From 3fd372243edb44fa6d8593e5325c9645b288ccb1 Mon Sep 17 00:00:00 2001
From: bashtwigs <zachkhong.workplace@gmail.com>
Date: Sun, 4 Oct 2026 10:51:07 +0800
Subject: [PATCH] fix(db): revoke every existing API key

Keys created before explicit roles can hold permissions beyond their
role preset, and no update or rotate path corrects them. Devnet only,
so revoke them all; integrators mint fresh keys from the dashboard.
---
 .../src/db/migrations/postgres/0124_revoke_all_api_keys.sql     | 2 ++
 1 file changed, 2 insertions(+)
 create mode 100644 apps/sdp-api/src/db/migrations/postgres/0124_revoke_all_api_keys.sql

diff --git a/apps/sdp-api/src/db/migrations/postgres/0124_revoke_all_api_keys.sql b/apps/sdp-api/src/db/migrations/postgres/0124_revoke_all_api_keys.sql
new file mode 100644
index 000000000..53d16ea48
--- /dev/null
+++ b/apps/sdp-api/src/db/migrations/postgres/0124_revoke_all_api_keys.sql
@@ -0,0 +1,2 @@
+-- sdp:migration-compat: breaking
+UPDATE api_keys SET status = 'revoked', revoked_at = sdp_datetime_now() WHERE status = 'active';