Apply policies on key retrieval from API

api.go

@@ -309,7 +309,8 @@ func handleGetDetail(sessionKey, apiID string, byHash bool) (interface{}, int) {
 	}
 
 	sessionManager := FallbackKeySesionManager
-	if spec := getApiSpec(apiID); spec != nil {
+	spec := getApiSpec(apiID)
+	if spec != nil {
 		sessionManager = spec.SessionManager
 	}
 
@@ -335,8 +336,18 @@ func handleGetDetail(sessionKey, apiID string, byHash bool) (interface{}, int) {
 		} else {
 			session.QuotaRemaining = remaining
 		}
+	} else {
+		log.WithFields(logrus.Fields{
+			"prefix": "api",
+			"key":    obfuscateKey(sessionKey),
+			"error": err,
+			"status": "ok",
+		}).Info("Can't retrieve key quota")
 	}
 
+	mw := BaseMiddleware{Spec: spec}
+	mw.ApplyPolicies(sessionKey, &session)
+
 	log.WithFields(logrus.Fields{
 		"prefix": "api",
 		"key":    obfuscateKey(sessionKey),

middleware.go

@@ -219,7 +219,7 @@ func (t BaseMiddleware) ApplyPolicies(key string, session *user.SessionState) er
 		}
 		// Check ownership, policy org owner must be the same as API,
 		// otherwise youcould overwrite a session key with a policy from a different org!
-		if policy.OrgID != t.Spec.OrgID {
+		if t.Spec != nil && policy.OrgID != t.Spec.OrgID {
 			err := fmt.Errorf("attempting to apply policy from different organisation to key, skipping")
 			log.Error(err)
 			return err