feat/one-api

ceilingApplies + rateLimitBucket both increment same key — ceiling halved

apps/platform/src/api/utils/public-v1-rate-limit-bucket.ts:4

Both call checkRateLimit(ip-ceiling:{ip}) — double-incrementing same bucket per request, halving the effective limit

migration-pipeline.md: duplicate 'Single path per env' bullet

.claude/rules/migration-pipeline.md:38

New block insertion left a duplicate trailing bullet in the SSOT rule file

one-api.md: duplicate '## Remaining risks' heading

.claude/rules/one-api.md:43

Two headings with same name break navigation and anchor links; remove the stub

authTokenHandler returns PLACEHOLDER token unconditionally

apps/platform/src/api/handlers/public-v1/auth-token.handler.ts:14

Reachable on staging/preview — any authenticated caller receives literal PLACEHOLDER string

handleBillFileDownload bypasses mount auth gate and rate limiting

apps/platform/src/app/api/v1/[...ts-rest]/route.ts:89

GET short-circuits before handleRequest; auth deferred to readBillFile internal wrapper — fragile; no rate limiting applied

IDOR risk: verify ctx.org.id is not request-parameter-influenced

apps/platform/src/api/utils/public-v1-file-read.ts:9

Guard is valid only if org resolved solely from authenticated JWT/API key, not request headers

Dynamic import hides module load failures — auth-less 500 path

apps/platform/src/app/api/v1/[...ts-rest]/route.ts:100

Import failure throws at request time with no auth check performed; prefer static import

destructive_migration boolean lacks a friction gate

.github/workflows/pr-checks.yml:6

Single checkbox suppresses auto-rollback; consider a required confirmation string

Rate limit key prefix change orphans in-flight counters on deploy

apps/platform/src/api/utils/public-v1-rate-limit-bucket.ts:4

IPs near limit under old ip: key get fresh window on deploy — one-time transient relaxation

providerId added to UtilityContract without visible type-check update

domains/utility/src/utility-contract/utility-contract.type.ts:14

AssertEqual in type-check.ts must also be updated per ADR-018

file_url added to PublicApiBill without visible Zod schema update

packages/api/src/types/public/bill.public-api-types.ts:26

satisfies alignment with Zod schema in packages/api/src/schemas/ must be confirmed

auth-token service test is a no-op placeholder

apps/platform/src/api/handlers/public-v1/__tests__/auth-token.service.test.ts:5

expect(true).toBe(true) — zero coverage on security-critical token exchange path

handleBillFileDownload has zero test coverage

apps/platform/src/app/api/v1/[...ts-rest]/route.ts

New public endpoint with auth implications, URL parsing, file access — entirely untested

Profile shell catch tests only verify result.ok===false, not error shape

domains/core/src/profile/__tests__/profile.shells.catch.test.ts:20

Missing _tag/statusCode assertions — callers branch on _tag; wrong tag passes test but breaks downstream

rateLimitBucket tests do not cover ceiling-blocked path or return values

apps/platform/src/api/utils/__tests__/public-v1-rate-limit-bucket.test.ts

Denied path (allowed:false) is untested; boundary {allowed:true,remaining:0} also missing

self-hosted runner for pure Node.js CI may stall PRs if dev-ops box offline

.github/workflows/pr-checks.yml:120

route-inventory-fresh and check-admin-required may not need the self-hosted runner

handleBillFileDownload duplicates path extraction already done by BILL_FILE_ROUTE

apps/platform/src/app/api/v1/[...ts-rest]/route.ts

Use named capture group in BILL_FILE_ROUTE to avoid dual regex application

Dynamic import should document why it is not a static import

apps/platform/src/app/api/v1/[...ts-rest]/route.ts

Without a comment, future readers will refactor to static import and reintroduce avoided problem