CV2-6604: Remove global keys permission

[melsawy]

Description

Check existing API keys and limit the usage of global keys.

• Log ApiKey last activity date
• Remove global API key permissions
• Verify that API key belongs to team
• Add rake task to set team_id for existing keys
• Add rake task to list global keys

References: CV2-6604

How to test?

• Re-run automated tests
• Using UI
• A) Generate API using workspace settings page(settings => Integrations => API Access)
• B) Generate API key using this guide
  For both cases I used graphql UI to run different quires

Checklist

• I have performed a self-review of my code and ensured that it is safe and runnable, that code coverage has not decreased, and that there are no new Code Climate issues. I have also followed Meedan's internal coding guidelines.

[caiosba]

Sawy, to be extra safe, I think we should make the team_id column on ApiKey mandatory. This should simplify the implementation since you won’t need to filter by non-null team IDs, and it also avoids the risk of forgetting to update that logic somewhere. Of course, you’ll need to run the rake task before deploying the code change; otherwise, the database migration will fail. Also, please rebase the PR since you already handled the last activity part in another PR.

[melsawy]

I think we should make the team_id column on ApiKey mandatory.

@caiosba for now I added a validation inside the model ApiKey so I can deploy and run the rake task and after deploying this PR I'll make the team_id column mandatory

[caiosba]

@melsawy , why not the opposite? A first PR with just the rake task, and then another PR that makes team_id mandatory?

[melsawy]

@melsawy , why not the opposite? A first PR with just the rake task, and then another PR that makes team_id mandatory?
it's same just a suggestion but it's OK to deploy the rake task first

[caiosba]

@melsawy , why not the opposite? A first PR with just the rake task, and then another PR that makes team_id mandatory?
it's same just a suggestion but it's OK to deploy the rake task first

Thanks, I think it's better.

[melsawy]

@caiosba I created a PR with rake task only so I can deploy it
please review it

[caiosba]

@caiosba I created a PR with rake task only so I can deploy it please review it

Thanks, done!

[caiosba]

Sawy, so now that the other PR contains only the rake task, you still need to update this one to remove the rake task and to make team_id mandatory, right?

[melsawy]

Sawy, so now that the other PR contains only the rake task, you still need to update this one to remove the rake task and to make team_id mandatory, right?

Right

[caiosba]

Did you run Check Web integration tests after this change?

[caiosba]

Blocker: This means any API key can read anything in any team. Other than trying to fix this rule, I think it's safer to just delete this line.

[caiosba]

Can't you just delete these lines?