feat/one-api

OAuth route emits no telemetry on 429 rate-limit rejection

apps/platform/src/app/api/v1/auth/oauth/token/route.ts:87

When the rate limiter fires, emit() is never called. Rate-limit hits on sk_ probing are invisible to api_request_events.

WizardDecisionError 403/404 statusCodes silently flatten to 422

apps/platform/src/api/handlers/utility-contracts.handler.ts:742

The new branch maps statusCode===409→conflict(), everything else→422. Wizard can emit 404/403 wrapped in WizardDecisionError; these surface as 422 — semantically wrong.

IDOR afterAll cleanup deletes metric_type by variable, not public_id

apps/platform/src/__tests__/integration/public-v1-idor.test.ts:253

More aggressive than needed; prefer DELETE WHERE public_id = IDOR_METRIC_TYPE_ID.

Profile retry: second-attempt error tag misclassified on username collision

domains/core/src/profile/profile.shells.ts:167

Cosmetic misclassification; no behavioral regression.

Session actor principal=null rows now persist to api_request_events

apps/platform/src/api/utils/public-v1-meta-gate.ts:149

Intentional. Queries joining principal→api_keys.public_id implicitly exclude session-actor rows. Fine for W2; revisit at W3.

OAuth rate-limit bucket is independent of the sibling /v1/auth/token bucket

apps/platform/src/app/api/v1/auth/oauth/token/route.ts:86

Two independent 10/min windows rather than a shared auth-family budget. Doc comment claims parity but it is not true.

x-forwarded-for is client-spoofable — no credential-hash fallback on OAuth route

apps/platform/src/app/api/v1/auth/oauth/token/route.ts:83

Safe on Vercel CDK topology but not enforced by code. Main ts-rest route has token-hash fallback; OAuth route has none.

Multi-membership session actors land in memberships[0] org — unreliable for attribution

apps/platform/src/api/utils/public-v1-meta-gate.ts:149

Data-quality concern, not a security boundary issue.

Sealed-secret exports removed cleanly — no dangling consumers

domains/core/src/index.ts:1

Grep confirms no remaining production references. Reduces attack surface.

IDOR harness: webhook probes correctly removed, metric_type probe reaches org gate

apps/platform/src/__tests__/integration/public-v1-idor.test.ts:175

Real metric_type needed because handler resolves it before site check.

unauthorized.ts placed in mappers/public-v1/ but is a shared constant, not a mapper

apps/platform/src/api/mappers/public-v1/unauthorized.ts:1

Per canonical-form.md, mappers/ owns domain→response mapping. Constant belongs in utils/. Also defines a subtly different 401 message from withMetaGate's own UNAUTHORIZED constant.

OAuth route rate-limit bucket is a free-form string, not a registry-derived key

apps/platform/src/app/api/v1/auth/oauth/token/route.ts:86

Route correctly outside withMetaGate (per BAT-294), but the rate-limit bucket '/v1/auth/oauth/token' is not the canonical route key derived from the registry.

MCP server README not updated in same change (mcp-server.md rule step 4)

packages/mcp-server/README.md:1

May be stale if it previously listed webhook tools.

route-inventory.json and guard test count updated consistently

scripts/one-api/route-inventory.json:1

3 webhook routes removed; inventory and guard test (≥48→≥45) are consistent.

Migration 0073 drops webhook_endpoints — schema file and Drizzle export also removed

packages/database/drizzle/0073_light_ted_forrester.sql:1

Migration, schema, and domain code consistently removed.

Session-actor telemetry gate change has no regression test

apps/platform/src/api/utils/__tests__/public-v1-meta-gate.test.ts:191

Reverting the gate from actor==='anonymous' back to principal===null would silently drop session-actor rows again with all tests green.

IDOR_METRIC_TYPE_ID uses 24-char ULID part (canonical is 26)

apps/platform/src/__tests__/integration/public-v1-idor.test.ts:67

Functionally harmless; cosmetically inconsistent with convention.

KEY_A constant uses 24-char ULID part (canonical is 26)

apps/platform/src/__tests__/integration/rls-machine-claim.test.ts:40

Functionally harmless; cosmetically inconsistent with convention.

OAuth rate-limit test correctly asserts DB lookup skipped on 429

apps/platform/src/app/api/v1/auth/oauth/token/__tests__/route.test.ts:170

findActiveByPrefix not-called assert confirms guard fires before DB lookup.

RLS machine-claim non-vacuous guard: pre-assertion proves row exists before checking machine cannot see it

apps/platform/src/__tests__/integration/rls-machine-claim.test.ts:170

Textbook non-vacuous pattern. Correctly eliminates empty-table false-pass.

MCP server JSDoc header still lists 'webhooks' as an exposed capability

packages/mcp-server/src/index.ts:6

Webhook tools correctly tombstoned at line 315 but module-level description not updated.

x-forwarded-for IP extraction duplicated in 3 places without shared utility

apps/platform/src/app/api/v1/auth/oauth/token/route.ts:83

Also in ts-rest mount route and auth.handler.ts (which has richer x-real-ip/cf-connecting-ip fallback).

Inline emit() actor mapping diverges from withMetaGate's actorType map

apps/platform/src/app/api/v1/auth/oauth/token/route.ts:96

Correct today (service keys only); won't track future credential classes added to withMetaGate automatically.

unauthorized.ts comment references its webhook provenance — can be trimmed

apps/platform/src/api/mappers/public-v1/unauthorized.ts:3

Accurate history but noisy. Minor.