feat/one-api

Revoked machine-key tokens can still LIST org API keys

apps/platform/src/api/handlers/public-v1/api-keys.handler.ts:164

apiKeysListHandler does not call resolveCaller. A revoked key's JWT (valid up to 1h) can enumerate all org key prefixes, scopes, and metadata. Dead-token window was closed for write paths but left open for reads.

Lock acquired AFTER fetch in revokeApiKeyShell — TOCTOU window on concurrent creates

domains/core/src/api-key/api-key.shells.ts:292

fetch-then-lock ordering means concurrent createApiKeyShell could insert a new child between the two calls. CTE reads live data at execution time so exploitability is low but the documented invariant requires lock-then-fetch.

callerMayActOn not applied to rotate at handler level — only inside decideRotate

apps/platform/src/api/handlers/public-v1/api-keys.handler.ts:280

Functionally correct but inconsistent with revoke's early-return handler check; error body comes from a different code path (mapper vs inline constant).

Revoke scope-authority check lives only in the handler, not in decideRevoke — FCIS violation

apps/platform/src/api/handlers/public-v1/api-keys.handler.ts:545

callerMayActOn for revoke is handler-only, outside the transaction. decideRevoke has no granterScopes param. The dashboard twin calling revokeApiKeyShell directly bypasses this protection. decideCreate/decideRotate enforce no-amplification in the decision; decideRevoke should too.

Revoke handler scope check races on target's scopes — pre-transaction snapshot

apps/platform/src/api/handlers/public-v1/api-keys.handler.ts:539

Handler pre-fetches existing outside the transaction, runs callerMayActOn on stale data, then calls shell which re-fetches inside the transaction. Target's scopes could change between the pre-fetch and the write.

RotateApiKeyCommand.granterScopes is optional (?) — undefined and null conflate silently

domains/core/src/api-key/api-key.decisions.ts:224

Both undefined (field absent) and null (session) skip the no-amplification check. An accidental omission silently grants session-level authority. Should be non-optional: `readonly granterScopes: readonly string[] | null`.

Authority test file missed by CI gate — security tests skip on handler-only PRs

.github/workflows/pr-checks.yml:152

db-changes path filter excludes handlers/public-v1/api-keys.handler.ts and the new authority test file. A PR changing only the public-v1 api-keys handler triggers changed=false and the database-checks job is skipped. These mocked-only tests should run in the always-on validate job.

Rotate 403 mapper branch untested at handler level

apps/platform/src/api/handlers/public-v1/__tests__/api-keys.authority.test.ts:191

Rotate describe block only checks granterScopes forwarding. Does not test ApiKeyScopeEscalation returned by shell → 403 via mapPublicRotateApiKeyError.

Outbox-collision test asserts .rejects.toThrow() — shell breaks never-throw on outbox-23505 path

domains/core/src/column-configuration/__tests__/column-configuration.shells.integration.test.ts:901

Correctly reflects that .catch() rethrows when nameWriteInFlight is false. But it documents an unresolved never-throw contract breach for callers without a try block.

Dead-token test for rotating status does not cover rotationExpiresAt === null

apps/platform/src/api/handlers/public-v1/__tests__/api-keys.authority.test.ts:163

it.each passes a past expiry for rotating. Does not verify rotating + null expiry which resolveCaller also treats as dead.

Secret-config admin shell: membershipQueries mock is a misleading no-op

domains/core/src/secret-configuration/__tests__/secret-configuration.shells.integration.test.ts:542

adminCreateSecretConfigurationShell skips membership lookup, so mocking findForUserInOrg gives false confidence.

createSecretConfigurationShell / adminCreateSecretConfigurationShell are near-verbatim duplicates

domains/core/src/secret-configuration/secret-configuration.shells.ts:712

Same orphanedSecret patch applied twice. A shared private helper would eliminate the parallel maintenance surface.

Mutable closure vars (nameWriteInFlight, dupWriteInFlight, orphanedSecret) — try/finally would be structurally safer

domains/core/src/column-configuration/column-configuration.shells.ts:929

Flag left true permanently on an exception — handled incidentally by the outer .catch. A try/finally around the write statement makes the contract explicit.