API keys for server scope: edges, server alerts and orgs can be scripted

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

infra.go

@@ -64,11 +64,22 @@ func validAddr(a string) bool {
 	return n > 0
 }
 
-func (s *Server) listEdges(w http.ResponseWriter, r *http.Request, p *principal) {
+func (s *Server) listEdges(w http.ResponseWriter, r *http.Request) {
+	p := s.principalFrom(r)
+	if p == nil {
+		fail(w, 401, errors.New("Sign in to continue."))
+		return
+	}
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	out := []edgeView{}
 	for _, e := range s.st.Edges {
+		if p.Key != nil && !p.serverKey() { // an org key sees the edges its organization may use
+			if s.edgeAllowedFor(e, p.Key.OrgID) {
+				out = append(out, s.viewEdge(e, false))
+			}
+			continue
+		}
 		if p.User.ServerAdmin {
 			out = append(out, s.viewEdge(e, true))
 			continue