internal/server/middleware/auth.go (107-109)

The WithOpenAPIAuth middleware correctly enforces that only TypeServiceAccount API keys can access the OpenAPI endpoints. However, it does not verify if the service account has the necessary ScopeWriteAPIKeys permission to create LLM API keys. This is a critical security oversight, as any service account could potentially create LLM API keys without proper authorization. You will also need to add import "slices" to the file.

        if apiKey.Type != apikey.TypeServiceAccount {
            AbortWithError(c, http.StatusUnauthorized, errors.New("API key type must be service account"))
            return
        }
        if !slices.Contains(apiKey.Scopes, string(scopes.ScopeWriteAPIKeys)) {
            AbortWithError(c, http.StatusUnauthorized, errors.New("API key missing required scope: write_api_keys"))
            return
        }

internal/server/middleware/graphql_auth_test.go (1-124)

The graphql_auth_test.go file was removed, which contained tests for the previous GraphQL authorization middleware. With the introduction of WithOpenAPIAuth middleware and the relocation of authorization logic, it is crucial to create new dedicated tests for WithOpenAPIAuth to ensure its correctness, especially for the critical scope checks (e.g., ScopeWriteAPIKeys for service accounts).

Makefile (13)

The echo message for the generate-openapi target is generic. To improve clarity, it should be more specific to reflect that it's generating OpenAPI-related GraphQL code.

  @echo "Generating OpenAPI GraphQL code..."

internal/server/biz/api_key.go (8)

The slices import was removed from this file. This indicates that the slices.Contains check for ScopeWriteAPIKeys is intended to be handled elsewhere, likely in the middleware. Please ensure this critical scope validation is correctly implemented in the WithOpenAPIAuth middleware to prevent unauthorized API key creation.

internal/server/routes.go (28)

The APIKey *api.APIKeyHandlers field was removed from the Handlers struct. Please confirm if this handler was intentionally removed and if its functionality is no longer required or has been fully replaced by other handlers. If it provided other API key related endpoints, those might now be missing.

internal/server/gql/axonhub.resolvers.go (1)

510-526: Consider removing the legacy “harms way” block once migration is complete.

It’s harmless, but leaving commented resolver logic in a generated file can confuse future edits and tooling. If the OpenAPI graph is now the sole owner, it’s safe to delete this block to keep the generated file clean.

🧹 Suggested cleanup

-// !!! WARNING !!!
-// The code below was going to be deleted when updating resolvers. It has been copied here so you have
-// one last chance to move it out of harms way if you want. There are two reasons this happens:
-//  - When renaming or deleting a resolver the old code will be put in here. You can safely delete
-//    it when you're done.
-//  - You have helper methods in this file. Move them out to keep these resolver files clean.
-/*
-    func (r *mutationResolver) CreateLLMAPIKey(ctx context.Context, name string) (*ent.APIKey, error) {
-        ownerKey, ok := contexts.GetAPIKey(ctx)
-        if !ok || ownerKey == nil {
-            return nil, fmt.Errorf("api key not found in context")
-        }
-
-        return r.apiKeyService.CreateLLMAPIKey(ctx, ownerKey, name)
-    }
-*/

Makefile (1)

12-15: Consider updating the echo message for clarity.

The message says "Generating GraphQL and Ent code..." but this target only generates OpenAPI GraphQL code, not Ent schemas. A more accurate message would help avoid confusion.

Suggested improvement

 generate-openapi:
-	`@echo` "Generating GraphQL and Ent code..."
+	`@echo` "Generating OpenAPI GraphQL code..."
 	cd internal/server/gql/openapi && go generate
-	`@echo` "Generation completed!"
+	`@echo` "OpenAPI GraphQL generation completed!"

internal/server/gql/openapi/gqlgen.yml (1)

7-10: Remove commented-out configuration.

The commented exec section is unused and adds noise. Consider removing it to keep the configuration clean.

Suggested cleanup

 omit_gqlgen_version_in_file_notice: true

-#exec:
-#  layout: follow-schema
-#  dir: ./graph
-#  package: graph
-
 # resolver reports where the resolver implementations go.

internal/server/middleware/auth.go (2)

87-88: Outdated comment doesn't match the function's purpose.

The comment states "allows API key auth for createLLMAPIKey only" but the function is a general OpenAPI authentication middleware that restricts access to service account API keys. Consider updating the comment to accurately describe the middleware's purpose.

📝 Suggested comment update

-// WithOpenAPIAuth allows API key auth for createLLMAPIKey only.
+// WithOpenAPIAuth middleware validates API key authentication for OpenAPI endpoints,
+// restricting access to service account type API keys only.
 func WithOpenAPIAuth(auth *biz.AuthService) gin.HandlerFunc {

---

89-119: Consider reducing code duplication with WithAPIKeyConfig.

WithOpenAPIAuth shares most of its logic with WithAPIKeyConfig (API key extraction, authentication, error handling, context propagation). You could refactor to compose the middleware or extract common logic into a helper function.

♻️ One possible approach

// Helper to handle common API key authentication logic
func authenticateAndSetContext(c *gin.Context, auth *biz.AuthService, config *APIKeyConfig) (*ent.APIKey, error) {
    key, err := ExtractAPIKeyFromRequest(c.Request, config)
    if err != nil {
        AbortWithError(c, http.StatusUnauthorized, err)
        return nil, err
    }

    apiKey, err := auth.AnthenticateAPIKey(c.Request.Context(), key)
    if err != nil {
        if ent.IsNotFound(err) || errors.Is(err, biz.ErrInvalidAPIKey) {
            AbortWithError(c, http.StatusUnauthorized, errors.New("Invalid API key"))
        } else {
            AbortWithError(c, http.StatusInternalServerError, errors.New("Failed to validate API key"))
        }
        return nil, err
    }
    return apiKey, nil
}

Then WithOpenAPIAuth can call this helper and add the service account check.

internal/server/gql/openapi/openapi.graphql (1)

7-9: Consider adding schema documentation.

The mutation signature is correct. For better API discoverability, consider adding GraphQL descriptions to document the mutation's purpose and requirements.

📝 Example with documentation

"""
Creates a new LLM API key associated with the authenticated service account's project.
Requires a service account API key with write_api_keys scope for authentication.
"""
extend type Mutation {
  createLLMAPIKey(
    """The display name for the new API key."""
    name: String!
  ): APIKey!
}

internal/server/gql/openapi/openapi.resolvers.go (1)

16-32: Consider simplifying the redundant nil check.

Based on the contexts.GetAPIKey implementation (which returns container.APIKey != nil as the boolean), when ok is true, ownerKey is guaranteed to be non-nil. The ownerKey == nil check is defensive but redundant.

♻️ Suggested simplification

 func (r *mutationResolver) CreateLLMAPIKey(ctx context.Context, name string) (*APIKey, error) {
 	ownerKey, ok := contexts.GetAPIKey(ctx)
-	if !ok || ownerKey == nil {
+	if !ok {
 		return nil, fmt.Errorf("api key not found in context")
 	}