fix(security): prevent privilege escalation via API key permission grants

[0xcucumbersalad]

Summary

API_KEY_CREATE and API_KEY_UPDATE accepted arbitrary permissions with no validation. A regular user-role member could create an API key with { "self": ["*"] } — granting wildcard access to every management tool. Better Auth's apiKey.create/apiKey.update performs no permission scoping.

Attack

POST /api/:org/tools/API_KEY_CREATE
{"name":"escalated","permissions":{"self":["*"]}}

Returns an API key that can call any management tool — including ORGANIZATION_MEMBER_UPDATE_ROLE to promote the attacker to owner.

Fix

Add validateApiKeyPermissions() in auth/roles.ts: owners and admins can grant any permissions (they already bypass all checks at runtime); regular users cannot grant wildcard "*" on any resource. Applied to both create and update handlers.

Files changed

File	Change
apps/mesh/src/auth/roles.ts	Add validateApiKeyPermissions()
apps/mesh/src/auth/roles.test.ts	7 new tests for permission validation
apps/mesh/src/tools/apiKeys/create.ts	Validate before apiKey.create()
apps/mesh/src/tools/apiKeys/update.ts	Validate before apiKey.update()

Test plan

• bun run fmt — passes
• bun run lint — passes (0 errors)
• bun test apps/mesh/src/auth/roles.test.ts — 12 pass, 0 fail
• Verify user calling API_KEY_CREATE with { "self": ["*"] } gets error
• Verify owner/admin can still create wildcard keys
• Verify user can create keys with specific tool permissions

🤖 Generated with Claude Code

---

Summary by cubic

Prevents privilege escalation by validating API key permission grants. Regular users can no longer create or update API keys with wildcard "*" permissions; only owners and admins can.

• Bug Fixes
  • Added validateApiKeyPermissions in apps/mesh/src/auth/roles.ts.
  • Enforced validation in API_KEY_CREATE and API_KEY_UPDATE before calling Better Auth apiKey.create/apiKey.update.
  • Added tests for wildcard rejection and specific tool permissions.

^{Written for commit 2d4ba6f. Summary will update on new commits.}