Rework API keys to support scopes and per project keys

backend/apps/cloud/src/analytics/v2/controllers/captcha-v2.controller.ts

@@ -1,3 +1,4 @@
+import { ApiKeyAccess } from '../../../api-key/api-key-access.decorator'
 import {
   Controller,
   Get,
@@ -47,6 +48,7 @@ export class CaptchaV2Controller {
 
   @Get('summary')
   @Auth(true, true)
+  @ApiKeyAccess('analytics:read', 'params', 'pid')
   @CacheableAnalytics()
   @ApiOperation({
     summary: 'Captcha summary',
@@ -72,6 +74,7 @@ export class CaptchaV2Controller {
 
   @Get('timeseries')
   @Auth(true, true)
+  @ApiKeyAccess('analytics:read', 'params', 'pid')
   @CacheableAnalytics()
   @ApiOperation({
     summary: 'Captcha timeseries',
@@ -97,6 +100,7 @@ export class CaptchaV2Controller {
 
   @Get('breakdown')
   @Auth(true, true)
+  @ApiKeyAccess('analytics:read', 'params', 'pid')
   @CacheableAnalytics()
   @ApiOperation({
     summary: 'Captcha breakdown',

backend/apps/cloud/src/analytics/v2/controllers/errors-v2.controller.ts

@@ -1,3 +1,4 @@
+import { ApiKeyAccess } from '../../../api-key/api-key-access.decorator'
 import {
   Controller,
   Get,
@@ -52,6 +53,7 @@ export class ErrorsV2Controller {
 
   @Get()
   @Auth(true, true)
+  @ApiKeyAccess('errors:read', 'params', 'pid')
   @CacheableAnalytics()
   @ApiOperation({
     summary: 'Error groups',
@@ -77,6 +79,7 @@ export class ErrorsV2Controller {
 
   @Get('overview')
   @Auth(true, true)
+  @ApiKeyAccess('errors:read', 'params', 'pid')
   @CacheableAnalytics()
   @ApiOperation({
     summary: 'Errors overview',
@@ -102,6 +105,7 @@ export class ErrorsV2Controller {
 
   @Get('timeseries')
   @Auth(true, true)
+  @ApiKeyAccess('errors:read', 'params', 'pid')
   @CacheableAnalytics()
   @ApiOperation({
     summary: 'Errors timeseries',
@@ -126,6 +130,7 @@ export class ErrorsV2Controller {
 
   @Get('breakdown')
   @Auth(true, true)
+  @ApiKeyAccess('errors:read', 'params', 'pid')
   @CacheableAnalytics()
   @ApiOperation({
     summary: 'Errors breakdown',
@@ -154,6 +159,7 @@ export class ErrorsV2Controller {
 
   @Get(':eid')
   @Auth(true, true)
+  @ApiKeyAccess('errors:read', 'params', 'pid')
   @ApiOperation({
     summary: 'Error details',
     description:
@@ -181,6 +187,7 @@ export class ErrorsV2Controller {
 
   @Get(':eid/sessions')
   @Auth(true, true)
+  @ApiKeyAccess('errors:read', 'params', 'pid', ['analytics:read'])
   @ApiOperation({
     summary: 'Error sessions',
     description: 'Paginated sessions affected by a specific error group.',

backend/apps/cloud/src/analytics/v2/controllers/performance-v2.controller.ts

@@ -1,3 +1,4 @@
+import { ApiKeyAccess } from '../../../api-key/api-key-access.decorator'
 import {
   Controller,
   Get,
@@ -48,6 +49,7 @@ export class PerformanceV2Controller {
 
   @Get('summary')
   @Auth(true, true)
+  @ApiKeyAccess('analytics:read', 'params', 'pid')
   @CacheableAnalytics()
   @ApiOperation({
     summary: 'Performance summary',
@@ -73,6 +75,7 @@ export class PerformanceV2Controller {
 
   @Get('timeseries')
   @Auth(true, true)
+  @ApiKeyAccess('analytics:read', 'params', 'pid')
   @CacheableAnalytics()
   @ApiOperation({
     summary: 'Performance timeseries',
@@ -101,6 +104,7 @@ export class PerformanceV2Controller {
 
   @Get('breakdown')
   @Auth(true, true)
+  @ApiKeyAccess('analytics:read', 'params', 'pid')
   @CacheableAnalytics()
   @ApiOperation({
     summary: 'Performance breakdown',

backend/apps/cloud/src/analytics/v2/controllers/profiles-v2.controller.ts

@@ -1,3 +1,4 @@
+import { ApiKeyAccess } from '../../../api-key/api-key-access.decorator'
 import {
   Controller,
   Get,
@@ -47,6 +48,10 @@ export class ProfilesV2Controller {
 
   @Get()
   @Auth(true, true)
+  @ApiKeyAccess('analytics:read', 'params', 'pid', [
+    'events:read',
+    'errors:read',
+  ])
   @CacheableAnalytics()
   @ApiOperation({
     summary: 'Profiles',
@@ -72,6 +77,11 @@ export class ProfilesV2Controller {
 
   @Get(':profileId')
   @Auth(true, true)
+  @ApiKeyAccess('analytics:read', 'params', 'pid', [
+    'events:read',
+    'errors:read',
+    'revenue:read',
+  ])
   @ApiOperation({
     summary: 'Profile details',
     description:
@@ -103,6 +113,10 @@ export class ProfilesV2Controller {
 
   @Get(':profileId/sessions')
   @Auth(true, true)
+  @ApiKeyAccess('analytics:read', 'params', 'pid', [
+    'events:read',
+    'errors:read',
+  ])
   @ApiOperation({
     summary: 'Profile sessions',
     description: 'Paginated sessions recorded for a specific profile.',

backend/apps/cloud/src/analytics/v2/controllers/project-v2.controller.ts

@@ -1,3 +1,4 @@
+import { ApiKeyAccess } from '../../../api-key/api-key-access.decorator'
 import {
   Controller,
   Get,
@@ -51,6 +52,7 @@ export class ProjectV2Controller {
 
   @Get('funnel')
   @Auth(true, true)
+  @ApiKeyAccess('funnels:read', 'params', 'pid')
   @CacheableAnalytics()
   @ApiOperation({
     summary: 'Funnel analysis',
@@ -76,6 +78,11 @@ export class ProjectV2Controller {
 
   @Get('funnel/sessions')
   @Auth(true, true)
+  @ApiKeyAccess('funnels:read', 'params', 'pid', [
+    'analytics:read',
+    'events:read',
+    'errors:read',
+  ])
   @CacheableAnalytics()
   @ApiOperation({
     summary: 'Funnel sessions',
@@ -104,6 +111,7 @@ export class ProjectV2Controller {
 
   @Get('live-visitors')
   @Auth(true, true)
+  @ApiKeyAccess('analytics:read', 'params', 'pid')
   @ApiOperation({
     summary: 'Live visitors',
     description:
@@ -127,6 +135,7 @@ export class ProjectV2Controller {
 
   @Get('dimensions')
   @Auth(true, true)
+  @ApiKeyAccess('analytics:read', 'params', 'pid')
   @ApiOperation({
     summary: 'Dimension & metric discovery',
     description:
@@ -157,6 +166,7 @@ export class ProjectV2Controller {
 
   @Get('dimensions/:dimension/values')
   @Auth(true, true)
+  @ApiKeyAccess('analytics:read', 'params', 'pid')
   @ApiOperation({
     summary: 'Dimension values',
     description:

backend/apps/cloud/src/analytics/v2/controllers/seo-v2.controller.ts

@@ -1,3 +1,4 @@
+import { ApiKeyAccess } from '../../../api-key/api-key-access.decorator'
 import {
   Controller,
   Get,
@@ -50,6 +51,7 @@ export class SeoV2Controller {
 
   @Get('status')
   @Auth(true, true)
+  @ApiKeyAccess('analytics:read', 'params', 'pid')
   @CacheableAnalytics()
   @ApiOperation({
     summary: 'Search Console connection status',
@@ -74,6 +76,7 @@ export class SeoV2Controller {
 
   @Get('summary')
   @Auth(true, true)
+  @ApiKeyAccess('analytics:read', 'params', 'pid')
   @CacheableAnalytics()
   @ApiOperation({
     summary: 'SEO summary',
@@ -99,6 +102,7 @@ export class SeoV2Controller {
 
   @Get('timeseries')
   @Auth(true, true)
+  @ApiKeyAccess('analytics:read', 'params', 'pid')
   @CacheableAnalytics()
   @ApiOperation({
     summary: 'SEO timeseries',
@@ -124,6 +128,7 @@ export class SeoV2Controller {
 
   @Get('breakdown')
   @Auth(true, true)
+  @ApiKeyAccess('analytics:read', 'params', 'pid')
   @CacheableAnalytics()
   @ApiOperation({
     summary: 'SEO breakdown',
@@ -152,6 +157,7 @@ export class SeoV2Controller {
 
   @Get('branded-traffic')
   @Auth(true, true)
+  @ApiKeyAccess('analytics:read', 'params', 'pid')
   @CacheableAnalytics()
   @ApiOperation({
     summary: 'Branded vs non-branded traffic',
@@ -177,6 +183,7 @@ export class SeoV2Controller {
 
   @Get('positions')
   @Auth(true, true)
+  @ApiKeyAccess('analytics:read', 'params', 'pid')
   @CacheableAnalytics()
   @ApiOperation({
     summary: 'Search position analytics',

backend/apps/cloud/src/analytics/v2/controllers/sessions-v2.controller.ts

@@ -1,3 +1,4 @@
+import { ApiKeyAccess } from '../../../api-key/api-key-access.decorator'
 import {
   Controller,
   Get,
@@ -47,6 +48,12 @@ export class SessionsV2Controller {
 
   @Get()
   @Auth(true, true)
+  @ApiKeyAccess('analytics:read', 'params', 'pid', [
+    'events:read',
+    'errors:read',
+    'replays:read',
+    'revenue:read',
+  ])
   @CacheableAnalytics()
   @ApiOperation({
     summary: 'Sessions',
@@ -72,6 +79,12 @@ export class SessionsV2Controller {
 
   @Get(':psid')
   @Auth(true, true)
+  @ApiKeyAccess('analytics:read', 'params', 'pid', [
+    'events:read',
+    'errors:read',
+    'replays:read',
+    'revenue:read',
+  ])
   @ApiOperation({
     summary: 'Session details',
     description:

backend/apps/cloud/src/analytics/v2/controllers/traffic-v2.controller.ts

@@ -1,3 +1,4 @@
+import { ApiKeyAccess } from '../../../api-key/api-key-access.decorator'
 import {
   Controller,
   Get,
@@ -54,6 +55,7 @@ export class TrafficV2Controller {
 
   @Get('summary')
   @Auth(true, true)
+  @ApiKeyAccess('analytics:read', 'params', 'pid')
   @CacheableAnalytics()
   @ApiOperation({
     summary: 'Traffic summary',
@@ -79,6 +81,7 @@ export class TrafficV2Controller {
 
   @Get('timeseries')
   @Auth(true, true)
+  @ApiKeyAccess('analytics:read', 'params', 'pid')
   @CacheableAnalytics()
   @ApiOperation({
     summary: 'Traffic timeseries',
@@ -104,6 +107,7 @@ export class TrafficV2Controller {
 
   @Get('breakdown')
   @Auth(true, true)
+  @ApiKeyAccess('analytics:read', 'params', 'pid')
   @CacheableAnalytics()
   @ApiOperation({
     summary: 'Traffic breakdown',
@@ -132,6 +136,7 @@ export class TrafficV2Controller {
 
   @Get('custom-events')
   @Auth(true, true)
+  @ApiKeyAccess('events:read', 'params', 'pid')
   @CacheableAnalytics()
   @ApiOperation({
     summary: 'Custom events',
@@ -160,6 +165,7 @@ export class TrafficV2Controller {
 
   @Get('custom-metrics')
   @Auth(true, true)
+  @ApiKeyAccess('events:read', 'params', 'pid')
   @CacheableAnalytics()
   @ApiOperation({
     summary: 'Custom metrics',
@@ -188,6 +194,7 @@ export class TrafficV2Controller {
 
   @Get('custom-events/timeseries')
   @Auth(true, true)
+  @ApiKeyAccess('events:read', 'params', 'pid')
   @CacheableAnalytics()
   @ApiOperation({
     summary: 'Custom events timeseries',
@@ -216,6 +223,7 @@ export class TrafficV2Controller {
 
   @Get('custom-events/metadata')
   @Auth(true, true)
+  @ApiKeyAccess('events:read', 'params', 'pid')
   @CacheableAnalytics()
   @ApiOperation({
     summary: 'Custom event metadata',
@@ -244,6 +252,7 @@ export class TrafficV2Controller {
 
   @Get('page-properties/metadata')
   @Auth(true, true)
+  @ApiKeyAccess('analytics:read', 'params', 'pid')
   @CacheableAnalytics()
   @ApiOperation({
     summary: 'Page property values',
@@ -271,6 +280,7 @@ export class TrafficV2Controller {
 
   @Get('page-properties')
   @Auth(true, true)
+  @ApiKeyAccess('analytics:read', 'params', 'pid')
   @CacheableAnalytics()
   @ApiOperation({
     summary: 'Page properties',

backend/apps/cloud/src/api-key/api-key-access.decorator.ts

@@ -0,0 +1,15 @@
+import { SetMetadata } from '@nestjs/common'
+import { API_KEY_ACCESS, ApiKeyPolicy, ApiKeyScope } from './api-key.types'
+
+export const ApiKeyAccess = (
+  scope: ApiKeyScope,
+  source: ApiKeyPolicy['source'],
+  field = 'pid',
+  requires: ApiKeyScope[] = [],
+) =>
+  SetMetadata(API_KEY_ACCESS, {
+    scope,
+    source,
+    field,
+    requires,
+  } satisfies ApiKeyPolicy)

backend/apps/cloud/src/api-key/api-key-collection.decorator.ts

@@ -0,0 +1,20 @@
+import {
+  CanActivate,
+  ExecutionContext,
+  Injectable,
+  UseGuards,
+} from '@nestjs/common'
+import { AuthGuard } from '@nestjs/passport'
+import { ApiKeyGuard } from './api-key.guard'
+import { ApiKeyRateLimitGuard } from '../auth/guards/api-key-rate-limit.guard'
+
+@Injectable()
+class CollectionKeyGuard extends AuthGuard('api-key') implements CanActivate {
+  canActivate(context: ExecutionContext) {
+    if (!context.switchToHttp().getRequest().headers?.['x-api-key']) return true
+    return super.canActivate(context)
+  }
+}
+
+export const ApiKeyCollection = () =>
+  UseGuards(CollectionKeyGuard, ApiKeyGuard, ApiKeyRateLimitGuard)