fix: server action (#698)

* fix: server action

* docs: add comment

* fix: ts error

apps/web/src/app/app/[workspaceSlug]/(dashboard)/settings/api-token/_components/actions.ts

···
 "use server";
 
+import { currentUser } from "@clerk/nextjs";
 import { Unkey } from "@unkey/api";
 
+import { db, eq } from "@openstatus/db";
+import { user, usersToWorkspaces, workspace } from "@openstatus/db/src/schema";
+
 import { env } from "@/env";
 
 const unkey = new Unkey({ token: env.UNKEY_TOKEN, cache: "no-cache" });
+
+// REMINDER: server actions should have middlewares to do auth checks
 
 export async function create(ownerId: number) {
+  const _user = await currentUser();
+
+  if (!_user) return;
+
+  const allowedWorkspaces = await db
+    .select()
+    .from(usersToWorkspaces)
+    .innerJoin(user, eq(user.id, usersToWorkspaces.userId))
+    .innerJoin(workspace, eq(workspace.id, usersToWorkspaces.workspaceId))
+    .where(eq(user.tenantId, _user.id))
+    .all();
+
+  const allowedIds = allowedWorkspaces.map((i) => i.workspace.id);
+
+  if (!allowedIds.includes(ownerId)) return;
+
   const key = await unkey.keys.create({
     apiId: env.UNKEY_API_ID,
     ownerId: String(ownerId),

apps/web/src/app/app/[workspaceSlug]/(dashboard)/settings/api-token/_components/create-form.tsx

···
   async function onCreate() {
     try {
       const res = await create(ownerId);
-      if (res.result) {
+      if (!res) toastAction("error");
+      if (res?.result) {
         setRawKey(res.result.key);
       }
     } catch {