feat: add identity-based credits schema and database changes

go/apps/api/routes/v2_identities_delete_identity/handler.go

@@ -71,27 +71,25 @@ func (h *Handler) Handle(ctx context.Context, s *zen.Session) error {
 		return err
 	}
 
-	results, err := db.Query.FindIdentityWithRatelimits(ctx, h.DB.RO(), db.FindIdentityWithRatelimitsParams{
+	identity, err := db.Query.FindIdentity(ctx, h.DB.RO(), db.FindIdentityParams{
 		WorkspaceID: auth.AuthorizedWorkspaceID,
 		Identity:    req.Identity,
 		Deleted:     false,
 	})
 	if err != nil {
+		if db.IsNotFound(err) {
+			return fault.New("identity not found",
+				fault.Code(codes.Data.Identity.NotFound.URN()),
+				fault.Internal("identity not found"), fault.Public("This identity does not exist."),
+			)
+		}
+
 		return fault.Wrap(err,
 			fault.Code(codes.App.Internal.ServiceUnavailable.URN()),
 			fault.Internal("database failed to find the identity"), fault.Public("Error finding the identity."),
 		)
 	}
 
-	if len(results) == 0 {
-		return fault.New("identity not found",
-			fault.Code(codes.Data.Identity.NotFound.URN()),
-			fault.Internal("identity not found"), fault.Public("This identity does not exist."),
-		)
-	}
-
-	identity := results[0]
-
 	// Parse ratelimits JSON
 	var ratelimits []db.RatelimitInfo
 	if ratelimitBytes, ok := identity.Ratelimits.([]byte); ok && ratelimitBytes != nil {

go/apps/api/routes/v2_identities_get_identity/handler.go

@@ -51,28 +51,26 @@ func (h *Handler) Handle(ctx context.Context, s *zen.Session) error {
 		return err
 	}
 
-	results, err := db.Query.FindIdentityWithRatelimits(ctx, h.DB.RO(), db.FindIdentityWithRatelimitsParams{
+	identity, err := db.Query.FindIdentity(ctx, h.DB.RO(), db.FindIdentityParams{
 		WorkspaceID: auth.AuthorizedWorkspaceID,
 		Identity:    req.Identity,
 		Deleted:     false,
 	})
 	if err != nil {
+		if db.IsNotFound(err) {
+			return fault.New("identity not found",
+				fault.Code(codes.Data.Identity.NotFound.URN()),
+				fault.Internal("identity not found"),
+				fault.Public("This identity does not exist."),
+			)
+		}
+
 		return fault.Wrap(err,
 			fault.Internal("unable to find identity"),
 			fault.Public("We're unable to retrieve the identity."),
 		)
 	}
 
-	if len(results) == 0 {
-		return fault.New("identity not found",
-			fault.Code(codes.Data.Identity.NotFound.URN()),
-			fault.Internal("identity not found"),
-			fault.Public("This identity does not exist."),
-		)
-	}
-
-	identity := results[0]
-
 	// Parse ratelimits JSON
 	var ratelimits []db.RatelimitInfo
 	if ratelimitBytes, ok := identity.Ratelimits.([]byte); ok && ratelimitBytes != nil {

go/apps/api/routes/v2_identities_update_identity/handler.go

@@ -113,36 +113,34 @@ func (h *Handler) Handle(ctx context.Context, s *zen.Session) error {
 	}
 
 	// Use UNION query to find identity + ratelimits in one query (fast!)
-	results, err := db.Query.FindIdentityWithRatelimits(ctx, h.DB.RO(), db.FindIdentityWithRatelimitsParams{
+	identityRow, err := db.Query.FindIdentity(ctx, h.DB.RO(), db.FindIdentityParams{
 		WorkspaceID: auth.AuthorizedWorkspaceID,
 		Identity:    req.Identity,
 		Deleted:     false,
 	})
 	if err != nil {
+		if db.IsNotFound(err) {
+			return fault.New("identity not found",
+				fault.Code(codes.Data.Identity.NotFound.URN()),
+				fault.Internal("identity not found"),
+				fault.Public("Identity not found in this workspace"),
+			)
+		}
+
 		return fault.Wrap(err,
 			fault.Internal("unable to find identity"),
 			fault.Public("We're unable to retrieve the identity."),
 		)
 	}
 
-	if len(results) == 0 {
-		return fault.New("identity not found",
-			fault.Code(codes.Data.Identity.NotFound.URN()),
-			fault.Internal("identity not found"),
-			fault.Public("Identity not found in this workspace"),
-		)
-	}
-
-	identityRow := results[0]
-
 	// Parse existing ratelimits from JSON
 	var existingRatelimits []db.RatelimitInfo
 	if ratelimitBytes, ok := identityRow.Ratelimits.([]byte); ok && ratelimitBytes != nil {
 		_ = json.Unmarshal(ratelimitBytes, &existingRatelimits) // Ignore error, default to empty array
 	}
 
 	type txResult struct {
-		identity        db.FindIdentityWithRatelimitsRow
+		identity        db.FindIdentityRow
 		finalRatelimits []openapi.RatelimitResponse
 	}
 

go/internal/services/keys/verifier.go

@@ -48,6 +48,10 @@ type KeyVerifier struct {
 	session *zen.Session // The current request session
 	region  string       // Geographic region identifier
 
+	// Credits - identity credits take priority over key credits
+	IdentityCredits *db.Credit // Identity-level credits (shared across all keys for this identity)
+	KeyCredits      *db.Credit // Key-level credits (specific to this key)
+
 	// Services
 	rateLimiter  ratelimit.Service     // Rate limiting service
 	usageLimiter usagelimiter.Service  // Usage limiting service