We'd like to include a toggle on the tokens page in the UI that one can switch to show 'all' tokens, or just tokens created by that user. This toggle should only appear if the user is allowed to read tokens created by other users.

@Emyrk Perhaps we can chat about implementation on Monday given you recently touched RBAC? I looked at the code but wasn't sure as to the best path forward given we don't have roles on the FE.

We'd like to include a toggle on the tokens page in the UI that one can switch to show 'all' tokens, or just tokens created by that user. This toggle should only appear if the user is allowed to read tokens created by other users.

@Emyrk Perhaps we can chat about implementation on Monday given you recently touched RBAC? I looked at the code but wasn't sure as to the best path forward given we don't have roles on the FE.

We should not check roles. We should do an authorization check like we do for other FE elements.

We should do a "read" check on an api token owner by a random uuid, which indicates reading any other user's api key

@Emyrk

We should do a "read" check on an api token owner by a random uuid, which indicates reading any other user's api key

I assume we do this check with the /authcheck endpoint.
The api_key model doesn't have a UUID. It just has a string ID. I could:

1. Change the model to use a UUID instead. Nervous about this because it touches auth
2. Add a new endpoint just to check for api_key permissions, modeling the handler off of api.checkAuthorization
3. Something else?

What do you think is the best path forward?

@Emyrk

We should do a "read" check on an api token owner by a random uuid, which indicates reading any other user's api key

I assume we do this check with the /authcheck endpoint. The api_key model doesn't have a UUID. It just has a string ID. I could:

1. Change the model to use a UUID instead. Nervous about this because it touches auth

2. Add a new endpoint just to check for `api_key` permissions, modeling the handler off of `api.checkAuthorization`

3. Something else?

What do you think is the best path forward?

We do not need to specify an ID. That would ask "Can I read the API key 123". But you want to ask, "Can I read all api keys".

The payload should be:

{
	"canReadAllAPIKeys": {
		"action": "read",
		"object": {
			// By not specifying an owner, this checks if all api keys
			// can be read by the user in the `site` scope.
			"resource_type": "api_key"
		}
	}
}