timescale.info#404 · API keys act only as their account; security changes revoke them
- timeline-app
- pull request
- api
- security
## What changes **An API key has its account's own access, not an administrator's.** Timeline access checks (`store.mjs`: `access`, `liveState` and a comparison's sources) now match administrators through `adminId` from the new `server/key-requests.mjs`. `http.mjs` runs every request carrying an `och_key_` bearer token as a key request, and there `adminId` is null. An administrator's browser and desktop sessions behave as before. The admin pages already refused keys. **Security changes revoke API keys.** `AccountSecurity.endAccess` now revokes every active key along with the other sessions. So keys are revoked whenever other sessions end: - turning two-factor authentication on or off; - replacing recovery codes; - adding or removing a passkey; - confirming an email change. Password changes and resets did this already; their own copy of the query is gone. Revoked keys stay in the list, as before. The notices, confirmation prompts, account page text, OpenAPI descriptions, `docs/authentication.md` and `docs/administration.md` all say keys are revoked. ## Tests - `test/administration-postgres.mjs`: an administrator's read/write key gets 404 on another account's private timeline for GET, `/revision`, PUT and DELETE, while the administrator's session still opens it. With the `http.mjs` change reverted, this test fails (the key got `role: "admin"`). - `test/account-security-postgres.mjs`: a key made before enabling two-factor authentication is revoked once it's enabled. - Locally: `administration-postgres`, `account-security-postgres`, `passkeys-postgres` and `npm test` (402) all pass. ## Note for operators After upgrading, anyone who changes their two-factor settings, recovery codes, passkeys or email address will need new API keys for their scripts.
Sources
Open #404 · API keys act only as their account; security changes revoke them in the timeline