@kuadrant/kuadrant-backstage-plugin-backend 0.0.1-test.1-d62c1cdb → 0.0.1-test.1-464d7760

package/dist/router.cjs.js

@@ -9,6 +9,7 @@ var Router = require('express-promise-router');
 var cors = require('cors');
 var crypto = require('crypto');
 var k8sClient = require('./k8s-client.cjs.js');
+var alpha = require('./alpha.cjs.js');
 var permissions = require('./permissions.cjs.js');
 
 function _interopDefaultCompat (e) { return e && typeof e === 'object' && 'default' in e ? e : { default: e }; }
@@ -21,45 +22,19 @@ function generateApiKey() {
   return crypto.randomBytes(32).toString("hex");
 }
 async function getUserIdentity(req, httpAuth, userInfo) {
-  try {
-    const credentials = await httpAuth.credentials(req, { allow: ["user", "none"] });
-    if (!credentials || !credentials.principal || credentials.principal.type === "none") {
-      console.log("no user credentials, treating as guest api owner");
-      return {
-        userId: "guest",
-        isPlatformEngineer: false,
-        isApiOwner: true,
-        // allow guest as api owner in development
-        isApiConsumer: true,
-        groups: []
-      };
-    }
-    const info = await userInfo.getUserInfo(credentials);
-    const userId = info.userEntityRef.split("/")[1] || "guest";
-    const groups = info.ownershipEntityRefs || [];
-    const isPlatformEngineer = userId === "guest" || groups.some(
-      (ref) => ref === "group:default/platform-engineers" || ref === "group:default/platform-admins"
-    );
-    const isApiOwner = userId === "guest" || groups.some(
-      (ref) => ref === "group:default/api-owners" || ref === "group:default/app-developers"
-    );
-    const isApiConsumer = groups.some(
-      (ref) => ref === "group:default/api-consumers"
-    );
-    console.log(`user identity resolved: userId=${userId}, isPlatformEngineer=${isPlatformEngineer}, isApiOwner=${isApiOwner}, isApiConsumer=${isApiConsumer}, groups=${groups.join(",")}`);
-    return { userId, isPlatformEngineer, isApiOwner, isApiConsumer, groups };
-  } catch (error) {
-    const errorMsg = error instanceof Error ? error.message : String(error);
-    console.warn(`failed to get user identity, defaulting to guest api owner: ${errorMsg}`);
-    return {
-      userId: "guest",
-      isPlatformEngineer: false,
-      isApiOwner: true,
-      // allow guest as api owner in development
-      isApiConsumer: true,
-      groups: []
-    };
+  const credentials = await httpAuth.credentials(req);
+  if (!credentials || !credentials.principal) {
+    throw new errors.NotAllowedError("authentication required");
   }
+  const info = await userInfo.getUserInfo(credentials);
+  const userId = info.userEntityRef.split("/")[1];
+  const groups = info.ownershipEntityRefs || [];
+  console.log(`user identity resolved: userId=${userId}, userEntityRef=${info.userEntityRef}, groups=${groups.join(",")}`);
+  return {
+    userId,
+    userEntityRef: info.userEntityRef,
+    groups
+  };
 }
 async function createRouter({
   httpAuth,
@@ -129,30 +104,42 @@ async function createRouter({
       }
       const { userId } = await getUserIdentity(req, httpAuth, userInfo);
       const apiProduct = req.body;
-      const namespace = apiProduct.metadata?.namespace;
-      const planPolicyRef = apiProduct.spec?.planPolicyRef;
-      if (!namespace) {
-        throw new errors.InputError("namespace is required in metadata");
-      }
-      if (!planPolicyRef?.name || !planPolicyRef?.namespace) {
-        throw new errors.InputError("planPolicyRef with name and namespace is required");
-      }
-      const planPolicy = await k8sClient$1.getCustomResource(
-        "extensions.kuadrant.io",
-        "v1alpha1",
-        planPolicyRef.namespace,
-        "planpolicies",
-        planPolicyRef.name
-      );
-      const plans = planPolicy.spec?.plans || [];
-      if (plans.length === 0) {
-        throw new errors.InputError("selected planpolicy has no plans defined");
+      const targetRef = apiProduct.spec?.targetRef;
+      if (!targetRef?.name || !targetRef?.kind || !targetRef?.namespace) {
+        throw new errors.InputError("targetRef with name, kind, and namespace is required");
       }
-      apiProduct.spec.plans = plans;
+      const namespace = targetRef.namespace;
+      apiProduct.metadata.namespace = namespace;
       if (!apiProduct.spec.contact) {
         apiProduct.spec.contact = {};
       }
       apiProduct.spec.contact.team = `user:default/${userId}`;
+      const httpRouteNamespace = namespace;
+      const httpRouteName = targetRef.name;
+      try {
+        const planPoliciesResponse = await k8sClient$1.listCustomResources(
+          "extensions.kuadrant.io",
+          "v1alpha1",
+          "planpolicies",
+          httpRouteNamespace
+        );
+        const planPolicy = (planPoliciesResponse.items || []).find((pp) => {
+          const ref = pp.spec?.targetRef;
+          return ref?.kind === "HTTPRoute" && ref?.name === httpRouteName && (!ref?.namespace || ref?.namespace === httpRouteNamespace);
+        });
+        if (planPolicy && planPolicy.spec?.plans) {
+          apiProduct.spec.plans = planPolicy.spec.plans.map((plan) => ({
+            tier: plan.tier,
+            description: plan.description,
+            limits: plan.limits
+          }));
+          console.log(`copied ${apiProduct.spec.plans.length} plans from planpolicy ${planPolicy.metadata.name}`);
+        } else {
+          console.log(`no planpolicy found for httproute ${httpRouteNamespace}/${httpRouteName}`);
+        }
+      } catch (error) {
+        console.warn("failed to populate plans from planpolicy:", error);
+      }
       const created = await k8sClient$1.createCustomResource(
         "extensions.kuadrant.io",
         "v1alpha1",
@@ -160,6 +147,10 @@ async function createRouter({
         "apiproducts",
         apiProduct
       );
+      const provider = alpha.getAPIProductEntityProvider();
+      if (provider) {
+        await provider.refresh();
+      }
       res.status(201).json(created);
     } catch (error) {
       console.error("error creating apiproduct:", error);
@@ -191,6 +182,10 @@ async function createRouter({
         "apiproducts",
         name
       );
+      const provider = alpha.getAPIProductEntityProvider();
+      if (provider) {
+        await provider.refresh();
+      }
       res.status(204).send();
     } catch (error) {
       console.error("error deleting apiproduct:", error);
@@ -201,125 +196,133 @@ async function createRouter({
       }
     }
   });
-  router.get("/planpolicies", async (req, res) => {
+  router.get("/httproutes", async (req, res) => {
     try {
       const credentials = await httpAuth.credentials(req);
       const decision = await permissions$1.authorize(
-        [{ permission: permissions.kuadrantPlanPolicyListPermission }],
+        [{ permission: permissions.kuadrantApiProductListPermission }],
         { credentials }
       );
       if (decision[0].result !== pluginPermissionCommon.AuthorizeResult.ALLOW) {
         throw new errors.NotAllowedError("unauthorised");
       }
-      const data = await k8sClient$1.listCustomResources("extensions.kuadrant.io", "v1alpha1", "planpolicies");
-      const filtered = {
-        items: (data.items || []).map((policy) => ({
-          metadata: {
-            name: policy.metadata.name,
-            namespace: policy.metadata.namespace
-          }
-        }))
-      };
-      res.json(filtered);
+      const data = await k8sClient$1.listCustomResources("gateway.networking.k8s.io", "v1", "httproutes");
+      res.json(data);
     } catch (error) {
-      console.error("error fetching planpolicies:", error);
+      console.error("error fetching httproutes:", error);
       if (error instanceof errors.NotAllowedError) {
         res.status(403).json({ error: error.message });
       } else {
-        res.status(500).json({ error: "failed to fetch planpolicies" });
+        res.status(500).json({ error: "failed to fetch httproutes" });
       }
     }
   });
-  router.get("/planpolicies/:namespace/:name", async (req, res) => {
+  router.patch("/apiproducts/:namespace/:name", async (req, res) => {
+    const patchSchema = zod.z.object({
+      spec: zod.z.object({
+        displayName: zod.z.string().optional(),
+        description: zod.z.string().optional(),
+        version: zod.z.string().optional(),
+        publishStatus: zod.z.enum(["Draft", "Published"]).optional(),
+        approvalMode: zod.z.enum(["automatic", "manual"]).optional(),
+        tags: zod.z.array(zod.z.string()).optional(),
+        contact: zod.z.object({
+          email: zod.z.string().optional(),
+          team: zod.z.string().optional(),
+          slack: zod.z.string().optional()
+        }).partial().optional(),
+        documentation: zod.z.object({
+          docsURL: zod.z.string().optional(),
+          openAPISpec: zod.z.string().optional()
+        }).partial().optional()
+      }).partial()
+    });
+    const parsed = patchSchema.safeParse(req.body);
+    if (!parsed.success) {
+      return res.status(400).json({ error: "invalid patch: " + parsed.error.toString() });
+    }
     try {
       const credentials = await httpAuth.credentials(req);
+      if (!credentials || !credentials.principal) {
+        throw new errors.NotAllowedError("authentication required");
+      }
       const decision = await permissions$1.authorize(
-        [{ permission: permissions.kuadrantPlanPolicyReadPermission }],
+        [{ permission: permissions.kuadrantApiProductUpdatePermission }],
         { credentials }
       );
       if (decision[0].result !== pluginPermissionCommon.AuthorizeResult.ALLOW) {
         throw new errors.NotAllowedError("unauthorised");
       }
       const { namespace, name } = req.params;
-      const data = await k8sClient$1.getCustomResource("extensions.kuadrant.io", "v1alpha1", namespace, "planpolicies", name);
-      res.json(data);
+      const updated = await k8sClient$1.patchCustomResource(
+        "extensions.kuadrant.io",
+        "v1alpha1",
+        namespace,
+        "apiproducts",
+        name,
+        parsed.data
+      );
+      return res.json(updated);
     } catch (error) {
-      console.error("error fetching planpolicy:", error);
+      console.error("error updating apiproduct:", error);
+      const errorMessage = error instanceof Error ? error.message : String(error);
       if (error instanceof errors.NotAllowedError) {
-        res.status(403).json({ error: error.message });
+        return res.status(403).json({ error: error.message });
+      } else if (error instanceof errors.InputError) {
+        return res.status(400).json({ error: error.message });
       } else {
-        res.status(500).json({ error: "failed to fetch planpolicy" });
+        return res.status(500).json({ error: errorMessage });
       }
     }
   });
-  router.get("/apikeys", async (req, res) => {
+  router.get("/planpolicies", async (req, res) => {
     try {
       const credentials = await httpAuth.credentials(req);
-      const userId = req.query.userId;
-      const namespace = req.query.namespace;
-      if (!namespace) {
-        throw new errors.InputError("namespace query parameter is required");
-      }
-      const permission = userId ? permissions.kuadrantApiKeyReadOwnPermission : permissions.kuadrantApiKeyReadAllPermission;
       const decision = await permissions$1.authorize(
-        [{ permission }],
+        [{ permission: permissions.kuadrantPlanPolicyListPermission }],
         { credentials }
       );
       if (decision[0].result !== pluginPermissionCommon.AuthorizeResult.ALLOW) {
         throw new errors.NotAllowedError("unauthorised");
       }
-      const data = await k8sClient$1.listSecrets(namespace);
-      let filteredItems = data.items || [];
-      if (userId) {
-        filteredItems = filteredItems.filter(
-          (secret) => secret.metadata?.annotations?.["secret.kuadrant.io/user-id"] === userId
-        );
-      }
-      filteredItems = filteredItems.filter(
-        (secret) => secret.metadata?.annotations?.["secret.kuadrant.io/user-id"]
-      );
-      res.json({ items: filteredItems });
+      const data = await k8sClient$1.listCustomResources("extensions.kuadrant.io", "v1alpha1", "planpolicies");
+      const filtered = {
+        items: (data.items || []).map((policy) => ({
+          metadata: {
+            name: policy.metadata.name,
+            namespace: policy.metadata.namespace
+          }
+        }))
+      };
+      res.json(filtered);
     } catch (error) {
-      console.error("error fetching api keys:", error);
+      console.error("error fetching planpolicies:", error);
       if (error instanceof errors.NotAllowedError) {
         res.status(403).json({ error: error.message });
       } else {
-        res.status(500).json({ error: "failed to fetch api keys" });
+        res.status(500).json({ error: "failed to fetch planpolicies" });
       }
     }
   });
-  router.delete("/apikeys/:namespace/:name", async (req, res) => {
+  router.get("/planpolicies/:namespace/:name", async (req, res) => {
     try {
       const credentials = await httpAuth.credentials(req);
-      const { userId } = await getUserIdentity(req, httpAuth, userInfo);
-      const { namespace, name } = req.params;
-      const secret = await k8sClient$1.getSecret(namespace, name);
-      const secretUserId = secret.metadata?.annotations?.["secret.kuadrant.io/user-id"];
-      const deleteAllDecision = await permissions$1.authorize(
-        [{ permission: permissions.kuadrantApiKeyDeleteAllPermission }],
+      const decision = await permissions$1.authorize(
+        [{ permission: permissions.kuadrantPlanPolicyReadPermission }],
         { credentials }
       );
-      const canDeleteAll = deleteAllDecision[0].result === pluginPermissionCommon.AuthorizeResult.ALLOW;
-      if (!canDeleteAll) {
-        const deleteOwnDecision = await permissions$1.authorize(
-          [{ permission: permissions.kuadrantApiKeyDeleteOwnPermission }],
-          { credentials }
-        );
-        if (deleteOwnDecision[0].result !== pluginPermissionCommon.AuthorizeResult.ALLOW) {
-          throw new errors.NotAllowedError("unauthorised");
-        }
-        if (secretUserId !== userId) {
-          throw new errors.NotAllowedError("you can only delete your own api keys");
-        }
+      if (decision[0].result !== pluginPermissionCommon.AuthorizeResult.ALLOW) {
+        throw new errors.NotAllowedError("unauthorised");
       }
-      await k8sClient$1.deleteSecret(namespace, name);
-      res.status(204).send();
+      const { namespace, name } = req.params;
+      const data = await k8sClient$1.getCustomResource("extensions.kuadrant.io", "v1alpha1", namespace, "planpolicies", name);
+      res.json(data);
     } catch (error) {
-      console.error("error deleting api key:", error);
+      console.error("error fetching planpolicy:", error);
       if (error instanceof errors.NotAllowedError) {
         res.status(403).json({ error: error.message });
       } else {
-        res.status(500).json({ error: "failed to delete api key" });
+        res.status(500).json({ error: "failed to fetch planpolicy" });
       }
     }
   });
@@ -328,9 +331,7 @@ async function createRouter({
     apiNamespace: zod.z.string(),
     planTier: zod.z.string(),
     useCase: zod.z.string().optional(),
-    userId: zod.z.string(),
-    userEmail: zod.z.string().optional(),
-    namespace: zod.z.string()
+    userEmail: zod.z.string().optional()
   });
   router.post("/requests", async (req, res) => {
     const parsed = requestSchema.safeParse(req.body);
@@ -339,7 +340,8 @@ async function createRouter({
     }
     try {
       const credentials = await httpAuth.credentials(req);
-      const { apiName, apiNamespace, planTier, useCase, userId, userEmail, namespace } = parsed.data;
+      const { apiName, apiNamespace, planTier, useCase, userEmail } = parsed.data;
+      const { userId } = await getUserIdentity(req, httpAuth, userInfo);
       const resourceRef = `apiproduct:${apiNamespace}/${apiName}`;
       const decision = await permissions$1.authorize(
         [{
@@ -351,11 +353,6 @@ async function createRouter({
       if (decision[0].result !== pluginPermissionCommon.AuthorizeResult.ALLOW) {
         throw new errors.NotAllowedError(`not authorised to request access to ${apiName}`);
       }
-      const { userId: authenticatedUserId, isPlatformEngineer, isApiOwner } = await getUserIdentity(req, httpAuth, userInfo);
-      const canCreateForOthers = isPlatformEngineer || isApiOwner;
-      if (!canCreateForOthers && userId !== authenticatedUserId) {
-        throw new errors.NotAllowedError("you can only create api key requests for yourself");
-      }
       const timestamp = (/* @__PURE__ */ new Date()).toISOString();
       const randomSuffix = crypto.randomBytes(4).toString("hex");
       const requestName = `${userId}-${apiName}-${randomSuffix}`.toLowerCase().replace(/[^a-z0-9-]/g, "-");
@@ -368,7 +365,7 @@ async function createRouter({
         kind: "APIKeyRequest",
         metadata: {
           name: requestName,
-          namespace
+          namespace: apiNamespace
         },
         spec: {
           apiName,
@@ -382,7 +379,7 @@ async function createRouter({
       const created = await k8sClient$1.createCustomResource(
         "extensions.kuadrant.io",
         "v1alpha1",
-        namespace,
+        apiNamespace,
         "apikeyrequests",
         request
       );
@@ -452,7 +449,7 @@ async function createRouter({
           await k8sClient$1.patchCustomResourceStatus(
             "extensions.kuadrant.io",
             "v1alpha1",
-            namespace,
+            apiNamespace,
             "apikeyrequests",
             requestName,
             status
@@ -516,11 +513,8 @@ async function createRouter({
       if (decision[0].result !== pluginPermissionCommon.AuthorizeResult.ALLOW) {
         throw new errors.NotAllowedError("unauthorised");
       }
-      const userId = req.query.userId;
+      const { userId } = await getUserIdentity(req, httpAuth, userInfo);
       const namespace = req.query.namespace;
-      if (!userId) {
-        throw new errors.InputError("userId query parameter is required");
-      }
       let data;
       if (namespace) {
         data = await k8sClient$1.listCustomResources("extensions.kuadrant.io", "v1alpha1", "apikeyrequests", namespace);
@@ -549,24 +543,14 @@ async function createRouter({
       throw new errors.InputError(parsed.error.toString());
     }
     try {
-      const { userId, isApiOwner } = await getUserIdentity(req, httpAuth, userInfo);
-      let canApprove = isApiOwner;
-      if (!canApprove) {
-        try {
-          const credentials = await httpAuth.credentials(req, { allow: ["none"] });
-          if (credentials) {
-            const decision = await permissions$1.authorize(
-              [{ permission: permissions.kuadrantApiKeyRequestUpdatePermission }],
-              { credentials }
-            );
-            canApprove = decision[0].result === pluginPermissionCommon.AuthorizeResult.ALLOW;
-          }
-        } catch (error) {
-          console.warn("permission check failed, using group-based authorization:", error);
-        }
-      }
-      if (!canApprove) {
-        throw new errors.NotAllowedError("you do not have permission to approve api key requests");
+      const credentials = await httpAuth.credentials(req);
+      const { userId } = await getUserIdentity(req, httpAuth, userInfo);
+      const decision = await permissions$1.authorize(
+        [{ permission: permissions.kuadrantApiKeyRequestUpdatePermission }],
+        { credentials }
+      );
+      if (decision[0].result !== pluginPermissionCommon.AuthorizeResult.ALLOW) {
+        throw new errors.NotAllowedError("unauthorised");
       }
       const { namespace, name } = req.params;
       const { comment } = parsed.data;
@@ -684,24 +668,14 @@ async function createRouter({
       throw new errors.InputError(parsed.error.toString());
     }
     try {
-      const { userId, isApiOwner } = await getUserIdentity(req, httpAuth, userInfo);
-      let canReject = isApiOwner;
-      if (!canReject) {
-        try {
-          const credentials = await httpAuth.credentials(req, { allow: ["none"] });
-          if (credentials) {
-            const decision = await permissions$1.authorize(
-              [{ permission: permissions.kuadrantApiKeyRequestUpdatePermission }],
-              { credentials }
-            );
-            canReject = decision[0].result === pluginPermissionCommon.AuthorizeResult.ALLOW;
-          }
-        } catch (error) {
-          console.warn("permission check failed, using group-based authorization:", error);
-        }
-      }
-      if (!canReject) {
-        throw new errors.NotAllowedError("you do not have permission to reject api key requests");
+      const credentials = await httpAuth.credentials(req);
+      const { userId } = await getUserIdentity(req, httpAuth, userInfo);
+      const decision = await permissions$1.authorize(
+        [{ permission: permissions.kuadrantApiKeyRequestUpdatePermission }],
+        { credentials }
+      );
+      if (decision[0].result !== pluginPermissionCommon.AuthorizeResult.ALLOW) {
+        throw new errors.NotAllowedError("unauthorised");
       }
       const { namespace, name } = req.params;
       const { comment } = parsed.data;
@@ -743,24 +717,14 @@ async function createRouter({
       throw new errors.InputError(parsed.error.toString());
     }
     try {
-      const { userId, isApiOwner } = await getUserIdentity(req, httpAuth, userInfo);
-      let canApprove = isApiOwner;
-      if (!canApprove) {
-        try {
-          const credentials = await httpAuth.credentials(req, { allow: ["none"] });
-          if (credentials) {
-            const decision = await permissions$1.authorize(
-              [{ permission: permissions.kuadrantApiKeyRequestUpdatePermission }],
-              { credentials }
-            );
-            canApprove = decision[0].result === pluginPermissionCommon.AuthorizeResult.ALLOW;
-          }
-        } catch (error) {
-          console.warn("permission check failed, using group-based authorization:", error);
-        }
-      }
-      if (!canApprove) {
-        throw new errors.NotAllowedError("you do not have permission to approve api key requests");
+      const credentials = await httpAuth.credentials(req);
+      const { userId } = await getUserIdentity(req, httpAuth, userInfo);
+      const decision = await permissions$1.authorize(
+        [{ permission: permissions.kuadrantApiKeyRequestUpdatePermission }],
+        { credentials }
+      );
+      if (decision[0].result !== pluginPermissionCommon.AuthorizeResult.ALLOW) {
+        throw new errors.NotAllowedError("unauthorised");
       }
       const { requests, comment } = parsed.data;
       const reviewedBy = `user:default/${userId}`;
@@ -891,24 +855,14 @@ async function createRouter({
       throw new errors.InputError(parsed.error.toString());
     }
     try {
-      const { userId, isApiOwner } = await getUserIdentity(req, httpAuth, userInfo);
-      let canReject = isApiOwner;
-      if (!canReject) {
-        try {
-          const credentials = await httpAuth.credentials(req, { allow: ["none"] });
-          if (credentials) {
-            const decision = await permissions$1.authorize(
-              [{ permission: permissions.kuadrantApiKeyRequestUpdatePermission }],
-              { credentials }
-            );
-            canReject = decision[0].result === pluginPermissionCommon.AuthorizeResult.ALLOW;
-          }
-        } catch (error) {
-          console.warn("permission check failed, using group-based authorization:", error);
-        }
-      }
-      if (!canReject) {
-        throw new errors.NotAllowedError("you do not have permission to reject api key requests");
+      const credentials = await httpAuth.credentials(req);
+      const { userId } = await getUserIdentity(req, httpAuth, userInfo);
+      const decision = await permissions$1.authorize(
+        [{ permission: permissions.kuadrantApiKeyRequestUpdatePermission }],
+        { credentials }
+      );
+      if (decision[0].result !== pluginPermissionCommon.AuthorizeResult.ALLOW) {
+        throw new errors.NotAllowedError("unauthorised");
       }
       const { requests, comment } = parsed.data;
       const reviewedBy = `user:default/${userId}`;
@@ -952,7 +906,8 @@ async function createRouter({
   });
   router.delete("/requests/:namespace/:name", async (req, res) => {
     try {
-      const { userId, isPlatformEngineer, isApiOwner } = await getUserIdentity(req, httpAuth, userInfo);
+      const credentials = await httpAuth.credentials(req);
+      const { userId } = await getUserIdentity(req, httpAuth, userInfo);
       const { namespace, name } = req.params;
       const request = await k8sClient$1.getCustomResource(
         "extensions.kuadrant.io",
@@ -962,9 +917,22 @@ async function createRouter({
         name
       );
       const requestUserId = request.spec?.requestedBy?.userId;
-      const canDeleteAll = isPlatformEngineer || isApiOwner;
-      if (!canDeleteAll && requestUserId !== userId) {
-        throw new errors.NotAllowedError("you can only delete your own api key requests");
+      const deleteAllDecision = await permissions$1.authorize(
+        [{ permission: permissions.kuadrantApiKeyRequestDeleteAllPermission }],
+        { credentials }
+      );
+      const canDeleteAll = deleteAllDecision[0].result === pluginPermissionCommon.AuthorizeResult.ALLOW;
+      if (!canDeleteAll) {
+        const deleteOwnDecision = await permissions$1.authorize(
+          [{ permission: permissions.kuadrantApiKeyRequestDeleteOwnPermission }],
+          { credentials }
+        );
+        if (deleteOwnDecision[0].result !== pluginPermissionCommon.AuthorizeResult.ALLOW) {
+          throw new errors.NotAllowedError("unauthorised");
+        }
+        if (requestUserId !== userId) {
+          throw new errors.NotAllowedError("you can only delete your own api key requests");
+        }
       }
       if (request.status?.phase === "Approved") {
         try {
@@ -1001,30 +969,57 @@ async function createRouter({
     }
   });
   router.patch("/requests/:namespace/:name", async (req, res) => {
+    const patchSchema = zod.z.object({
+      spec: zod.z.object({
+        useCase: zod.z.string().optional()
+      }).partial()
+    });
+    const parsed = patchSchema.safeParse(req.body);
+    if (!parsed.success) {
+      throw new errors.InputError("invalid patch: " + parsed.error.toString());
+    }
     try {
       const credentials = await httpAuth.credentials(req);
-      const decision = await permissions$1.authorize(
+      const { userId } = await getUserIdentity(req, httpAuth, userInfo);
+      const { namespace, name } = req.params;
+      const existing = await k8sClient$1.getCustomResource(
+        "extensions.kuadrant.io",
+        "v1alpha1",
+        namespace,
+        "apikeyrequests",
+        name
+      );
+      const updateAllDecision = await permissions$1.authorize(
         [{ permission: permissions.kuadrantApiKeyRequestUpdatePermission }],
         { credentials }
       );
-      if (decision[0].result !== pluginPermissionCommon.AuthorizeResult.ALLOW) {
-        throw new errors.NotAllowedError("unauthorised");
+      if (updateAllDecision[0].result !== pluginPermissionCommon.AuthorizeResult.ALLOW) {
+        const updateOwnDecision = await permissions$1.authorize(
+          [{ permission: permissions.kuadrantApiKeyRequestUpdateOwnPermission }],
+          { credentials }
+        );
+        if (updateOwnDecision[0].result !== pluginPermissionCommon.AuthorizeResult.ALLOW) {
+          throw new errors.NotAllowedError("unauthorised");
+        }
+        if (existing.spec?.requestedBy?.userId !== userId) {
+          throw new errors.NotAllowedError("you can only update your own api key requests");
+        }
       }
-      const { namespace, name } = req.params;
-      const patch = req.body;
       const updated = await k8sClient$1.patchCustomResource(
         "extensions.kuadrant.io",
         "v1alpha1",
         namespace,
         "apikeyrequests",
         name,
-        patch
+        parsed.data
       );
       res.json(updated);
     } catch (error) {
       console.error("error updating api key request:", error);
       if (error instanceof errors.NotAllowedError) {
         res.status(403).json({ error: error.message });
+      } else if (error instanceof errors.InputError) {
+        res.status(400).json({ error: error.message });
       } else {
         res.status(500).json({ error: "failed to update api key request" });
       }