fix: update the permission for create and read the api keys

src/app/api/keys/[id]/route.js

@@ -1,16 +1,25 @@
 import { NextResponse } from "next/server";
-import { deleteApiKey, getApiKeyById, updateApiKey } from "@/lib/localDb";
+import { deleteApiKey, getApiKeyByIdAndOwnerId, updateApiKey } from "@/lib/localDb";
+import { requireCurrentDashboardUser } from "@/lib/auth/currentUser";
+
+async function getOwnedApiKey(id) {
+  const user = await requireCurrentDashboardUser();
+  return getApiKeyByIdAndOwnerId(id, user.id);
+}
 
 // GET /api/keys/[id] - Get single key
 export async function GET(request, { params }) {
   try {
     const { id } = await params;
-    const key = await getApiKeyById(id);
+    const key = await getOwnedApiKey(id);
     if (!key) {
       return NextResponse.json({ error: "Key not found" }, { status: 404 });
     }
     return NextResponse.json({ key });
   } catch (error) {
+    if (error.message === "Unauthorized") {
+      return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    }
     console.log("Error fetching key:", error);
     return NextResponse.json({ error: "Failed to fetch key" }, { status: 500 });
   }
@@ -23,7 +32,7 @@ export async function PUT(request, { params }) {
     const body = await request.json();
     const { isActive } = body;
 
-    const existing = await getApiKeyById(id);
+    const existing = await getOwnedApiKey(id);
     if (!existing) {
       return NextResponse.json({ error: "Key not found" }, { status: 404 });
     }
@@ -35,6 +44,9 @@ export async function PUT(request, { params }) {
 
     return NextResponse.json({ key: updated });
   } catch (error) {
+    if (error.message === "Unauthorized") {
+      return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    }
     console.log("Error updating key:", error);
     return NextResponse.json({ error: "Failed to update key" }, { status: 500 });
   }
@@ -45,6 +57,10 @@ export async function DELETE(request, { params }) {
   try {
     const { id } = await params;
 
+    const existing = await getOwnedApiKey(id);
+    if (!existing) {
+      return NextResponse.json({ error: "Key not found" }, { status: 404 });
+    }
     const deleted = await deleteApiKey(id);
     if (!deleted) {
       return NextResponse.json({ error: "Key not found" }, { status: 404 });
@@ -52,6 +68,9 @@ export async function DELETE(request, { params }) {
 
     return NextResponse.json({ message: "Key deleted successfully" });
   } catch (error) {
+    if (error.message === "Unauthorized") {
+      return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    }
     console.log("Error deleting key:", error);
     return NextResponse.json({ error: "Failed to delete key" }, { status: 500 });
   }