@kuadrant/kuadrant-backstage-plugin-backend 0.0.2-dev-39963ad → 0.0.2-dev-8f2e157

package/dist/router.cjs.js

@@ -21,17 +21,19 @@ var cors__default = /*#__PURE__*/_interopDefaultCompat(cors);
 function generateApiKey() {
   return crypto.randomBytes(32).toString("hex");
 }
+function extractNameFromEntityRef(entityRef) {
+  const parts = entityRef.split("/");
+  return parts[parts.length - 1];
+}
 async function getUserIdentity(req, httpAuth, userInfo) {
   const credentials = await httpAuth.credentials(req);
   if (!credentials || !credentials.principal) {
     throw new errors.NotAllowedError("authentication required");
   }
   const info = await userInfo.getUserInfo(credentials);
-  const userId = info.userEntityRef.split("/")[1];
   const groups = info.ownershipEntityRefs || [];
-  console.log(`user identity resolved: userId=${userId}, userEntityRef=${info.userEntityRef}, groups=${groups.join(",")}`);
+  console.log(`user identity resolved: userEntityRef=${info.userEntityRef}, groups=${groups.join(",")}`);
   return {
-    userId,
     userEntityRef: info.userEntityRef,
     groups
   };
@@ -52,15 +54,35 @@ async function createRouter({
   router.get("/apiproducts", async (req, res) => {
     try {
       const credentials = await httpAuth.credentials(req);
-      const decision = await permissions$1.authorize(
+      const listDecision = await permissions$1.authorize(
         [{ permission: permissions.kuadrantApiProductListPermission }],
         { credentials }
       );
-      if (decision[0].result !== pluginPermissionCommon.AuthorizeResult.ALLOW) {
+      if (listDecision[0].result !== pluginPermissionCommon.AuthorizeResult.ALLOW) {
         throw new errors.NotAllowedError("unauthorised");
       }
+      const { userEntityRef } = await getUserIdentity(req, httpAuth, userInfo);
       const data = await k8sClient$1.listCustomResources("extensions.kuadrant.io", "v1alpha1", "apiproducts");
-      res.json(data);
+      const readAllDecision = await permissions$1.authorize(
+        [{ permission: permissions.kuadrantApiProductReadAllPermission }],
+        { credentials }
+      );
+      if (readAllDecision[0].result === pluginPermissionCommon.AuthorizeResult.ALLOW) {
+        res.json(data);
+      } else {
+        const readOwnDecision = await permissions$1.authorize(
+          [{ permission: permissions.kuadrantApiProductReadOwnPermission }],
+          { credentials }
+        );
+        if (readOwnDecision[0].result !== pluginPermissionCommon.AuthorizeResult.ALLOW) {
+          throw new errors.NotAllowedError("unauthorised");
+        }
+        const ownedItems = (data.items || []).filter((item) => {
+          const owner = item.metadata?.annotations?.["backstage.io/owner"];
+          return owner === userEntityRef;
+        });
+        res.json({ ...data, items: ownedItems });
+      }
     } catch (error) {
       console.error("error fetching apiproducts:", error);
       if (error instanceof errors.NotAllowedError) {
@@ -73,16 +95,30 @@ async function createRouter({
   router.get("/apiproducts/:namespace/:name", async (req, res) => {
     try {
       const credentials = await httpAuth.credentials(req);
-      const decision = await permissions$1.authorize(
-        [{ permission: permissions.kuadrantApiProductReadPermission }],
+      const { namespace, name } = req.params;
+      const readAllDecision = await permissions$1.authorize(
+        [{ permission: permissions.kuadrantApiProductReadAllPermission }],
         { credentials }
       );
-      if (decision[0].result !== pluginPermissionCommon.AuthorizeResult.ALLOW) {
-        throw new errors.NotAllowedError("unauthorised");
+      if (readAllDecision[0].result !== pluginPermissionCommon.AuthorizeResult.ALLOW) {
+        const readOwnDecision = await permissions$1.authorize(
+          [{ permission: permissions.kuadrantApiProductReadOwnPermission }],
+          { credentials }
+        );
+        if (readOwnDecision[0].result !== pluginPermissionCommon.AuthorizeResult.ALLOW) {
+          throw new errors.NotAllowedError("unauthorised");
+        }
+        const { userEntityRef } = await getUserIdentity(req, httpAuth, userInfo);
+        const data = await k8sClient$1.getCustomResource("extensions.kuadrant.io", "v1alpha1", namespace, "apiproducts", name);
+        const owner = data.metadata?.annotations?.["backstage.io/owner"];
+        if (owner !== userEntityRef) {
+          throw new errors.NotAllowedError("you can only read your own api products");
+        }
+        res.json(data);
+      } else {
+        const data = await k8sClient$1.getCustomResource("extensions.kuadrant.io", "v1alpha1", namespace, "apiproducts", name);
+        res.json(data);
       }
-      const { namespace, name } = req.params;
-      const data = await k8sClient$1.getCustomResource("extensions.kuadrant.io", "v1alpha1", namespace, "apiproducts", name);
-      res.json(data);
     } catch (error) {
       console.error("error fetching apiproduct:", error);
       if (error instanceof errors.NotAllowedError) {
@@ -102,7 +138,7 @@ async function createRouter({
       if (decision[0].result !== pluginPermissionCommon.AuthorizeResult.ALLOW) {
         throw new errors.NotAllowedError("unauthorised");
       }
-      const { userId } = await getUserIdentity(req, httpAuth, userInfo);
+      const { userEntityRef } = await getUserIdentity(req, httpAuth, userInfo);
       const apiProduct = req.body;
       const targetRef = apiProduct.spec?.targetRef;
       if (!targetRef?.name || !targetRef?.kind || !targetRef?.namespace) {
@@ -110,10 +146,10 @@ async function createRouter({
       }
       const namespace = targetRef.namespace;
       apiProduct.metadata.namespace = namespace;
-      if (!apiProduct.spec.contact) {
-        apiProduct.spec.contact = {};
+      if (!apiProduct.metadata.annotations) {
+        apiProduct.metadata.annotations = {};
       }
-      apiProduct.spec.contact.team = `user:default/${userId}`;
+      apiProduct.metadata.annotations["backstage.io/owner"] = userEntityRef;
       const httpRouteNamespace = namespace;
       const httpRouteName = targetRef.name;
       try {
@@ -167,14 +203,26 @@ async function createRouter({
   router.delete("/apiproducts/:namespace/:name", async (req, res) => {
     try {
       const credentials = await httpAuth.credentials(req);
-      const decision = await permissions$1.authorize(
-        [{ permission: permissions.kuadrantApiProductDeletePermission }],
+      const { namespace, name } = req.params;
+      const deleteAllDecision = await permissions$1.authorize(
+        [{ permission: permissions.kuadrantApiProductDeleteAllPermission }],
         { credentials }
       );
-      if (decision[0].result !== pluginPermissionCommon.AuthorizeResult.ALLOW) {
-        throw new errors.NotAllowedError("unauthorised");
+      if (deleteAllDecision[0].result !== pluginPermissionCommon.AuthorizeResult.ALLOW) {
+        const deleteOwnDecision = await permissions$1.authorize(
+          [{ permission: permissions.kuadrantApiProductDeleteOwnPermission }],
+          { credentials }
+        );
+        if (deleteOwnDecision[0].result !== pluginPermissionCommon.AuthorizeResult.ALLOW) {
+          throw new errors.NotAllowedError("unauthorised");
+        }
+        const { userEntityRef } = await getUserIdentity(req, httpAuth, userInfo);
+        const existing = await k8sClient$1.getCustomResource("extensions.kuadrant.io", "v1alpha1", namespace, "apiproducts", name);
+        const owner = existing.metadata?.annotations?.["backstage.io/owner"];
+        if (owner !== userEntityRef) {
+          throw new errors.NotAllowedError("you can only delete your own api products");
+        }
       }
-      const { namespace, name } = req.params;
       await k8sClient$1.deleteCustomResource(
         "extensions.kuadrant.io",
         "v1alpha1",
@@ -246,14 +294,29 @@ async function createRouter({
       if (!credentials || !credentials.principal) {
         throw new errors.NotAllowedError("authentication required");
       }
-      const decision = await permissions$1.authorize(
-        [{ permission: permissions.kuadrantApiProductUpdatePermission }],
+      const { namespace, name } = req.params;
+      const updateAllDecision = await permissions$1.authorize(
+        [{ permission: permissions.kuadrantApiProductUpdateAllPermission }],
         { credentials }
       );
-      if (decision[0].result !== pluginPermissionCommon.AuthorizeResult.ALLOW) {
-        throw new errors.NotAllowedError("unauthorised");
+      if (updateAllDecision[0].result !== pluginPermissionCommon.AuthorizeResult.ALLOW) {
+        const updateOwnDecision = await permissions$1.authorize(
+          [{ permission: permissions.kuadrantApiProductUpdateOwnPermission }],
+          { credentials }
+        );
+        if (updateOwnDecision[0].result !== pluginPermissionCommon.AuthorizeResult.ALLOW) {
+          throw new errors.NotAllowedError("unauthorised");
+        }
+        const { userEntityRef } = await getUserIdentity(req, httpAuth, userInfo);
+        const existing = await k8sClient$1.getCustomResource("extensions.kuadrant.io", "v1alpha1", namespace, "apiproducts", name);
+        const owner = existing.metadata?.annotations?.["backstage.io/owner"];
+        if (owner !== userEntityRef) {
+          throw new errors.NotAllowedError("you can only update your own api products");
+        }
+      }
+      if (req.body.metadata?.annotations) {
+        delete req.body.metadata.annotations["backstage.io/owner"];
       }
-      const { namespace, name } = req.params;
       const updated = await k8sClient$1.patchCustomResource(
         "extensions.kuadrant.io",
         "v1alpha1",
@@ -353,7 +416,7 @@ async function createRouter({
     try {
       const credentials = await httpAuth.credentials(req);
       const { apiName, apiNamespace, planTier, useCase, userEmail } = parsed.data;
-      const { userId } = await getUserIdentity(req, httpAuth, userInfo);
+      const { userEntityRef } = await getUserIdentity(req, httpAuth, userInfo);
       const resourceRef = `apiproduct:${apiNamespace}/${apiName}`;
       const decision = await permissions$1.authorize(
         [{
@@ -367,8 +430,9 @@ async function createRouter({
       }
       const timestamp = (/* @__PURE__ */ new Date()).toISOString();
       const randomSuffix = crypto.randomBytes(4).toString("hex");
-      const requestName = `${userId}-${apiName}-${randomSuffix}`.toLowerCase().replace(/[^a-z0-9-]/g, "-");
-      const requestedBy = { userId };
+      const userName = extractNameFromEntityRef(userEntityRef);
+      const requestName = `${userName}-${apiName}-${randomSuffix}`.toLowerCase().replace(/[^a-z0-9-]/g, "-");
+      const requestedBy = { userId: userEntityRef };
       if (userEmail) {
         requestedBy.email = userEmail;
       }
@@ -406,7 +470,8 @@ async function createRouter({
         if (apiProduct.spec?.approvalMode === "automatic") {
           const apiKey = generateApiKey();
           const timestamp2 = Date.now();
-          const secretName = `${userId}-${apiName}-${timestamp2}`.toLowerCase().replace(/[^a-z0-9-]/g, "-");
+          const userName2 = extractNameFromEntityRef(userEntityRef);
+          const secretName = `${userName2}-${apiName}-${timestamp2}`.toLowerCase().replace(/[^a-z0-9-]/g, "-");
           const secret = {
             apiVersion: "v1",
             kind: "Secret",
@@ -418,7 +483,7 @@ async function createRouter({
               },
               annotations: {
                 "secret.kuadrant.io/plan-id": planTier,
-                "secret.kuadrant.io/user-id": userId
+                "secret.kuadrant.io/user-id": userEntityRef
               }
             },
             stringData: {
@@ -483,12 +548,19 @@ async function createRouter({
   router.get("/requests", async (req, res) => {
     try {
       const credentials = await httpAuth.credentials(req);
-      const decision = await permissions$1.authorize(
-        [{ permission: permissions.kuadrantApiKeyRequestListPermission }],
+      const readAllDecision = await permissions$1.authorize(
+        [{ permission: permissions.kuadrantApiKeyRequestReadAllPermission }],
         { credentials }
       );
-      if (decision[0].result !== pluginPermissionCommon.AuthorizeResult.ALLOW) {
-        throw new errors.NotAllowedError("unauthorised");
+      const canReadAll = readAllDecision[0].result === pluginPermissionCommon.AuthorizeResult.ALLOW;
+      if (!canReadAll) {
+        const readOwnDecision = await permissions$1.authorize(
+          [{ permission: permissions.kuadrantApiKeyRequestReadOwnPermission }],
+          { credentials }
+        );
+        if (readOwnDecision[0].result !== pluginPermissionCommon.AuthorizeResult.ALLOW) {
+          throw new errors.NotAllowedError("unauthorised");
+        }
       }
       const status = req.query.status;
       const namespace = req.query.namespace;
@@ -499,6 +571,17 @@ async function createRouter({
         data = await k8sClient$1.listCustomResources("extensions.kuadrant.io", "v1alpha1", "apikeyrequests");
       }
       let filteredItems = data.items || [];
+      if (!canReadAll) {
+        const { userEntityRef } = await getUserIdentity(req, httpAuth, userInfo);
+        const apiproducts = await k8sClient$1.listCustomResources("extensions.kuadrant.io", "v1alpha1", "apiproducts");
+        const ownedApiProducts = (apiproducts.items || []).filter((product) => {
+          const owner = product.metadata?.annotations?.["backstage.io/owner"];
+          return owner === userEntityRef;
+        }).map((product) => product.metadata.name);
+        filteredItems = filteredItems.filter(
+          (req2) => ownedApiProducts.includes(req2.spec?.apiName)
+        );
+      }
       if (status) {
         filteredItems = filteredItems.filter((req2) => {
           const phase = req2.status?.phase || "Pending";
@@ -525,7 +608,7 @@ async function createRouter({
       if (decision[0].result !== pluginPermissionCommon.AuthorizeResult.ALLOW) {
         throw new errors.NotAllowedError("unauthorised");
       }
-      const { userId } = await getUserIdentity(req, httpAuth, userInfo);
+      const { userEntityRef } = await getUserIdentity(req, httpAuth, userInfo);
       const namespace = req.query.namespace;
       let data;
       if (namespace) {
@@ -534,7 +617,7 @@ async function createRouter({
         data = await k8sClient$1.listCustomResources("extensions.kuadrant.io", "v1alpha1", "apikeyrequests");
       }
       const filteredItems = (data.items || []).filter(
-        (req2) => req2.spec?.requestedBy?.userId === userId
+        (req2) => req2.spec?.requestedBy?.userId === userEntityRef
       );
       res.json({ items: filteredItems });
     } catch (error) {
@@ -556,17 +639,10 @@ async function createRouter({
     }
     try {
       const credentials = await httpAuth.credentials(req);
-      const { userId } = await getUserIdentity(req, httpAuth, userInfo);
-      const decision = await permissions$1.authorize(
-        [{ permission: permissions.kuadrantApiKeyRequestUpdatePermission }],
-        { credentials }
-      );
-      if (decision[0].result !== pluginPermissionCommon.AuthorizeResult.ALLOW) {
-        throw new errors.NotAllowedError("unauthorised");
-      }
+      const { userEntityRef } = await getUserIdentity(req, httpAuth, userInfo);
       const { namespace, name } = req.params;
       const { comment } = parsed.data;
-      const reviewedBy = `user:default/${userId}`;
+      const reviewedBy = userEntityRef;
       const request = await k8sClient$1.getCustomResource(
         "extensions.kuadrant.io",
         "v1alpha1",
@@ -575,9 +651,34 @@ async function createRouter({
         name
       );
       const spec = request.spec;
+      const apiProduct = await k8sClient$1.getCustomResource(
+        "extensions.kuadrant.io",
+        "v1alpha1",
+        spec.apiNamespace,
+        "apiproducts",
+        spec.apiName
+      );
+      const owner = apiProduct.metadata?.annotations?.["backstage.io/owner"];
+      const updateAllDecision = await permissions$1.authorize(
+        [{ permission: permissions.kuadrantApiKeyRequestUpdateAllPermission }],
+        { credentials }
+      );
+      if (updateAllDecision[0].result !== pluginPermissionCommon.AuthorizeResult.ALLOW) {
+        const updateOwnDecision = await permissions$1.authorize(
+          [{ permission: permissions.kuadrantApiKeyRequestUpdateOwnPermission }],
+          { credentials }
+        );
+        if (updateOwnDecision[0].result !== pluginPermissionCommon.AuthorizeResult.ALLOW) {
+          throw new errors.NotAllowedError("unauthorised");
+        }
+        if (owner !== userEntityRef) {
+          throw new errors.NotAllowedError("you can only approve requests for your own api products");
+        }
+      }
       const apiKey = generateApiKey();
       const timestamp = Date.now();
-      const secretName = `${spec.requestedBy.userId}-${spec.apiName}-${timestamp}`.toLowerCase().replace(/[^a-z0-9-]/g, "-");
+      const userName = extractNameFromEntityRef(spec.requestedBy.userId);
+      const secretName = `${userName}-${spec.apiName}-${timestamp}`.toLowerCase().replace(/[^a-z0-9-]/g, "-");
       const secret = {
         apiVersion: "v1",
         kind: "Secret",
@@ -681,17 +782,42 @@ async function createRouter({
     }
     try {
       const credentials = await httpAuth.credentials(req);
-      const { userId } = await getUserIdentity(req, httpAuth, userInfo);
-      const decision = await permissions$1.authorize(
-        [{ permission: permissions.kuadrantApiKeyRequestUpdatePermission }],
+      const { userEntityRef } = await getUserIdentity(req, httpAuth, userInfo);
+      const { namespace, name } = req.params;
+      const { comment } = parsed.data;
+      const reviewedBy = userEntityRef;
+      const request = await k8sClient$1.getCustomResource(
+        "extensions.kuadrant.io",
+        "v1alpha1",
+        namespace,
+        "apikeyrequests",
+        name
+      );
+      const spec = request.spec;
+      const apiProduct = await k8sClient$1.getCustomResource(
+        "extensions.kuadrant.io",
+        "v1alpha1",
+        spec.apiNamespace,
+        "apiproducts",
+        spec.apiName
+      );
+      const owner = apiProduct.metadata?.annotations?.["backstage.io/owner"];
+      const updateAllDecision = await permissions$1.authorize(
+        [{ permission: permissions.kuadrantApiKeyRequestUpdateAllPermission }],
         { credentials }
       );
-      if (decision[0].result !== pluginPermissionCommon.AuthorizeResult.ALLOW) {
-        throw new errors.NotAllowedError("unauthorised");
+      if (updateAllDecision[0].result !== pluginPermissionCommon.AuthorizeResult.ALLOW) {
+        const updateOwnDecision = await permissions$1.authorize(
+          [{ permission: permissions.kuadrantApiKeyRequestUpdateOwnPermission }],
+          { credentials }
+        );
+        if (updateOwnDecision[0].result !== pluginPermissionCommon.AuthorizeResult.ALLOW) {
+          throw new errors.NotAllowedError("unauthorised");
+        }
+        if (owner !== userEntityRef) {
+          throw new errors.NotAllowedError("you can only reject requests for your own api products");
+        }
       }
-      const { namespace, name } = req.params;
-      const { comment } = parsed.data;
-      const reviewedBy = `user:default/${userId}`;
       const status = {
         phase: "Rejected",
         reviewedBy,
@@ -730,16 +856,16 @@ async function createRouter({
     }
     try {
       const credentials = await httpAuth.credentials(req);
-      const { userId } = await getUserIdentity(req, httpAuth, userInfo);
+      const { userEntityRef } = await getUserIdentity(req, httpAuth, userInfo);
       const decision = await permissions$1.authorize(
-        [{ permission: permissions.kuadrantApiKeyRequestUpdatePermission }],
+        [{ permission: permissions.kuadrantApiKeyRequestUpdateAllPermission }],
         { credentials }
       );
       if (decision[0].result !== pluginPermissionCommon.AuthorizeResult.ALLOW) {
         throw new errors.NotAllowedError("unauthorised");
       }
       const { requests, comment } = parsed.data;
-      const reviewedBy = `user:default/${userId}`;
+      const reviewedBy = userEntityRef;
       const results = [];
       for (const reqRef of requests) {
         try {
@@ -751,9 +877,34 @@ async function createRouter({
             reqRef.name
           );
           const spec = request.spec;
+          const apiProduct = await k8sClient$1.getCustomResource(
+            "extensions.kuadrant.io",
+            "v1alpha1",
+            spec.apiNamespace,
+            "apiproducts",
+            spec.apiName
+          );
+          const owner = apiProduct.metadata?.annotations?.["backstage.io/owner"];
+          const updateAllDecision = await permissions$1.authorize(
+            [{ permission: permissions.kuadrantApiProductUpdateAllPermission }],
+            { credentials }
+          );
+          if (updateAllDecision[0].result !== pluginPermissionCommon.AuthorizeResult.ALLOW) {
+            const updateOwnDecision = await permissions$1.authorize(
+              [{ permission: permissions.kuadrantApiProductUpdateOwnPermission }],
+              { credentials }
+            );
+            if (updateOwnDecision[0].result !== pluginPermissionCommon.AuthorizeResult.ALLOW) {
+              throw new errors.NotAllowedError("unauthorised");
+            }
+            if (owner !== userEntityRef) {
+              throw new errors.NotAllowedError("you can only approve requests for your own api products");
+            }
+          }
           const apiKey = generateApiKey();
           const timestamp = Date.now();
-          const secretName = `${spec.requestedBy.userId}-${spec.apiName}-${timestamp}`.toLowerCase().replace(/[^a-z0-9-]/g, "-");
+          const userName = extractNameFromEntityRef(spec.requestedBy.userId);
+          const secretName = `${userName}-${spec.apiName}-${timestamp}`.toLowerCase().replace(/[^a-z0-9-]/g, "-");
           const secret = {
             apiVersion: "v1",
             kind: "Secret",
@@ -868,19 +1019,51 @@ async function createRouter({
     }
     try {
       const credentials = await httpAuth.credentials(req);
-      const { userId } = await getUserIdentity(req, httpAuth, userInfo);
+      const { userEntityRef } = await getUserIdentity(req, httpAuth, userInfo);
       const decision = await permissions$1.authorize(
-        [{ permission: permissions.kuadrantApiKeyRequestUpdatePermission }],
+        [{ permission: permissions.kuadrantApiKeyRequestUpdateAllPermission }],
         { credentials }
       );
       if (decision[0].result !== pluginPermissionCommon.AuthorizeResult.ALLOW) {
         throw new errors.NotAllowedError("unauthorised");
       }
       const { requests, comment } = parsed.data;
-      const reviewedBy = `user:default/${userId}`;
+      const reviewedBy = userEntityRef;
       const results = [];
       for (const reqRef of requests) {
         try {
+          const request = await k8sClient$1.getCustomResource(
+            "extensions.kuadrant.io",
+            "v1alpha1",
+            reqRef.namespace,
+            "apikeyrequests",
+            reqRef.name
+          );
+          const spec = request.spec;
+          const apiProduct = await k8sClient$1.getCustomResource(
+            "extensions.kuadrant.io",
+            "v1alpha1",
+            spec.apiNamespace,
+            "apiproducts",
+            spec.apiName
+          );
+          const owner = apiProduct.metadata?.annotations?.["backstage.io/owner"];
+          const updateAllDecision = await permissions$1.authorize(
+            [{ permission: permissions.kuadrantApiProductUpdateAllPermission }],
+            { credentials }
+          );
+          if (updateAllDecision[0].result !== pluginPermissionCommon.AuthorizeResult.ALLOW) {
+            const updateOwnDecision = await permissions$1.authorize(
+              [{ permission: permissions.kuadrantApiProductUpdateOwnPermission }],
+              { credentials }
+            );
+            if (updateOwnDecision[0].result !== pluginPermissionCommon.AuthorizeResult.ALLOW) {
+              throw new errors.NotAllowedError("unauthorised");
+            }
+            if (owner !== userEntityRef) {
+              throw new errors.NotAllowedError("you can only reject requests for your own api products");
+            }
+          }
           const status = {
             phase: "Rejected",
             reviewedBy,
@@ -919,7 +1102,7 @@ async function createRouter({
   router.delete("/requests/:namespace/:name", async (req, res) => {
     try {
       const credentials = await httpAuth.credentials(req);
-      const { userId } = await getUserIdentity(req, httpAuth, userInfo);
+      const { userEntityRef } = await getUserIdentity(req, httpAuth, userInfo);
       const { namespace, name } = req.params;
       const request = await k8sClient$1.getCustomResource(
         "extensions.kuadrant.io",
@@ -942,7 +1125,7 @@ async function createRouter({
         if (deleteOwnDecision[0].result !== pluginPermissionCommon.AuthorizeResult.ALLOW) {
           throw new errors.NotAllowedError("unauthorised");
         }
-        if (requestUserId !== userId) {
+        if (requestUserId !== userEntityRef) {
           throw new errors.NotAllowedError("you can only delete your own api key requests");
         }
       }
@@ -983,7 +1166,8 @@ async function createRouter({
   router.patch("/requests/:namespace/:name", async (req, res) => {
     const patchSchema = zod.z.object({
       spec: zod.z.object({
-        useCase: zod.z.string().optional()
+        useCase: zod.z.string().optional(),
+        planTier: zod.z.string().optional()
       }).partial()
     });
     const parsed = patchSchema.safeParse(req.body);
@@ -992,7 +1176,7 @@ async function createRouter({
     }
     try {
       const credentials = await httpAuth.credentials(req);
-      const { userId } = await getUserIdentity(req, httpAuth, userInfo);
+      const { userEntityRef } = await getUserIdentity(req, httpAuth, userInfo);
       const { namespace, name } = req.params;
       const existing = await k8sClient$1.getCustomResource(
         "extensions.kuadrant.io",
@@ -1001,8 +1185,13 @@ async function createRouter({
         "apikeyrequests",
         name
       );
+      const requestUserId = existing.spec?.requestedBy?.userId;
+      const currentPhase = existing.status?.phase || "Pending";
+      if (currentPhase !== "Pending") {
+        throw new errors.NotAllowedError("only pending requests can be edited");
+      }
       const updateAllDecision = await permissions$1.authorize(
-        [{ permission: permissions.kuadrantApiKeyRequestUpdatePermission }],
+        [{ permission: permissions.kuadrantApiKeyRequestUpdateAllPermission }],
         { credentials }
       );
       if (updateAllDecision[0].result !== pluginPermissionCommon.AuthorizeResult.ALLOW) {
@@ -1013,7 +1202,7 @@ async function createRouter({
         if (updateOwnDecision[0].result !== pluginPermissionCommon.AuthorizeResult.ALLOW) {
           throw new errors.NotAllowedError("unauthorised");
         }
-        if (existing.spec?.requestedBy?.userId !== userId) {
+        if (requestUserId !== userEntityRef) {
           throw new errors.NotAllowedError("you can only update your own api key requests");
         }
       }