feat/one-api

'service' RouteAuthKind unreachable in the gate — latent FORBIDDEN_ACTOR

apps/platform/src/api/utils/public-v1-meta-gate.ts:104

Gate maps actorType via `=== 'machine' ? 'machine' : 'session'`. AuthContext.actorType is 'user'|'machine', so 'service' can never be produced. A future service-key route declaring auth:['service'] would always return FORBIDDEN_ACTOR without a gate branch addition.

ULID_SYNTH contains Crockford-invalid characters — probes test 400-path not 404-path

apps/platform/src/__tests__/integration/public-v1-idor.test.ts:63

Contains 'I' and 'O' excluded from Crockford base32. Handlers validate against publicIdRegex → 400. For 'denied' probes, 400 is accepted; security invariant holds. Slightly weaker proof of isolation (400-path, not not-found-404-path).

scopesSatisfied(granted, []) trivially passes — intentional by design

packages/api/src/meta/route-meta.ts:79

required.every(...) on [] returns true. Combined with meta.scopes.length > 0 short-circuit, routes with scopes:[] skip all scope enforcement. Explicitly intended — documented in code.

Session actors bypass scope checks — BAT-276 (membership RBAC) not yet built

apps/platform/src/api/utils/public-v1-meta-gate.ts:107

The gate skips scope checks for session actors intentionally ('membership RBAC governs them — BAT-276'), but BAT-276 is not yet built. A session JWT from org-A can call any route with auth:['session','machine'] with no scope enforcement. Real isolation rests entirely on handler-level org-id extraction from auth.memberships[0].orgId.

INFRA_DEPENDENT routes: 500 body content on infra failures not fully ruled out

apps/platform/src/__tests__/integration/public-v1-idor.test.ts:76

The harness relaxes status assertions for 5 routes and allows ≥500. assertNoLeak still runs against the canary. A production infra 500 containing internal ARNs, bucket names, or stack traces would not be caught — publicApiErrorHandler is the real backstop here.

withPublicApiAuth fallback re-verifies raw Bearer outside the gate

packages/api/src/middleware/public-api-auth.ts:76

If req.auth is absent (handler called outside publicV1GatedHandlers), withPublicApiAuth falls back to verifying the raw Bearer token. Dead code in production but no gate-level org/scope check would apply.

Machine scope '*' grants unrestricted API access — not documented in key issuance flow

packages/api/src/meta/route-meta.ts:72

A key issued with '*' can call every machine-permissioned route. Key issuance flow should document and ideally require explicit confirmation for wildcard scope grants.

New publicized routes skip the beta stability entry tier required by one-api.md

apps/platform/src/api/contracts/public-v1/asset-management.contract.ts:81

one-api.md §6 and the publicization definition-of-done require newly-publicized routes to enter as stability:'beta'. Asset-management routes (provision, makes, metric-types, etc.) are marked stability:'stable' directly. The guard test enforces no stability constraint, so CI won't catch this.

Error code casing: gate/schema use lowercase; one-api.md canonical shows SCREAMING_SNAKE_CASE

apps/platform/src/api/utils/public-v1-meta-gate.ts:42

The gate and PublicApiErrorCodeSchema agree (lowercase). But one-api.md §Failure shapes shows uppercase. The inconsistency is in the rule doc — will mislead API consumers reading the spec.

Capability duplicated per-route instead of router-level per canonical form

apps/platform/src/api/contracts/public-v1/asset-management.contract.ts:77

one-api.md §Canonical contract form shows capability set once at the router level. Here capability is repeated in every routeMeta() call across all 46 routes, risking drift between capability and scope prefix.

withMetaGate fail-closed returns 401 for missing metadata instead of 500

apps/platform/src/api/utils/public-v1-meta-gate.ts:87

Intentional per comment. However 401 for a programmer error conflates a security signal with an infra fault — clients retry with different credentials rather than treating as an infra problem.

Admin gate before validateInput — minor pattern deviation in BAT-273 handlers

apps/platform/src/api/handlers/integrations.handler.ts:80

Canonical pattern is withAuth → validate → shell → map. BAT-273 handlers insert isPlatformAdmin between withAuth and validate. Reasonable optimization (avoids parsing body for unauthorized callers); consistent across all three handler files.

api-key.decisions.ts is fully FCIS-compliant

domains/core/src/api-key/api-key.decisions.ts:1

All four decision functions are synchronous, side-effect-free, and return Result<Decision, Error>. Naming follows canonical-form.md exactly. Confirmed correct.

assertNoLeak ID-exclusion could mask 200-response IDOR when org-B IDs appear in probe args

apps/platform/src/__tests__/integration/public-v1-idor.test.ts:309

assertNoLeak silences org-B ID checks for IDs in probe.args. If a buggy handler returns 200 echoing that exact ID, the ID check is silenced. Canary string is the backstop — works as long as every org-B row has canary-embedded string fields (holds for seeded entities, not for auto-generated ULIDs in response bodies).

filesList over-classified as INFRA_DEPENDENT — S3 presign path unreachable in test fixture

apps/platform/src/__tests__/integration/public-v1-idor.test.ts:77

filesList presigns only per-file. Org-A has no seeded bills/files so the result is empty and presigning never runs — the handler returns 200 not 500. INFRA_DEPENDENT is never triggered but silently allows a 500 to pass without a leak check. Should be a 'clean' probe expecting <300.

Meta gate unit test missing wrong-actor-kind test case

apps/platform/src/api/utils/__tests__/public-v1-meta-gate.test.ts:84

FORBIDDEN_ACTOR branch (line 105 of meta-gate) is never exercised — all 48 routes allow both machine and session. A one-line contract fixture addition (auth:['machine'] only) + session call would close this gap.

RouteMetaSchema unit test covers only one valid shape — other enum variants untested at unit level

packages/api/src/__tests__/meta/route-meta.test.ts:50

No coverage for stability 'beta'/'app-fast'/'coordinated', visibility 'app'/'infra', or auth kind 'service'. Covered implicitly by the guard test on 48 live routes, not at unit level.

SYNTH_RPU '990000000001' not asserted absent — parallel CI run collision risk

apps/platform/src/__tests__/integration/public-v1-idor.test.ts:70

If two integration runs execute concurrently against the same preview DB, one run's jobsCreate could create this RPU before the other run's probe fires. Low risk on branch-isolated DBs but the sentinel is not documented as reserved.

Router-level metadata merging not used — 46 routes repeat visibility/auth/stability boilerplate

apps/platform/src/api/contracts/public-v1/bills.contract.ts:43

one-api.md canonical form shows using c.router's second metadata argument. ts-rest merges this into every route. All 46 authenticated public routes share the same visibility:'public', auth:['machine','session'], stability:'stable' triple inline. Extracting to router-level would cut each routeMeta to just {scopes:['bills:read']}.

INFRA_DEPENDENT set will drift silently as new infra-touching routes are added

apps/platform/src/api/utils/public-v1-meta-gate.ts:76

Static Set<string> maintained by hand. RouteMeta already has optional markers (occ, binary, idempotency); an infraDependent?: true flag would let the harness derive this set from the contract itself.

Gate↔withPublicApiAuth stash is an undocumented implicit protocol

apps/platform/src/api/utils/public-v1-meta-gate.ts:119

Gate writes ctx.request.auth and ctx.nextRequest.auth; withPublicApiAuth reads req.auth and fast-paths. No shared type or constant for the stash key. A refactor of the ts-rest context shape could break the stash silently. Export a shared AUTH_STASH_KEY constant used in both files as a minimum.

read/write op-level scope wildcards add grammar surface with no current issuer

packages/api/src/meta/route-meta.ts:71

scopeSatisfied supports *, read (all reads), write (all writes), {cap}:*, {cap}:{op}. No existing or planned key type issues bare 'read'/'write'. Unused vocabulary in a security primitive is a maintenance liability.

route-inventory.json is a generated artifact in git with no CI freshness check

scripts/one-api/route-inventory.json:1

The file has a 'do not hand-edit' comment but no CI job verifies it matches a fresh classifier run. Will drift silently as routes are added each wave.

withMetaGate type signature erases handler types internally

apps/platform/src/api/utils/public-v1-meta-gate.ts:76

Externally preserves T but internally casts to AnyHandler. Tightening the generic constraint against the contract shape would catch a handler mis-keyed to the wrong route at compile time.