feat: Implement OpenAPI with API Key authentication and role-based access control

app/api/emails/[id]/[messageId]/route.ts

@@ -1,14 +1,30 @@
 import { NextResponse } from "next/server"
 import { createDb } from "@/lib/db"
-import { messages } from "@/lib/schema"
+import { messages, emails } from "@/lib/schema"
 import { and, eq } from "drizzle-orm"
-
+import { getUserId } from "@/lib/apiKey"
 export const runtime = "edge"
 
-export async function GET(request: Request, { params }: { params: Promise<{ id: string; messageId: string }> }) {
+export async function GET(_request: Request, { params }: { params: Promise<{ id: string; messageId: string }> }) {
   try {
     const { id, messageId } = await params
     const db = createDb()
+    const userId = await getUserId()
+
+    const email = await db.query.emails.findFirst({
+      where: and(
+        eq(emails.id, id),
+        eq(emails.userId, userId!)
+      )
+    })
+
+    if (!email) {
+      return NextResponse.json(
+        { error: "无权限查看" },
+        { status: 403 }
+      )
+    }
+
     const message = await db.query.messages.findFirst({
       where: and(
         eq(messages.id, messageId),

app/api/emails/[id]/route.ts

@@ -1,17 +1,16 @@
 import { NextResponse } from "next/server"
-import { auth } from "@/lib/auth"
 import { createDb } from "@/lib/db"
 import { emails, messages } from "@/lib/schema"
 import { eq, and, lt, or, sql } from "drizzle-orm"
 import { encodeCursor, decodeCursor } from "@/lib/cursor"
-
+import { getUserId } from "@/lib/apiKey"
 export const runtime = "edge"
 
 export async function DELETE(
-  _request: Request,
+  request: Request,
   { params }: { params: Promise<{ id: string }> }
 ) {
-  const session = await auth()
+  const userId = await getUserId()
 
   try {
     const db = createDb()
@@ -19,7 +18,7 @@ export async function DELETE(
     const email = await db.query.emails.findFirst({
       where: and(
         eq(emails.id, id),
-        eq(emails.userId, session!.user!.id!)
+        eq(emails.userId, userId!)
       )
     })
 
@@ -58,6 +57,22 @@ export async function GET(
     const db = createDb()
     const { id } = await params
 
+    const userId = await getUserId()
+
+    const email = await db.query.emails.findFirst({
+      where: and(
+        eq(emails.id, id),
+        eq(emails.userId, userId!)
+      )
+    })
+
+    if (!email) {
+      return NextResponse.json(
+        { error: "无权限查看" },
+        { status: 403 }
+      )
+    }
+
     const baseConditions = eq(messages.emailId, id)
 
     const totalResult = await db.select({ count: sql<number>`count(*)` })