Remove 'can_infer' field

pkg/auth/key.go

@@ -28,7 +28,6 @@ type APIKey struct {
 type KeyPermission struct {
 	KeyID      int
 	InstanceID int
-	CanInfer   bool
 }
 
 // GenerateKey generates a cryptographically secure API key with the given prefix

pkg/database/apikeys.go

@@ -45,10 +45,10 @@ func (db *sqliteDB) CreateKey(ctx context.Context, key *auth.APIKey, permissions
 	if key.PermissionMode == auth.PermissionModePerInstance {
 		for _, perm := range permissions {
 			query := `
-				INSERT INTO key_permissions (key_id, instance_id, can_infer)
-				VALUES (?, ?, ?)
+				INSERT INTO key_permissions (key_id, instance_id)
+				VALUES (?, ?)
 			`
-			_, err := tx.ExecContext(ctx, query, key.ID, perm.InstanceID, perm.CanInfer)
+			_, err := tx.ExecContext(ctx, query, key.ID, perm.InstanceID)
 			if err != nil {
 				return fmt.Errorf("failed to insert permission for instance %d: %w", perm.InstanceID, err)
 			}

pkg/database/migrations/001_initial_schema.up.sql

@@ -47,7 +47,6 @@ CREATE TABLE IF NOT EXISTS api_keys (
 CREATE TABLE IF NOT EXISTS key_permissions (
     key_id INTEGER NOT NULL,
     instance_id INTEGER NOT NULL,
-    can_infer INTEGER NOT NULL DEFAULT 0,
     PRIMARY KEY (key_id, instance_id),
     FOREIGN KEY (key_id) REFERENCES api_keys (id) ON DELETE CASCADE,
     FOREIGN KEY (instance_id) REFERENCES instances (id) ON DELETE CASCADE

pkg/database/permissions.go

@@ -10,7 +10,7 @@ import (
 // GetPermissions retrieves all permissions for a key
 func (db *sqliteDB) GetPermissions(ctx context.Context, keyID int) ([]auth.KeyPermission, error) {
 	query := `
-		SELECT key_id, instance_id, can_infer
+		SELECT key_id, instance_id
 		FROM key_permissions
 		WHERE key_id = ?
 		ORDER BY instance_id
@@ -25,7 +25,7 @@ func (db *sqliteDB) GetPermissions(ctx context.Context, keyID int) ([]auth.KeyPe
 	var permissions []auth.KeyPermission
 	for rows.Next() {
 		var perm auth.KeyPermission
-		err := rows.Scan(&perm.KeyID, &perm.InstanceID, &perm.CanInfer)
+		err := rows.Scan(&perm.KeyID, &perm.InstanceID)
 		if err != nil {
 			return nil, fmt.Errorf("failed to scan key permission: %w", err)
 		}
@@ -38,13 +38,13 @@ func (db *sqliteDB) GetPermissions(ctx context.Context, keyID int) ([]auth.KeyPe
 // HasPermission checks if key has inference permission for instance
 func (db *sqliteDB) HasPermission(ctx context.Context, keyID, instanceID int) (bool, error) {
 	query := `
-		SELECT can_infer 
+		SELECT 1
 		FROM key_permissions
 		WHERE key_id = ? AND instance_id = ?
 	`
 
-	var canInfer bool
-	err := db.QueryRowContext(ctx, query, keyID, instanceID).Scan(&canInfer)
+	var exists int
+	err := db.QueryRowContext(ctx, query, keyID, instanceID).Scan(&exists)
 	if err != nil {
 		if err == sql.ErrNoRows {
 			// No permission record found, deny access
@@ -53,5 +53,5 @@ func (db *sqliteDB) HasPermission(ctx context.Context, keyID, instanceID int) (b
 		return false, fmt.Errorf("failed to check key permission: %w", err)
 	}
 
-	return canInfer, nil
+	return true, nil
 }

pkg/server/handlers_auth.go

@@ -13,8 +13,7 @@ import (
 
 // InstancePermission defines the permissions for an API key on a specific instance.
 type InstancePermission struct {
-	InstanceID int  `json:"instance_id"`
-	CanInfer   bool `json:"can_infer"`
+	InstanceID int `json:"instance_id"`
 }
 
 // CreateKeyRequest represents the request body for creating a new API key.
@@ -54,7 +53,6 @@ type KeyResponse struct {
 type KeyPermissionResponse struct {
 	InstanceID   int    `json:"instance_id"`
 	InstanceName string `json:"instance_name"`
-	CanInfer     bool   `json:"can_infer"`
 }
 
 // CreateKey godoc
@@ -150,7 +148,6 @@ func (h *Handler) CreateKey() http.HandlerFunc {
 			keyPermissions = append(keyPermissions, auth.KeyPermission{
 				KeyID:      0, // Will be set by database after key creation
 				InstanceID: perm.InstanceID,
-				CanInfer:   perm.CanInfer,
 			})
 		}
 
@@ -353,7 +350,6 @@ func (h *Handler) GetKeyPermissions() http.HandlerFunc {
 			response = append(response, KeyPermissionResponse{
 				InstanceID:   perm.InstanceID,
 				InstanceName: instanceNameMap[perm.InstanceID],
-				CanInfer:     perm.CanInfer,
 			})
 		}
 

webui/src/components/settings/ApiKeysSection.tsx

@@ -249,11 +249,7 @@ function ApiKeysSection() {
                                   <tr key={perm.instance_id} className="border-b">
                                     <td className="py-2">{perm.instance_name}</td>
                                     <td className="py-2">
-                                      {perm.can_infer ? (
-                                        <Check className="h-4 w-4 text-green-600" />
-                                      ) : (
-                                        <X className="h-4 w-4 text-red-600" />
-                                      )}
+                                      <Check className="h-4 w-4 text-green-600" />
                                     </td>
                                   </tr>
                                 ))}

webui/src/types/apiKey.ts

@@ -23,7 +23,6 @@ export interface CreateKeyRequest {
 
 export interface InstancePermission {
   InstanceID: number
-  CanInfer: boolean
 }
 
 export interface CreateKeyResponse extends ApiKey {
@@ -33,5 +32,4 @@ export interface CreateKeyResponse extends ApiKey {
 export interface KeyPermissionResponse {
   instance_id: number
   instance_name: string
-  can_infer: boolean
 }