fix(mobile): let API keys revoke themselves

- Allow API key authentication to revoke its own key for sign out
- Prevent API keys from revoking other keys

Author: MohamedBassem

packages/trpc/routers/apiKeys.test.ts

@@ -283,6 +283,60 @@ describe("API Keys Routes", () => {
         unauthedAPICaller.apiKeys.revoke({ id: "some-id" }),
       ).rejects.toThrow(/UNAUTHORIZED/);
     });
+
+    test<CustomTestContext>("an API key can revoke itself", async ({
+      unauthedAPICaller,
+      db,
+    }) => {
+      const user = await unauthedAPICaller.users.create({
+        name: "Test User",
+        email: "test@test.com",
+        password: "password123",
+        confirmPassword: "password123",
+      });
+
+      const key = await unauthedAPICaller.apiKeys.exchange({
+        keyName: "Mobile App",
+        email: user.email,
+        password: "password123",
+      });
+      const keyCaller = await getApiKeyCallerForPlainKey(db, key.key);
+
+      await keyCaller.apiKeys.revoke({ id: key.id });
+
+      const remainingKeys = await db
+        .select()
+        .from(apiKeys)
+        .where(eq(apiKeys.id, key.id));
+      expect(remainingKeys).toHaveLength(0);
+    });
+
+    test<CustomTestContext>("an API key cannot revoke other keys", async ({
+      unauthedAPICaller,
+      db,
+    }) => {
+      const user = await unauthedAPICaller.users.create({
+        name: "Test User",
+        email: "test@test.com",
+        password: "password123",
+        confirmPassword: "password123",
+      });
+
+      const api = getApiCaller(db, user.id, user.email).apiKeys;
+      const otherKey = await api.create({ name: "Other Key" });
+      const key = await api.create({ name: "Caller Key" });
+      const keyCaller = await getApiKeyCallerForPlainKey(db, key.key);
+
+      await expect(
+        keyCaller.apiKeys.revoke({ id: otherKey.id }),
+      ).rejects.toThrow(/API keys can only revoke themselves/);
+
+      const remainingKeys = await db
+        .select()
+        .from(apiKeys)
+        .where(eq(apiKeys.id, otherKey.id));
+      expect(remainingKeys).toHaveLength(1);
+    });
   });
 
   describe("validate", () => {

packages/trpc/routers/apiKeys.ts

@@ -17,6 +17,7 @@ import {
   validatePassword,
 } from "../auth";
 import {
+  authedProcedure,
   createEventLogMiddleware,
   createRateLimitMiddleware,
   publicProcedure,
@@ -86,7 +87,10 @@ export const apiKeysAppRouter = router({
         key: await regenerateApiKey(existingKey.id, ctx.user.id, ctx.db),
       };
     }),
-  revoke: sessionProcedure
+  // Sessions can revoke any of the user's keys. An API key can only revoke
+  // itself, which is how the mobile app and the extension clean up their key
+  // on sign out.
+  revoke: authedProcedure
     .use(createEventLogMiddleware("apiKey.revoke"))
     .input(
       z.object({
@@ -95,6 +99,18 @@ export const apiKeysAppRouter = router({
     )
     .mutation(async ({ input, ctx }) => {
       addLogFields<"apiKey.revoke">({ "apiKey.id": input.id });
+      if (ctx.auth?.type === "apiKey") {
+        const key = await ctx.db.query.apiKeys.findFirst({
+          where: and(eq(apiKeys.id, input.id), eq(apiKeys.userId, ctx.user.id)),
+          columns: { keyId: true },
+        });
+        if (key?.keyId !== ctx.auth.keyId) {
+          throw new TRPCError({
+            code: "FORBIDDEN",
+            message: "API keys can only revoke themselves",
+          });
+        }
+      }
       await ctx.db
         .delete(apiKeys)
         .where(and(eq(apiKeys.id, input.id), eq(apiKeys.userId, ctx.user.id)));