diegosouzapw b6d2f0f82b fix(api): reject revoked, deactivated, banned or expired keys on DELETE /v1/batches/delete-completed ...

The fail-closed gate added in #13262 authorized a presented key by row
EXISTENCE (getApiKeyMetadata); a revoked/deactivated/banned/expired key
still has a row and ran the sweep (CWE-613). The route now also requires
validateApiKey() — the one lifecycle gate — before choosing a scope, and
neither an unresolved nor an invalid key falls through to the session
branch. Both 401 bodies now go through buildErrorBody() (Hard Rule #12).

Found by the omni-code-sec battery on #12969 (SEC-B, SEC-E, SEC-F);
4 negative route tests added (revoked, deactivated, banned, expired —
the last one alongside a session cookie).

Refs #12969

2026-09-10 19:06:29 -03:00

..

app

fix(api): reject revoked, deactivated, banned or expired keys on DELETE /v1/batches/delete-completed

2026-09-10 19:06:29 -03:00

domain

fix(claude): extra-usage switch does not skip 5h preflight (#12803)

2026-09-07 08:59:39 -03:00

hooks

chore(lint): batch 7 of #12146 — final src tail: 37 react-hooks violations across 33 files resolved (#12244)

2026-09-01 01:07:46 -03:00

i18n

fix(chat): continue after a server-owned tool on Chat Completions (#12867)

2026-09-07 09:15:00 -03:00

lib

fix(api): explicit scope, audit log and atomic sweep for DELETE /v1/batches/delete-completed (omni-code-review battery on #12969) (#13262)

2026-09-10 17:58:15 -03:00

middleware

fix(guardrails): restore injection-guard logging on middleware-only routes (#12117)

2026-08-30 11:11:12 -03:00

mitm

feat(sse): support native max reasoning effort and per-model clamping (#11875)

2026-09-02 00:12:13 -03:00

models

fix(barrel): migrate open-sse, src/shared, src/sse, src/models, src/domain off the @/lib/localDb barrel import (#11795 Phase 4) (#12053)

2026-08-30 02:31:09 -03:00

scripts

feat(db): consolidate all database settings into SystemStorageTab (closes #1935) (#1947)

2026-05-04 19:25:41 -03:00

server

fix(authz): hard-gate every credential export and CLI-config write (GHSA-5926-2w35-7h4q) (#12600)

2026-09-03 09:19:44 -03:00

shared

fix(chat): continue after a server-owned tool on Chat Completions (#12867)

2026-09-07 09:15:00 -03:00

sse

fix(combo): treat a pin-only step as implicit connection allowlist (#12697)

2026-09-07 09:00:37 -03:00

store

feat(dashboard): collapsible JSON tree viewer for request/response payloads (#11703)

2026-08-30 04:26:15 -03:00

types

fix(providers): retire common ChatGPT Web provider (#11754)

2026-08-28 06:52:46 -03:00

instrumentation-node.ts

feat(quota): Moonshot Open Platform balance and TPD lock for custom nodes (#12590)

2026-09-03 12:47:50 -03:00

instrumentation.ts

fix(cli): guarantee non-empty [STARTUP] Fatal log on instrumentation-hook boot throw (#10447)

2026-08-18 10:57:44 -03:00

proxy.ts

fix(security): close 4 STILL-REAL advisory findings (ACP RCE hardening, db-backups tier, uppercase authz bypass, spawn-veto drift) (#11028)

2026-08-21 13:57:42 -03:00