feat: harden data access and simplify user management

app/api/interface_center.py

@@ -19,12 +19,15 @@ from app.data_platform.interface_service import (
     interface_catalog,
     interface_summary,
     issue_api_credential,
+    issue_dbeaver_access,
     list_api_call_logs,
     list_api_clients,
     list_api_credentials,
     list_api_policies,
+    list_dbeaver_access_grants,
     resolve_api_policy,
     revoke_api_credential,
+    revoke_dbeaver_access,
     update_api_client,
     update_api_policy,
     write_api_call_log,
@@ -75,6 +78,30 @@ async def catalog(user: CurrentUser):
     return await interface_catalog()
 
 
+@router.get("/dbeaver-access")
+async def dbeaver_access_grants(user: CurrentUser):
+    _require_admin(user)
+    return await list_dbeaver_access_grants()
+
+
+@router.post("/dbeaver-access")
+async def add_dbeaver_access(body: dict[str, Any], user: CurrentUser):
+    _require_admin(user)
+    try:
+        return await issue_dbeaver_access(body, user["username"])
+    except ValueError as exc:
+        raise _bad_request(exc) from exc
+
+
+@router.post("/dbeaver-access/{grant_id}/revoke")
+async def revoke_dbeaver_access_grant(grant_id: str, user: CurrentUser):
+    _require_admin(user)
+    try:
+        return await revoke_dbeaver_access(grant_id, user["username"])
+    except ValueError as exc:
+        raise _bad_request(exc) from exc
+
+
 @router.get("/clients")
 async def clients(user: CurrentUser):
     _require_admin(user)