refactor(api-keys): single dashboard-only create path with explicit roles - #2182
Open
multipletwigs wants to merge 3 commits into
Open
multipletwigs wants to merge 3 commits into
multipletwigs wants to merge 3 commits into
Conversation
Contributor
 |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
multipletwigs
force-pushed
the
bashtwigs/api-key-create-consistency
branch
from
October 2, 2026 09:52
32268e2 to
c9a8742
Compare
multipletwigs
changed the base branch from
main
to
bashtwigs/remove-legacy-sessions
October 2, 2026 09:52
multipletwigs
force-pushed
the
bashtwigs/api-key-create-consistency
branch
from
October 3, 2026 16:07
c9a8742 to
59d38db
Compare
multipletwigs
force-pushed
the
bashtwigs/api-key-create-consistency
branch
from
October 4, 2026 02:43
59d38db to
5b02ecb
Compare
multipletwigs
changed the base branch from
main
to
bashtwigs/api-key-role-drop-default
October 4, 2026 02:43
multipletwigs
force-pushed
the
bashtwigs/api-key-create-consistency
branch
from
October 4, 2026 02:52
5b02ecb to
de2e1ac
Compare
multipletwigs
changed the base branch from
bashtwigs/api-key-role-drop-default
to
bashtwigs/hoo-1890-revoke-all-api-keys
October 4, 2026 02:52
…oles Delete POST/GET /v1/projects/:projectId/api-keys and route all key creation through POST /v1/api-keys, which now requires a signed-in user plus x-project-id; API keys can no longer mint API keys. Role is required (zod default and column default removed), a permissions override may only narrow the role preset, and the wallet-provisioning fields are gone from the create body. created_by is always the acting user. Docs and generated reference updated.
Register POST /v1/api-keys in the internal document only, since the public document defines no clerkBearerAuth scheme, and regenerate the Postman collection and llms-full.txt. Expiration examples move to a future date. The role DROP DEFAULT migration moves to its own migrations-only PR so this change stays rollback-safe.
multipletwigs
force-pushed
the
bashtwigs/api-key-create-consistency
branch
from
October 4, 2026 03:00
de2e1ac to
566ceb7
Compare
multipletwigs
changed the base branch from
bashtwigs/hoo-1890-revoke-all-api-keys
to
bashtwigs/api-key-role-drop-default
October 4, 2026 03:01
Key creation is Clerk-only now, so tests mint keys through a signed-in admin with x-project-id and an explicit role. Integration tests get a signInTestUser helper. Cases for the deleted project route, create-time wallet provisioning, and key-mints-key guards are removed.
Collaborator
Author
|
On the remaining risk ("existing keys remain active" and the legacy-update gap): #2198, stacked on top of this PR, revokes every existing API key ( |
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #2197 (drops the
api_keys.rolecolumn default); #2198 on top revokes every existing key. Consolidates API-key creation onto one dashboard-only path.POST /v1/api-keysrequires a signed-in user plusx-project-id;/v1/projects/:projectId/api-keysis deleted.created_byis always the acting user.requireUserActorruns beforerequirePermissionson create, so any key gets 403.roleis required: zod default removed; the column default drop ships in fix(api): drop the api_keys.role column default #2197.permissionsoverride may only narrow the role preset, checked before the org:admin exemption and shared by create, update, and rotate. fix(api): revoke every existing API key #2198 revokes every key minted before this lands.provisionWallet/walletLabel/walletPurposeremoved from create; create the wallet via custody, then bind it.API before/after (local, key actor; before values reconstructed):
Verification:
@sdp/api+sdp-webtypecheck pass; local dashboard create flow walked end to end (wizard → generated key →api_keysandaudit_logsrows); adversarial pass over 8 vectors with live probes, 0 exploitable. Not run: vitest. CI is red on six stale suites that still exercise the deleted route and key-mints-key paths; a follow-up test PR rewrites them.