feat(auth): API key groups with model-level permissions

[herjarsa]

Team access control:\n- Groups with model-level permissions (wildcard patterns, deny-override)\n- API keys inherit restrictions from group membership\n- DB migration 065 with full CRUD API

[kilo-code-bot]

Kilo Code Review could not run — your account is out of credits.

Add credits or switch to a free model to enable reviews on this change.

[gemini-code-assist]

Code Review

This pull request introduces a robust API key grouping and model-level authorization system, including new database migrations, a service layer, and several API routes for managing groups and permissions. The code review highlights a critical security concern regarding potential ReDoS vulnerabilities in regex-based pattern matching and identifies several violations of the repository's style guide concerning mandatory Zod-based input validation. Furthermore, feedback was provided to optimize database query performance and improve TypeScript type safety by replacing 'any' casts with specific interfaces.

[gemini-code-assist]

Using new RegExp with a pattern derived from user or operator input is a security risk as it can lead to Regular Expression Denial of Service (ReDoS) attacks. A malicious pattern like *a*a*a*a*a*a*a*a*a*a*b can cause exponential backtracking.

I recommend reusing the matchesWildcardPattern function already implemented in src/lib/db/apiKeys.ts, which was specifically designed to avoid this vulnerability by using a deterministic token-based matching approach. You should move that function to a shared utility file (e.g., src/shared/utils/patterns.ts) so both modules can use it safely.

[gemini-code-assist]

The input validation here is performed manually. According to the Repository Style Guide (Rule 8), all inputs should be validated using Zod schemas from src/shared/validation/schemas.ts. This ensures consistent validation logic and better type safety across the API.

References

1. Always validate inputs with Zod schemas from src/shared/validation/schemas.ts. ^(link)

[gemini-code-assist]

Manual input validation detected. Please use a Zod schema for validating the request body, as required by the Repository Style Guide (Rule 8).

References

1. Always validate inputs with Zod schemas from src/shared/validation/schemas.ts. ^(link)

[gemini-code-assist]

This line is inefficient. It fetches all permissions for a group and then performs an O(N) search in memory to find the newly created permission. Since you already have the id, it would be much more efficient to fetch the specific permission by its ID using a direct SQL query.

  const row = db.prepare("SELECT * FROM group_model_permissions WHERE id = ?").get(id);
  return rowToPermission(row);

[gemini-code-assist]

Casting the database instance to any bypasses TypeScript's type checking. It is better to use a specific interface for the database instance, similar to how ApiKeysDbLike is used in src/lib/db/apiKeys.ts. Consider exporting ApiKeysDbLike or a similar shared interface to maintain type safety across database modules.

[diegosouzapw]

Thank you! PR merged.