control API access grants

lib/cartodb/api/auth_api.js

@@ -81,6 +81,15 @@ AuthApi.prototype.authorizedByAPIKey = function(user, req, callback) {
             return callback(error);
         }
 
+        if (!apikey.grantsMaps) {
+            const error = new Error('Forbidden');
+            error.type = 'auth';
+            error.subtype = 'api-key-does-not-grant-access';
+            error.http_status = 403;
+
+            return callback(error);
+        }
+
         return callback(null, true);
     });
 };