[khaliqgant]

Summary

Follow-up to #114, addressing review thread #114 (comment).

Delegating an assertion scope (through POST /v1/api-keys or POST /v1/tokens/workspace) now requires the caller to be a plain API key that holds the exact literal. Bearer tokens and workspace tokens do not qualify, because their scopes can be assigned within an org. Broker keys are provisioned out of band (bootstrap file or operator insert), so the assertion tests now seed them directly.

Verification

• packages/server npm test: 694/694 pass.
• tsc --noEmit (after turbo build): clean.
• Reverting the credential check fails the new bearer-delegation test.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Agent Relay sessions

• claude session a685ac1e · opened via gh pr create · last active 2026-10-31

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-31T04:46:55.964535Z	81dd7f8	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Caution

Review failed

The pull request is closed.

Walkthrough

Broker-scope delegation now requires a plain API key with the exact requested scope. API-key and workspace-token creation routes pass caller type and scopes to the check. Tests cover bearer-token rejection and plain API-key delegation.

Changes: Broker scope delegation

Layer / File(s)	Summary
Broker-scope eligibility rule packages/server/src/lib/broker-scopes.ts	The check now rejects broker-scope delegation unless the caller is a plain API key that holds the exact requested scope.
Route integration and test coverage packages/server/src/routes/api-keys.ts, packages/server/src/routes/tokens.ts, packages/server/src/__tests__/test-helpers.ts, packages/server/src/__tests__/tokens-route.test.ts	Both routes pass caller scopes and plain API-key status to the check. Tests seed plain API keys directly and cover rejection for bearer JWTs and successful delegation by a plain API key.

Estimated code review effort: 2 (Simple) | ~12 minutes

Change: Bug fix

Suggested reviewers: kjgbot

Merge Risk: Minimal · up to 81dd7

No merge-blocking defect was found. Additional assertions would protect the delegation rules against regressions.

- [ ] Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the keys at night,
Broker scopes must match just right.
A plain key may pass along,
A bearer token gets a no.
Tests hop through the guarded door,
Then curl up softly on the floor.}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[greptile-apps]

Confidence Score: 5/5

[Critical impact] The PR appears safe to merge; the previous test gap is addressed and no new issues were found.

Summary

Assertion scopes can now be delegated only by a plain API key holding the exact literal.

• Only a plain API key can pass on a broker scope.

_{Reviews (2) · Last reviewed commit: "test(tokens): cover workspace-token dele..." · Reviewed by Greptile}