auth: cut over community machine access to agent keys

apps/admin-api/src/routes/access.rs

@@ -9,7 +9,7 @@ use serde_json::{Value, json};
 use crate::{
     auth::AuthenticatedSession,
     error::ApiError,
-    service::{InvitationPayload, PlatformApiKeyPayload, UpdateMembershipPayload},
+    service::{InvitationPayload, UpdateMembershipPayload},
     state::AppState,
 };
 
@@ -30,12 +30,6 @@ pub struct WorkspaceMembershipPath {
     pub user_id: String,
 }
 
-#[derive(Deserialize)]
-pub struct WorkspacePlatformApiKeyPath {
-    pub workspace_id: String,
-    pub key_id: String,
-}
-
 pub async fn list_memberships(
     Path(path): Path<WorkspacePath>,
     State(state): State<AppState>,
@@ -118,57 +112,6 @@ pub async fn delete_invitation(
     Ok(StatusCode::NO_CONTENT)
 }
 
-pub async fn list_platform_api_keys(
-    Path(path): Path<WorkspacePath>,
-    State(state): State<AppState>,
-) -> Result<Json<Value>, ApiError> {
-    let items = state
-        .service
-        .list_platform_api_keys(&path.workspace_id.as_str().into())
-        .await?;
-    Ok(Json(json!({ "items": items })))
-}
-
-pub async fn create_platform_api_key(
-    Path(path): Path<WorkspacePath>,
-    State(state): State<AppState>,
-    Json(payload): Json<PlatformApiKeyPayload>,
-) -> Result<Json<Value>, ApiError> {
-    let created = state
-        .service
-        .create_platform_api_key(&path.workspace_id.as_str().into(), payload)
-        .await?;
-    Ok(Json(json!(created)))
-}
-
-pub async fn revoke_platform_api_key(
-    Path(path): Path<WorkspacePlatformApiKeyPath>,
-    State(state): State<AppState>,
-) -> Result<StatusCode, ApiError> {
-    state
-        .service
-        .revoke_platform_api_key(
-            &path.workspace_id.as_str().into(),
-            &path.key_id.as_str().into(),
-        )
-        .await?;
-    Ok(StatusCode::NO_CONTENT)
-}
-
-pub async fn delete_platform_api_key(
-    Path(path): Path<WorkspacePlatformApiKeyPath>,
-    State(state): State<AppState>,
-) -> Result<StatusCode, ApiError> {
-    state
-        .service
-        .delete_platform_api_key(
-            &path.workspace_id.as_str().into(),
-            &path.key_id.as_str().into(),
-        )
-        .await?;
-    Ok(StatusCode::NO_CONTENT)
-}
-
 pub async fn export_workspace(
     Path(path): Path<WorkspacePath>,
     State(state): State<AppState>,

apps/admin-api/src/routes/agents.rs

@@ -7,7 +7,10 @@ use serde_json::{Value, json};
 
 use crate::{
     error::ApiError,
-    service::{AgentBindingPayload, AgentPayload, PublishPayload, UpdateAgentPayload},
+    service::{
+        AgentBindingPayload, AgentPayload, PlatformApiKeyPayload, PublishPayload,
+        UpdateAgentPayload,
+    },
     state::AppState,
 };
 
@@ -29,6 +32,13 @@ pub struct WorkspaceAgentVersionPath {
     pub version: u32,
 }
 
+#[derive(Deserialize)]
+pub struct WorkspaceAgentPlatformApiKeyPath {
+    pub workspace_id: String,
+    pub agent_id: String,
+    pub key_id: String,
+}
+
 pub async fn list_agents(
     Path(path): Path<WorkspacePath>,
     State(state): State<AppState>,
@@ -170,3 +180,63 @@ pub async fn archive_agent(
         .await?;
     Ok(Json(json!(updated)))
 }
+
+pub async fn list_agent_platform_api_keys(
+    Path(path): Path<WorkspaceAgentPath>,
+    State(state): State<AppState>,
+) -> Result<Json<Value>, ApiError> {
+    let items = state
+        .service
+        .list_agent_platform_api_keys(
+            &path.workspace_id.as_str().into(),
+            &path.agent_id.as_str().into(),
+        )
+        .await?;
+    Ok(Json(json!({ "items": items })))
+}
+
+pub async fn create_agent_platform_api_key(
+    Path(path): Path<WorkspaceAgentPath>,
+    State(state): State<AppState>,
+    Json(payload): Json<PlatformApiKeyPayload>,
+) -> Result<Json<Value>, ApiError> {
+    let created = state
+        .service
+        .create_agent_platform_api_key(
+            &path.workspace_id.as_str().into(),
+            &path.agent_id.as_str().into(),
+            payload,
+        )
+        .await?;
+    Ok(Json(json!(created)))
+}
+
+pub async fn revoke_agent_platform_api_key(
+    Path(path): Path<WorkspaceAgentPlatformApiKeyPath>,
+    State(state): State<AppState>,
+) -> Result<axum::http::StatusCode, ApiError> {
+    state
+        .service
+        .revoke_agent_platform_api_key(
+            &path.workspace_id.as_str().into(),
+            &path.agent_id.as_str().into(),
+            &path.key_id.as_str().into(),
+        )
+        .await?;
+    Ok(axum::http::StatusCode::NO_CONTENT)
+}
+
+pub async fn delete_agent_platform_api_key(
+    Path(path): Path<WorkspaceAgentPlatformApiKeyPath>,
+    State(state): State<AppState>,
+) -> Result<axum::http::StatusCode, ApiError> {
+    state
+        .service
+        .delete_agent_platform_api_key(
+            &path.workspace_id.as_str().into(),
+            &path.agent_id.as_str().into(),
+            &path.key_id.as_str().into(),
+        )
+        .await?;
+    Ok(axum::http::StatusCode::NO_CONTENT)
+}