refactor: require KiloClawAccess to get chat credentials

Author: catrielmuller

src/app/api/kiloclaw/chat-credentials/route.ts

@@ -1,15 +1,26 @@
 import { NextResponse } from 'next/server';
+import { TRPCError } from '@trpc/server';
 import { getUserFromAuth } from '@/lib/user.server';
 import { KiloClawUserClient } from '@/lib/kiloclaw/kiloclaw-user-client';
 import { KiloClawApiError } from '@/lib/kiloclaw/kiloclaw-internal-client';
 import { generateApiToken, TOKEN_EXPIRY } from '@/lib/tokens';
+import { requireKiloClawAccess } from '@/lib/kiloclaw/access-gate';
 
 export async function GET() {
   const { user, authFailedResponse } = await getUserFromAuth({
     adminOnly: false,
   });
   if (authFailedResponse) return authFailedResponse;
 
+  try {
+    await requireKiloClawAccess(user.id);
+  } catch (err) {
+    if (err instanceof TRPCError && err.code === 'FORBIDDEN') {
+      return NextResponse.json({ error: err.message }, { status: 403 });
+    }
+    throw err;
+  }
+
   try {
     const token = generateApiToken(user, undefined, {
       expiresIn: TOKEN_EXPIRY.fiveMinutes,

src/routers/kiloclaw-router.ts

@@ -484,7 +484,7 @@ export const kiloclawRouter = createTRPCRouter({
       }
     }),
 
-  getStreamChatCredentials: baseProcedure.query(async ({ ctx }) => {
+  getStreamChatCredentials: clawAccessProcedure.query(async ({ ctx }) => {
     const client = new KiloClawInternalClient();
     return client.getStreamChatCredentials(ctx.user.id);
   }),