feat(api-key): Allow revoking in the future, and enforce the secret key (#6484)

Since there is quite a bit of code here already, I'll do the middleware changes in a separate PR

packages/medusa/src/api-v2/admin/api-keys/[id]/revoke/route.ts

@@ -16,6 +16,7 @@ export const POST = async (
     input: {
       selector: { id: req.params.id },
       revoke: {
+        ...(req.validatedBody as Omit<RevokeApiKeyDTO, "revoked_by">),
         revoked_by: req.auth.actor_id,
       } as RevokeApiKeyDTO,
     },

packages/medusa/src/api-v2/admin/api-keys/[id]/route.ts

@@ -37,7 +37,7 @@ export const POST = async (
   const { result, errors } = await updateApiKeysWorkflow(req.scope).run({
     input: {
       selector: { id: req.params.id },
-      update: req.validatedBody,
+      update: req.validatedBody as UpdateApiKeyDTO,
     },
     throwOnError: false,
   })

packages/medusa/src/api-v2/admin/api-keys/validators.ts

@@ -3,6 +3,7 @@ import { Type } from "class-transformer"
 import {
   IsArray,
   IsEnum,
+  IsNumber,
   IsOptional,
   IsString,
   ValidateNested,
@@ -65,6 +66,10 @@ export class AdminPostApiKeysApiKeyReq {
   title: string
 }
 
-export class AdminRevokeApiKeysApiKeyReq {}
+export class AdminRevokeApiKeysApiKeyReq {
+  @IsOptional()
+  @IsNumber()
+  revoke_in?: number
+}
 
 export class AdminDeleteApiKeysApiKeyReq {}