feat: Implement OpenAPI with API Key authentication and role-based access control

app/api/emails/[id]/[messageId]/route.ts

@@ -1,14 +1,30 @@
 import { NextResponse } from "next/server"
 import { createDb } from "@/lib/db"
-import { messages } from "@/lib/schema"
+import { messages, emails } from "@/lib/schema"
 import { and, eq } from "drizzle-orm"
-
+import { getUserId } from "@/lib/apiKey"
 export const runtime = "edge"
 
-export async function GET(request: Request, { params }: { params: Promise<{ id: string; messageId: string }> }) {
+export async function GET(_request: Request, { params }: { params: Promise<{ id: string; messageId: string }> }) {
   try {
     const { id, messageId } = await params
     const db = createDb()
+    const userId = await getUserId()
+
+    const email = await db.query.emails.findFirst({
+      where: and(
+        eq(emails.id, id),
+        eq(emails.userId, userId!)
+      )
+    })
+
+    if (!email) {
+      return NextResponse.json(
+        { error: "无权限查看" },
+        { status: 403 }
+      )
+    }
+
     const message = await db.query.messages.findFirst({
       where: and(
         eq(messages.id, messageId),

app/api/emails/[id]/route.ts

@@ -1,17 +1,16 @@
 import { NextResponse } from "next/server"
-import { auth } from "@/lib/auth"
 import { createDb } from "@/lib/db"
 import { emails, messages } from "@/lib/schema"
 import { eq, and, lt, or, sql } from "drizzle-orm"
 import { encodeCursor, decodeCursor } from "@/lib/cursor"
-
+import { getUserId } from "@/lib/apiKey"
 export const runtime = "edge"
 
 export async function DELETE(
-  _request: Request,
+  request: Request,
   { params }: { params: Promise<{ id: string }> }
 ) {
-  const session = await auth()
+  const userId = await getUserId()
 
   try {
     const db = createDb()
@@ -19,7 +18,7 @@ export async function DELETE(
     const email = await db.query.emails.findFirst({
       where: and(
         eq(emails.id, id),
-        eq(emails.userId, session!.user!.id!)
+        eq(emails.userId, userId!)
       )
     })
 
@@ -58,6 +57,22 @@ export async function GET(
     const db = createDb()
     const { id } = await params
 
+    const userId = await getUserId()
+
+    const email = await db.query.emails.findFirst({
+      where: and(
+        eq(emails.id, id),
+        eq(emails.userId, userId!)
+      )
+    })
+
+    if (!email) {
+      return NextResponse.json(
+        { error: "无权限查看" },
+        { status: 403 }
+      )
+    }
+
     const baseConditions = eq(messages.emailId, id)
 
     const totalResult = await db.select({ count: sql<number>`count(*)` })

app/api/emails/generate/route.ts

@@ -1,18 +1,18 @@
 import { NextResponse } from "next/server"
 import { nanoid } from "nanoid"
-import { auth } from "@/lib/auth"
 import { createDb } from "@/lib/db"
 import { emails } from "@/lib/schema"
 import { eq, and, gt, sql } from "drizzle-orm"
 import { EXPIRY_OPTIONS } from "@/types/email"
 import { EMAIL_CONFIG } from "@/config"
 import { getRequestContext } from "@cloudflare/next-on-pages"
-
+import { getUserId } from "@/lib/apiKey"
 export const runtime = "edge"
 
 export async function POST(request: Request) {
   const db = createDb()
-  const session = await auth()
+
+  const userId = await getUserId()
 
   try {
     const activeEmailsCount = await db
@@ -20,7 +20,7 @@ export async function POST(request: Request) {
       .from(emails)
       .where(
         and(
-          eq(emails.userId, session!.user!.id!),
+          eq(emails.userId, userId!),
           gt(emails.expiresAt, new Date())
         )
       )
@@ -76,7 +76,7 @@ export async function POST(request: Request) {
       address,
       createdAt: now,
       expiresAt: expires,
-      userId: session!.user!.id
+      userId: userId!
     }
     
     const result = await db.insert(emails)

app/api/emails/route.ts

@@ -1,16 +1,17 @@
-import { auth } from "@/lib/auth"
 import { createDb } from "@/lib/db"
 import { and, eq, gt, lt, or, sql } from "drizzle-orm"
 import { NextResponse } from "next/server"
 import { emails } from "@/lib/schema"
 import { encodeCursor, decodeCursor } from "@/lib/cursor"
+import { getUserId } from "@/lib/apiKey"
 
 export const runtime = "edge"
 
 const PAGE_SIZE = 20
 
 export async function GET(request: Request) {
-  const session = await auth()
+  const userId = await getUserId()
+
   const { searchParams } = new URL(request.url)
   const cursor = searchParams.get('cursor')
   
@@ -18,7 +19,7 @@ export async function GET(request: Request) {
 
   try {
     const baseConditions = and(
-      eq(emails.userId, session!.user!.id!),
+      eq(emails.userId, userId!),
       gt(emails.expiresAt, new Date())
     )