fix

apps/api/internal/httpapi/apikey_handlers.go

@@ -1,11 +1,14 @@
 package httpapi
 
 import (
+	"errors"
 	"net/http"
+	"strings"
 
 	"github.com/descrybe/descrybe-v2/apps/api/internal/auth"
 	"github.com/go-chi/chi/v5"
 	"github.com/google/uuid"
+	"github.com/jackc/pgx/v5"
 )
 
 func (s *Server) handleListAPIKeys(w http.ResponseWriter, r *http.Request) {
@@ -80,6 +83,61 @@ func (s *Server) handleCreateAPIKey(w http.ResponseWriter, r *http.Request) {
 	})
 }
 
+func (s *Server) handleUpdateAPIKey(w http.ResponseWriter, r *http.Request) {
+	cid, _ := CompanyIDFromContext(r.Context())
+	if !s.allowCompanyAdminOrPlatform(w, r) {
+		return
+	}
+	if !s.requireFeatures(w, r, "settings.api_keys", "capability.api_access") {
+		return
+	}
+	id, err := uuid.Parse(chi.URLParam(r, "id"))
+	if err != nil {
+		Error(w, http.StatusBadRequest, "invalid id")
+		return
+	}
+	var body struct {
+		Name string `json:"name"`
+	}
+	if err := DecodeJSON(r, &body); err != nil {
+		Error(w, http.StatusBadRequest, "invalid json")
+		return
+	}
+	name := strings.TrimSpace(body.Name)
+	if name == "" {
+		Error(w, http.StatusBadRequest, "name required")
+		return
+	}
+	if len(name) > 120 {
+		Error(w, http.StatusBadRequest, "name too long")
+		return
+	}
+	var (
+		outID    uuid.UUID
+		outName  string
+		prefix   string
+		lastUsed any
+		created  any
+	)
+	err = s.Pool.QueryRow(r.Context(), `
+		UPDATE api_keys
+		SET name = $3, updated_at = now()
+		WHERE id = $1 AND company_id = $2 AND revoked_at IS NULL
+		RETURNING id, name, key_prefix, last_used_at, created_at`,
+		id, cid, name).Scan(&outID, &outName, &prefix, &lastUsed, &created)
+	if errors.Is(err, pgx.ErrNoRows) {
+		Error(w, http.StatusNotFound, "not found")
+		return
+	}
+	if err != nil {
+		Error(w, http.StatusInternalServerError, "update failed")
+		return
+	}
+	JSON(w, http.StatusOK, map[string]any{
+		"id": outID, "name": outName, "key_prefix": prefix, "last_used_at": lastUsed, "created_at": created,
+	})
+}
+
 func (s *Server) handleRevokeAPIKey(w http.ResponseWriter, r *http.Request) {
 	cid, _ := CompanyIDFromContext(r.Context())
 	if !s.allowCompanyAdminOrPlatform(w, r) {