GeezerVison

Personal and workspace API keys gain an access level (full access or read
only) and an expiry picked when the key is created (30 days, 90 days,
1 year, or never; bounded server-side to one day through one year).

A read-only key is granted the api:read scope: the operation funnel
refuses it any operation api:read does not cover, including operations
that declare no scope, with a 403 READ_ONLY_API_KEY refusal rather than
an OAuth insufficient_scope challenge. Surfaces that authorize outside the
funnel refuse it too: v1 refuses every non-GET except knowledge search,
the legacy execute route refuses it, and a workflow MCP server refuses
tools/call. An expired key now answers 401 "API key has expired" on v2,
v1, and hybrid auth. /api/v2/meta reports the credential's scopes.

Migration 0455 adds api_key.access (enum api_key_access, NOT NULL DEFAULT
'write'), so existing keys and the deployed app keep full access. Write
keys serialize without the field and older serialized principals parse
as write, so queued runs survive a mixed-version deploy.

…, share key principal builder

- Create modal defaults Expires to Never; docs say so and note read-only keys keep search chat
- Client key list defaults a missing access to write during deploy rollout
- apiKeyPrincipal builds the key principal once for v1, hybrid, and workflow route auth
- Auth result carries expired: true instead of callers matching the message text
- Integration fixture uses valid table names; v2 create answers 201
- Serialized-principal test uses the wire shape; migration snapshot formatted

…docs

- api-key-read-only flag (global, fallback API_KEY_READ_ONLY) gates creating read keys:
  the server answers 400 and the create modal hides Access while it is off. Enforcement
  of existing read keys is never gated, since older pods would serve them as full access
- Reserve the mothership-delegation: key-name prefix so delegation minting can never
  adopt a user's key
- Expiry is checked after every other key gate, so a foreign or banned key reports invalid
- Workflow MCP serve and MCP discover answer an expired key with API key has expired
- Share DAY_MS from the api-keys contract; the year bound's day of slack is for clock skew
- Docs: per-surface refusal shapes, what read keys can still spend, and where the
  expiry message appears
- Integration: flag-off and reserved-name refusals, v1 search asserts 200

cubic-dev-ai Bot left a comment •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

…only-expiry

cubic-dev-ai Bot left a comment •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

…ction

…meta scopes

- The account settings layout resolves api-key-read-only and wraps its sections in
  FeatureFlagsProvider, as the workspace and organization layouts do, so personal API
  key settings no longer throw from the create modal's flag read
- The /api/v2/meta scopes description says read-only keys are also refused every
  operation that declares no API scope; OpenAPI regenerated

cubic-dev-ai Bot left a comment

…dered text

…only-expiry

cubic-dev-ai Bot left a comment