add api key code and oidc auto provision code

server/middlewares/index.ts

@@ -16,3 +16,7 @@ export * from "./verifyUserInRole";
 export * from "./verifyAccessTokenAccess";
 export * from "./verifyUserIsServerAdmin";
 export * from "./verifyIsLoggedInUser";
+export * from "./integration";
+export * from "./verifyValidLicense";
+export * from "./verifyUserHasAction";
+export * from "./verifyApiKeyAccess";

server/middlewares/integration/index.ts

@@ -0,0 +1,17 @@
+// This file is licensed under the Fossorial Commercial License.
+// Unauthorized use, copying, modification, or distribution is strictly prohibited.
+//
+// Copyright (c) 2025 Fossorial LLC. All rights reserved.
+
+export * from "./verifyApiKey";
+export * from "./verifyApiKeyOrgAccess";
+export * from "./verifyApiKeyHasAction";
+export * from "./verifyApiKeySiteAccess";
+export * from "./verifyApiKeyResourceAccess";
+export * from "./verifyApiKeyTargetAccess";
+export * from "./verifyApiKeyRoleAccess";
+export * from "./verifyApiKeyUserAccess";
+export * from "./verifyApiKeySetResourceUsers";
+export * from "./verifyAccessTokenAccess";
+export * from "./verifyApiKeyIsRoot";
+export * from "./verifyApiKeyApiKeyAccess";

server/middlewares/integration/verifyAccessTokenAccess.ts

@@ -0,0 +1,115 @@
+// This file is licensed under the Fossorial Commercial License.
+// Unauthorized use, copying, modification, or distribution is strictly prohibited.
+//
+// Copyright (c) 2025 Fossorial LLC. All rights reserved.
+
+import { Request, Response, NextFunction } from "express";
+import { db } from "@server/db";
+import { resourceAccessToken, resources, apiKeyOrg } from "@server/db/schemas";
+import { and, eq } from "drizzle-orm";
+import createHttpError from "http-errors";
+import HttpCode from "@server/types/HttpCode";
+
+export async function verifyApiKeyAccessTokenAccess(
+    req: Request,
+    res: Response,
+    next: NextFunction
+) {
+    try {
+        const apiKey = req.apiKey;
+        const accessTokenId = req.params.accessTokenId;
+
+        if (!apiKey) {
+            return next(
+                createHttpError(HttpCode.UNAUTHORIZED, "Key not authenticated")
+            );
+        }
+
+        const [accessToken] = await db
+            .select()
+            .from(resourceAccessToken)
+            .where(eq(resourceAccessToken.accessTokenId, accessTokenId))
+            .limit(1);
+
+        if (!accessToken) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `Access token with ID ${accessTokenId} not found`
+                )
+            );
+        }
+
+        const resourceId = accessToken.resourceId;
+
+        if (!resourceId) {
+            return next(
+                createHttpError(
+                    HttpCode.INTERNAL_SERVER_ERROR,
+                    `Access token with ID ${accessTokenId} does not have a resource ID`
+                )
+            );
+        }
+
+        const [resource] = await db
+            .select()
+            .from(resources)
+            .where(eq(resources.resourceId, resourceId))
+            .limit(1);
+
+        if (!resource) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `Resource with ID ${resourceId} not found`
+                )
+            );
+        }
+
+        if (!resource.orgId) {
+            return next(
+                createHttpError(
+                    HttpCode.INTERNAL_SERVER_ERROR,
+                    `Resource with ID ${resourceId} does not have an organization ID`
+                )
+            );
+        }
+
+        // Verify that the API key is linked to the resource's organization
+        if (!req.apiKeyOrg) {
+            const apiKeyOrgResult = await db
+                .select()
+                .from(apiKeyOrg)
+                .where(
+                    and(
+                        eq(apiKeyOrg.apiKeyId, apiKey.apiKeyId),
+                        eq(apiKeyOrg.orgId, resource.orgId)
+                    )
+                )
+                .limit(1);
+
+            if (apiKeyOrgResult.length > 0) {
+                req.apiKeyOrg = apiKeyOrgResult[0];
+            }
+        }
+
+        if (!req.apiKeyOrg) {
+            return next(
+                createHttpError(
+                    HttpCode.FORBIDDEN,
+                    "Key does not have access to this organization"
+                )
+            );
+        }
+
+
+        return next();
+    } catch (e) {
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                "Error verifying access token access"
+            )
+        );
+    }
+}

server/middlewares/integration/verifyApiKey.ts

@@ -0,0 +1,65 @@
+// This file is licensed under the Fossorial Commercial License.
+// Unauthorized use, copying, modification, or distribution is strictly prohibited.
+//
+// Copyright (c) 2025 Fossorial LLC. All rights reserved.
+
+import { verifyPassword } from "@server/auth/password";
+import db from "@server/db";
+import { apiKeys } from "@server/db/schemas";
+import logger from "@server/logger";
+import HttpCode from "@server/types/HttpCode";
+import { eq } from "drizzle-orm";
+import { Request, Response, NextFunction } from "express";
+import createHttpError from "http-errors";
+
+export async function verifyApiKey(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<void> {
+    try {
+        const authHeader = req.headers["authorization"];
+
+        if (!authHeader || !authHeader.startsWith("Bearer ")) {
+            return next(
+                createHttpError(HttpCode.UNAUTHORIZED, "API key required")
+            );
+        }
+
+        const key = authHeader.split(" ")[1]; // Get the token part after "Bearer"
+        const [apiKeyId, apiKeySecret] = key.split(".");
+
+        const [apiKey] = await db
+            .select()
+            .from(apiKeys)
+            .where(eq(apiKeys.apiKeyId, apiKeyId))
+            .limit(1);
+
+        if (!apiKey) {
+            return next(
+                createHttpError(HttpCode.UNAUTHORIZED, "Invalid API key")
+            );
+        }
+
+        const secretHash = apiKey.apiKeyHash;
+        const valid = await verifyPassword(apiKeySecret, secretHash);
+
+        if (!valid) {
+            return next(
+                createHttpError(HttpCode.UNAUTHORIZED, "Invalid API key")
+            );
+        }
+
+        req.apiKey = apiKey;
+
+        return next();
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                "An error occurred checking API key"
+            )
+        );
+    }
+}

server/middlewares/integration/verifyApiKeyApiKeyAccess.ts

@@ -0,0 +1,86 @@
+// This file is licensed under the Fossorial Commercial License.
+// Unauthorized use, copying, modification, or distribution is strictly prohibited.
+//
+// Copyright (c) 2025 Fossorial LLC. All rights reserved.
+
+import { Request, Response, NextFunction } from "express";
+import { db } from "@server/db";
+import { apiKeys, apiKeyOrg } from "@server/db/schemas";
+import { and, eq, or } from "drizzle-orm";
+import createHttpError from "http-errors";
+import HttpCode from "@server/types/HttpCode";
+
+export async function verifyApiKeyApiKeyAccess(
+    req: Request,
+    res: Response,
+    next: NextFunction
+) {
+    try {
+        const {apiKey: callerApiKey } = req;
+
+        const apiKeyId =
+            req.params.apiKeyId || req.body.apiKeyId || req.query.apiKeyId;
+        const orgId = req.params.orgId;
+
+        if (!callerApiKey) {
+            return next(
+                createHttpError(HttpCode.UNAUTHORIZED, "Key not authenticated")
+            );
+        }
+
+        if (!orgId) {
+            return next(
+                createHttpError(HttpCode.BAD_REQUEST, "Invalid organization ID")
+            );
+        }
+
+        if (!apiKeyId) {
+            return next(
+                createHttpError(HttpCode.BAD_REQUEST, "Invalid key ID")
+            );
+        }
+
+        const [callerApiKeyOrg] = await db
+            .select()
+            .from(apiKeyOrg)
+            .where(
+                and(eq(apiKeys.apiKeyId, callerApiKey.apiKeyId), eq(apiKeyOrg.orgId, orgId))
+            )
+            .limit(1);
+
+        if (!callerApiKeyOrg) {
+            return next(
+                createHttpError(
+                    HttpCode.INTERNAL_SERVER_ERROR,
+                    `API key with ID ${apiKeyId} does not have an organization ID`
+                )
+            );
+        }
+
+        const [otherApiKeyOrg] = await db
+            .select()
+            .from(apiKeyOrg)
+            .where(
+                and(eq(apiKeys.apiKeyId, apiKeyId), eq(apiKeyOrg.orgId, orgId))
+            )
+            .limit(1);
+
+        if (!otherApiKeyOrg) {
+            return next(
+                createHttpError(
+                    HttpCode.FORBIDDEN,
+                    `API key with ID ${apiKeyId} does not have access to organization with ID ${orgId}`
+                )
+            );
+        }
+
+        return next();
+    } catch (error) {
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                "Error verifying key access"
+            )
+        );
+    }
+}

server/middlewares/integration/verifyApiKeyHasAction.ts

@@ -0,0 +1,61 @@
+// This file is licensed under the Fossorial Commercial License.
+// Unauthorized use, copying, modification, or distribution is strictly prohibited.
+//
+// Copyright (c) 2025 Fossorial LLC. All rights reserved.
+
+import { Request, Response, NextFunction } from "express";
+import createHttpError from "http-errors";
+import HttpCode from "@server/types/HttpCode";
+import logger from "@server/logger";
+import { ActionsEnum } from "@server/auth/actions";
+import db from "@server/db";
+import { apiKeyActions } from "@server/db/schemas";
+import { and, eq } from "drizzle-orm";
+
+export function verifyApiKeyHasAction(action: ActionsEnum) {
+    return async function (
+        req: Request,
+        res: Response,
+        next: NextFunction
+    ): Promise<any> {
+        try {
+            if (!req.apiKey) {
+                return next(
+                    createHttpError(
+                        HttpCode.UNAUTHORIZED,
+                        "API Key not authenticated"
+                    )
+                );
+            }
+
+            const [actionRes] = await db
+                .select()
+                .from(apiKeyActions)
+                .where(
+                    and(
+                        eq(apiKeyActions.apiKeyId, req.apiKey.apiKeyId),
+                        eq(apiKeyActions.actionId, action)
+                    )
+                );
+
+            if (!actionRes) {
+                return next(
+                    createHttpError(
+                        HttpCode.FORBIDDEN,
+                        "Key does not have permission perform this action"
+                    )
+                );
+            }
+
+            return next();
+        } catch (error) {
+            logger.error("Error verifying key action access:", error);
+            return next(
+                createHttpError(
+                    HttpCode.INTERNAL_SERVER_ERROR,
+                    "Error verifying key action access"
+                )
+            );
+        }
+    };
+}

server/middlewares/integration/verifyApiKeyIsRoot.ts

@@ -0,0 +1,44 @@
+// This file is licensed under the Fossorial Commercial License.
+// Unauthorized use, copying, modification, or distribution is strictly prohibited.
+//
+// Copyright (c) 2025 Fossorial LLC. All rights reserved.
+
+import logger from "@server/logger";
+import HttpCode from "@server/types/HttpCode";
+import { Request, Response, NextFunction } from "express";
+import createHttpError from "http-errors";
+
+export async function verifyApiKeyIsRoot(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<void> {
+    try {
+        const { apiKey } = req;
+
+        if (!apiKey) {
+            return next(
+                createHttpError(HttpCode.UNAUTHORIZED, "Key not authenticated")
+            );
+        }
+
+        if (!apiKey.isRoot) {
+            return next(
+                createHttpError(
+                    HttpCode.FORBIDDEN,
+                    "Key does not have root access"
+                )
+            );
+        }
+
+        return next();
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                "An error occurred checking API key"
+            )
+        );
+    }
+}

server/middlewares/integration/verifyApiKeyOrgAccess.ts

@@ -0,0 +1,66 @@
+// This file is licensed under the Fossorial Commercial License.
+// Unauthorized use, copying, modification, or distribution is strictly prohibited.
+//
+// Copyright (c) 2025 Fossorial LLC. All rights reserved.
+
+import { Request, Response, NextFunction } from "express";
+import { db } from "@server/db";
+import { apiKeyOrg } from "@server/db/schemas";
+import { and, eq } from "drizzle-orm";
+import createHttpError from "http-errors";
+import HttpCode from "@server/types/HttpCode";
+import logger from "@server/logger";
+
+export async function verifyApiKeyOrgAccess(
+    req: Request,
+    res: Response,
+    next: NextFunction
+) {
+    try {
+        const apiKeyId = req.apiKey?.apiKeyId;
+        const orgId = req.params.orgId;
+
+        if (!apiKeyId) {
+            return next(
+                createHttpError(HttpCode.UNAUTHORIZED, "Key not authenticated")
+            );
+        }
+
+        if (!orgId) {
+            return next(
+                createHttpError(HttpCode.BAD_REQUEST, "Invalid organization ID")
+            );
+        }
+
+        if (!req.apiKeyOrg) {
+            const apiKeyOrgRes = await db
+                .select()
+                .from(apiKeyOrg)
+                .where(
+                    and(
+                        eq(apiKeyOrg.apiKeyId, apiKeyId),
+                        eq(apiKeyOrg.orgId, orgId)
+                    )
+                );
+            req.apiKeyOrg = apiKeyOrgRes[0];
+        }
+
+        if (!req.apiKeyOrg) {
+            next(
+                createHttpError(
+                    HttpCode.FORBIDDEN,
+                    "Key does not have access to this organization"
+                )
+            );
+        }
+
+        return next();
+    } catch (e) {
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                "Error verifying organization access"
+            )
+        );
+    }
+}

server/middlewares/integration/verifyApiKeyResourceAccess.ts

@@ -0,0 +1,90 @@
+// This file is licensed under the Fossorial Commercial License.
+// Unauthorized use, copying, modification, or distribution is strictly prohibited.
+//
+// Copyright (c) 2025 Fossorial LLC. All rights reserved.
+
+import { Request, Response, NextFunction } from "express";
+import { db } from "@server/db";
+import { resources, apiKeyOrg } from "@server/db/schemas";
+import { eq, and } from "drizzle-orm";
+import createHttpError from "http-errors";
+import HttpCode from "@server/types/HttpCode";
+
+export async function verifyApiKeyResourceAccess(
+    req: Request,
+    res: Response,
+    next: NextFunction
+) {
+    const apiKey = req.apiKey;
+    const resourceId =
+        req.params.resourceId || req.body.resourceId || req.query.resourceId;
+
+    if (!apiKey) {
+        return next(
+            createHttpError(HttpCode.UNAUTHORIZED, "Key not authenticated")
+        );
+    }
+
+    try {
+        // Retrieve the resource
+        const [resource] = await db
+            .select()
+            .from(resources)
+            .where(eq(resources.resourceId, resourceId))
+            .limit(1);
+
+        if (!resource) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `Resource with ID ${resourceId} not found`
+                )
+            );
+        }
+
+        if (!resource.orgId) {
+            return next(
+                createHttpError(
+                    HttpCode.INTERNAL_SERVER_ERROR,
+                    `Resource with ID ${resourceId} does not have an organization ID`
+                )
+            );
+        }
+
+        // Verify that the API key is linked to the resource's organization
+        if (!req.apiKeyOrg) {
+            const apiKeyOrgResult = await db
+                .select()
+                .from(apiKeyOrg)
+                .where(
+                    and(
+                        eq(apiKeyOrg.apiKeyId, apiKey.apiKeyId),
+                        eq(apiKeyOrg.orgId, resource.orgId)
+                    )
+                )
+                .limit(1);
+
+            if (apiKeyOrgResult.length > 0) {
+                req.apiKeyOrg = apiKeyOrgResult[0];
+            }
+        }
+
+        if (!req.apiKeyOrg) {
+            return next(
+                createHttpError(
+                    HttpCode.FORBIDDEN,
+                    "Key does not have access to this organization"
+                )
+            );
+        }
+
+        return next();
+    } catch (error) {
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                "Error verifying resource access"
+            )
+        );
+    }
+}

server/middlewares/integration/verifyApiKeyRoleAccess.ts

@@ -0,0 +1,132 @@
+// This file is licensed under the Fossorial Commercial License.
+// Unauthorized use, copying, modification, or distribution is strictly prohibited.
+//
+// Copyright (c) 2025 Fossorial LLC. All rights reserved.
+
+import { Request, Response, NextFunction } from "express";
+import { db } from "@server/db";
+import { roles, apiKeyOrg } from "@server/db/schemas";
+import { and, eq, inArray } from "drizzle-orm";
+import createHttpError from "http-errors";
+import HttpCode from "@server/types/HttpCode";
+import logger from "@server/logger";
+
+export async function verifyApiKeyRoleAccess(
+    req: Request,
+    res: Response,
+    next: NextFunction
+) {
+    try {
+        const apiKey = req.apiKey;
+        const singleRoleId = parseInt(
+            req.params.roleId || req.body.roleId || req.query.roleId
+        );
+
+        if (!apiKey) {
+            return next(
+                createHttpError(HttpCode.UNAUTHORIZED, "Key not authenticated")
+            );
+        }
+
+        const { roleIds } = req.body;
+        const allRoleIds =
+            roleIds || (isNaN(singleRoleId) ? [] : [singleRoleId]);
+
+        if (allRoleIds.length === 0) {
+            return next();
+        }
+
+        const rolesData = await db
+            .select()
+            .from(roles)
+            .where(inArray(roles.roleId, allRoleIds));
+
+        if (rolesData.length !== allRoleIds.length) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    "One or more roles not found"
+                )
+            );
+        }
+
+        const orgIds = new Set(rolesData.map((role) => role.orgId));
+
+        for (const role of rolesData) {
+            const apiKeyOrgAccess = await db
+                .select()
+                .from(apiKeyOrg)
+                .where(
+                    and(
+                        eq(apiKeyOrg.apiKeyId, apiKey.apiKeyId),
+                        eq(apiKeyOrg.orgId, role.orgId!)
+                    )
+                )
+                .limit(1);
+
+            if (apiKeyOrgAccess.length === 0) {
+                return next(
+                    createHttpError(
+                        HttpCode.FORBIDDEN,
+                        `Key does not have access to organization for role ID ${role.roleId}`
+                    )
+                );
+            }
+        }
+
+        if (orgIds.size > 1) {
+            return next(
+                createHttpError(
+                    HttpCode.FORBIDDEN,
+                    "Roles must belong to the same organization"
+                )
+            );
+        }
+
+        const orgId = orgIds.values().next().value;
+
+        if (!orgId) {
+            return next(
+                createHttpError(
+                    HttpCode.INTERNAL_SERVER_ERROR,
+                    "Roles do not have an organization ID"
+                )
+            );
+        }
+
+        if (!req.apiKeyOrg) {
+            // Retrieve the API key's organization link if not already set
+            const apiKeyOrgRes = await db
+                .select()
+                .from(apiKeyOrg)
+                .where(
+                    and(
+                        eq(apiKeyOrg.apiKeyId, apiKey.apiKeyId),
+                        eq(apiKeyOrg.orgId, orgId)
+                    )
+                )
+                .limit(1);
+
+            if (apiKeyOrgRes.length === 0) {
+                return next(
+                    createHttpError(
+                        HttpCode.FORBIDDEN,
+                        "Key does not have access to this organization"
+                    )
+                );
+            }
+
+            req.apiKeyOrg = apiKeyOrgRes[0];
+        }
+
+        return next();
+    } catch (error) {
+        logger.error("Error verifying role access:", error);
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                "Error verifying role access"
+            )
+        );
+    }
+}

server/middlewares/integration/verifyApiKeySetResourceUsers.ts

@@ -0,0 +1,74 @@
+// This file is licensed under the Fossorial Commercial License.
+// Unauthorized use, copying, modification, or distribution is strictly prohibited.
+//
+// Copyright (c) 2025 Fossorial LLC. All rights reserved.
+
+import { Request, Response, NextFunction } from "express";
+import { db } from "@server/db";
+import { userOrgs } from "@server/db/schemas";
+import { and, eq, inArray } from "drizzle-orm";
+import createHttpError from "http-errors";
+import HttpCode from "@server/types/HttpCode";
+
+export async function verifyApiKeySetResourceUsers(
+    req: Request,
+    res: Response,
+    next: NextFunction
+) {
+    const apiKey = req.apiKey;
+    const userIds = req.body.userIds;
+
+    if (!apiKey) {
+        return next(
+            createHttpError(HttpCode.UNAUTHORIZED, "Key not authenticated")
+        );
+    }
+
+    if (!req.apiKeyOrg) {
+        return next(
+            createHttpError(
+                HttpCode.FORBIDDEN,
+                "Key does not have access to this organization"
+            )
+        );
+    }
+
+    if (!userIds) {
+        return next(createHttpError(HttpCode.BAD_REQUEST, "Invalid user IDs"));
+    }
+
+    if (userIds.length === 0) {
+        return next();
+    }
+
+    try {
+        const orgId = req.apiKeyOrg.orgId;
+        const userOrgsData = await db
+            .select()
+            .from(userOrgs)
+            .where(
+                and(
+                    inArray(userOrgs.userId, userIds),
+                    eq(userOrgs.orgId, orgId)
+                )
+            );
+
+        if (userOrgsData.length !== userIds.length) {
+            return next(
+                createHttpError(
+                    HttpCode.FORBIDDEN,
+                    "Key does not have access to one or more specified users"
+                )
+            );
+        }
+
+        return next();
+    } catch (error) {
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                "Error checking if key has access to the specified users"
+            )
+        );
+    }
+}

server/middlewares/integration/verifyApiKeySiteAccess.ts

@@ -0,0 +1,94 @@
+// This file is licensed under the Fossorial Commercial License.
+// Unauthorized use, copying, modification, or distribution is strictly prohibited.
+//
+// Copyright (c) 2025 Fossorial LLC. All rights reserved.
+
+import { Request, Response, NextFunction } from "express";
+import { db } from "@server/db";
+import {
+    sites,
+    apiKeyOrg
+} from "@server/db/schemas";
+import { and, eq, or } from "drizzle-orm";
+import createHttpError from "http-errors";
+import HttpCode from "@server/types/HttpCode";
+
+export async function verifyApiKeySiteAccess(
+    req: Request,
+    res: Response,
+    next: NextFunction
+) {
+    try {
+        const apiKey = req.apiKey;
+        const siteId = parseInt(
+            req.params.siteId || req.body.siteId || req.query.siteId
+        );
+
+        if (!apiKey) {
+            return next(
+                createHttpError(HttpCode.UNAUTHORIZED, "Key not authenticated")
+            );
+        }
+
+        if (isNaN(siteId)) {
+            return next(
+                createHttpError(HttpCode.BAD_REQUEST, "Invalid site ID")
+            );
+        }
+
+        const site = await db
+            .select()
+            .from(sites)
+            .where(eq(sites.siteId, siteId))
+            .limit(1);
+
+        if (site.length === 0) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `Site with ID ${siteId} not found`
+                )
+            );
+        }
+
+        if (!site[0].orgId) {
+            return next(
+                createHttpError(
+                    HttpCode.INTERNAL_SERVER_ERROR,
+                    `Site with ID ${siteId} does not have an organization ID`
+                )
+            );
+        }
+
+        if (!req.apiKeyOrg) {
+            const apiKeyOrgRes = await db
+                .select()
+                .from(apiKeyOrg)
+                .where(
+                    and(
+                        eq(apiKeyOrg.apiKeyId, apiKey.apiKeyId),
+                        eq(apiKeyOrg.orgId, site[0].orgId)
+                    )
+                );
+            req.apiKeyOrg = apiKeyOrgRes[0];
+        }
+
+        if (!req.apiKeyOrg) {
+            return next(
+                createHttpError(
+                    HttpCode.FORBIDDEN,
+                    "Key does not have access to this organization"
+                )
+            );
+        }
+
+        return next();
+    } catch (error) {
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                "Error verifying site access"
+            )
+        );
+    }
+}

server/middlewares/integration/verifyApiKeyTargetAccess.ts

@@ -0,0 +1,117 @@
+// This file is licensed under the Fossorial Commercial License.
+// Unauthorized use, copying, modification, or distribution is strictly prohibited.
+//
+// Copyright (c) 2025 Fossorial LLC. All rights reserved.
+
+import { Request, Response, NextFunction } from "express";
+import { db } from "@server/db";
+import { resources, targets, apiKeyOrg } from "@server/db/schemas";
+import { and, eq } from "drizzle-orm";
+import createHttpError from "http-errors";
+import HttpCode from "@server/types/HttpCode";
+
+export async function verifyApiKeyTargetAccess(
+    req: Request,
+    res: Response,
+    next: NextFunction
+) {
+    try {
+        const apiKey = req.apiKey;
+        const targetId = parseInt(req.params.targetId);
+
+        if (!apiKey) {
+            return next(
+                createHttpError(HttpCode.UNAUTHORIZED, "Key not authenticated")
+            );
+        }
+
+        if (isNaN(targetId)) {
+            return next(
+                createHttpError(HttpCode.BAD_REQUEST, "Invalid target ID")
+            );
+        }
+
+        const [target] = await db
+            .select()
+            .from(targets)
+            .where(eq(targets.targetId, targetId))
+            .limit(1);
+
+        if (!target) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `Target with ID ${targetId} not found`
+                )
+            );
+        }
+
+        const resourceId = target.resourceId;
+        if (!resourceId) {
+            return next(
+                createHttpError(
+                    HttpCode.INTERNAL_SERVER_ERROR,
+                    `Target with ID ${targetId} does not have a resource ID`
+                )
+            );
+        }
+
+        const [resource] = await db
+            .select()
+            .from(resources)
+            .where(eq(resources.resourceId, resourceId))
+            .limit(1);
+
+        if (!resource) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `Resource with ID ${resourceId} not found`
+                )
+            );
+        }
+
+        if (!resource.orgId) {
+            return next(
+                createHttpError(
+                    HttpCode.INTERNAL_SERVER_ERROR,
+                    `Resource with ID ${resourceId} does not have an organization ID`
+                )
+            );
+        }
+
+        if (!req.apiKeyOrg) {
+            const apiKeyOrgResult = await db
+                .select()
+                .from(apiKeyOrg)
+                .where(
+                    and(
+                        eq(apiKeyOrg.apiKeyId, apiKey.apiKeyId),
+                        eq(apiKeyOrg.orgId, resource.orgId)
+                    )
+                )
+                .limit(1);
+            if (apiKeyOrgResult.length > 0) {
+                req.apiKeyOrg = apiKeyOrgResult[0];
+            }
+        }
+
+        if (!req.apiKeyOrg) {
+            return next(
+                createHttpError(
+                    HttpCode.FORBIDDEN,
+                    "Key does not have access to this organization"
+                )
+            );
+        }
+
+        return next();
+    } catch (error) {
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                "Error verifying target access"
+            )
+        );
+    }
+}

server/middlewares/integration/verifyApiKeyUserAccess.ts

@@ -0,0 +1,72 @@
+// This file is licensed under the Fossorial Commercial License.
+// Unauthorized use, copying, modification, or distribution is strictly prohibited.
+//
+// Copyright (c) 2025 Fossorial LLC. All rights reserved.
+
+import { Request, Response, NextFunction } from "express";
+import { db } from "@server/db";
+import { userOrgs } from "@server/db/schemas";
+import { and, eq } from "drizzle-orm";
+import createHttpError from "http-errors";
+import HttpCode from "@server/types/HttpCode";
+
+export async function verifyApiKeyUserAccess(
+    req: Request,
+    res: Response,
+    next: NextFunction
+) {
+    try {
+        const apiKey = req.apiKey;
+        const reqUserId =
+            req.params.userId || req.body.userId || req.query.userId;
+
+        if (!apiKey) {
+            return next(
+                createHttpError(HttpCode.UNAUTHORIZED, "Key not authenticated")
+            );
+        }
+
+        if (!reqUserId) {
+            return next(
+                createHttpError(HttpCode.BAD_REQUEST, "Invalid user ID")
+            );
+        }
+
+        if (!req.apiKeyOrg || !req.apiKeyOrg.orgId) {
+            return next(
+                createHttpError(
+                    HttpCode.FORBIDDEN,
+                    "Key does not have organization access"
+                )
+            );
+        }
+
+        const orgId = req.apiKeyOrg.orgId;
+
+        const [userOrgRecord] = await db
+            .select()
+            .from(userOrgs)
+            .where(
+                and(eq(userOrgs.userId, reqUserId), eq(userOrgs.orgId, orgId))
+            )
+            .limit(1);
+
+        if (!userOrgRecord) {
+            return next(
+                createHttpError(
+                    HttpCode.FORBIDDEN,
+                    "Key does not have access to this user"
+                )
+            );
+        }
+
+        return next();
+    } catch (error) {
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                "Error checking if key has access to this user"
+            )
+        );
+    }
+}

server/middlewares/verifyApiKeyAccess.ts

@@ -0,0 +1,104 @@
+// This file is licensed under the Fossorial Commercial License.
+// Unauthorized use, copying, modification, or distribution is strictly prohibited.
+//
+// Copyright (c) 2025 Fossorial LLC. All rights reserved.
+
+import { Request, Response, NextFunction } from "express";
+import { db } from "@server/db";
+import { userOrgs, apiKeys, apiKeyOrg } from "@server/db/schemas";
+import { and, eq, or } from "drizzle-orm";
+import createHttpError from "http-errors";
+import HttpCode from "@server/types/HttpCode";
+
+export async function verifyApiKeyAccess(
+    req: Request,
+    res: Response,
+    next: NextFunction
+) {
+    try {
+        const userId = req.user!.userId;
+        const apiKeyId =
+            req.params.apiKeyId || req.body.apiKeyId || req.query.apiKeyId;
+        const orgId = req.params.orgId;
+
+        if (!userId) {
+            return next(
+                createHttpError(HttpCode.UNAUTHORIZED, "User not authenticated")
+            );
+        }
+
+        if (!orgId) {
+            return next(
+                createHttpError(HttpCode.BAD_REQUEST, "Invalid organization ID")
+            );
+        }
+
+        if (!apiKeyId) {
+            return next(
+                createHttpError(HttpCode.BAD_REQUEST, "Invalid key ID")
+            );
+        }
+
+        const [apiKey] = await db
+            .select()
+            .from(apiKeys)
+            .innerJoin(apiKeyOrg, eq(apiKeys.apiKeyId, apiKeyOrg.apiKeyId))
+            .where(
+                and(eq(apiKeys.apiKeyId, apiKeyId), eq(apiKeyOrg.orgId, orgId))
+            )
+            .limit(1);
+
+        if (!apiKey.apiKeys) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `API key with ID ${apiKeyId} not found`
+                )
+            );
+        }
+
+        if (!apiKeyOrg.orgId) {
+            return next(
+                createHttpError(
+                    HttpCode.INTERNAL_SERVER_ERROR,
+                    `API key with ID ${apiKeyId} does not have an organization ID`
+                )
+            );
+        }
+
+        if (!req.userOrg) {
+            const userOrgRole = await db
+                .select()
+                .from(userOrgs)
+                .where(
+                    and(
+                        eq(userOrgs.userId, userId),
+                        eq(userOrgs.orgId, apiKeyOrg.orgId)
+                    )
+                )
+                .limit(1);
+            req.userOrg = userOrgRole[0];
+        }
+
+        if (!req.userOrg) {
+            return next(
+                createHttpError(
+                    HttpCode.FORBIDDEN,
+                    "User does not have access to this organization"
+                )
+            );
+        }
+
+        const userOrgRoleId = req.userOrg.roleId;
+        req.userOrgRoleId = userOrgRoleId;
+
+        return next();
+    } catch (error) {
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                "Error verifying key access"
+            )
+        );
+    }
+}

server/middlewares/verifyValidLicense.ts

@@ -0,0 +1,33 @@
+// This file is licensed under the Fossorial Commercial License.
+// Unauthorized use, copying, modification, or distribution is strictly prohibited.
+//
+// Copyright (c) 2025 Fossorial LLC. All rights reserved.
+
+import { Request, Response, NextFunction } from "express";
+import createHttpError from "http-errors";
+import HttpCode from "@server/types/HttpCode";
+import license from "@server/license/license";
+
+export async function verifyValidLicense(
+    req: Request,
+    res: Response,
+    next: NextFunction
+) {
+    try {
+        const unlocked = await license.isUnlocked();
+        if (!unlocked) {
+            return next(
+                createHttpError(HttpCode.FORBIDDEN, "License is not valid")
+            );
+        }
+
+        return next();
+    } catch (e) {
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                "Error verifying license"
+            )
+        );
+    }
+}