feat/one-api

Master key plaintext silently dropped from org-creation response

apps/platform/src/api/handlers/organizations.handler.ts

Both org-creation handlers drop result.value.masterApiKey. The secret is never stored (only scrypt hash), so the provisioned master key becomes permanently inaccessible via machine path until dashboard rotation.

revokeAllInOrg two-phase SELECT+UPDATE non-atomic — race window for in-flight creates

domains/core/src/api-key/api-key.queries.ts

SELECT snapshots live keys then UPDATE by id. A concurrent create between the two statements escapes the sweep. Advisory lock not held in revoke path. Fix: single UPDATE...WHERE...RETURNING or acquire lock.

decideRotate master check === false does not guard undefined; comment misleading

domains/core/src/api-key/api-key.decisions.ts:324

Intentional for sessions but comment implies all non-master callers are blocked. Document the three-state intent: undefined/null = session, false = non-master machine, true = master.

Orphaned JSDoc block for revokeDescendants sits above revokeAllInOrg

domains/core/src/api-key/api-key.queries.ts:234

Inserting revokeAllInOrg displaced the revokeDescendants comment. Two back-to-back JSDoc blocks confuse readers.

No backfill migration — existing orgs lose machine key-to-key minting

packages/database/drizzle/0067_premium_terrax.sql

Migration sets is_master=false for all existing rows. Existing orgs have no master key post-migration. Any customer using machine key-to-key minting via /v1/api-keys will receive 403 not_master with no upgrade path. Silent breaking change.

Error message for non-master reveals master-key architecture in 403 body

domains/core/src/api-key/api-key.errors.ts:246

notMasterKey() error message names the master key tier and suggests the dashboard. Verify public mapper does not include the message field in the external response body.

Partial unique index prevents second active master but not two concurrent rotating masters — by design

OCC version check serializes concurrent rotations. No multi-active-master path is reachable.

granterIsMaster sourcing asymmetry — state-sourced for create, command-sourced for rotate

apps/platform/src/api/handlers/public-v1/api-keys.handler.ts:223

If decideCreate is refactored to read command.granterIsMaster (mirroring rotate), master-only enforcement silently stops because the create handler never sets that field. Document or unify.

api-key.master.ts is not a canonical entity slot

domains/core/src/api-key/api-key.master.ts

Canonical form: .type .decisions .errors .queries .shells .mapper index. Move prepareMasterApiKey to .queries.ts, insertMasterApiKey to .shells.ts or cross-domain.

insertMasterApiKey + prepareMasterApiKey exported outside ApiKeyFCIS namespace

domains/core/src/api-key/index.ts

Top-level named exports bypass ApiKeyFCIS namespace convention. Add to namespace or move to cross-domain.

Migration files missing trailing newline

packages/database/drizzle/0067_premium_terrax.sql

0067 sql and _journal.json end without newline. Permanent diff noise.

PublicApiKeyResourceSchema satisfies z.ZodType correctly — no drift risk

packages/api/src/schemas/public/api-key.public-schemas.ts

is_master added to both interface and schema with satisfies. No action needed.

IDOR harness uses non-master caller — write route probes now 403 for wrong reason

apps/platform/src/__tests__/integration/public-v1-idor.test.ts:141

Harness mints callerKey without master credential. Write routes return 403 ApiKeyNotMaster before cross-org check. Cross-org coverage silently lost for create/rotate/revoke routes.

Kill-switch test never asserts the master key own final status

apps/platform/src/__tests__/integration/public-v1-api-keys.test.ts:258

Assertion loop iterates only child keys a and b. A regression leaving master in rotating/active state would pass this test.

Disposable orgs leak — afterAll deletes api_keys rows but not org or membership rows

apps/platform/src/__tests__/integration/public-v1-api-keys.test.ts:165

freshOrgWithMaster creates org+membership+master key rows. afterAll only cleans api_keys by org id. Org and membership rows accumulate across runs.

No handler-level test for DELETE 409 API_KEY_MASTER_NOT_DELETABLE

apps/platform/src/__tests__/integration/public-v1-api-keys.test.ts

Contract declares 409 for master delete. No integration test fires DELETE /v1/api-keys/:id against the master and asserts 409 with API_KEY_MASTER_NOT_DELETABLE.

No test for one-active-master-per-org unique index enforcement

domains/core/src/api-key/__tests__/api-key.integration.test.ts:333

Partial unique index is the last-resort guard against double-master. insertMasterApiKey called twice for same org should hit the constraint. Untested.

No shell-level test: master rotation must preserve isMaster=true, createdByApiKeyId=null

domains/core/src/api-key/__tests__/api-key.integration.test.ts

Decision test covers pure function. No shell test confirms the resulting DB row has correct is_master and created_by_api_key_id values post-rotation.

Cross-org isolation not directly tested for master key operations

apps/platform/src/__tests__/integration/public-v1-api-keys.test.ts

orgA and orgB masters exist in fixture but no test uses orgB master to attempt operations against orgA keys.

Non-master rotate 403 test does not assert error body

apps/platform/src/__tests__/integration/public-v1-api-keys.test.ts:344

Only asserts status 403. A swap from forbidden to insufficient_scope in the mapper would pass silently.

Integration test uses tx as never to call insertMasterApiKey

domains/core/src/api-key/__tests__/api-key.integration.test.ts:344

as never cast suppresses a type incompatibility. Use the shell or fix DbOrTx typing.

Cap test does not verify master is excluded from the active-key count

domains/core/src/api-key/__tests__/api-key.integration.test.ts:86

countActiveByOrg excludes masters but the exclusion is never exercised in the cap suite.

granterIsMaster=undefined (omit) path not explicitly unit-tested in decideRotate

domains/core/src/api-key/__tests__/api-key.decisions.test.ts:309

Implicit in baseline tests. Add an explicit backward-compat assertion for omitted field.

Outbox events for insertMasterApiKey not asserted in integration test

domains/core/src/api-key/__tests__/api-key.integration.test.ts

insertMasterApiKey writes outbox but shell tests do not assert core.api_key.created event was written atomically.

Duplicate 403 forbidden literal in public api-keys mapper

apps/platform/src/api/mappers/public-v1/api-keys.mapper.ts:86

Same inline 403 forbidden object in mapPublicCreateApiKeyError and mapPublicRotateApiKeyError. File already has internalError() and notFound() helpers; add forbidden() to match.

tokenForOrg / tokenFor near-duplicate test helpers

apps/platform/src/__tests__/integration/public-v1-api-keys.test.ts:42

Differ only in org source and scopes parameterization. Collapse to one helper.

childWithScopes re-fetches master row from DB on every call

apps/platform/src/__tests__/integration/public-v1-api-keys.test.ts:117

Cache master row in beforeAll instead of re-querying per test invocation.

updated.orgId guard in revoke shell redundant given DB CHECK constraint

domains/core/src/api-key/api-key.shells.ts:345

DB CHECK api_keys_master_is_org_scoped guarantees orgId non-null when isMaster. Harmless safety-net.

Two org-creation shells replicate identical master-seeding block

domains/core/src/organization/organization.shells.ts:69

Acceptable now; consolidate if both shells survive W3 convergence.