Allow deletion of revoked API keys #62

Merged

erik merged 1 commit from feat/task-48c3ee03-revoked-key-deletion into main

2026-10-26 22:01:12 -05:00

erik commented

2026-10-26 21:59:23 -05:00

Owner

Summary

Upgrade @evcraddock/slug-auth to exactly 1.0.0; refresh the lockfile and runtime/generated-site package metadata while preserving the recorded template version.
Port storage, settings route, UI, and regressions from Slugkit PR #309 (template 0.11.0 reference) without replacing site customizations.
Delete only already-revoked keys through an atomic guarded SQLite DELETE with optional owner restriction; active, missing, repeated and out-of-scope requests are no-ops.
Keep Revoke separate; show Delete only for revoked keys. Retain session authentication, CSRF validation and viewer-owner/admin-wide access rules.
Document the credential workflow; no migration or portable bearer API change.

Verification

./scripts/pre-pr.sh passed: formatting, typecheck, build, unchanged generated CSS, all 627 tests / 61 files (including local federation integration coverage).
Targeted auth/storage, settings, CSRF and API metadata checks: 85 tests passed.
CSRF regression submits the rendered Delete form token, and rejects missing/invalid, cross-origin and cross-session tokens.
npm ls confirms @evcraddock/slug-auth@1.0.0; only the auth package changed in the lockfile.
CI verify succeeded at cf277dca6c (run #69).
Independent read-only review: no actionable findings; 85 targeted tests, typecheck and whitespace checks independently passed. See review comment for limits.
No release, production credential mutation, migration, or deployment performed.

Task: task-48c3ee03

## Summary - Upgrade @evcraddock/slug-auth to exactly 1.0.0; refresh the lockfile and runtime/generated-site package metadata while preserving the recorded template version. - Port storage, settings route, UI, and regressions from Slugkit PR #309 (template 0.11.0 reference) without replacing site customizations. - Delete only already-revoked keys through an atomic guarded SQLite DELETE with optional owner restriction; active, missing, repeated and out-of-scope requests are no-ops. - Keep Revoke separate; show Delete only for revoked keys. Retain session authentication, CSRF validation and viewer-owner/admin-wide access rules. - Document the credential workflow; no migration or portable bearer API change. ## Verification - ./scripts/pre-pr.sh passed: formatting, typecheck, build, unchanged generated CSS, all 627 tests / 61 files (including local federation integration coverage). - Targeted auth/storage, settings, CSRF and API metadata checks: 85 tests passed. - CSRF regression submits the rendered Delete form token, and rejects missing/invalid, cross-origin and cross-session tokens. - npm ls confirms @evcraddock/slug-auth@1.0.0; only the auth package changed in the lockfile. - CI verify succeeded at cf277dca6c (run #69). - Independent read-only review: no actionable findings; 85 targeted tests, typecheck and whitespace checks independently passed. See review comment for limits. - No release, production credential mutation, migration, or deployment performed. Task: task-48c3ee03

erik added 1 commit

2026-10-26 21:59:23 -05:00

feat: allow deletion of revoked API keys

CI / verify (pull_request) Successful in 45s

Details

cf277dca6c

Upgrade slug-auth to 1.0.0 and port the site-owned credential management changes from Slugkit PR #309 while retaining viewer ownership, session authentication, and CSRF enforcement.

Task: task-48c3ee03

erik commented

2026-10-26 22:01:03 -05:00

Author

Owner

Independent review — no actionable findings

A separate read-only reviewer assessed cf277dc against origin/main, the PR description, reference commits/changelog, relevant project guidance and surrounding auth/storage/route/UI code. It found no correctness, security, maintainability, or scope defects. It confirmed the exact auth 1.0.0 pin and metadata, atomic revoked-only owner-restricted deletion, session and CSRF enforcement, separate revocation and preserved site customizations.

Independent checks: 85 targeted tests, typecheck, and whitespace checks passed; working tree clean. Limits: reviewer did not rerun the complete 627-test suite/build, browser tests, CI, or production verification. Implementing session separately passed ./scripts/pre-pr.sh (627 tests/61 files) and verified CI run #69 succeeded at current head cf277dca6c.

Local review artifact: /tmp/task-48c3ee03-review.log

## Independent review — no actionable findings A separate read-only reviewer assessed cf277dc against origin/main, the PR description, reference commits/changelog, relevant project guidance and surrounding auth/storage/route/UI code. It found no correctness, security, maintainability, or scope defects. It confirmed the exact auth 1.0.0 pin and metadata, atomic revoked-only owner-restricted deletion, session and CSRF enforcement, separate revocation and preserved site customizations. Independent checks: 85 targeted tests, typecheck, and whitespace checks passed; working tree clean. Limits: reviewer did not rerun the complete 627-test suite/build, browser tests, CI, or production verification. Implementing session separately passed ./scripts/pre-pr.sh (627 tests/61 files) and verified CI run #69 succeeded at current head cf277dca6c. Local review artifact: /tmp/task-48c3ee03-review.log

erik merged commit 2409a8d9a5 into main

2026-10-26 22:01:12 -05:00

erik deleted branch feat/task-48c3ee03-revoked-key-deletion

2026-10-26 22:01:12 -05:00

erik referenced this pull request from a commit

2026-10-26 22:01:13 -05:00

Merge pull request 'Allow deletion of revoked API keys' (#62) from feat/task-48c3ee03-revoked-key-deletion into main