Split MCP and approval agent keys

crates/crank-core/src/access.rs

@@ -35,12 +35,22 @@ pub enum PlatformApiKeyStatus {
     Revoked,
 }
 
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum PlatformApiKeyKind {
+    McpClient,
+    Approval,
+}
+
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(rename_all = "snake_case")]
 pub enum PlatformApiKeyScope {
     Read,
     Write,
     Deploy,
+    Approve,
+    Deny,
+    ReadPending,
 }
 
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
@@ -82,6 +92,8 @@ pub struct PlatformApiKey {
     pub workspace_id: WorkspaceId,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub agent_id: Option<AgentId>,
+    #[serde(default = "default_platform_api_key_kind")]
+    pub key_kind: PlatformApiKeyKind,
     pub name: String,
     pub prefix: String,
     pub scopes: Vec<PlatformApiKeyScope>,
@@ -90,6 +102,14 @@ pub struct PlatformApiKey {
     pub created_at: OffsetDateTime,
     #[serde(with = "time::serde::rfc3339::option")]
     pub last_used_at: Option<OffsetDateTime>,
+    #[serde(with = "time::serde::rfc3339::option")]
+    pub expires_at: Option<OffsetDateTime>,
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub allowed_origins: Vec<String>,
+}
+
+fn default_platform_api_key_kind() -> PlatformApiKeyKind {
+    PlatformApiKeyKind::McpClient
 }
 
 #[cfg(test)]
@@ -97,7 +117,10 @@ mod tests {
     use serde_json::json;
     use time::{OffsetDateTime, format_description::well_known::Rfc3339};
 
-    use super::{PlatformApiKey, PlatformApiKeyScope, PlatformApiKeyStatus, User, UserStatus};
+    use super::{
+        PlatformApiKey, PlatformApiKeyKind, PlatformApiKeyScope, PlatformApiKeyStatus, User,
+        UserStatus,
+    };
     use crate::ids::{AgentId, PlatformApiKeyId, UserId, WorkspaceId};
 
     #[test]
@@ -138,16 +161,20 @@ mod tests {
             id: PlatformApiKeyId::new("pk_01"),
             workspace_id: WorkspaceId::new("ws_01"),
             agent_id: Some(AgentId::new("agent_01")),
+            key_kind: PlatformApiKeyKind::McpClient,
             name: "Primary".to_owned(),
             prefix: "crk_live".to_owned(),
             scopes: vec![PlatformApiKeyScope::Read, PlatformApiKeyScope::Write],
             status: PlatformApiKeyStatus::Active,
             created_at: OffsetDateTime::parse("2026-03-25T12:01:00Z", &Rfc3339).unwrap(),
             last_used_at: Some(OffsetDateTime::parse("2026-03-25T12:05:00Z", &Rfc3339).unwrap()),
+            expires_at: None,
+            allowed_origins: Vec::new(),
         };
 
         let value = serde_json::to_value(&api_key).unwrap();
 
+        assert_eq!(value["key_kind"], json!("mcp_client"));
         assert_eq!(value["created_at"], json!("2026-03-25T12:01:00Z"));
         assert_eq!(value["last_used_at"], json!("2026-03-25T12:05:00Z"));
     }

crates/crank-core/src/lib.rs

@@ -15,7 +15,7 @@ pub mod workspace;
 pub mod domain {
     pub use crate::access::{
         InvitationStatus, InvitationToken, Membership, MembershipRole, PlatformApiKey,
-        PlatformApiKeyScope, PlatformApiKeyStatus, User, UserStatus,
+        PlatformApiKeyKind, PlatformApiKeyScope, PlatformApiKeyStatus, User, UserStatus,
     };
     pub use crate::agent::{Agent, AgentOperationBinding, AgentStatus, AgentVersion};
     pub use crate::auth::{
@@ -85,7 +85,7 @@ pub mod ports {
 
 pub use access::{
     InvitationStatus, InvitationToken, Membership, MembershipRole, PlatformApiKey,
-    PlatformApiKeyScope, PlatformApiKeyStatus, User, UserStatus,
+    PlatformApiKeyKind, PlatformApiKeyScope, PlatformApiKeyStatus, User, UserStatus,
 };
 pub use agent::{Agent, AgentOperationBinding, AgentStatus, AgentVersion};
 pub use auth::{