feat/one-api

Anonymous reads: IP ceiling and per-credential bucket both track same key — harmless

apps/platform/src/app/api/v1/[...ts-rest]/route.ts:110

For unauthenticated reads (no bearer), key === ipKey. Both checkRateLimit calls run the same string in different namespaces. Per-credential budget (200/15min) is always the binding constraint.

contractKeys() dot-notation vs probes() camelCase — latent, self-revealing

apps/platform/src/__tests__/integration/public-v1-idor.test.ts:551

Walk returns 'bills.list'; probes() uses 'billsList'. Flat contract today = identical keys. Nesting would cause a noisy test failure — self-revealing, not silent.

Dual auth rate-limit namespaces allow ~20 token mints/minute

apps/platform/src/app/api/v1/auth/oauth/token/route.ts:84

The /auth/oauth/token standalone route and the [...ts-rest] mount use different Redis key namespaces. An attacker gets 10/min from each independently. Verify whether both paths are live simultaneously and whether their quotas should share a bucket.

clientIp trusts x-real-ip unconditionally — bypassable off Vercel

apps/platform/src/api/utils/public-v1-rate-limit-bucket.ts:16

clientIp() checks x-real-ip first; both headers are client-controllable unless the edge proxy strips and re-sets them. Safe on Vercel (edge sets x-real-ip) but should be documented as a deployment invariant.

ip:unknown bucket collapse — header-stripped clients share one ceiling slot

apps/platform/src/api/utils/public-v1-rate-limit-bucket.ts:16

When both x-real-ip and x-forwarded-for are absent, all traffic keys to ip:unknown. Unlikely on Vercel but could cause false 429s for legitimate clients behind proxies that strip headers.

1h JWT revocation window — accepted risk, runbook adequate

.claude/rules/one-api.md:661

sk_ revocation stops new mints but outstanding JWTs remain valid 1h. Runbook documents mitigations (wait TTL, rotate signing key). Accepted architectural tradeoff for zero-DB hot path.

Telemetry records publicIds only — no credential or PII leakage

apps/platform/src/api/utils/public-v1-telemetry.ts:1

recordApiRequest logs route, actor type, public principal id, public org id, status, and duration. No request/response bodies, no key material.

CreateServiceKeyCommand correctly moved to decisions; naming follows conventions

domains/core/src/api-key/api-key.decisions.ts:440

Command types belong with the decision function. decideCreateService -> decideCreateServiceKey follows the decideXxx convention. Barrel exports correctly reorganized.

withRateLimit per-IP ceiling-exceeded path has no test

apps/platform/src/app/api/v1/[...ts-rest]/route.ts:109

The new per-IP ceiling branch (checkRateLimit on ipKey returning 429) is entirely untested. This is the main behavioral addition of round 7 and can be silently broken by any refactor without any test catching it.

auth-kind bucket: ipKey not asserted equal to key

apps/platform/src/api/utils/__tests__/public-v1-rate-limit-bucket.test.ts:36

The auth-kind test asserts key value but never asserts ipKey === key. A change to the auth branch that separates these two fields would silently break the ceiling without any test catching it.

auth-token handler: recordApiRequest not-called never asserted on failure paths

apps/platform/src/api/handlers/public-v1/__tests__/auth-token.service.test.ts:125

Failure-path tests assert signBatuJwt not called but none assert recordApiRequest not called. A regression moving recordMint above the auth gate would go undetected.

uniqueConstraintName 23505 discriminator has no unit test

domains/core/src/profile/profile.shells.ts:193

No integration test simulates a 23505 on either the username or authId constraint. A typo in the constraint-name check or a Postgres rename would silently route the wrong error type.

contractKeys recursive walk has no standalone unit test

apps/platform/src/__tests__/integration/public-v1-idor.test.ts:551

The floor assertion (>=45) is the only guard. A walk bug at a specific nesting depth could still collect >=45 routes from flat entries while missing nested ones.

Four divergent 23505-handler patterns — no shared utility

domains/core/src/profile/profile.shells.ts:193

profile.shells.ts, utility-contract.shells.ts, credit-metering.shells.ts, and contract-wizard.shells.ts each have their own isUniqueViolation / constraint-name extraction. The credit-metering variant is most complete (checks .constraint too). These should converge on one exported helper.

Stale entity_relationships references in utility-contracts schema file

packages/database/src/schema/utility-contracts.ts:11

Comments still reference entity_relationships as the access path. The table was dropped (BAT-301). No runtime risk but will mislead future readers.

rateLimitBucket auth case: key === ipKey intentional but undocumented

apps/platform/src/api/utils/public-v1-rate-limit-bucket.ts:53

A one-line comment would clarify that key and ipKey collapse for auth kind by design (bearer is attacker-controlled).