Add MembersCanCreateApiKey team preference

server/policies/apiKey.ts

@@ -1,3 +1,4 @@
+import { TeamPreference } from "@shared/types";
 import { ApiKey, User, Team } from "@server/models";
 import { allow } from "./cancan";
 import { and, isOwner, isTeamModel, isTeamMutable } from "./utils";
@@ -9,7 +10,9 @@ allow(User, "createApiKey", Team, (actor, team) =>
     isTeamMutable(actor),
     !actor.isViewer,
     !actor.isGuest,
-    !actor.isSuspended
+    !actor.isSuspended,
+    actor.isAdmin ||
+      !!team?.getPreference(TeamPreference.MembersCanCreateApiKey)
   )
 );
 

server/routes/api/teams/schema.ts

@@ -39,6 +39,8 @@ export const TeamsUpdateSchema = BaseSchema.extend({
         viewersCanExport: z.boolean().optional(),
         /** Whether members can invite new people to the team. */
         membersCanInvite: z.boolean().optional(),
+        /** Whether members can create API keys. */
+        membersCanCreateApiKey: z.boolean().optional(),
         /** Whether commenting is enabled */
         commenting: z.boolean().optional(),
         /** The custom theme for the team. */

shared/constants.ts

@@ -18,6 +18,7 @@ export const TeamPreferenceDefaults: TeamPreferences = {
   [TeamPreference.SeamlessEdit]: true,
   [TeamPreference.ViewersCanExport]: true,
   [TeamPreference.MembersCanInvite]: false,
+  [TeamPreference.MembersCanCreateApiKey]: true,
   [TeamPreference.PublicBranding]: false,
   [TeamPreference.Commenting]: true,
   [TeamPreference.CustomTheme]: undefined,

shared/i18n/locales/en_US/translation.json

@@ -918,6 +918,8 @@
   "Allow editors to invite other people to the workspace": "Allow editors to invite other people to the workspace",
   "Require invites": "Require invites",
   "Require members to be invited to the workspace before they can create an account using SSO.": "Require members to be invited to the workspace before they can create an account using SSO.",
+  "API access": "API access",
+  "Allow members to create API keys for programmatic access": "Allow members to create API keys for programmatic access",
   "Default role": "Default role",
   "The default user role for new accounts. Changing this setting does not affect existing user accounts.": "The default user role for new accounts. Changing this setting does not affect existing user accounts.",
   "When enabled, documents can be shared publicly on the internet by any member of the workspace": "When enabled, documents can be shared publicly on the internet by any member of the workspace",

shared/types.ts

@@ -189,6 +189,8 @@ export enum TeamPreference {
   ViewersCanExport = "viewersCanExport",
   /** Whether members can invite new users. */
   MembersCanInvite = "membersCanInvite",
+  /** Whether members can create API keys. */
+  MembersCanCreateApiKey = "membersCanCreateApiKey",
   /** Whether users can comment on documents. */
   Commenting = "commenting",
   /** The custom theme for the team. */
@@ -200,6 +202,7 @@ export type TeamPreferences = {
   [TeamPreference.PublicBranding]?: boolean;
   [TeamPreference.ViewersCanExport]?: boolean;
   [TeamPreference.MembersCanInvite]?: boolean;
+  [TeamPreference.MembersCanCreateApiKey]?: boolean;
   [TeamPreference.Commenting]?: boolean;
   [TeamPreference.CustomTheme]?: Partial<CustomTheme>;
 };