Allow deletion of revoked API keys #309

Merged

erik merged 2 commits from feat/task-5358527a-delete-revoked-api-keys into main

2026-10-26 21:37:16 -05:00

erik commented

2026-10-26 21:29:19 -05:00

Owner

Summary

Allow users to permanently delete already-revoked API keys from credential management while preserving revocation as a separate operation.

Task

Todu: task-5358527a — Allow deletion of revoked API keys

Changes

Show a Delete form only for revoked keys; active keys retain Revoke.
Add a session-authenticated, CSRF-protected POST deletion action, with admin-wide and viewer-owner authorization matching revocation.
Enforce revoked-only deletion atomically in SQLite; active, missing, repeated, and out-of-scope requests are no-ops.
Extend the shared auth repository contract with deleteRevoked and document the template workflow.
Cover key deletion, ownership, retained authentication protection, UI state, non-mutating GETs, anonymous access, and CSRF enforcement with regression tests.

Testing

Unit/route/security tests added and passing.
./scripts/pre-pr.sh passes (build/API contract, generated CSS, formatting, lint, types, full local tests including integration tests).
Manual browser testing performed (not run; HTTP workflow tests cover rendered forms and mutations).

Checklist

Documentation updated.
No unrelated changes included.
CI green: Forgejo task #545, build-lint-test, success in 56s at f8e957bbd0.
Independent review completed after CI: no findings; 78 targeted tests passed. The earlier optional suggestion is addressed by submitting the actual rendered Delete form token in the CSRF regression test.
Explicit human merge approval received (user: "merge").

Delivery state

Merged into main as 6b13d84779a144d4c421370385c7f61bae8f786b after explicit human approval. Post-merge CI task #546 (build-lint-test) succeeded in 56s. Local main is synchronized, the working tree is clean, and the task branch is deleted locally and remotely. No release was requested or performed. Full local ./scripts/pre-pr.sh passed on the final changes. Independent review did not rerun the entire suite or perform browser testing. fj pr status has a Forgejo URL parsing error; CI was verified using fj actions tasks instead. Review artifact: /tmp/slugkit-task-5358527a-review-final.md (local).

## Summary Allow users to permanently delete already-revoked API keys from credential management while preserving revocation as a separate operation. ## Task Todu: `task-5358527a` — Allow deletion of revoked API keys ## Changes - Show a Delete form only for revoked keys; active keys retain Revoke. - Add a session-authenticated, CSRF-protected POST deletion action, with admin-wide and viewer-owner authorization matching revocation. - Enforce revoked-only deletion atomically in SQLite; active, missing, repeated, and out-of-scope requests are no-ops. - Extend the shared auth repository contract with `deleteRevoked` and document the template workflow. - Cover key deletion, ownership, retained authentication protection, UI state, non-mutating GETs, anonymous access, and CSRF enforcement with regression tests. ## Testing - [x] Unit/route/security tests added and passing. - [x] `./scripts/pre-pr.sh` passes (build/API contract, generated CSS, formatting, lint, types, full local tests including integration tests). - [ ] Manual browser testing performed (not run; HTTP workflow tests cover rendered forms and mutations). ## Checklist - [x] Documentation updated. - [x] No unrelated changes included. - [x] CI green: Forgejo task #545, `build-lint-test`, success in 56s at `f8e957bbd0`. - [x] Independent review completed after CI: no findings; 78 targeted tests passed. The earlier optional suggestion is addressed by submitting the actual rendered Delete form token in the CSRF regression test. - [x] Explicit human merge approval received (user: "merge"). ## Delivery state Merged into `main` as `6b13d84779a144d4c421370385c7f61bae8f786b` after explicit human approval. Post-merge CI task #546 (`build-lint-test`) succeeded in 56s. Local `main` is synchronized, the working tree is clean, and the task branch is deleted locally and remotely. No release was requested or performed. Full local `./scripts/pre-pr.sh` passed on the final changes. Independent review did not rerun the entire suite or perform browser testing. `fj pr status` has a Forgejo URL parsing error; CI was verified using `fj actions tasks` instead. Review artifact: `/tmp/slugkit-task-5358527a-review-final.md` (local).

erik added 1 commit

2026-10-26 21:29:19 -05:00

feat: allow deletion of revoked API keys

CI / build-lint-test (pull_request) Successful in 56s

Details

d3e98229b4