← all branches

feat/one-api

needs attentionviewing older commit
ec46958 · incrementalpre-PRreviewed 2026-07-27 16:51 UTC0H · 3M · 5L · 1I
The branch
Purpose
Build a service-key system so Batu's own Lambdas/SFNs can call internal endpoints with scoped, rotatable credentials instead of a shared static secret.
Goal
W2 complete: service actors minted and dual-accepted on the internal mount; migrate-and-retire the static key in later SGs.
Sub-goals
  • SG-1a: platform service actor — JWT, AuthContext, gate
  • SG-1b: ServiceKey entity merged into api_keys table (kind discriminator)
  • SG-2: mint service tokens from /v1/auth/token
  • SG-3: internal mount dual-accepts legacy x-api-key OR bearer service token (expand half)
  • SG-4/5: migrate callers, remove legacy key (future)
The changes (whole branch)
What
Reverts the scope check on the internal mount — removes INTERNAL_MOUNT_SCOPES and scopesSatisfied() call, replaces with pure actorType === 'service' class check. Updates tests to pin the new behavior.
Why
The scope check was guarding a state that cannot exist today (no narrowed service keys, no per-route metadata). It was security theater; the class check is the real discriminant.
Areas
packages/api+13−24domains/core+0−0apps/platform+0−0
Blast
35 files, +1681/-114 across packages/api, domains/core, apps/platform (whole branch). This commit: 2 files, +13/-24 — auth middleware + tests only.
auth transitional-dual-accept
➖CI· no PR open yet — pre-PR branch➖CodeRabbit· no .coderabbit.yaml✅correctness✅security❌conventions· SG-5 phase marker + task-scoped rationale in source comment❌tests· missing narrowed-scope (bills:read) positive assertion✅improvement· 5-line comment could be trimmed

Findings · 9

correctness1

low

Empty-scopes token now passes — latent risk if mint path changes

packages/api/src/middleware/internal-auth.ts:69

Correct given stated premises; decision traceable via comment and test.

security2

low

No enforcement barrier if a narrowed service key is minted before retirement

packages/api/src/middleware/internal-auth.ts:78

Risk acknowledged; mint path structurally hard-codes ['*']. A DB check constraint would make this structural.

info

Legacy shared-secret path remains unchanged

packages/api/src/middleware/internal-auth.ts:62

The static INTERNAL_API_KEY path is still the primary credential; no regression introduced.

conventions3

medium

SG-5 phase marker in production comment

packages/api/src/middleware/internal-auth.ts:72

Project convention: future-phase markers belong in commit/PR messages, not source. The invariant can be stated without the marker.

medium

Comment mixes invariant with task-scoped rationale

packages/api/src/middleware/internal-auth.ts:72

'When a real permissions model lands, its enforcement arrives with it — that is the same change, not a follow-up' is forward-looking task commentary, not a stable invariant.

low

Test comment contains temporal task commentary

packages/api/src/middleware/__tests__/internal-auth.test.ts:185

'Enforcement arrives WITH the perms model' is phased-delivery note, not stable invariant.

tests2

medium

Missing positive case for narrowed scopes (bills:read)

packages/api/src/middleware/__tests__/internal-auth.test.ts:182

Old 'refuses narrowed' test used authOf('service', ['bills:read']). No replacement asserts it PASSES now. Add: authOf('service', ['bills:read']) → 200.

low

Empty-scope example understates the behavior change

packages/api/src/middleware/__tests__/internal-auth.test.ts:190

Most contested deletion was narrowed-scope (['bills:read']), not empty ([]). Pinning only empty leaves the more controversial case undocumented in executable form.

improvement1

low

5-line comment block may over-explain a one-liner

packages/api/src/middleware/internal-auth.ts:72

Consider: '// internal-mount: actor class is the sole gate — scopes not evaluated'. Fuller rationale lives in commit message ec469588.

History · 47 commits

  1. 82bb5b9blockedincremental5H · 5M · 4L2026-08-12 01:48
  2. 90aa3d5needs attentionincremental1H · 5M · 3L2026-08-11 19:37
  3. 29d19a0needs attentionincremental1H · 5M · 9L2026-08-11 17:41
  4. 9bd8a0cneeds attentionfull0H · 5M · 9L2026-08-11 02:14
  5. 62ec3f7needs attentionincremental2H · 5M · 6L2026-08-10 22:51
  6. f93bca9needs attentionincremental2H · 5M · 8L2026-08-10 17:51
  7. 052db6fneeds attentionincremental1H · 3M · 4L2026-08-09 21:13
  8. 45699caneeds attentionincremental0H · 7M · 11L2026-08-09 17:44
  9. b843d8aneeds attentionincremental1H · 7M · 9L2026-08-09 04:05
  10. e1757b8needs attentionincremental0H · 3M · 6L2026-08-05 02:11
  11. 7a762faneeds attentionincremental2H · 5M · 5L2026-08-05 01:25
  12. 3300a60needs attentionincremental2H · 4M · 7L2026-08-04 19:06
  13. 0c8a7f5needs attentionincremental0H · 4M · 9L2026-08-04 18:15
  14. 345f42eneeds attentionincremental2H · 6M · 9L2026-08-04 17:28
  15. 8338a9aneeds attentionincremental5H · 14M · 14L2026-08-04 00:33
  16. 41be4c3needs attentionincremental0H · 5M · 7L2026-08-03 23:49
  17. 5ed593dneeds attentionincremental1H · 6M · 6L2026-08-03 21:32
  18. b333e25needs attentionincremental4H · 9M · 8L2026-08-03 21:00
  19. 5642cccneeds attentionincremental2H · 3M · 2L2026-08-03 20:17
  20. 73b0b39needs attentionincremental3H · 10M · 13L2026-07-31 18:29
  21. b19852eneeds attentionincremental0H · 1M · 5L2026-07-29 05:04
  22. 3845205needs attentionincremental3H · 6M · 4L2026-07-29 04:47
  23. eb8eb50needs attentionincremental0H · 1M · 2L2026-07-29 03:03
  24. f4720a3needs attentionincremental6H · 8M · 7L2026-07-29 02:54
  25. f8d341ablockedincremental2H · 2M · 5L2026-07-29 00:00
  26. a7f1a64needs attentionincremental2H · 8M · 8L2026-07-28 18:41
  27. 738b60bblockedincremental3H · 6M · 5L2026-07-28 00:46
  28. 2c248b6needs attentionincremental8H · 12M · 8L2026-07-27 23:23
  29. 1346cc0needs attentionincremental2H · 8M · 6L2026-07-27 20:15
  30. 0716018needs attentionincremental2H · 11M · 12L2026-07-27 19:22
  31. 215cd2dneeds attentionincremental3H · 6M · 5L2026-07-27 17:04
  32. ec46958needs attentionincremental0H · 3M · 5L2026-07-27 16:51current
  33. de7b337blockedincremental4H · 9M · 14L2026-07-27 06:36
  34. b1bb9c0needs attentionincremental1H · 2M · 4L2026-07-27 05:09
  35. 4701d11needs attentionincremental0H · 4M · 3L2026-07-27 04:44
  36. e1626c4needs attentionincremental3H · 9M · 10L2026-07-27 03:21
  37. 195f198needs attentionincremental3H · 3M · 3L2026-07-25 01:22
  38. 42c7358safeincremental0H · 0M · 0L2026-07-22 20:46
  39. 85b9018needs attentionincremental0H · 1M · 6L2026-07-21 23:51
  40. a7b2a9aneeds attentionincremental0H · 9M · 12L2026-07-21 18:49
  41. c2ee0daneeds attentionincremental4H · 7M · 7L2026-07-21 02:17
  42. e8ffa5eneeds attentionincremental4H · 7M · 5L2026-07-21 01:33
  43. a2d2a54needs attentionincremental2H · 7M · 3L2026-07-21 00:51
  44. 576fbd6needs attentionfull1H · 6M · 7L2026-07-21 00:35
  45. d3465e8needs attentionincremental1H · 7M · 10L2026-07-21 00:23
  46. dc794a7needs attentionincremental0H · 5M · 5L2026-07-20 23:46
  47. 9082773needs attentionfull1H · 3M · 3L2026-07-20 23:13