feat(platform): Add api generator functions and endpoints

[Abhi1992002]

Fix #8589

This issue depends on #8585

---

These changes make it easy to create and manage API keys, so we can control who gets access and what they can do. It’s like giving out special keys that we can turn on or off anytime, keeping things secure and organized.

Changes 🏗️

• Created /api-keys endpoint to generate a new API key with custom permissions.

• Added generate_api_key function to handle API key generation and hashing.

• Built validate_api_key function to check if a provided API key is valid.

• Created DELETE /api-keys/{key_id} endpoint to revoke an API key.

• Made POST /api-keys/{key_id}/suspend and POST /api-keys/{key_id}/reactivate endpoints to suspend/reactivate keys.

• Added list_user_api_keys function to list all API keys for a user, ordered by creation date.

• Created update_api_key_permissions function to modify an existing key’s permissions.

• Defined request/response models (CreateAPIKeyRequest, CreateAPIKeyResponse) for API key handling.

• Added permission validation with has_permission function to check if a key has the required access.

---

Depends on this schema

enum APIKeyPermission {
	EXECUTE_GRAPH // Can execute agent graphs
	READ_GRAPH // Can get graph versions and details
	EXECUTE_BLOCK // Can execute individual blocks
	READ_BLOCK // Can get block information
}

model APIKey {
	id          String             @id @default(uuid())
	name        String
	prefix      String             @unique // First 8 chars for identification
	key         String             @unique // Hashed key
	status      APIKeyStatus       @default(ACTIVE)
	permissions APIKeyPermission[]

	// Core tracking fields
	createdAt  DateTime  @default(now())
	lastUsedAt DateTime?
	revokedAt  DateTime?

	// Basic metadata
	description String?

	// Relation to user
	userId String
	user   User   @relation(fields: [userId], references: [id], onDelete: Cascade)

	@@index([key])
	@@index([prefix])
	@@index([userId])
	@@index([status])
	@@index([userId, status])
}

enum APIKeyStatus {
	ACTIVE
	REVOKED
	SUSPENDED
}

[github-actions]

This PR targets the master branch but does not come from dev or a hotfix/* branch.

Automatically setting the base branch to dev.

[qodo-merge-pro]

PR-Agent was enabled for this repository. To continue using it, please link your git user with your CodiumAI identity here.

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

🎫 Ticket compliance analysis 🔶 8589 - Fully compliant Fully compliant requirements: Create function to generate and store API key (hashed) Create related endpoint for API key generation 8585 - Fully compliant Fully compliant requirements: Add permissions Enum Add API key table with hashed key Add FK relationship between user and API keys

⏱️ Estimated effort to review: 4 🔵🔵🔵🔵⚪

🧪 No relevant tests

🔒 Security concerns API Key Exposure: The plain text API key is returned in the CreateAPIKeyResponse. Consider only showing it once during creation and never storing/returning it again. Also ensure it's transmitted securely over HTTPS.

⚡ Recommended focus areas for review Security Concern The validate_api_key function should update lastUsedAt timestamp when validating a key to track key usage Code Smell The hash_api_key function decodes the hashed key back to string which is unnecessary since bcrypt output should stay as bytes Code Structure UpdatePermissionsRequest model is defined inside the route function instead of with other models at the top

[netlify]

✅ Deploy Preview for auto-gpt-docs canceled.

Name	Link
🔨 Latest commit	219719d
🔍 Latest deploy log	https://app.netlify.com/sites/auto-gpt-docs/deploys/673591131df6700008379f38

[aarushik93]

@Abhi1992002 thanks for the speedy work as usual

I have a few notes:

We don't need a salt or bcrypt as that's needed for passwords, not for API keys which should already be unique and high entropy strings. So we can use something like token_urlsafe e.g.

secrets.token_urlsafe(32)

for hashing: sha256

We also need a prefix pattern: agpt_

Lastly, in my last PR, I also added a postfix, not sure if you've seen that, would you be able to incorporate that in as well, please

[aarushik93]

Looks good, if you can just address a few minor comments and fix the linting then we can merge please

[netlify]

✅ Deploy Preview for auto-gpt-docs canceled.

Name	Link
🔨 Latest commit	c373c4c
🔍 Latest deploy log	https://app.netlify.com/sites/auto-gpt-docs/deploys/6735f8c40e363e0008828f13