tapimo 0.4.1 → 0.4.4

package/src/apps/management/routes/invitations.test.ts

@@ -6,6 +6,7 @@ import * as Invitations from '../../../db/tables/invitations.js'
 import * as InvitationsApp from './invitations.js'
 import * as Memberships from '../../../db/tables/memberships.js'
 import * as Orgs from './orgs.js'
+import * as Organizations from '../../../db/tables/organizations.js'
 import * as Users from '../../../db/tables/users.js'
 
 /** Origin pinned for SIWE domain binding; Hono test requests use this host. */
@@ -36,11 +37,26 @@ function sender() {
 /** Super admin secret configured on the test app. */
 const secret = 'tempo:sk:d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3'
 
-function createApp(options: { db?: ReturnType<typeof TestApp.database>; email?: App.Email } = {}) {
+/** Organization management credential used by API-key route tests. */
+const management = {
+  id: 'key_management',
+  orgId: 'org_management',
+  scopes: ['management:read', 'management:write'],
+  token: 'secret_management_key',
+} satisfies TestApp.kvStore.Key
+
+function createApp(
+  options: {
+    db?: ReturnType<typeof TestApp.database>
+    email?: App.Email
+    kv?: { store: ReturnType<typeof TestApp.kvStore> }
+  } = {},
+) {
   return TestApp.create({
     auth: { superAdmin: { secret } },
     db: options.db ?? TestApp.database(),
     ...(options.email ? { email: options.email } : {}),
+    ...(options.kv ? { kv: options.kv } : {}),
     session: { wallet: { origin } },
   })
 }
@@ -55,6 +71,47 @@ async function session(app: ReturnType<typeof createApp>) {
 }
 
 describe('invitations', () => {
+  test('lets management keys manage organization invitations', async () => {
+    const db = TestApp.database()
+    await Organizations.create(db, { id: management.orgId, name: 'Acme' })
+    const app = createApp({
+      db,
+      kv: { store: TestApp.kvStore({ keys: [management] }) },
+    })
+    const path = `/v1/orgs/${management.orgId}/invitations`
+    const headers = {
+      'content-type': 'application/json',
+      'tempo-api-key': management.token,
+    }
+
+    const created = await app.request(path, {
+      body: JSON.stringify({ email: 'dev@example.com', role: 'owner' }),
+      headers,
+      method: 'POST',
+    })
+    expect(created.status).toBe(200)
+    const invitation = await TestApp.json(created, InvitationsApp.schema.Invitation)
+    expect(invitation.invitedBy).toBe(management.id)
+
+    const listed = await app.request(path, { headers })
+    expect(listed.status).toBe(200)
+    expect(
+      (await TestApp.json(listed, InvitationsApp.schema.listInvitations.Response)).data.map(
+        ({ id }) => id,
+      ),
+    ).toEqual([invitation.id])
+
+    expect((await app.request('/v1/invitations', { headers })).status).toBe(403)
+    expect(
+      (
+        await app.request(`${path}/${invitation.id}`, {
+          headers,
+          method: 'DELETE',
+        })
+      ).status,
+    ).toBe(200)
+  })
+
   test('invites, surfaces, and accepts into membership', async () => {
     const db = TestApp.database()
     const { email, sent } = sender()
@@ -123,6 +180,50 @@ describe('invitations', () => {
     expect(again.status).toBe(404)
   })
 
+  test('accepting an invitation preserves membership in another organization', async () => {
+    const db = TestApp.database()
+    const app = createApp({ db })
+    const invitee = await session(app)
+    const createdA = await app.request('/v1/orgs', json('POST', invitee.cookie, { name: 'Org A' }))
+    const orgA = await TestApp.json(createdA, Orgs.schema.Organization)
+    await Users.setEmail(db, invitee.userId, 'dev@example.com')
+
+    const owner = await session(app)
+    const createdB = await app.request('/v1/orgs', json('POST', owner.cookie, { name: 'Org B' }))
+    const orgB = await TestApp.json(createdB, Orgs.schema.Organization)
+    const invited = await app.request(
+      `/v1/orgs/${orgB.id}/invitations`,
+      json('POST', owner.cookie, { email: 'dev@example.com', role: 'member' }),
+    )
+    const invitation = await TestApp.json(invited, InvitationsApp.schema.Invitation)
+
+    const accepted = await app.request(`/v1/invitations/${invitation.id}/accept`, {
+      headers: { cookie: invitee.cookie },
+      method: 'POST',
+    })
+    expect(accepted.status).toBe(200)
+
+    const listed = await app.request('/v1/orgs', { headers: { cookie: invitee.cookie } })
+    const organizations = await TestApp.json(listed, Orgs.schema.listOrganizations.Response)
+    expect(
+      organizations.data
+        .map(({ id, role }) => ({ id, role }))
+        .sort((a, b) => a.id.localeCompare(b.id)),
+    ).toEqual(
+      [
+        { id: orgA.id, role: 'owner' },
+        { id: orgB.id, role: 'member' },
+      ].sort((a, b) => a.id.localeCompare(b.id)),
+    )
+
+    const [readA, readB] = await Promise.all([
+      app.request(`/v1/orgs/${orgA.id}`, { headers: { cookie: invitee.cookie } }),
+      app.request(`/v1/orgs/${orgB.id}`, { headers: { cookie: invitee.cookie } }),
+    ])
+    expect(readA.status).toBe(200)
+    expect(readB.status).toBe(200)
+  })
+
   test('accepting elevates an existing member but never demotes', async () => {
     const db = TestApp.database()
     const app = createApp({ db })

package/src/apps/management/routes/invitations.ts

@@ -48,7 +48,7 @@ export namespace schema {
       invitedBy: z
         .string()
         .check(
-          z.describe('User id (`usr_…`) that created the invitation.'),
+          z.describe('User or API key id that created the invitation.'),
           z.meta({ examples: ['usr_1a2b3c4d5e6f7g8h9j0k1m2n'] }),
         ),
       orgId: z
@@ -204,16 +204,14 @@ export namespace schema {
 
 /**
  * Mounts the invitations surface: org-scoped management
- * (`/orgs/:orgId/invitations`, admins and owners) plus the invitee's side
- * (`/invitations`, matched against the session's verified email). Invitation
- * emails dispatch through the sender the management group publishes on context
- * (`c.get('email')`), best-effort.
+ * (`/orgs/:orgId/invitations`) plus session-only invitee actions. Invitation
+ * emails dispatch through the management group's sender, best-effort.
  */
 export function invitations() {
   return new Hono<Environment>()
     .post(
       '/v1/orgs/:orgId{org_[A-Za-z0-9_-]+}/invitations',
-      Auth.policy({ session: true }),
+      Auth.policy({ apiKey: { scopes: ['management:write'] }, session: true }),
       Auth.ensureOrg({ role: 'admin' }),
       OpenApi.validate('param', schema.Params, {
         code: 'param_invalid',
@@ -234,7 +232,7 @@ export function invitations() {
         tags: ['Invitations'],
       }),
       async (c) => {
-        if (Auth.narrowAccess) return Auth.superAdminAccessError(c)
+        if (Auth.narrowAccess) return Auth.accessError(c)
         if (Auth.narrowScope) return Auth.ensureOrgError(c)
         if (OpenApi.narrowValidation)
           return OpenApi.validationError(c, {
@@ -248,9 +246,7 @@ export function invitations() {
           })
 
         const body = c.req.valid('json')
-        // Owners invite anyone; everyone else grants only roles strictly below
-        // their own (an admin invites members, never peers). The super admin
-        // has no membership and may grant any role.
+        // Owners, write-scoped keys, and the super admin grant any role; admins grant only members.
         const caller = Auth.membership(c)
         if (
           caller &&
@@ -262,7 +258,9 @@ export function invitations() {
             message: 'Cannot invite at or above your own role',
             status: 403,
           })
-        const invitedBy = caller?.userId ?? 'super_admin'
+        const principal = Auth.getPrincipal(c)
+        const invitedBy =
+          principal?.type === 'api_key' ? principal.id : (caller?.userId ?? 'super_admin')
 
         const db = Db.get(c.get('db'))
         try {
@@ -282,7 +280,7 @@ export function invitations() {
     )
     .get(
       '/v1/orgs/:orgId{org_[A-Za-z0-9_-]+}/invitations',
-      Auth.policy({ session: true }),
+      Auth.policy({ apiKey: { scopes: ['management:read'] }, session: true }),
       Auth.ensureOrg({ role: 'admin' }),
       OpenApi.validate('param', schema.Params, {
         code: 'param_invalid',
@@ -301,7 +299,7 @@ export function invitations() {
         tags: ['Invitations'],
       }),
       async (c) => {
-        if (Auth.narrowAccess) return Auth.superAdminAccessError(c)
+        if (Auth.narrowAccess) return Auth.accessError(c)
         if (Auth.narrowScope) return Auth.ensureOrgError(c)
         if (OpenApi.narrowValidation)
           return OpenApi.validationError(c, {
@@ -325,7 +323,7 @@ export function invitations() {
     )
     .delete(
       '/v1/orgs/:orgId{org_[A-Za-z0-9_-]+}/invitations/:invitationId{inv_[A-Za-z0-9_-]+}',
-      Auth.policy({ session: true }),
+      Auth.policy({ apiKey: { scopes: ['management:write'] }, session: true }),
       Auth.ensureOrg({ role: 'admin' }),
       OpenApi.validate('param', schema.InvitationParams, {
         code: 'param_invalid',
@@ -344,7 +342,7 @@ export function invitations() {
         tags: ['Invitations'],
       }),
       async (c) => {
-        if (Auth.narrowAccess) return Auth.superAdminAccessError(c)
+        if (Auth.narrowAccess) return Auth.accessError(c)
         if (Auth.narrowScope) return Auth.ensureOrgError(c)
         if (OpenApi.narrowValidation)
           return OpenApi.validationError(c, {

package/src/apps/management/routes/members.ts

@@ -113,14 +113,14 @@ export namespace schema {
 
 /**
  * Mounts the `/orgs/:orgId/members` resource: the organization's team.
- * Members read; owners change roles and remove members (any member may remove
- * themself). The last owner can never be demoted or removed.
+ * Members and read-scoped keys list. Owners and write-scoped keys manage;
+ * members may remove themselves. The last owner remains protected.
  */
 export function members() {
   return new Hono<App.Environment>()
     .get(
       '/v1/orgs/:orgId{org_[A-Za-z0-9_-]+}/members',
-      Auth.policy({ session: true }),
+      Auth.policy({ apiKey: { scopes: ['management:read'] }, session: true }),
       Auth.ensureOrg(),
       OpenApi.validate('param', schema.Params, {
         code: 'param_invalid',
@@ -139,7 +139,7 @@ export function members() {
         tags: ['Members'],
       }),
       async (c) => {
-        if (Auth.narrowAccess) return Auth.superAdminAccessError(c)
+        if (Auth.narrowAccess) return Auth.accessError(c)
         if (Auth.narrowScope) return Auth.ensureOrgError(c)
         if (OpenApi.narrowValidation)
           return OpenApi.validationError(c, {
@@ -163,7 +163,7 @@ export function members() {
     )
     .patch(
       '/v1/orgs/:orgId{org_[A-Za-z0-9_-]+}/members/:userId{usr_[A-Za-z0-9_-]+}',
-      Auth.policy({ session: true }),
+      Auth.policy({ apiKey: { scopes: ['management:write'] }, session: true }),
       Auth.ensureOrg({ role: 'owner' }),
       OpenApi.validate('param', schema.MemberParams, {
         code: 'param_invalid',
@@ -190,7 +190,7 @@ export function members() {
         tags: ['Members'],
       }),
       async (c) => {
-        if (Auth.narrowAccess) return Auth.superAdminAccessError(c)
+        if (Auth.narrowAccess) return Auth.accessError(c)
         if (Auth.narrowScope) return Auth.ensureOrgError(c)
         if (OpenApi.narrowValidation)
           return OpenApi.validationError(c, {
@@ -226,14 +226,14 @@ export function members() {
     )
     .delete(
       '/v1/orgs/:orgId{org_[A-Za-z0-9_-]+}/members/:userId{usr_[A-Za-z0-9_-]+}',
-      Auth.policy({ session: true }),
+      Auth.policy({ apiKey: { scopes: ['management:write'] }, session: true }),
       Auth.ensureOrg(),
       OpenApi.validate('param', schema.MemberParams, {
         code: 'param_invalid',
         message: 'Check the path parameters and try again.',
       }),
       OpenApi.describeRoute({
-        description: 'Remove a member. Owners remove anyone; any member removes themself. The last owner cannot be removed.', // prettier-ignore
+        description: 'Remove a member. Owners and management-write keys remove anyone; members remove themselves. The last owner stays.', // prettier-ignore
         operationId: 'removeMember',
         responses: OpenApi.responses({
           errors: {
@@ -252,7 +252,7 @@ export function members() {
         tags: ['Members'],
       }),
       async (c) => {
-        if (Auth.narrowAccess) return Auth.superAdminAccessError(c)
+        if (Auth.narrowAccess) return Auth.accessError(c)
         if (Auth.narrowScope) return Auth.ensureOrgError(c)
         if (OpenApi.narrowValidation)
           return OpenApi.validationError(c, {
@@ -261,7 +261,7 @@ export function members() {
           })
 
         const { userId } = c.req.valid('param')
-        // Owners remove anyone; everyone else only themself (leaving the org).
+        // Owners and write-scoped keys remove anyone; other members only themselves.
         const caller = Auth.membership(c)
         if (caller && caller.role !== 'owner' && caller.userId !== userId)
           return Response.error(c, {

package/src/apps/management/routes/orgs.test.ts

@@ -12,14 +12,30 @@ const origin = 'http://localhost'
 /** Super admin secret configured on the test app. */
 const secret = 'tempo:sk:b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1'
 
-/** Wildcard-scoped key: full data access, still not a super admin. */
+/** Wildcard-scoped key: full API access, still not a super admin. */
 const wildcard = {
   id: 'key_wildcard',
-  orgId: 'org_test',
+  orgId: 'org_a',
   scopes: ['*'],
   token: 'secret_wildcard_key',
 } satisfies TestApp.kvStore.Key
 
+/** Key limited to management reads for Org A. */
+const managementRead = {
+  id: 'key_management_read',
+  orgId: 'org_a',
+  scopes: ['management:read'],
+  token: 'secret_management_read_key',
+} satisfies TestApp.kvStore.Key
+
+/** Key limited to management writes for Org A. */
+const managementWrite = {
+  id: 'key_management_write',
+  orgId: 'org_a',
+  scopes: ['management:write'],
+  token: 'secret_management_write_key',
+} satisfies TestApp.kvStore.Key
+
 /** RequestInit presenting the given token. */
 function as(token: string) {
   return { headers: { 'tempo-api-key': token } } as const
@@ -36,7 +52,10 @@ function json(method: 'PATCH' | 'POST', cookie: string, body: unknown) {
 
 function createApp(db = TestApp.database()) {
   return TestApp.create({
-    auth: { keys: [TestApp.key, wildcard], superAdmin: { secret } },
+    auth: {
+      keys: [TestApp.key, managementRead, managementWrite, wildcard],
+      superAdmin: { secret },
+    },
     db,
     session: { wallet: { origin } },
   })
@@ -81,6 +100,19 @@ describe('GET /orgs', () => {
     `)
   })
 
+  test('accepts a management API key in the query parameter', async () => {
+    const app = await seeded()
+    const response = await app.request(`/v1/orgs?key=${encodeURIComponent(managementRead.token)}`)
+    const body = await TestApp.json(response, Orgs.schema.listOrganizations.Response)
+
+    expect(response.status).toMatchInlineSnapshot(`200`)
+    expect(body.data.map(({ id }) => id)).toMatchInlineSnapshot(`
+      [
+        "org_a",
+      ]
+    `)
+  })
+
   test('lists only owned organizations for a session', async () => {
     const app = await seeded()
     const cookie = await session(app)
@@ -112,24 +144,26 @@ describe('GET /orgs', () => {
     `)
   })
 
-  test('rejects API keys without the wildcard scope', async () => {
+  test('rejects API keys without the management read scope', async () => {
     const response = await (await seeded()).request('/v1/orgs', as(TestApp.key.token))
     expect(response.status).toBe(403)
   })
 
-  test('rejects wildcard API keys', async () => {
+  test('lists only the owning organization for scoped and wildcard keys', async () => {
+    const app = await seeded()
+    const scoped = await app.request('/v1/orgs', as(managementRead.token))
+    expect(scoped.status).toBe(200)
+    expect(
+      (await TestApp.json(scoped, Orgs.schema.listOrganizations.Response)).data.map(({ id }) => id),
+    ).toEqual(['org_a'])
+
     const response = await (await seeded()).request('/v1/orgs', as(wildcard.token))
-    expect(response.status).toBe(403)
-    const { requestId, ...body } = (await response.json()) as { requestId?: string }
-    expect(requestId).toBeDefined()
-    expect(body).toMatchInlineSnapshot(`
-      {
-        "error": {
-          "code": "forbidden",
-          "message": "API key not permitted for this route",
-        },
-      }
-    `)
+    expect(response.status).toBe(200)
+    expect(
+      (await TestApp.json(response, Orgs.schema.listOrganizations.Response)).data.map(
+        ({ id }) => id,
+      ),
+    ).toEqual(['org_a'])
   })
 
   test('rejects the secret when super admin is unconfigured', async () => {
@@ -200,6 +234,13 @@ describe('POST /orgs', () => {
 })
 
 describe('GET /orgs/:orgId', () => {
+  test('binds API keys to their owning organization', async () => {
+    const app = await seeded()
+    expect((await app.request('/v1/orgs/org_a', as(managementRead.token))).status).toBe(200)
+    expect((await app.request('/v1/orgs/org_b', as(managementRead.token))).status).toBe(404)
+    expect((await app.request('/v1/orgs/org_a', as(managementWrite.token))).status).toBe(403)
+  })
+
   test('hides foreign organizations behind 404', async () => {
     const app = createApp()
     const owner = await session(app)
@@ -219,6 +260,27 @@ describe('GET /orgs/:orgId', () => {
 })
 
 describe('PATCH /orgs/:orgId', () => {
+  test('requires the management write scope', async () => {
+    const app = await seeded()
+    const write = await app.request(
+      `/v1/orgs/org_a?key=${encodeURIComponent(managementWrite.token)}`,
+      {
+        body: JSON.stringify({ name: 'Managed' }),
+        headers: { 'content-type': 'application/json' },
+        method: 'PATCH',
+      },
+    )
+    expect(write.status).toBe(200)
+    expect((await TestApp.json(write, Orgs.schema.Organization)).name).toBe('Managed')
+
+    const readOnly = await app.request('/v1/orgs/org_a', {
+      body: JSON.stringify({ name: 'Denied' }),
+      headers: { 'content-type': 'application/json', 'tempo-api-key': managementRead.token },
+      method: 'PATCH',
+    })
+    expect(readOnly.status).toBe(403)
+  })
+
   test('renames an owned organization', async () => {
     const app = createApp()
     const cookie = await session(app)

package/src/apps/management/routes/orgs.ts

@@ -46,7 +46,7 @@ export namespace schema {
       role: z
         .optional(z.enum(Memberships.roles))
         .check(
-          z.describe("The caller's role in this organization; absent for the super admin."),
+          z.describe("The caller's role; absent for API keys and the super admin."),
           z.meta({ examples: ['owner'] }),
         ),
       updatedAt: z
@@ -104,17 +104,13 @@ export namespace schema {
 }
 
 /**
- * Mounts the `/orgs` resource: session-owned tenancy (each organization is
- * owned by the user that created it). The super admin bypasses ownership;
- * inaccessible or absent ids render `404` so foreign org ids are
- * indistinguishable from missing ones. Projects nest under `/orgs/:orgId` in
- * the projects app.
+ * Mounts organizations. Sessions access memberships, API keys access their owning organization, and the super admin bypasses ownership.
  */
 export function orgs() {
   return new Hono<App.Environment>()
     .get(
       '/v1/orgs',
-      Auth.policy({ session: true }),
+      Auth.policy({ apiKey: { scopes: ['management:read'] }, session: true }),
       OpenApi.describeRoute({
         operationId: 'listOrganizations',
         responses: OpenApi.responses({
@@ -127,18 +123,21 @@ export function orgs() {
         tags: ['Organizations'],
       }),
       async (c) => {
-        if (Auth.narrowAccess) return Auth.superAdminAccessError(c)
-
-        const principal = Auth.getPrincipal(c)
-        if (principal?.type !== 'session' && principal?.type !== 'super_admin')
-          return sessionRequired(c)
+        if (Auth.narrowAccess) return Auth.accessError(c)
 
         const db = Db.get(c.get('db'))
         try {
+          const principal = Auth.getPrincipal(c)
+          if (!principal || principal.type === 'public')
+            throw new Error('organization auth policy admitted an unsupported principal')
           const records =
             principal.type === 'super_admin'
               ? await Organizations.list(db)
-              : await Organizations.listByMember(db, principal.id)
+              : principal.type === 'api_key'
+                ? [await Organizations.get(db, principal.orgId)].filter(
+                    (record): record is Organizations.Record => record !== undefined,
+                  )
+                : await Organizations.listByMember(db, principal.id)
           return c.json(
             Response.validated(schema.listOrganizations.Response, {
               data: records.map(serializeOrganization),
@@ -203,7 +202,7 @@ export function orgs() {
     )
     .get(
       '/v1/orgs/:orgId{org_[A-Za-z0-9_-]+}',
-      Auth.policy({ session: true }),
+      Auth.policy({ apiKey: { scopes: ['management:read'] }, session: true }),
       Auth.ensureOrg(),
       OpenApi.validate('param', schema.Params, {
         code: 'param_invalid',
@@ -219,7 +218,7 @@ export function orgs() {
         tags: ['Organizations'],
       }),
       async (c) => {
-        if (Auth.narrowAccess) return Auth.superAdminAccessError(c)
+        if (Auth.narrowAccess) return Auth.accessError(c)
         if (Auth.narrowScope) return Auth.ensureOrgError(c)
         if (OpenApi.narrowValidation)
           return OpenApi.validationError(c, {
@@ -238,7 +237,7 @@ export function orgs() {
     )
     .patch(
       '/v1/orgs/:orgId{org_[A-Za-z0-9_-]+}',
-      Auth.policy({ session: true }),
+      Auth.policy({ apiKey: { scopes: ['management:write'] }, session: true }),
       Auth.ensureOrg({ role: 'owner' }),
       OpenApi.validate('param', schema.Params, {
         code: 'param_invalid',
@@ -258,7 +257,7 @@ export function orgs() {
         tags: ['Organizations'],
       }),
       async (c) => {
-        if (Auth.narrowAccess) return Auth.superAdminAccessError(c)
+        if (Auth.narrowAccess) return Auth.accessError(c)
         if (OpenApi.narrowValidation)
           return OpenApi.validationError(c, {
             code: 'param_invalid',
@@ -289,7 +288,7 @@ export function orgs() {
     )
     .delete(
       '/v1/orgs/:orgId{org_[A-Za-z0-9_-]+}',
-      Auth.policy({ session: true }),
+      Auth.policy({ apiKey: { scopes: ['management:write'] }, session: true }),
       Auth.ensureOrg({ role: 'owner' }),
       OpenApi.validate('param', schema.Params, {
         code: 'param_invalid',
@@ -309,7 +308,7 @@ export function orgs() {
         tags: ['Organizations'],
       }),
       async (c) => {
-        if (Auth.narrowAccess) return Auth.superAdminAccessError(c)
+        if (Auth.narrowAccess) return Auth.accessError(c)
         if (Auth.narrowScope) return Auth.ensureOrgError(c)
         if (OpenApi.narrowValidation)
           return OpenApi.validationError(c, {
@@ -321,7 +320,9 @@ export function orgs() {
         try {
           const kv = c.get('kv')
           if (kv)
-            for (const record of await ApiKeys.listByOrg(kv.store, Auth.org(c).id))
+            for (const record of await ApiKeys.listByOrg(kv.store, Auth.org(c).id, {
+              scopeCatalog: c.get('scopeCatalog'),
+            }))
               await ApiKeys.revoke(kv.store, record.id)
           const deleted = await Organizations.deleteOrganization(db, Auth.org(c).id)
           if (!deleted) return organizationNotFound(c)

package/src/apps/management/routes/projects.ts

@@ -125,15 +125,13 @@ export namespace schema {
 }
 
 /**
- * Mounts the `/orgs/:orgId/projects` resource: projects nested under their
- * owning organization. Access follows the org scope (owning session or super
- * admin); inaccessible or absent ids render `404`.
+ * Mounts projects under their owning organization. Access follows the scoped session, API key, or super admin; inaccessible projects return `404`.
  */
 export function projects() {
   return new Hono<App.Environment>()
     .get(
       '/v1/orgs/:orgId{org_[A-Za-z0-9_-]+}/projects',
-      Auth.policy({ session: true }),
+      Auth.policy({ apiKey: { scopes: ['management:read'] }, session: true }),
       Auth.ensureOrg(),
       OpenApi.validate('param', schema.Params, {
         code: 'param_invalid',
@@ -152,7 +150,7 @@ export function projects() {
         tags: ['Projects'],
       }),
       async (c) => {
-        if (Auth.narrowAccess) return Auth.superAdminAccessError(c)
+        if (Auth.narrowAccess) return Auth.accessError(c)
         if (Auth.narrowScope) return Auth.ensureOrgError(c)
         if (OpenApi.narrowValidation)
           return OpenApi.validationError(c, {
@@ -176,7 +174,7 @@ export function projects() {
     )
     .post(
       '/v1/orgs/:orgId{org_[A-Za-z0-9_-]+}/projects',
-      Auth.policy({ session: true }),
+      Auth.policy({ apiKey: { scopes: ['management:write'] }, session: true }),
       Auth.ensureOrg({ role: 'admin' }),
       OpenApi.validate('param', schema.Params, {
         code: 'param_invalid',
@@ -196,7 +194,7 @@ export function projects() {
         tags: ['Projects'],
       }),
       async (c) => {
-        if (Auth.narrowAccess) return Auth.superAdminAccessError(c)
+        if (Auth.narrowAccess) return Auth.accessError(c)
         if (Auth.narrowScope) return Auth.ensureOrgError(c)
         if (OpenApi.narrowValidation)
           return OpenApi.validationError(c, {
@@ -221,7 +219,7 @@ export function projects() {
     )
     .get(
       '/v1/orgs/:orgId{org_[A-Za-z0-9_-]+}/projects/:projectId{prj_[A-Za-z0-9_-]+}',
-      Auth.policy({ session: true }),
+      Auth.policy({ apiKey: { scopes: ['management:read'] }, session: true }),
       Auth.ensureOrg(),
       Auth.ensureProject(),
       OpenApi.validate('param', schema.ProjectParams, {
@@ -238,7 +236,7 @@ export function projects() {
         tags: ['Projects'],
       }),
       async (c) => {
-        if (Auth.narrowAccess) return Auth.superAdminAccessError(c)
+        if (Auth.narrowAccess) return Auth.accessError(c)
         if (Auth.narrowScope) return Auth.ensureProjectError(c)
         if (OpenApi.narrowValidation)
           return OpenApi.validationError(c, {
@@ -251,7 +249,7 @@ export function projects() {
     )
     .patch(
       '/v1/orgs/:orgId{org_[A-Za-z0-9_-]+}/projects/:projectId{prj_[A-Za-z0-9_-]+}',
-      Auth.policy({ session: true }),
+      Auth.policy({ apiKey: { scopes: ['management:write'] }, session: true }),
       Auth.ensureOrg({ role: 'admin' }),
       Auth.ensureProject(),
       OpenApi.validate('param', schema.ProjectParams, {
@@ -272,7 +270,7 @@ export function projects() {
         tags: ['Projects'],
       }),
       async (c) => {
-        if (Auth.narrowAccess) return Auth.superAdminAccessError(c)
+        if (Auth.narrowAccess) return Auth.accessError(c)
         if (OpenApi.narrowValidation)
           return OpenApi.validationError(c, {
             code: 'param_invalid',
@@ -298,7 +296,7 @@ export function projects() {
     )
     .delete(
       '/v1/orgs/:orgId{org_[A-Za-z0-9_-]+}/projects/:projectId{prj_[A-Za-z0-9_-]+}',
-      Auth.policy({ session: true }),
+      Auth.policy({ apiKey: { scopes: ['management:write'] }, session: true }),
       Auth.ensureOrg({ role: 'admin' }),
       Auth.ensureProject(),
       OpenApi.validate('param', schema.ProjectParams, {
@@ -318,7 +316,7 @@ export function projects() {
         tags: ['Projects'],
       }),
       async (c) => {
-        if (Auth.narrowAccess) return Auth.superAdminAccessError(c)
+        if (Auth.narrowAccess) return Auth.accessError(c)
         if (Auth.narrowScope) return Auth.ensureProjectError(c)
         if (OpenApi.narrowValidation)
           return OpenApi.validationError(c, {
@@ -332,6 +330,7 @@ export function projects() {
           if (kv)
             for (const record of await ApiKeys.listByOrg(kv.store, Auth.org(c).id, {
               projectId: Auth.project(c).id,
+              scopeCatalog: c.get('scopeCatalog'),
             }))
               await ApiKeys.revoke(kv.store, record.id)
           const deleted = await Projects.deleteProject(db, Auth.project(c).id)