PR Custody

feat(apollo): internal-dashboard routes for trigger manage + user api-key revoke

@sarahsimionescuchecks n/achecks…feat/internal-dashboard-trigger-manage-routes → master5 files · +803 −0review: @sohamganatrareview: @kaavee315review: @anshugarg15updated 7h ago

GitHub

▸Description

Summary

The new dashboard's browser-side calls to the public cookie-auth endpoints are dead (browser cookie auth no longer works against Apollo), so these operations currently fail in the dashboard UI. This PR adds dashboard JWT + WorkOS-authenticated internal-dashboard equivalents that the dashboard's tRPC server can call through the typed @composiohq/internal-dashboard-openapi facade, replacing:

PATCH /api/v3/trigger_instances/manage/{triggerId} (enable/disable a trigger)
DELETE /api/v3/trigger_instances/manage/{triggerId} (delete a trigger)
DELETE /api/v3/internal/user/api_keys/{key_id} (revoke a user API key)

New operations

Method	Path	Delegates to
`PATCH`	`/api/internal-dashboard/triggers/manage/{triggerId}`	`manageTriggerInstanceStatus` (same lib call as the public PATCH; body `{ status: "enable" \| "disable" }`, schemas imported from the public route so the contract stays mirrored)
`DELETE`	`/api/internal-dashboard/triggers/manage/{triggerId}`	`DB_TRIGGER_INSTANCE_GET.byNanoId` + `DB_TI_UPDATE.softDeleteTriggerInstance` (same flow as the public DELETE)
`POST`	`/api/internal-dashboard/user/api-keys/{keyId}/revoke`	`DB_USER_API_KEY.revokeById` (same lib call as the public user api-key DELETE; POST per the dashboard revoke convention since edge proxies strip DELETE bodies — mirrors `internal-dashboard/api-keys/{apiKeyId}/revoke`)

Both trigger routes resolve project scope + membership via resolveDashboardProjectContext (x-project-id header); the user api-key revoke is user-scoped and resolves the caller from the verified dashboard email, with ownership enforced inside revokeById.

Notes

No new business logic — handlers delegate to the same lib functions the public routes call.
Routes are auto-discovered for the internal-dashboard OpenAPI spec (post #10643); verified locally that spec generation picks up all three operations.
After merge: @composiohq/internal-dashboard-openapi must be republished (the publish workflow triggers on apps/apollo/src/pages/api/internal-dashboard/**) and the dashboard bumped to the new version before it can call these.

Verification

pnpm -C apps/apollo run check-types — clean (after regenerating the thermos client locally)
pnpm -C apps/apollo run lint / format:check — no errors in new files
pnpm -C packages/internal-dashboard-openapi run generate — all 3 new operations appear in the generated spec
Not exercised against a live DB — pending CI / staging

🤖 Generated with Claude Code

loading diff…