packages/console/core/script/create-api-key.ts

import { Resource } from "@opencode-ai/console-resource"
import { and, Database, eq, isNull } from "../src/drizzle/index.js"
import { Identifier } from "../src/identifier.js"
import { AccountTable } from "../src/schema/account.sql.js"
import { AuthTable } from "../src/schema/auth.sql.js"
import { BillingTable } from "../src/schema/billing.sql.js"
import { KeyTable } from "../src/schema/key.sql.js"
import { UserTable } from "../src/schema/user.sql.js"
import { WorkspaceTable } from "../src/schema/workspace.sql.js"
import { centsToMicroCents } from "../src/util/price.js"

const args = parseArgs(process.argv.slice(2))
if (!args.email) {
  console.error(
    "Usage: bun script/create-api-key.ts --email <email> [--workspace-id <wrk_...>] [--workspace-name <name>] [--key-name <name>] [--balance-dollars <amount>] [--allow-production]",
  )
  process.exit(1)
}
if (Resource.App.stage === "production" && !args.allowProduction) {
  throw new Error("Refusing to create a production API key without --allow-production")
}

const result = await Database.transaction(async (tx) => {
  const auth = await tx
    .select()
    .from(AuthTable)
    .where(and(eq(AuthTable.provider, "email"), eq(AuthTable.subject, args.email)))
    .then((rows) => rows[0])
  const accountID = auth?.accountID ?? Identifier.create("account")
  if (!auth) {
    await tx.insert(AccountTable).values({ id: accountID })
    await tx.insert(AuthTable).values({
      id: Identifier.create("auth"),
      provider: "email",
      subject: args.email,
      accountID,
    })
  }

  const workspace = args.workspaceID
    ? await tx
        .select()
        .from(WorkspaceTable)
        .where(eq(WorkspaceTable.id, args.workspaceID))
        .then((rows) => rows[0])
    : await tx
        .select({ workspace: WorkspaceTable })
        .from(UserTable)
        .innerJoin(WorkspaceTable, eq(WorkspaceTable.id, UserTable.workspaceID))
        .where(and(eq(UserTable.accountID, accountID), isNull(UserTable.timeDeleted)))
        .then((rows) => rows[0]?.workspace)
  if (args.workspaceID && !workspace) throw new Error(`Workspace not found: ${args.workspaceID}`)
  const workspaceID = workspace?.id ?? Identifier.create("workspace")
  if (!workspace) {
    await tx.insert(WorkspaceTable).values({
      id: workspaceID,
      slug: null,
      name: args.workspaceName ?? `${args.email} manual`,
    })
  }

  const user = await tx
    .select()
    .from(UserTable)
    .where(
      and(eq(UserTable.workspaceID, workspaceID), eq(UserTable.accountID, accountID), isNull(UserTable.timeDeleted)),
    )
    .then((rows) => rows[0])
  const userID = user?.id ?? Identifier.create("user")
  if (!user) {
    await tx.insert(UserTable).values({
      id: userID,
      workspaceID,
      accountID,
      email: args.email,
      name: args.email,
      role: "admin",
    })
  }

  const balance = centsToMicroCents(args.balanceDollars * 100)
  const billing = await tx
    .select()
    .from(BillingTable)
    .where(eq(BillingTable.workspaceID, workspaceID))
    .then((rows) => rows[0])
  if (!billing) {
    await tx.insert(BillingTable).values({
      id: Identifier.create("billing"),
      workspaceID,
      balance,
    })
  } else if (billing.balance < balance) {
    await tx.update(BillingTable).set({ balance }).where(eq(BillingTable.workspaceID, workspaceID))
  }

  const secretKey = createSecretKey()
  const keyID = Identifier.create("key")
  await tx.insert(KeyTable).values({
    id: keyID,
    workspaceID,
    userID,
    name: args.keyName ?? "Manual API Key",
    key: secretKey,
    timeUsed: null,
  })

  return { accountID, workspaceID, userID, keyID, secretKey }
})

console.log(JSON.stringify({ stage: Resource.App.stage, ...result }, null, 2))

function createSecretKey() {
  const chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"
  const values = new Uint32Array(64)
  crypto.getRandomValues(values)
  return `sk-${Array.from(values, (value) => chars[value % chars.length]).join("")}`
}

function parseArgs(argv: string[]) {
  const parsed = {
    email: "",
    workspaceID: "",
    workspaceName: "",
    keyName: "",
    balanceDollars: 100,
    allowProduction: false,
  }
  for (let index = 0; index < argv.length; index++) {
    const arg = argv[index]
    if (arg === "--email") parsed.email = requiredValue(argv, ++index, arg)
    if (arg === "--workspace-id") parsed.workspaceID = requiredValue(argv, ++index, arg)
    if (arg === "--workspace-name") parsed.workspaceName = requiredValue(argv, ++index, arg)
    if (arg === "--key-name") parsed.keyName = requiredValue(argv, ++index, arg)
    if (arg === "--balance-dollars") parsed.balanceDollars = Number(requiredValue(argv, ++index, arg))
    if (arg === "--allow-production") parsed.allowProduction = true
  }
  if (!Number.isFinite(parsed.balanceDollars) || parsed.balanceDollars < 0) throw new Error("Invalid --balance-dollars")
  return parsed
}

function requiredValue(argv: string[], index: number, arg: string) {
  const value = argv[index]
  if (!value || value.startsWith("--")) throw new Error(`Missing value for ${arg}`)
  return value
}