id;
|
|
if (!effectiveTenantId || effectiveTenantId === 'all') return res.json([]);
|
|
|
|
const [rows] = await pool.query(
|
|
'SELECT id, name, created_at, last_used_at, CASE WHEN secret_key LIKE "masked:%" THEN CONCAT("fasto_sk_", RIGHT(secret_key, 6), "...") ELSE CONCAT(SUBSTRING(secret_key, 1, 14), "...") END as masked_key FROM api_keys WHERE tenant_id = ?',
|
|
[effectiveTenantId]
|
|
);
|
|
res.json(rows);
|
|
} catch (error) {
|
|
res.status(500).json({ error: error.message });
|
|
}
|
|
});
|
|
|
|
router.post('/api-keys', requireRole(['admin', 'super_admin']), async (req, res) => {
|
|
const { name, tenantId } = req.body;
|
|
const effectiveTenantId = req.user.role === 'super_admin' ? tenantId : req.user.tenant_id;
|
|
try {
|
|
const id = `apk_${crypto.randomUUID().split('-')[0]}`;
|
|
const secretKey = `fasto_sk_${crypto.randomBytes(32).toString('hex')}`;
|
|
|
|
await pool.query(
|
|
'INSERT INTO api_keys (id, tenant_id, name, secret_key, secret_hash) VALUES (?, ?, ?, ?, ?)',
|
|
[id, effectiveTenantId, name || 'Nova Integração API', maskSecret(id, secretKey), hashSecret(secretKey)]
|
|
);
|
|
|
|
res.status(201).json({ id, secret_key: secretKey, message: 'Chave criada. Salve-a agora, ela não será exibida novamente.' });
|
|
} catch (error) {
|
|
res.status(500).json({ error: error.message });
|
|
}
|
|
});
|
|
|
|
router.delete('/api-keys/:id', requireRole(['admin', 'super_admin']), async (req, res) => {
|
|
try {
|
|
const [existing] = await pool.query('SELECT tenant_id FROM api_keys WHERE id = ?', [req.params.id]);
|
|
if (existing.length === 0) return res.status(404).json({ error: 'Chave não encontrada' });
|
|
if (req.user.role !== 'super_admin' && existing[0].tenant_id !== req.user.tenant_id) return res.status(403).json({ error: 'Acesso negado' });
|
|
|
|
await pool.query('DELETE FROM api_keys WHERE id = ?', [req.params.id]);
|
|
res.json({ message: 'Chave de API revogada com sucesso.' });
|
|
} catch (error) {
|
|
res.status(500).json({ error: error.message });
|
|
}
|
|
});
|
|
|
|
return router;
|
|
};
|
|
|
|
module.exports = {
|
|
createApiKeysRouter,
|
|
};
|