feat: api key validation

[Anushtha-Rathore]

prevent deletion of API keys currently in use by agents

[windsurf-bot]

Looks good to me 🤙

💡 To request another review, post a new comment with "/windsurf-review".

[Husainbw786]

Code Review - Optimization Suggestions

1. Add Index for Query Pattern (High Priority - Performance)

The query pattern { org_id, \apikey_object_id.${service}`: apikey_object_id, deletedAt: null }` will be slow without an index.

Recommendation: Add a compound index:

{ org_id: 1, 'apikey_object_id.openai': 1, deletedAt: 1 }
// Repeat for each service, or use a wildcard index if MongoDB 4.2+

2. Validate service Against a Whitelist (Security)

Currently any string is accepted for service. This should be validated to protect against query injection.

Recommendation:

const VALID_SERVICES = ['openai', 'anthropic', 'google', ...];
if (!VALID_SERVICES.includes(service)) {
  return { success: false, error: 'Invalid service' };
}

3. Consider Adding .limit() to Queries

If an API key is used by hundreds of agents/versions, pulling all documents could be expensive.

Recommendation: Add .limit(100) or similar to avoid pulling thousands of docs.

4. Redundant Error Handling

The current pattern catches the error, logs it, then rethrows. Consider either:

• Let it propagate naturally, OR
• Return a consistent error response:

} catch (error) {
  return { success: false, error: \`Failed to check API key usage: ${error.message}\` };
}

Overall

Solid feature implementation. The index is the biggest performance win, and service validation is important for security.