Wire API-key renewal, add revocation + selectable expiry (closes #3)#4
Open
Rashmi-278 wants to merge 1 commit into
Open
Wire API-key renewal, add revocation + selectable expiry (closes #3)#4Rashmi-278 wants to merge 1 commit into
Rashmi-278 wants to merge 1 commit into
Conversation
) Registered users were locked out of self-service key renewal: the UI only called POST /api/auth/register, which 409s for existing accounts, while the working POST /api/auth/keys endpoint had no UI control. Reported by @aolieman (#3), who had to hand-craft a Privy-token request to mint a key. - Wire "Generate new API key" button to POST /api/auth/keys for registered users - Add selectable key lifetime (3mo / 6mo / 1yr) with server-side allow-list; default bumped from 3 months to 1 year - Add DELETE /api/auth/keys/:id with an ownership check (a token can only revoke its own keys; others' keys return 404) + per-key Revoke button - Raise active-key cap from 3 to 5 No schema migration; existing keys and the register flow are unaffected. Auth/keys is security-sensitive — ownership check and duration allow-list need human review. Docs: adds the maintenance-flow design + the manual triage of #3 that produced this fix. Claude-Session: https://claude.ai/code/session_01BxtA4nBczx1CaSDcBfZ24W
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #3.
Registered users could not generate a replacement API key from the UI. The "Generate API Key" button only called
POST /api/auth/register, which returns409 Already registeredfor existing accounts, while the workingPOST /api/auth/keysendpoint had no UI control. Reported by @aolieman, who had to hand-craft a Privy-token request to mint a key.Changes
Renewal (fixes the reported lockout)
/get-api-access, shown once registered, callingPOST /api/auth/keyswith the Privy Bearer token./api/auth/keysquery invalidated.Selectable expiry
durationDayson the mint routes, validated against an allow-list (90 / 180 / 365); anything else →400.Revocation
DELETE /api/auth/keys/:idbehindverifyPrivyToken, callingstorage.revokeApiKey().404) and can never be revoked cross-account.Cap
400.Notes / blast radius
Auth + keys — security-sensitive. The two review-critical items are the ownership check on revoke and the expiry allow-list. No schema migration (
api_keys.expires_at/statusalready exist). Backward compatible: existing 3-month keys and the first-timeregisterpath are untouched.Testing
resolveKeyExpiryallow-list logic unit-tested in isolation.Diagnosis and spec:
docs/maintenance-flow/issue-3-manual-triage.md.https://claude.ai/code/session_01BxtA4nBczx1CaSDcBfZ24W