n8n/packages/cli/src/controllers/api-keys.controller.ts

import {
	CreateApiKeyRequestDto,
	ListApiKeysQueryDto,
	UpdateApiKeyRequestDto,
} from '@n8n/api-types';
import { EventService } from '@n8n/backend-services';
import { AuthenticatedRequest } from '@n8n/db';
import {
	Body,
	Delete,
	Get,
	GlobalScope,
	Param,
	Patch,
	Post,
	Query,
	RestController,
} from '@n8n/decorators';
import { getApiKeyScopesForRole } from '@n8n/permissions';
import type { RequestHandler } from 'express';

import { BadRequestError } from '@n8n/errors';
import { isApiKeyAuthEnabled } from '@/public-api';
import { PublicApiKeyService } from '@/services/public-api-key.service';

export const isApiKeyAuthEnabledMiddleware: RequestHandler = (_, res, next) => {
	if (isApiKeyAuthEnabled()) {
		next();
	} else {
		res.status(404).end();
	}
};

@RestController('/api-keys')
export class ApiKeysController {
	constructor(
		private readonly eventService: EventService,
		private readonly publicApiKeyService: PublicApiKeyService,
	) {}

	@GlobalScope('apiKey:create')
	@Post('/', { middlewares: [isApiKeyAuthEnabledMiddleware] })
	async createApiKey(
		req: AuthenticatedRequest,
		_res: Response,
		@Body body: CreateApiKeyRequestDto,
	) {
		if (!this.publicApiKeyService.apiKeyHasValidScopesForRole(req.user, body.scopes)) {
			throw new BadRequestError('Invalid scopes for user role');
		}

		const newApiKey = await this.publicApiKeyService.createPublicApiKeyForUser(req.user, body);

		this.eventService.emit('public-api-key-created', { user: req.user, publicApi: false });

		return {
			...newApiKey,
			apiKey: this.publicApiKeyService.redactApiKey(newApiKey.apiKey),
			rawApiKey: newApiKey.apiKey,
			expiresAt: body.expiresAt,
		};
	}

	// Every authenticated user may list their own keys. The service only
	// includes other users' keys for `apiKey:manage` callers; `ownership=mine`
	// narrows back to own.
	@Get('/', { middlewares: [isApiKeyAuthEnabledMiddleware] })
	async getApiKeys(req: AuthenticatedRequest, _res: Response, @Query query: ListApiKeysQueryDto) {
		return await this.publicApiKeyService.getRedactedApiKeys(req.user, {
			take: query.take,
			skip: query.skip,
			ownership: query.ownership,
			label: query.label,
			ownerIds: query.ownerIds,
			sortBy: query.sortBy,
		});
	}

	// No role scope required: own keys are always revocable. The service
	// restricts deleting other users' keys to `apiKey:manage` holders.
	@Delete('/:id', { middlewares: [isApiKeyAuthEnabledMiddleware] })
	async deleteApiKey(req: AuthenticatedRequest, _res: Response, @Param('id') apiKeyId: string) {
		const { isOwn } = await this.publicApiKeyService.deleteApiKey(req.user, apiKeyId);

		this.eventService.emit('public-api-key-deleted', {
			user: req.user,
			publicApi: false,
			isOwn,
		});

		return { success: true };
	}

	// Owner-only — `apiKey:manage` doesn't extend to editing someone else's key.
	@GlobalScope('apiKey:update')
	@Patch('/:id', { middlewares: [isApiKeyAuthEnabledMiddleware] })
	async updateApiKey(
		req: AuthenticatedRequest,
		_res: Response,
		@Param('id') apiKeyId: string,
		@Body body: UpdateApiKeyRequestDto,
	) {
		if (!this.publicApiKeyService.apiKeyHasValidScopesForRole(req.user, body.scopes)) {
			throw new BadRequestError('Invalid scopes for user role');
		}

		await this.publicApiKeyService.updateApiKeyForUser(req.user, apiKeyId, body);

		return { success: true };
	}

	// Owner-only — re-issues the secret in place, keeping label, scopes and expiry.
	@GlobalScope('apiKey:update')
	@Post('/:id/rotate', { middlewares: [isApiKeyAuthEnabledMiddleware] })
	async rotateApiKey(req: AuthenticatedRequest, _res: Response, @Param('id') apiKeyId: string) {
		const rotatedApiKey = await this.publicApiKeyService.rotateApiKey(req.user, apiKeyId);

		this.eventService.emit('public-api-key-rotated', { user: req.user, publicApi: false });

		return {
			...rotatedApiKey,
			apiKey: this.publicApiKeyService.redactApiKey(rotatedApiKey.apiKey),
			rawApiKey: rotatedApiKey.apiKey,
			expiresAt: this.publicApiKeyService.getApiKeyExpiration(rotatedApiKey.apiKey),
		};
	}

	// No role scope required: returns the scopes the caller's role can assign
	// to a key — empty-ish for roles without apiKey grants.
	@Get('/scopes', { middlewares: [isApiKeyAuthEnabledMiddleware] })
	async getApiKeyScopes(req: AuthenticatedRequest, _res: Response) {
		const scopes = getApiKeyScopesForRole(req.user);
		return scopes;
	}
}