fix(api-keys): remove billed account check during workspace api key generation

[waleedlatif1]

Summary

• remove billed account check during api key generation

Type of Change

• Bug fix

Testing

Tested manually

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Review	Updated (UTC)
docs	Skipped		Dec 19, 2025 7:24pm

[greptile-apps]

Greptile Summary

removed the billedAccountUserId restriction from workspace API key creation and deletion endpoints

• Previously, only the workspace billing account owner could create/delete workspace API keys
• Now any workspace admin can create/delete workspace API keys
• The change simplifies permission model by relying solely on the existing admin permission check via getUserEntityPermissions()

Confidence Score: 4/5

• This PR is safe to merge with low risk
• The change relaxes a permission constraint by removing the billing account check, allowing any workspace admin to manage API keys. While the permission model is simpler and still protected by admin checks, this represents a meaningful authorization change that broadens access. The code is clean and consistent, but the business impact of allowing non-billing admins to manage keys should be verified.
• No files require special attention

Important Files Changed

Filename	Overview
apps/sim/app/api/workspaces/[id]/api-keys/route.ts	removed billedAccountUserId check from POST and DELETE endpoints, now allows any workspace admin to create/delete workspace API keys instead of only the billing account owner

Sequence Diagram

sequenceDiagram
    participant Client
    participant API as API Route
    participant Auth as getSession()
    participant Perms as getUserEntityPermissions()
    participant DB as Database

    Note over Client,DB: POST /api/workspaces/{id}/api-keys

    Client->>API: POST request with API key name
    API->>Auth: Check user session
    Auth-->>API: Return session with userId
    
    alt No session
        API-->>Client: 401 Unauthorized
    end
    
    API->>Perms: getUserEntityPermissions(userId, 'workspace', workspaceId)
    Perms->>DB: Query permissions table
    DB-->>Perms: Return permission type
    Perms-->>API: Return permission level
    
    alt Permission !== 'admin'
        API-->>Client: 403 Forbidden
    end
    
    Note over API,DB: REMOVED: billedAccountUserId check
    
    API->>DB: Check for existing key with same name
    DB-->>API: Return existing keys
    
    alt Key name already exists
        API-->>Client: 409 Conflict
    end
    
    API->>API: Generate and encrypt API key
    API->>DB: Insert new API key record
    DB-->>API: Return created key
    API-->>Client: 200 OK with new API key

    Note over Client,DB: DELETE /api/workspaces/{id}/api-keys

    Client->>API: DELETE request with key IDs
    API->>Auth: Check user session
    Auth-->>API: Return session with userId
    
    alt No session
        API-->>Client: 401 Unauthorized
    end
    
    API->>Perms: getUserEntityPermissions(userId, 'workspace', workspaceId)
    Perms->>DB: Query permissions table
    DB-->>Perms: Return permission type
    Perms-->>API: Return permission level
    
    alt Permission !== 'admin'
        API-->>Client: 403 Forbidden
    end
    
    Note over API,DB: REMOVED: billedAccountUserId check
    
    API->>DB: Delete API keys matching IDs and workspaceId
    DB-->>API: Return deleted count
    API-->>Client: 200 OK with deletedCount

Loading