[gospeltout]

Summary

Introduces coarse-grained capability scopes (read:prices, read:history, subscribe) to API keys, enforced per route.

Key changes:

• Schema & Context: Added scopes String[] @default([]) to the ApiKey Prisma model and propagated scopes onto ApiKeyContext.
• Route Scoping: Routes declare the capability they require via config: { scope: '<scope>' }.
• Auth Enforcement: The auth hook validates scopes; missing scopes are refused with HTTP 403 (code: 'insufficient_scope') explicitly naming the required scope.
• Legacy Compatibility: Keys with no scopes recorded continue to have access to all routes ("everything") to prevent breaking existing integrations.
• Admin Endpoints: POST /admin/keys accepts an optional scopes array on minting, and GET /admin/keys lists existing keys with their scopes visible.
• Tests: Comprehensive tests added covering allowed calls, refused calls (with named scopes), legacy unscoped key fallback, minting, and listing.

Related issue

Closes #504

Type of change

• Bug fix
• New feature
• Refactor
• Docs
• Tests
• CI / tooling

Checklist

• I have read CONTRIBUTING.md
• npx tsc --noEmit passes
• npm run build passes
• I added / updated tests where relevant
• I updated docs where relevant

[drips-wave]

@gospeltout Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits