capsets

backend/src/routes/profile.rs

@@ -12,14 +12,13 @@ use crate::auth::{
     api_tokens::{
         create_api_token as issue_token, list_api_tokens as load_tokens,
         regenerate_api_token as rotate_token, revoke_api_token as revoke_token,
-        update_api_token_capabilities as update_capabilities,
     },
-    capability_sets::load_capabilities_for_set,
+    capability_sets::load_capability_set,
     passkeys::PasskeySummary,
     TenantScopedConn,
 };
 use crate::error::{AppError, AppResult};
-use crate::models::{ApiCapability, ApiToken};
+use crate::models::ApiToken;
 use crate::state::{AppState, PgPooledConnection};
 use crate::utils::{db::no_content, time::to_iso};
 
@@ -29,7 +28,7 @@ pub struct ApiTokenResponse {
     pub tenant_id: Uuid,
     #[schema(nullable)]
     pub label: Option<String>,
-    pub capabilities: Vec<ApiCapability>,
+    pub capability_set_id: Uuid,
     pub created_at: String,
     #[schema(nullable)]
     pub last_used_at: Option<String>,
@@ -51,14 +50,7 @@ pub struct CreateApiTokenRequest {
     pub label: Option<String>,
     #[schema(nullable)]
     pub expires_at: Option<String>,
-    #[serde(default)]
-    #[schema(nullable)]
-    pub capabilities: Option<Vec<ApiCapability>>,
-}
-
-#[derive(Debug, Deserialize, ToSchema)]
-pub struct UpdateApiTokenCapabilitiesRequest {
-    pub capabilities: Vec<ApiCapability>,
+    pub capability_set_id: Uuid,
 }
 
 #[derive(Debug, Deserialize, ToSchema)]
@@ -104,10 +96,7 @@ pub async fn list_api_tokens(
     }: TenantScopedConn,
 ) -> AppResult<Json<Vec<ApiTokenResponse>>> {
     let tokens = load_tokens(&mut conn, user_id, Some(tenant_id))?;
-    let mut responses = Vec::with_capacity(tokens.len());
-    for token in tokens {
-        responses.push(api_token_to_response(&mut conn, token)?);
-    }
+    let responses = tokens.into_iter().map(api_token_to_response).collect();
     Ok(Json(responses))
 }
 
@@ -132,13 +121,7 @@ pub async fn create_api_token(
         None => None,
     };
 
-    let capabilities = payload
-        .capabilities
-        .ok_or_else(|| AppError::bad_request("at least one capability is required"))?;
-
-    if capabilities.is_empty() {
-        return Err(AppError::bad_request("at least one capability is required"));
-    }
+    let capability_set_id = validate_capability_set(&mut conn, tenant_id, payload.capability_set_id)?;
 
     let issued = issue_token(
         &mut conn,
@@ -146,10 +129,10 @@ pub async fn create_api_token(
         tenant_id,
         payload.label.clone(),
         expires_at,
-        capabilities,
+        capability_set_id,
     )?;
 
-    let token_info = api_token_to_response(&mut conn, issued.record)?;
+    let token_info = api_token_to_response(issued.record);
 
     let response = ApiTokenCreatedResponse {
         token: issued.token,
@@ -176,7 +159,7 @@ pub async fn regenerate_api_token(
     Path(token_id): Path<Uuid>,
 ) -> AppResult<Json<ApiTokenCreatedResponse>> {
     let issued = rotate_token(&mut conn, token_id, user_id, Some(tenant_id))?;
-    let token_info = api_token_to_response(&mut conn, issued.record)?;
+    let token_info = api_token_to_response(issued.record);
     let response = ApiTokenCreatedResponse {
         token: issued.token,
         token_info,
@@ -185,41 +168,6 @@ pub async fn regenerate_api_token(
     Ok(Json(response))
 }
 
-#[utoipa::path(
-    patch,
-    path = "/api/profile/api-tokens/{id}",
-    params(("id" = Uuid, Path, description = "API token ID")),
-    request_body = UpdateApiTokenCapabilitiesRequest,
-    responses((status = 200, description = "API token updated", body = ApiTokenResponse)),
-    tag = "Profile"
-)]
-pub async fn update_api_token(
-    TenantScopedConn {
-        mut conn,
-        tenant_id,
-        user_id,
-        ..
-    }: TenantScopedConn,
-    Path(token_id): Path<Uuid>,
-    Json(payload): Json<UpdateApiTokenCapabilitiesRequest>,
-) -> AppResult<Json<ApiTokenResponse>> {
-    if payload.capabilities.is_empty() {
-        return Err(AppError::bad_request("at least one capability is required"));
-    }
-
-    let updated = update_capabilities(
-        &mut conn,
-        token_id,
-        user_id,
-        Some(tenant_id),
-        payload.capabilities,
-    )?;
-
-    let response = api_token_to_response(&mut conn, updated)?;
-
-    Ok(Json(response))
-}
-
 #[utoipa::path(
     delete,
     path = "/api/profile/api-tokens/{id}",
@@ -271,10 +219,7 @@ pub async fn delete_passkey(
     no_content()
 }
 
-fn api_token_to_response(
-    conn: &mut PgPooledConnection,
-    token: ApiToken,
-) -> AppResult<ApiTokenResponse> {
+fn api_token_to_response(token: ApiToken) -> ApiTokenResponse {
     let ApiToken {
         id,
         tenant_id,
@@ -287,18 +232,16 @@ fn api_token_to_response(
         ..
     } = token;
 
-    let capabilities = load_capabilities_for_set(conn, capability_set_id)?;
-
-    Ok(ApiTokenResponse {
+    ApiTokenResponse {
         id,
         tenant_id,
         label,
-        capabilities,
+        capability_set_id,
         created_at: to_iso(created_at),
         last_used_at: last_used_at.map(to_iso),
         expires_at: expires_at.map(to_iso),
         revoked_at: revoked_at.map(to_iso),
-    })
+    }
 }
 
 fn parse_timestamp(value: &str) -> AppResult<NaiveDateTime> {
@@ -307,13 +250,26 @@ fn parse_timestamp(value: &str) -> AppResult<NaiveDateTime> {
     Ok(dt.naive_utc())
 }
 
+fn validate_capability_set(
+    conn: &mut PgPooledConnection,
+    tenant_id: Uuid,
+    capability_set_id: Uuid,
+) -> AppResult<Uuid> {
+    let set = load_capability_set(conn, capability_set_id)?;
+    if set.tenant_id != tenant_id {
+        return Err(AppError::bad_request(
+            "capability set does not belong to the tenant",
+        ));
+    }
+    Ok(set.id)
+}
+
 #[derive(utoipa::OpenApi)]
 #[openapi(
     paths(
         crate::routes::profile::list_api_tokens,
         crate::routes::profile::create_api_token,
         crate::routes::profile::regenerate_api_token,
-        crate::routes::profile::update_api_token,
         crate::routes::profile::delete_api_token,
         crate::routes::profile::list_passkeys,
         crate::routes::profile::delete_passkey
@@ -323,7 +279,6 @@ fn parse_timestamp(value: &str) -> AppResult<NaiveDateTime> {
         crate::routes::profile::ApiTokenResponse,
         crate::routes::profile::ApiTokenCreatedResponse,
         crate::routes::profile::CreateApiTokenRequest,
-        crate::routes::profile::UpdateApiTokenCapabilitiesRequest,
         crate::routes::profile::RevokePasskeyQuery,
         crate::auth::passkeys::PasskeySummary
     ))