@nextsparkjs/core 0.1.0-beta.184 → 0.1.0-beta.186

package/dist/templates/app/(public)/[...slug]/page.tsx

@@ -13,7 +13,6 @@
  * 2. Falls back to default PageRenderer if no template
  */
 
-import { Suspense } from 'react'
 import { notFound } from 'next/navigation'
 import { query } from '@nextsparkjs/core/lib/db'
 import { PageRenderer } from '@nextsparkjs/core/components/public/pageBuilder'
@@ -249,9 +248,16 @@ export async function generateMetadata({
 }
 
 /**
- * Main catch-all page content (async, wrapped in Suspense by parent)
+ * Main catch-all page component
+ *
+ * Not wrapped in Suspense: this route's entire content depends on whether the
+ * slug resolves to a published item, so notFound() must be able to run before
+ * any part of the response commits to a 200. A Suspense boundary here would
+ * let Next.js flush the (null) fallback with a 200 status ahead of the
+ * DB-backed lookup, so a later notFound() inside the boundary could no longer
+ * change the status code — see #129.
  */
-async function DynamicPublicPageContent({
+export default async function DynamicPublicPage({
   params,
   searchParams,
 }: PageProps) {
@@ -378,14 +384,3 @@ async function DynamicPublicPageContent({
   // No match found
   notFound()
 }
-
-/**
- * Main catch-all page component — wraps async content in Suspense for PPR compatibility
- */
-export default function DynamicPublicPage(props: PageProps) {
-  return (
-    <Suspense fallback={null}>
-      <DynamicPublicPageContent {...props} />
-    </Suspense>
-  )
-}

package/dist/templates/app/api/auth/[...all]/route.ts

@@ -9,6 +9,7 @@ import { TeamService } from "@nextsparkjs/core/lib/services";
 import { wrapAuthHandlerWithCors, handleCorsPreflightRequest, addCorsHeaders } from "@nextsparkjs/core/lib/api/helpers";
 import { checkDistributedRateLimit } from "@nextsparkjs/core/lib/api/rate-limit";
 import { withSignupContext } from "@nextsparkjs/core/lib/auth-context";
+import { dispatchSecurityNotificationsForRequest } from "@nextsparkjs/core/lib/auth/security-notifications";
 
 const handlers = toNextJsHandler(auth);
 
@@ -181,11 +182,32 @@ export async function POST(req: NextRequest) {
       ? (req.cookies.get('signup-intent')?.value || undefined)
       : undefined;
 
+  // Clone the request BEFORE the handler consumes its body. The
+  // security-notifications dispatcher (below) needs the original request's
+  // headers (UA/IP) and, for change-email, its body (newEmail) — but
+  // handlers.POST(req) reads req's body exactly once.
+  const securityReq = req.clone() as NextRequest;
+
   // Wrap with CORS headers for cross-origin requests (mobile apps, etc.)
-  return wrapAuthHandlerWithCors(
+  const response = await wrapAuthHandlerWithCors(
     signupIntent
       ? () => withSignupContext({ signupIntent }, () => handlers.POST(req))
       : () => handlers.POST(req),
     req
   );
+
+  // Built-in security email notifications (issue #75): after a successful
+  // sign-in / change-password / change-email, queue the matching security
+  // email. Guarded by AUTH_CONFIG.securityNotifications.enabled and wrapped in
+  // try/catch — a notification failure must NEVER change the auth response
+  // status (the dispatcher is itself best-effort, this is defense in depth).
+  if (AUTH_CONFIG.securityNotifications?.enabled) {
+    try {
+      await dispatchSecurityNotificationsForRequest(securityReq, response);
+    } catch (error) {
+      console.error("[auth] security-notifications dispatch error:", error);
+    }
+  }
+
+  return response;
 }

package/dist/templates/app/api/health/route.ts

@@ -24,8 +24,10 @@ export const GET = withRateLimitTier(async (request: NextRequest) => {
     timestamp: new Date().toISOString(),
   };
 
-  // Check if caller is authenticated for detailed info
-  const authResult = await authenticateRequest(request);
+  // Check if caller is authenticated for detailed info. Public endpoint: any
+  // valid API key (whatever its scopes) may see the detailed status, so the
+  // scope-agnostic opt-out is explicit here (#93).
+  const authResult = await authenticateRequest(request, { allowAnyScope: true });
   const isAuthenticated = authResult.success && authResult.user;
 
   if (!isAuthenticated) {

package/dist/templates/app/api/internal/user-metadata/route.ts

@@ -1,14 +1,16 @@
 import { NextRequest, NextResponse } from 'next/server'
 import { MetaService } from '@nextsparkjs/core/lib/services/meta.service'
 import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
-import { authenticateRequest } from '@nextsparkjs/core/lib/api/auth/dual-auth'
+import { authenticateRequest, createAuthFailureResponse } from '@nextsparkjs/core/lib/api/auth/dual-auth'
 
 // Endpoint interno para crear metadata default después del signup
 export const POST = withRateLimitTier(async (req: NextRequest) => {
   try {
-    const authResult = await authenticateRequest(req)
+    // The API-key scope is declared at the entry point, which fails closed
+    // for keys that lack it (#93).
+    const authResult = await authenticateRequest(req, { requiredScope: 'users:write' })
     if (!authResult.success || !authResult.user) {
-      return NextResponse.json({ error: 'Authentication required' }, { status: 401 })
+      return createAuthFailureResponse(authResult)
     }
 
     const body = await req.json()

package/dist/templates/app/api/mcp/route.ts

@@ -0,0 +1,176 @@
+/**
+ * MCP endpoint — POST /api/mcp (Streamable HTTP, stateless JSON mode).
+ *
+ * Auth: API key ONLY (Authorization: Bearer sk_... or x-api-key). Session
+ * cookies are rejected — this endpoint is for MCP clients, not browsers.
+ * authenticateRequest runs ONCE here; the resolved identity, team context and
+ * api_key id travel to every tool via ToolExecutionContext.
+ *
+ * Tools and overrides are entirely registry-driven: every access.api-enabled
+ * entity in ENTITY_REGISTRY becomes a set of tools automatically, and any
+ * `entities/<slug>/mcp.ts` a theme defines is picked up via the generated
+ * MCP_OVERRIDES registry — no per-app hand-wiring required.
+ *
+ * Security posture:
+ * - kill-switch: MCP_ENABLED (dev: on unless 'false'; production: OFF unless 'true')
+ * - Origin validated when present (DNS-rebinding protection); no CORS reflection
+ * - rate limit: tier 'api' — with the in-process executor this is the ONLY
+ *   rate limit on the whole MCP surface (deploy prerequisite: Redis)
+ * - team-role permissions + scopes + ownership/field guards come from the
+ *   real generic entity handlers the executor calls in-process (#94/#95)
+ * - every tool call is audited to api_audit_log
+ */
+
+import { NextRequest, NextResponse } from 'next/server'
+import {
+  authenticateRequest,
+  resolveTeamContext,
+} from '@nextsparkjs/core/lib/api/auth/dual-auth'
+import { validateApiKey } from '@nextsparkjs/core/lib/api/auth'
+import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
+import { setEntityRegistry } from '@nextsparkjs/core/lib/entities/queries'
+import { createMcpEngine } from '@nextsparkjs/core/lib/mcp'
+import type { ToolExecutionContext } from '@nextsparkjs/core/lib/mcp'
+import type { EntityConfig } from '@nextsparkjs/core/lib/entities/types'
+// Import registries directly - webpack resolves @nextsparkjs/registries alias at compile time
+import { ENTITY_REGISTRY, ENTITY_METADATA } from '@nextsparkjs/registries/entity-registry'
+import { MCP_OVERRIDES } from '@nextsparkjs/registries/mcp-registry'
+import { API_PRESETS_REGISTRY } from '@nextsparkjs/registries/api-presets-registry'
+
+// Initialize registry at module load time (before any handler runs)
+setEntityRegistry(ENTITY_REGISTRY, ENTITY_METADATA)
+
+// Registry entries are wrappers ({ name, config, tableName, ... }) — the
+// engine consumes the EntityConfig map.
+const entityConfigs = Object.fromEntries(
+  Object.entries(ENTITY_REGISTRY as Record<string, { config: EntityConfig }>).map(
+    ([slug, entry]) => [slug, entry.config]
+  )
+)
+
+// Tool descriptions are seeded from api/presets.ts (summary → entity
+// description, presets → few-shot examples) — the same registry the API
+// Explorer already uses, keyed by endpoint instead of slug here.
+const presetsBySlug = Object.fromEntries(
+  Object.entries(API_PRESETS_REGISTRY.endpoints ?? {}).map(([endpoint, data]) => [
+    endpoint.replace(/^\/api\/v1\//, ''),
+    { summary: data.summary, presets: data.presets },
+  ])
+)
+
+const toolPrefix = (process.env.MCP_TOOL_PREFIX || process.env.NEXT_PUBLIC_ACTIVE_THEME || 'app')
+  .toLowerCase()
+  .replace(/[^a-z0-9]+/g, '_')
+  .replace(/^_+|_+$/g, '')
+
+const engine = createMcpEngine(entityConfigs, {
+  toolPrefix,
+  overrides: MCP_OVERRIDES,
+  presets: presetsBySlug,
+})
+
+const API_KEY_HELP =
+  'This endpoint requires an API key: generate one in Settings → API Keys and configure it in your MCP client as the header "Authorization: Bearer sk_...".'
+
+function isMcpEnabled(): boolean {
+  const flag = process.env.MCP_ENABLED
+  if (process.env.NODE_ENV === 'production') return flag === 'true'
+  return flag !== 'false'
+}
+
+function isOriginAllowed(request: NextRequest): boolean {
+  const origin = request.headers.get('origin')
+  if (!origin) return true // non-browser MCP clients don't send Origin
+  const allowed = new Set(
+    [request.nextUrl.origin, process.env.NEXT_PUBLIC_APP_URL, process.env.BETTER_AUTH_URL].filter(
+      Boolean
+    )
+  )
+  return allowed.has(origin)
+}
+
+function jsonRpcError(
+  status: number,
+  code: number,
+  message: string,
+  id: string | number | null = null
+): NextResponse {
+  return NextResponse.json({ jsonrpc: '2.0', error: { code, message }, id }, { status })
+}
+
+async function handleMcpPost(request: NextRequest): Promise<NextResponse> {
+  if (!isMcpEnabled()) {
+    return NextResponse.json({ error: 'Not found' }, { status: 404 })
+  }
+  if (!isOriginAllowed(request)) {
+    return jsonRpcError(403, -32000, 'Origin not allowed')
+  }
+
+  // Transport-level auth only: per-tool scopes (`<entity>:read/write/delete`)
+  // are enforced by the generic entity handlers the executor invokes for each
+  // tool call, so this entry point accepts any valid key explicitly (#93).
+  const authResult = await authenticateRequest(request, { allowAnyScope: true })
+  if (!authResult.success || authResult.type !== 'api-key' || !authResult.user) {
+    return jsonRpcError(401, -32001, API_KEY_HELP)
+  }
+
+  // Same cached lookup the auth already did — needed for the audit trail.
+  const apiKeyAuth = await validateApiKey(request)
+
+  const teamResult = await resolveTeamContext(request, authResult)
+  if (teamResult instanceof Response) {
+    const status = teamResult.status
+    return jsonRpcError(
+      status,
+      -32002,
+      status === 403
+        ? 'The API key user is not a member of the team specified in x-team-id.'
+        : 'Could not resolve the user team. Send the x-team-id header or assign a default team.'
+    )
+  }
+
+  let body: unknown
+  try {
+    body = await request.json()
+  } catch {
+    return jsonRpcError(400, -32700, 'Parse error: body must be JSON-RPC')
+  }
+
+  const ctx: ToolExecutionContext = {
+    userId: authResult.user.id,
+    userRole: authResult.user.role,
+    teamId: teamResult,
+    authHeader:
+      request.headers.get('authorization') ?? `Bearer ${request.headers.get('x-api-key') ?? ''}`,
+    apiKeyId: apiKeyAuth?.keyId ?? null,
+    scopes: authResult.scopes ?? [],
+  }
+
+  try {
+    const result = await engine.handleJsonRpc(body, ctx)
+    if (result === null) {
+      // Notification(s) only — accepted, nothing to return.
+      return new NextResponse(null, { status: 202 })
+    }
+    return NextResponse.json(result, { status: 200 })
+  } catch (error) {
+    console.error('[mcp] request failed:', error)
+    return jsonRpcError(500, -32603, 'Internal error processing MCP request')
+  }
+}
+
+export const POST = withRateLimitTier(handleMcpPost, 'api')
+
+export async function GET(): Promise<NextResponse> {
+  return NextResponse.json(
+    { error: 'Method not allowed. MCP requests must be POST (stateless JSON mode, no SSE).' },
+    { status: 405, headers: { Allow: 'POST' } }
+  )
+}
+
+export async function DELETE(): Promise<NextResponse> {
+  return NextResponse.json(
+    { error: 'Method not allowed. This server is stateless: there is no session to delete.' },
+    { status: 405, headers: { Allow: 'POST' } }
+  )
+}

package/dist/templates/app/api/superadmin/subscriptions/route.ts

@@ -230,6 +230,7 @@ export const GET = withRateLimitTier(async (request: NextRequest) => {
     const totalPages = Math.ceil(total / limit);
 
     // Format subscriptions
+    const billingGateway = await getBillingGateway()
     const subscriptions = subscriptionsResult.map(sub => ({
       id: sub.id,
       team: {
@@ -257,7 +258,7 @@ export const GET = withRateLimitTier(async (request: NextRequest) => {
       cancelAtPeriodEnd: sub.cancelAtPeriodEnd,
       externalSubscriptionId: sub.externalSubscriptionId,
       paymentProvider: sub.paymentProvider,
-      providerDashboardUrl: getBillingGateway().getSubscriptionDashboardUrl(sub.externalSubscriptionId),
+      providerDashboardUrl: billingGateway.getSubscriptionDashboardUrl(sub.externalSubscriptionId),
       createdAt: sub.createdAt
     }));
 

package/dist/templates/app/api/superadmin/teams/[teamId]/route.ts

@@ -204,6 +204,7 @@ export const GET = withRateLimitTier(async (
     const subscription = subscriptionResult[0] || null;
 
     // Prepare response data
+    const billingGateway = subscription ? await getBillingGateway() : null
     const responseData = {
       team: {
         id: team.id,
@@ -225,7 +226,7 @@ export const GET = withRateLimitTier(async (
         role: member.role,
         joinedAt: member.joinedAt
       })),
-      subscription: subscription ? {
+      subscription: subscription && billingGateway ? {
         id: subscription.id,
         plan: {
           id: subscription.planId,
@@ -246,8 +247,8 @@ export const GET = withRateLimitTier(async (
         externalSubscriptionId: subscription.externalSubscriptionId,
         externalCustomerId: subscription.externalCustomerId,
         paymentProvider: subscription.paymentProvider,
-        providerName: getBillingGateway().getProviderName(),
-        providerDashboardUrl: getBillingGateway().getSubscriptionDashboardUrl(subscription.externalSubscriptionId),
+        providerName: billingGateway.getProviderName(),
+        providerDashboardUrl: billingGateway.getSubscriptionDashboardUrl(subscription.externalSubscriptionId),
         createdAt: subscription.createdAt
       } : null,
       billingHistory: billingEventsResult.map((event) => ({

package/dist/templates/app/api/superadmin/users/[userId]/route.ts

@@ -129,11 +129,18 @@ export const GET = withRateLimitTier(async (request: NextRequest, { params }: Ro
       ORDER BY "metaKey"
     `;
 
-    // Execute all queries in parallel
+    // Execute all queries in parallel.
+    //
+    // The team_members queries run on the service (RLS-bypass) pool: team_members
+    // has no superadmin/developer bypass policy, so with the acting admin's own
+    // id as RLS context the SELECT policy silently ANDs "teams the actor belongs
+    // to" on top of WHERE "userId" = $1 and under-reports multi-team users.
+    // Authorization is already enforced above (superadmin/developer role check)
+    // and the WHERE clause scopes the rows to the subject user.
     const [userResults, teamsResults, countsResults, metasResults] = await Promise.all([
       queryWithRLS(userQuery, [userId], session.user.id) as Promise<UserResult[]>,
-      queryWithRLS(teamsQuery, [userId], session.user.id) as Promise<TeamMembershipResult[]>,
-      queryWithRLS(countsQuery, [userId], session.user.id) as Promise<{
+      queryWithRLS(teamsQuery, [userId], session.user.id, { service: true }) as Promise<TeamMembershipResult[]>,
+      queryWithRLS(countsQuery, [userId], session.user.id, { service: true }) as Promise<{
         totalTeams: number;
         ownedTeams: number;
       }[]>,

package/dist/templates/app/api/v1/api-keys/[id]/route.ts

@@ -20,12 +20,13 @@ import {
   handleCorsPreflightRequest,
   addCorsHeaders
 } from '@nextsparkjs/core/lib/api/helpers';
-import { authenticateRequest, hasRequiredScope } from '@nextsparkjs/core/lib/api/auth/dual-auth';
+import { authenticateRequest, createAuthFailureResponse } from '@nextsparkjs/core/lib/api/auth/dual-auth';
+import { invalidateApiKeyCache } from '@nextsparkjs/core/lib/api/auth';
 import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit';
 
 // Handle CORS preflight
-export async function OPTIONS() {
-  return handleCorsPreflightRequest();
+export async function OPTIONS(request: NextRequest) {
+  return handleCorsPreflightRequest(request);
 }
 
 // GET /api/v1/api-keys/:id - Get specific API key details
@@ -34,34 +35,23 @@ export const GET = withRateLimitTier(withApiLogging(async (
   { params }: { params: Promise<{ id: string }> }
 ): Promise<NextResponse> => {
   try {
-    // Authenticate using dual auth
-    const authResult = await authenticateRequest(req);
-    
+    // Authenticate using dual auth; the API-key scope is declared at the entry
+    // point, which fails closed for keys that lack it (#93).
+    const authResult = await authenticateRequest(req, { requiredScope: 'admin:api-keys' });
+
     if (!authResult.success) {
-      return NextResponse.json(
-        { success: false, error: 'Authentication required', code: 'AUTHENTICATION_FAILED' },
-        { status: 401 }
-      );
+      return createAuthFailureResponse(authResult);
     }
 
     if (authResult.rateLimitResponse) {
       return authResult.rateLimitResponse as NextResponse;
     }
 
-    // Check required permissions - session users have admin access, API key users need specific scope
-    const hasPermission = authResult.type === 'session' || 
-      (authResult.type === 'api-key' && hasRequiredScope(authResult, 'admin:api-keys'));
-
-    if (!hasPermission) {
-      const response = createApiError('Insufficient permissions. Admin access required for API key management.', 403);
-      return addCorsHeaders(response);
-    }
-
     const { id } = await params;
 
     if (!id || id.trim() === '') {
       const response = createApiError('API key ID is required', 400, null, 'MISSING_API_KEY_ID');
-      return addCorsHeaders(response);
+      return addCorsHeaders(response, req);
     }
 
     const apiKey = await queryOneWithRLS(
@@ -74,7 +64,7 @@ export const GET = withRateLimitTier(withApiLogging(async (
 
     if (!apiKey) {
       const response = createApiError('API key not found', 404, null, 'API_KEY_NOT_FOUND');
-      return addCorsHeaders(response);
+      return addCorsHeaders(response, req);
     }
 
     // Get detailed usage statistics
@@ -129,11 +119,11 @@ export const GET = withRateLimitTier(withApiLogging(async (
         success_rate: null
       }
     });
-    return addCorsHeaders(response);
+    return addCorsHeaders(response, req);
   } catch (error) {
     console.error('Error fetching API key:', error);
     const response = createApiError('Internal server error', 500);
-    return addCorsHeaders(response);
+    return addCorsHeaders(response, req);
   }
 }), 'strict');
 
@@ -143,34 +133,23 @@ export const PATCH = withRateLimitTier(withApiLogging(async (
   { params }: { params: Promise<{ id: string }> }
 ): Promise<NextResponse> => {
   try {
-    // Authenticate using dual auth
-    const authResult = await authenticateRequest(req);
-    
+    // Authenticate using dual auth; the API-key scope is declared at the entry
+    // point, which fails closed for keys that lack it (#93).
+    const authResult = await authenticateRequest(req, { requiredScope: 'admin:api-keys' });
+
     if (!authResult.success) {
-      return NextResponse.json(
-        { success: false, error: 'Authentication required', code: 'AUTHENTICATION_FAILED' },
-        { status: 401 }
-      );
+      return createAuthFailureResponse(authResult);
     }
 
     if (authResult.rateLimitResponse) {
       return authResult.rateLimitResponse as NextResponse;
     }
 
-    // Check required permissions - session users have admin access, API key users need specific scope
-    const hasPermission = authResult.type === 'session' || 
-      (authResult.type === 'api-key' && hasRequiredScope(authResult, 'admin:api-keys'));
-
-    if (!hasPermission) {
-      const response = createApiError('Insufficient permissions. Admin access required for API key management.', 403);
-      return addCorsHeaders(response);
-    }
-
     const { id } = await params;
 
     if (!id || id.trim() === '') {
       const response = createApiError('API key ID is required', 400, null, 'MISSING_API_KEY_ID');
-      return addCorsHeaders(response);
+      return addCorsHeaders(response, req);
     }
 
     const body = await req.json();
@@ -185,11 +164,11 @@ export const PATCH = withRateLimitTier(withApiLogging(async (
       if (body[field] !== undefined) {
         if (field === 'name' && typeof body[field] !== 'string') {
           const response = createApiError('Name must be a string', 400, null, 'INVALID_NAME_TYPE');
-          return addCorsHeaders(response);
+          return addCorsHeaders(response, req);
         }
         if (field === 'status' && !['active', 'inactive', 'expired'].includes(body[field])) {
           const response = createApiError('status must be active, inactive, or expired', 400, null, 'INVALID_STATUS_TYPE');
-          return addCorsHeaders(response);
+          return addCorsHeaders(response, req);
         }
         
         updates.push(`"${field}" = $${paramCount++}`);
@@ -199,7 +178,7 @@ export const PATCH = withRateLimitTier(withApiLogging(async (
 
     if (updates.length === 0) {
       const response = createApiError('No valid fields to update', 400, null, 'NO_FIELDS');
-      return addCorsHeaders(response);
+      return addCorsHeaders(response, req);
     }
 
     updates.push(`"updatedAt" = CURRENT_TIMESTAMP`);
@@ -209,22 +188,28 @@ export const PATCH = withRateLimitTier(withApiLogging(async (
       UPDATE "api_key" 
       SET ${updates.join(", ")}
       WHERE id = $${paramCount} AND "userId" = $${paramCount + 1}
-      RETURNING id, "keyPrefix", name, scopes, status, "lastUsedAt", "expiresAt", "createdAt", "updatedAt"
+      RETURNING id, "keyPrefix", "keyHash", name, scopes, status, "lastUsedAt", "expiresAt", "createdAt", "updatedAt"
     `;
 
     const result = await mutateWithRLS(query, values, authResult.user!.id);
 
     if (result.rows.length === 0) {
       const response = createApiError('API key not found', 404, null, 'API_KEY_NOT_FOUND');
-      return addCorsHeaders(response);
+      return addCorsHeaders(response, req);
     }
 
-    const response = createApiResponse(result.rows[0]);
-    return addCorsHeaders(response);
+    // A status change must take effect immediately: drop the cached validation
+    // entry so the next request re-reads the row (see #92). keyHash is only
+    // used for the invalidation and never returned to the client.
+    const { keyHash, ...updatedApiKey } = result.rows[0] as { keyHash: string } & Record<string, unknown>;
+    invalidateApiKeyCache(keyHash);
+
+    const response = createApiResponse(updatedApiKey);
+    return addCorsHeaders(response, req);
   } catch (error) {
     console.error('Error updating API key:', error);
     const response = createApiError('Internal server error', 500);
-    return addCorsHeaders(response);
+    return addCorsHeaders(response, req);
   }
 }), 'strict');
 
@@ -234,34 +219,23 @@ export const DELETE = withRateLimitTier(withApiLogging(async (
   { params }: { params: Promise<{ id: string }> }
 ): Promise<NextResponse> => {
   try {
-    // Authenticate using dual auth
-    const authResult = await authenticateRequest(req);
-    
+    // Authenticate using dual auth; the API-key scope is declared at the entry
+    // point, which fails closed for keys that lack it (#93).
+    const authResult = await authenticateRequest(req, { requiredScope: 'admin:api-keys' });
+
     if (!authResult.success) {
-      return NextResponse.json(
-        { success: false, error: 'Authentication required', code: 'AUTHENTICATION_FAILED' },
-        { status: 401 }
-      );
+      return createAuthFailureResponse(authResult);
     }
 
     if (authResult.rateLimitResponse) {
       return authResult.rateLimitResponse as NextResponse;
     }
 
-    // Check required permissions - session users have admin access, API key users need specific scope
-    const hasPermission = authResult.type === 'session' || 
-      (authResult.type === 'api-key' && hasRequiredScope(authResult, 'admin:api-keys'));
-
-    if (!hasPermission) {
-      const response = createApiError('Insufficient permissions. Admin access required for API key management.', 403);
-      return addCorsHeaders(response);
-    }
-
     const { id } = await params;
 
     if (!id || id.trim() === '') {
       const response = createApiError('API key ID is required', 400, null, 'MISSING_API_KEY_ID');
-      return addCorsHeaders(response);
+      return addCorsHeaders(response, req);
     }
 
     // For API key auth, prevent deletion of the current API key being used
@@ -272,7 +246,7 @@ export const DELETE = withRateLimitTier(withApiLogging(async (
         null, 
         'SELF_REVOKE_FORBIDDEN'
       );
-      return addCorsHeaders(response);
+      return addCorsHeaders(response, req);
     }
 
     // Soft delete - just mark as inactive
@@ -280,25 +254,30 @@ export const DELETE = withRateLimitTier(withApiLogging(async (
       `UPDATE "api_key" 
        SET status = 'inactive', "updatedAt" = CURRENT_TIMESTAMP
        WHERE id = $1 AND "userId" = $2
-       RETURNING id, name`,
+       RETURNING id, name, "keyHash"`,
       [id, authResult.user!.id],
       authResult.user!.id
     );
 
     if (result.rows.length === 0) {
       const response = createApiError('API key not found', 404, null, 'API_KEY_NOT_FOUND');
-      return addCorsHeaders(response);
+      return addCorsHeaders(response, req);
     }
 
+    const revokedRow = result.rows[0] as { name: string; keyHash: string };
+
+    // Revocation must be effective right away, not after the 5 min cache TTL (see #92)
+    invalidateApiKeyCache(revokedRow.keyHash);
+
     const response = createApiResponse({ 
       revoked: true, 
       id,
-      name: (result.rows[0] as { name: string }).name
+      name: revokedRow.name
     });
-    return addCorsHeaders(response);
+    return addCorsHeaders(response, req);
   } catch (error) {
     console.error('Error revoking API key:', error);
     const response = createApiError('Internal server error', 500);
-    return addCorsHeaders(response);
+    return addCorsHeaders(response, req);
   }
 }), 'strict');