Require a freshly authenticated JWT when creating an api_key

Change-type: major

src/features/auth/hooks/index.ts

@@ -3,6 +3,7 @@ import './create-application-actor.js';
 import './create-device-actor.js';
 import './create-user-actor.js';
 import './fetch-api-key.js';
+import './restrict-api-key-creation.js';
 import './restrict-user-deletion.js';
 import './update-jwt-secret.js';
 import './validate-username-email.js';

src/features/auth/hooks/restrict-api-key-creation.ts

@@ -0,0 +1,15 @@
+import { hooks, errors } from '@balena/pinejs';
+
+import { getUser } from '../../../infra/auth/auth.js';
+import { checkSudoValidity } from '../../../infra/auth/jwt.js';
+
+const { UnauthorizedError } = errors;
+
+hooks.addPureHook('POST', 'resin', 'api_key', {
+	PRERUN: async ({ req, tx }) => {
+		const user = await getUser(req, tx);
+		if (!(await checkSudoValidity(user))) {
+			throw new UnauthorizedError('Fresh authentication token required');
+		}
+	},
+});