feat(apollo): internal-dashboard routes for trigger manage + user api-key revoke
loading diff…
The new dashboard's browser-side calls to the public cookie-auth endpoints are dead (browser cookie auth no longer works against Apollo), so these operations currently fail in the dashboard UI. This PR adds dashboard JWT + WorkOS-authenticated internal-dashboard equivalents that the dashboard's tRPC server can call through the typed @composiohq/internal-dashboard-openapi facade, replacing:
PATCH /api/v3/trigger_instances/manage/{triggerId} (enable/disable a trigger)DELETE /api/v3/trigger_instances/manage/{triggerId} (delete a trigger)DELETE /api/v3/internal/user/api_keys/{key_id} (revoke a user API key)| Method | Path | Delegates to |
|---|---|---|
PATCH | /api/internal-dashboard/triggers/manage/{triggerId} | manageTriggerInstanceStatus (same lib call as the public PATCH; body { status: "enable" | "disable" }, schemas imported from the public route so the contract stays mirrored) |
DELETE | /api/internal-dashboard/triggers/manage/{triggerId} | DB_TRIGGER_INSTANCE_GET.byNanoId + DB_TI_UPDATE.softDeleteTriggerInstance (same flow as the public DELETE) |
POST | /api/internal-dashboard/user/api-keys/{keyId}/revoke | DB_USER_API_KEY.revokeById (same lib call as the public user api-key DELETE; POST per the dashboard revoke convention since edge proxies strip DELETE bodies — mirrors internal-dashboard/api-keys/{apiKeyId}/revoke) |
Both trigger routes resolve project scope + membership via resolveDashboardProjectContext (x-project-id header); the user api-key revoke is user-scoped and resolves the caller from the verified dashboard email, with ownership enforced inside revokeById.
@composiohq/internal-dashboard-openapi must be republished (the publish workflow triggers on apps/apollo/src/pages/api/internal-dashboard/**) and the dashboard bumped to the new version before it can call these.pnpm -C apps/apollo run check-types — clean (after regenerating the thermos client locally)pnpm -C apps/apollo run lint / format:check — no errors in new filespnpm -C packages/internal-dashboard-openapi run generate — all 3 new operations appear in the generated spec🤖 Generated with Claude Code