feat(all): add organisation, api updates with organisation check

Now calling run endpoints with GET, POST will check against the API key, whether there is org_id or not, if the operation workflow doesnt match with the user org or user id, will return with workflow not found, run not found

web/src/server/curdApiKeys.ts

@@ -3,7 +3,7 @@
 import { db } from "@/db/db";
 import { apiKeyTable } from "@/db/schema";
 import { auth } from "@clerk/nextjs";
-import { and, desc, eq } from "drizzle-orm";
+import { and, desc, eq, isNull } from "drizzle-orm";
 import jwt from "jsonwebtoken";
 import { revalidatePath } from "next/cache";
 
@@ -29,7 +29,7 @@ export async function addNewAPIKey(name: string) {
   if (orgId) {
     token = jwt.sign(
       { user_id: userId, org_id: orgId },
-      process.env.JWT_SECRET!,
+      process.env.JWT_SECRET!
     );
   } else {
     token = jwt.sign({ user_id: userId }, process.env.JWT_SECRET!);
@@ -90,7 +90,11 @@ export async function getAPIKeys() {
     });
   } else {
     return await db.query.apiKeyTable.findMany({
-      where: and(eq(apiKeyTable.user_id, userId), eq(apiKeyTable.revoked, false)),
+      where: and(
+        eq(apiKeyTable.user_id, userId),
+        isNull(apiKeyTable.org_id),
+        eq(apiKeyTable.revoked, false)
+      ),
       orderBy: desc(apiKeyTable.created_at),
     });
   }
@@ -102,4 +106,4 @@ export async function isKeyRevoked(key: string) {
   });
 
   return revokedKey !== undefined;
-}
+}