fix(api): tell a missing key owner from an owner whose ban state is null

user.banned is nullable, so a real owner with banned = NULL had every
personal key refused as orphaned. Select the joined user id and test that
instead; the ban and suspension checks are unchanged.

Author: waleedlatif1

apps/sim/lib/api/server/routes/v2-api-key-auth.test.ts

@@ -199,6 +199,26 @@ describe('v2 API key authentication', () => {
     )
   })
 
+  it('accepts a personal key whose owner has never had a ban state recorded', async () => {
+    queueTableRows(schemaMock.apiKey, [
+      {
+        id: 'key-1',
+        userId: 'user-1',
+        workspaceId: null,
+        type: 'personal',
+        access: 'write',
+        expiresAt: null,
+        ownerUserId: 'user-1',
+        userBanned: null,
+        userSuspendedAt: null,
+      },
+    ])
+
+    const result = await authenticateV2ApiKey({ apiKey: 'secret', bearer: null })
+
+    expect(result.principal).toEqual(createPersonalApiKeyPrincipal())
+  })
+
   it('refuses a personal key whose owner row is gone as invalid, expired or not', async () => {
     for (const expiresAt of [null, new Date(Date.now() - 1)]) {
       queueTableRows(schemaMock.apiKey, [
@@ -209,6 +229,7 @@ describe('v2 API key authentication', () => {
           type: 'personal',
           access: 'write',
           expiresAt,
+          ownerUserId: null,
           userBanned: null,
           userSuspendedAt: null,
         },

apps/sim/lib/api/server/routes/v2-api-key-auth.ts

@@ -77,14 +77,16 @@ interface ApiKeyRow {
   type: string
   access: ApiKeyAccess
   expiresAt: Date | null
+  /** The joined owner's id: `null` only when the owner row is gone (`user.banned` is itself nullable). */
+  ownerUserId: string | null
   userBanned: boolean | null
   userSuspendedAt: Date | null
 }
 
 function requireValidRow(row: ApiKeyRow | undefined): ApiKeyRow {
   if (!row) throw new V2ApiKeyUnauthenticatedError()
   if (row.type === 'personal' && row.workspaceId === null) {
-    if (row.userBanned === null) {
+    if (row.ownerUserId === null) {
       logger.error('Personal API key is missing its credential owner', { keyId: row.id })
       throw new V2ApiKeyUnauthenticatedError()
     }
@@ -118,6 +120,7 @@ async function authenticateApiKey(apiKeyHeader: string): Promise<V2ApiKeyAuthCon
       type: apiKey.type,
       access: apiKey.access,
       expiresAt: apiKey.expiresAt,
+      ownerUserId: user.id,
       userBanned: user.banned,
       userSuspendedAt: user.suspendedAt,
     })