feat(sso): seed default developer API key limit (#2948)

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: steebchen

apps/api/src/routes/sso.ts

@@ -9,7 +9,7 @@ import { maskToken } from "@/lib/maskToken.js";
 import { getOrgProjectsOldestFirst } from "@/lib/sso-default-projects.js";
 
 import { logAuditEvent } from "@llmgateway/audit";
-import { and, db, eq, shortid, tables } from "@llmgateway/db";
+import { and, db, eq, isNull, shortid, tables } from "@llmgateway/db";
 import { getApiKeyFingerprint } from "@llmgateway/shared/api-key-hash";
 
 import type { ServerTypes } from "@/vars.js";
@@ -19,6 +19,12 @@ export const sso = new OpenAPIHono<ServerTypes>();
 
 const apiUrl = getApiBaseUrl();
 
+// Default per-developer active API key cap seeded when an org first wires up
+// SSO. Developers are provisioned in bulk via SCIM/SSO, so give them a sane
+// baseline that admins can still override org-wide (default developer budget)
+// or per member.
+const DEFAULT_SSO_DEVELOPER_MAX_API_KEYS = 3;
+
 async function assertEnterpriseOrgAccess(
 	userId: string,
 	organizationId: string,
@@ -311,6 +317,19 @@ sso.openapi(register, async (c) => {
 			createdAt: tables.ssoProvider.createdAt,
 		});
 
+	// Seed a reasonable default per-developer API key cap for the org. Only set
+	// it when the org hasn't already configured its own default developer budget,
+	// so we never clobber an explicit admin choice.
+	await db
+		.update(tables.organization)
+		.set({ defaultDeveloperMaxApiKeys: DEFAULT_SSO_DEVELOPER_MAX_API_KEYS })
+		.where(
+			and(
+				eq(tables.organization.id, organizationId),
+				isNull(tables.organization.defaultDeveloperMaxApiKeys),
+			),
+		);
+
 	await logAuditEvent({
 		organizationId,
 		userId: user.id,

packages/db/migrations/1783524018_backfill_sso_default_developer_max_api_keys.sql

@@ -0,0 +1,13 @@
+-- Backfill a reasonable default per-developer API key cap (3) for organizations
+-- that already have an SSO connection but never configured their own default
+-- developer budget. New SSO setups seed this at registration time; this covers
+-- the handful of orgs provisioned before that seeding existed. Only NULL values
+-- are touched so we never clobber an explicit admin choice.
+UPDATE "organization"
+SET "default_developer_max_api_keys" = 3
+WHERE "default_developer_max_api_keys" IS NULL
+	AND "id" IN (
+		SELECT DISTINCT "organization_id"
+		FROM "sso_provider"
+		WHERE "organization_id" IS NOT NULL
+	);