fix(oauth): rotate the api key alongside a shared pre-split client secret - #61
Merged
Conversation
…cret Apps created before the api-key/client-secret split (78137a0) share one hash across api_key_hash and oauth_client_secret_hash, so rotating the client secret left the outgoing secret valid as an api key forever. Rotating the secret on such an app now rotates the api key in the same action, and the danger zone gains a standalone api key rotation (no rotation path existed for api keys at all). Api key cutover is immediate; the OAuth surface keeps its 7-day grace window.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Apps created before the api-key/client-secret split (78137a0) share one hash across
api_key_hashandoauth_client_secret_hash; migration 005 coalesced them and nothing backfilled. Rotating the client secret therefore left the outgoing secret valid as an api key on/api/activation-requestsand/api/authorizationsindefinitely, and no api key rotation path existed at all.rotate_secretnow co-rotates the api key when the app's credential is shared. Sharing is detected in SQL as hash equality or a matching row inexternal_app_oauth_secrets- the grace-table check covers pre-split apps that already rotated their secret before this fix (their shared hash moved to the grace table whileapi_key_hashkept holding it, so plain equality misses them).bearer_requests.plaintext_keyso a pending one-time reveal hands out the new key instead of a dead one.Review attention: the co-rotation decision lives in
findExternalAppSecretHashForOwner'sapi_key_shared_with_oauthSQL; the OAuth surface keeps its existing 7-day grace for the outgoing secret by design, so a leaked shared secret dies immediately as an api key but stays valid as an OAuth secret for the grace period.