arcadia-admin/app/lib/arcadia/api-keys.ts

// Arcadia per-user API key helpers (v2 multi-key path).
//
// `POST /api/v1/users/:user_id/api_keys` returns the raw key value exactly
// once — list/show endpoints only return the prefix. Callers must surface
// the value to the user immediately on create.

import type { ArcadiaClient } from "@crema/arcadia-core-client"

export interface ApiKey {
  id: string
  key_prefix: string
  description: string | null
  created_at: string
  last_used_at: string | null
  expires_at: string | null
  revoked_at: string | null
  is_active: boolean
}

export interface ApiKeyCreateInput {
  description?: string
  expires_at?: string | null
}

export interface ApiKeyCreated {
  api_key: string
  key_id: string
  key_prefix: string
  user_id: string
  description: string | null
  created_at: string
  expires_at: string | null
  warning: string
}

export async function listUserApiKeys(
  arcadia: ArcadiaClient,
  userId: string,
): Promise<ApiKey[]> {
  const res = await arcadia.GET<{ data: ApiKey[] }>(
    `/api/v1/users/${userId}/api_keys`,
  )
  return res.data
}

export async function createUserApiKey(
  arcadia: ArcadiaClient,
  userId: string,
  input: ApiKeyCreateInput,
): Promise<ApiKeyCreated> {
  const res = await arcadia.POST<{ data: ApiKeyCreated }>(
    `/api/v1/users/${userId}/api_keys`,
    { body: input },
  )
  return res.data
}

export async function revokeUserApiKey(
  arcadia: ArcadiaClient,
  userId: string,
  keyId: string,
  reason?: string,
): Promise<void> {
  await arcadia.DELETE(`/api/v1/users/${userId}/api_keys/${keyId}`, {
    body: reason ? { reason } : undefined,
  })
}