Add scoped API keys with least-privilege enforcement to src/routes/apiKeys.ts

[Baskarayelu]

📋 Description

src/routes/apiKeys.ts issues API keys, but keys appear to grant broad access rather than a narrow, declared set of scopes. There is no middleware that checks a request's required scope against the presenting key.

Why this matters: a leaked all-powerful key is a full compromise; a leaked read-only trust:read key is a contained incident. Least-privilege scoping turns key leakage from catastrophe into inconvenience.

🎯 Requirements & Context

• Define a scope vocabulary (e.g. bond:read, bond:write, attestation:write, trust:read, payouts:write) as a typed enum.
• Persist scopes with each key (migration via node-pg-migrate); default new keys to least privilege.
• Add a requireScope(scope) Express middleware and apply it to the relevant routes.
• Return the project's standard 403 envelope on missing scope; never leak which scope was missing beyond what's safe.
• Add an endpoint/flow to mint a key with an explicit scope set, with audit-log entries (reuse src/services/audit).

Constraints: Express 4, Postgres, zod, existing RBAC in src/services/rbac. Coordinate with the auth middleware in src/middleware.

🛠️ Suggested Execution

git checkout -b feature/scoped-api-keys

• Migration + service changes + requireScope middleware + route wiring + audit logging.
• supertest tests: key with scope passes, without scope gets 403, scope escalation rejected.
• TSDoc + docs/api-keys.md documenting the scope vocabulary.

npm run test -- apiKeys
npm run migrate:lint
npm run lint && npm run build

Edge cases: revoked key, expired key, key with empty scope set, scope present but route not covered.

Example commit message

feat(auth): scoped API keys with requireScope least-privilege middleware

✅ Acceptance Criteria & Guidelines

Requirement	Target
Scope enforcement middleware + route wiring	Required
Migration passes migrate:lint / safety	Required
Audit-logged key minting	Required
Coverage of new code	≥ 95%
docs/api-keys.md	Required
Timeframe	96 hours

💬 Community & Support

Security design questions → Credence Discord: https://discord.gg/nmnPBkBge. Comment here when you start. 🚀

[Tobi-8]

Hey maintainer, i have read your description and i have worked on several issues like this, kindly assign to me

[grantfox-oss]

🦊 GrantFox — @Tobi-8 has been assigned to this issue!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #460)
2. Your PR will be reviewed by the CredenceOrg maintainers

Good luck! Track your progress on GrantFox.

[Tobi-8]

hey maintainer, you closed this issue but i wasn't awarded yet,
please see to that