Add role management

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>

pkg/server/auth/create_api_key_handler.go

@@ -22,6 +22,7 @@ import (
 
 	"go.gearno.de/kit/httpserver"
 	authsvc "go.probo.inc/probo/pkg/auth"
+	"go.probo.inc/probo/pkg/authz"
 	"go.probo.inc/probo/pkg/coredata"
 	"go.probo.inc/probo/pkg/gid"
 )
@@ -44,7 +45,7 @@ type (
 	}
 )
 
-func CreateUserAPIKeyHandler(authSvc *authsvc.Service) http.HandlerFunc {
+func CreateUserAPIKeyHandler(authSvc *authsvc.Service, authzSvc *authz.Service) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		ctx := r.Context()
 		user := UserFromContext(ctx)
@@ -92,6 +93,24 @@ func CreateUserAPIKeyHandler(authSvc *authsvc.Service) http.HandlerFunc {
 				})
 				return
 			}
+
+			// Check if user is an OWNER for this organization
+			tenantAuthzSvc := authzSvc.WithTenant(orgID.TenantID())
+			role, err := tenantAuthzSvc.GetUserRoleInOrganization(ctx, user.ID, orgID)
+			if err != nil {
+				httpserver.RenderJSON(w, http.StatusForbidden, map[string]string{
+					"error": "user does not have access to this organization",
+				})
+				return
+			}
+
+			if role != coredata.MembershipRoleOwner {
+				httpserver.RenderJSON(w, http.StatusForbidden, map[string]string{
+					"error": "only owners can create API keys for this organization",
+				})
+				return
+			}
+
 			orgInputs[i] = authsvc.UserAPIKeyOrganizationRequest{
 				OrganizationID: orgID,
 				Role:           coredata.APIRole(org.Role),