erik/erikvancraddock.com
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

Allow deletion of revoked API keys #27

Merged
erik merged 2 commits from feat/task-cac7d057-delete-revoked-api-keys into main 2026-10-27 06:18:16 -05:00
Conversation 1 Commits 2 Files changed 13 +219 -14
erik commented 2026-10-27 06:14:49 -05:00
Owner
Copy link

Summary

  • Upgrade @evcraddock/slug-auth to 1.0.0 with lockfile and site package metadata.
  • Adapt Slugkit PR #309 into site-owned storage, routes, and templates without replacing customizations.
  • Add Delete only for revoked keys; atomically reject active or out-of-owner deletion and preserve session authentication and CSRF checks.
  • Cover lifecycle/idempotence, viewer ownership, admin access, CSRF form/session binding, and browser create → revoke → delete.
  • Document credential lifecycle; no database migration or deployment.

Verification

  • npm run build, npm run lint, git diff --check: passed.
  • npm run test:ci: 497 passed (49 files).
  • npm test: 587 passed (56 files).
  • Browser suite: 40 passed using installed Chromium via PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH (default Playwright browser revision is unavailable).
  • Build-only generated CSS drift excluded; original checkout CSS change untouched.

Task: task-cac7d057
Reference: published slugkit.com note changelog-2026-10-26-revoked-key-deletion, template 0.11.0, Slugkit PR #309.

Independent review and CI required before merge.

## Summary - Upgrade `@evcraddock/slug-auth` to 1.0.0 with lockfile and site package metadata. - Adapt Slugkit PR #309 into site-owned storage, routes, and templates without replacing customizations. - Add Delete only for revoked keys; atomically reject active or out-of-owner deletion and preserve session authentication and CSRF checks. - Cover lifecycle/idempotence, viewer ownership, admin access, CSRF form/session binding, and browser create → revoke → delete. - Document credential lifecycle; no database migration or deployment. ## Verification - `npm run build`, `npm run lint`, `git diff --check`: passed. - `npm run test:ci`: 497 passed (49 files). - `npm test`: 587 passed (56 files). - Browser suite: 40 passed using installed Chromium via `PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH` (default Playwright browser revision is unavailable). - Build-only generated CSS drift excluded; original checkout CSS change untouched. Task: task-cac7d057 Reference: published slugkit.com note `changelog-2026-10-26-revoked-key-deletion`, template 0.11.0, Slugkit PR #309. Independent review and CI required before merge.
feat: allow deletion of revoked API keys
All checks were successful
CI / build-lint-test (push) Successful in 42s
Details
121f1c5bc8
fix: report updated auth version in API metadata
All checks were successful
CI / build-lint-test (push) Successful in 38s
Details
80c393e1f2
erik commented 2026-10-27 06:18:10 -05:00
Author
Owner
Copy link

No issues found in PR #27 at HEAD 80c393e.

  • Prior finding resolved: src/config/package-metadata.ts:10 and src/api/__tests__/routes.test.ts:73 now specify slug-auth 1.0.0, consistent with the manifest, lockfile, and site metadata.
  • Storage deletion atomically requires revocation and, for viewers, matching ownership. Admin access, session authentication, and CSRF protection remain intact.
  • Delete appears only for revoked keys. No migration or wholesale template replacement was introduced.

Reviewed origin/main...HEAD and surrounding security code against Slugkit 6b13d84 and changelog/2026-10-26-revoked-key-deletion.md. git diff --check passed.

Verification limits: Did not independently rerun the reported build, lint, 587 full tests, 497 CI tests, or 40 browser tests, or verify remote CI. Repository left unchanged; nothing posted.

**No issues found** in PR #27 at HEAD `80c393e`. - **Prior finding resolved:** `src/config/package-metadata.ts:10` and `src/api/__tests__/routes.test.ts:73` now specify slug-auth `1.0.0`, consistent with the manifest, lockfile, and site metadata. - Storage deletion atomically requires revocation and, for viewers, matching ownership. Admin access, session authentication, and CSRF protection remain intact. - Delete appears only for revoked keys. No migration or wholesale template replacement was introduced. Reviewed `origin/main...HEAD` and surrounding security code against Slugkit `6b13d84` and `changelog/2026-10-26-revoked-key-deletion.md`. `git diff --check` passed. **Verification limits:** Did not independently rerun the reported build, lint, 587 full tests, 497 CI tests, or 40 browser tests, or verify remote CI. Repository left unchanged; nothing posted.
erik merged commit 7f4da500fb into main 2026-10-27 06:18:16 -05:00
erik deleted branch feat/task-cac7d057-delete-revoked-api-keys 2026-10-27 06:18:16 -05:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
bug

   
priority:high

   
status:active

   
status:inprogress
No labels
bug
priority:high
status:active
status:inprogress
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
erik/erikvancraddock.com!27
No description provided.