refactor openapikey and outlink apis (#2134)

* refactor: OpenAPIKey refactor

* refactor: outlink api refactor

fix: list return wrong data

* chore: remove deprecated type definition

* chore: remove throw Error. instead of Promise.reject

* fix: auth openapikey's owner

* fix: manager could read all keys

projects/app/src/pages/api/support/openapi/create.ts

@@ -1,44 +1,56 @@
-import type { NextApiRequest, NextApiResponse } from 'next';
-import { jsonRes } from '@fastgpt/service/common/response';
-import { connectToDatabase } from '@/service/mongo';
 import { MongoOpenApi } from '@fastgpt/service/support/openapi/schema';
-import { customAlphabet } from 'nanoid';
 import type { EditApiKeyProps } from '@/global/support/openapi/api';
 import { authUserPer } from '@fastgpt/service/support/permission/user/auth';
-import { WritePermissionVal } from '@fastgpt/global/support/permission/constant';
 import { getNanoid } from '@fastgpt/global/common/string/tools';
+import type { ApiRequestProps } from '@fastgpt/service/type/next';
+import { NextAPI } from '@/service/middleware/entry';
+import {
+  ManagePermissionVal,
+  WritePermissionVal
+} from '@fastgpt/global/support/permission/constant';
+import { authApp } from '@fastgpt/service/support/permission/app/auth';
+import { OpenApiErrEnum } from '@fastgpt/global/common/error/code/openapi';
 
-export default async function handler(req: NextApiRequest, res: NextApiResponse) {
-  try {
-    await connectToDatabase();
-    const { appId, name, limit } = req.body as EditApiKeyProps;
-    const { teamId, tmbId } = await authUserPer({ req, authToken: true, per: WritePermissionVal });
-
-    const count = await MongoOpenApi.find({ tmbId, appId }).countDocuments();
-
-    if (count >= 10) {
-      throw new Error('最多 10 组 API 秘钥');
+async function handler(req: ApiRequestProps<EditApiKeyProps>): Promise<string> {
+  const { appId, name, limit } = req.body;
+  const { tmbId, teamId } = await (async () => {
+    if (!appId) {
+      // global apikey is being created, auth the tmb
+      const { teamId, tmbId } = await authUserPer({
+        req,
+        authToken: true,
+        per: WritePermissionVal
+      });
+      return { teamId, tmbId };
+    } else {
+      const { teamId, tmbId } = await authApp({
+        req,
+        per: ManagePermissionVal,
+        appId,
+        authToken: true
+      });
+      return { teamId, tmbId };
     }
+  })();
 
-    const nanoid = getNanoid(Math.floor(Math.random() * 14) + 52);
-    const apiKey = `${global.systemEnv?.openapiPrefix || 'fastgpt'}-${nanoid}`;
+  const count = await MongoOpenApi.find({ tmbId, appId }).countDocuments();
 
-    await MongoOpenApi.create({
-      teamId,
-      tmbId,
-      apiKey,
-      appId,
-      name,
-      limit
-    });
-
-    jsonRes(res, {
-      data: apiKey
-    });
-  } catch (err) {
-    jsonRes(res, {
-      code: 500,
-      error: err
-    });
+  if (count >= 10) {
+    return Promise.reject(OpenApiErrEnum.exceedLimit);
   }
+
+  const nanoid = getNanoid(Math.floor(Math.random() * 14) + 52);
+  const apiKey = `${global.systemEnv?.openapiPrefix || 'fastgpt'}-${nanoid}`;
+
+  await MongoOpenApi.create({
+    teamId,
+    tmbId,
+    apiKey,
+    appId,
+    name,
+    limit
+  });
+  return apiKey;
 }
+
+export default NextAPI(handler);

projects/app/src/pages/api/support/openapi/delete.ts

@@ -4,6 +4,7 @@ import { connectToDatabase } from '@/service/mongo';
 import { MongoOpenApi } from '@fastgpt/service/support/openapi/schema';
 import { authOpenApiKeyCrud } from '@fastgpt/service/support/permission/auth/openapi';
 import { OwnerPermissionVal } from '@fastgpt/global/support/permission/constant';
+import { CommonErrEnum } from '@fastgpt/global/common/error/code/common';
 
 export default async function handler(req: NextApiRequest, res: NextApiResponse) {
   try {
@@ -11,7 +12,7 @@ export default async function handler(req: NextApiRequest, res: NextApiResponse)
     const { id } = req.query as { id: string };
 
     if (!id) {
-      throw new Error('缺少参数');
+      return Promise.reject(CommonErrEnum.missingParams);
     }
 
     await authOpenApiKeyCrud({ req, authToken: true, id, per: OwnerPermissionVal });

projects/app/src/pages/api/support/openapi/list.ts

@@ -1,53 +1,42 @@
-import type { NextApiRequest, NextApiResponse } from 'next';
-import { jsonRes } from '@fastgpt/service/common/response';
-import { connectToDatabase } from '@/service/mongo';
 import { MongoOpenApi } from '@fastgpt/service/support/openapi/schema';
 import type { GetApiKeyProps } from '@/global/support/openapi/api';
 import { authUserPer } from '@fastgpt/service/support/permission/user/auth';
 import { authApp } from '@fastgpt/service/support/permission/app/auth';
 import { ManagePermissionVal } from '@fastgpt/global/support/permission/constant';
+import type { ApiRequestProps } from '@fastgpt/service/type/next';
+import { NextAPI } from '@/service/middleware/entry';
 
-export default async function handler(req: NextApiRequest, res: NextApiResponse) {
-  try {
-    await connectToDatabase();
-    const { appId } = req.query as GetApiKeyProps;
+async function handler(req: ApiRequestProps<any, GetApiKeyProps>) {
+  const { appId } = req.query;
 
-    if (appId) {
-      await authApp({
-        req,
-        authToken: true,
-        appId,
-        per: ManagePermissionVal
-      });
-
-      const findResponse = await MongoOpenApi.find({
-        appId
-      }).sort({ _id: -1 });
-
-      return jsonRes(res, {
-        data: findResponse.map((item) => item.toObject())
-      });
-    }
-
-    const { teamId, tmbId, permission } = await authUserPer({
+  if (appId) {
+    // app-level apikey
+    await authApp({
       req,
       authToken: true,
+      appId,
       per: ManagePermissionVal
     });
 
     const findResponse = await MongoOpenApi.find({
-      appId,
-      teamId,
-      ...(!permission.isOwner && { tmbId })
+      appId
     }).sort({ _id: -1 });
 
-    return jsonRes(res, {
-      data: findResponse.map((item) => item.toObject())
-    });
-  } catch (err) {
-    jsonRes(res, {
-      code: 500,
-      error: err
-    });
+    return findResponse.map((item) => item.toObject());
   }
+  // global apikey
+  const { teamId, tmbId, permission } = await authUserPer({
+    req,
+    authToken: true
+  });
+
+  const findResponse = await MongoOpenApi.find({
+    appId,
+    teamId,
+    ...(!permission.hasManagePer && { tmbId }) // if not manager, read own key
+  }).sort({ _id: -1 });
+
+  return findResponse.map((item) => item.toObject());
 }
+
+export default NextAPI(handler);

projects/app/src/pages/api/support/openapi/update.ts

@@ -1,28 +1,19 @@
-import type { NextApiRequest, NextApiResponse } from 'next';
-import { jsonRes } from '@fastgpt/service/common/response';
-import { connectToDatabase } from '@/service/mongo';
 import { MongoOpenApi } from '@fastgpt/service/support/openapi/schema';
 import type { EditApiKeyProps } from '@/global/support/openapi/api.d';
 import { authOpenApiKeyCrud } from '@fastgpt/service/support/permission/auth/openapi';
 import { OwnerPermissionVal } from '@fastgpt/global/support/permission/constant';
+import type { ApiRequestProps } from '@fastgpt/service/type/next';
+import { NextAPI } from '@/service/middleware/entry';
 
-export default async function handler(req: NextApiRequest, res: NextApiResponse) {
-  try {
-    await connectToDatabase();
-    const { _id, name, limit } = req.body as EditApiKeyProps & { _id: string };
+async function handler(req: ApiRequestProps<EditApiKeyProps & { _id: string }>): Promise<void> {
+  const { _id, name, limit } = req.body;
 
-    await authOpenApiKeyCrud({ req, authToken: true, id: _id, per: OwnerPermissionVal });
+  await authOpenApiKeyCrud({ req, authToken: true, id: _id, per: OwnerPermissionVal });
 
-    await MongoOpenApi.findByIdAndUpdate(_id, {
-      ...(name && { name }),
-      ...(limit && { limit })
-    });
-
-    jsonRes(res);
-  } catch (err) {
-    jsonRes(res, {
-      code: 500,
-      error: err
-    });
-  }
+  await MongoOpenApi.findByIdAndUpdate(_id, {
+    ...(name && { name }),
+    ...(limit && { limit })
+  });
 }
+
+export default NextAPI(handler);