@nextsparkjs/core 0.1.0-beta.185 → 0.1.0-beta.187

package/dist/providers/DashboardProviders.d.ts

@@ -1,8 +1,17 @@
 /**
- * DashboardProviders — Client providers needed only for authenticated routes.
+ * DashboardProviders — Client providers needed by authenticated routes.
  *
- * These were moved out of the root layout to avoid loading ~500KB of unused JS
- * (TanStack Query, team context, billing hooks) on public landing pages.
+ * Since #115 the generated root layout mounts QueryProvider, TeamProvider,
+ * SubscriptionProvider and Toaster itself (matching layout.ppr.tsx) so the
+ * activeTeamId cookie is synced from any route, not only from the dashboard.
+ * When a TeamProvider is already mounted above, this component renders its
+ * children as-is: nesting a second TeamProvider would duplicate the teams
+ * fetch, the cookie sync and the TeamSwitchModal, and a second Toaster would
+ * show every toast twice.
+ *
+ * The full provider stack is kept as a fallback for apps whose generated root
+ * layout predates that change (it originally lived here to keep ~500KB of
+ * client JS off public landing pages).
  *
  * Used by: dashboard/layout.tsx, superadmin/layout.tsx, devtools/layout.tsx
  */

package/dist/providers/DashboardProviders.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DashboardProviders.d.ts","sourceRoot":"","sources":["../../src/providers/DashboardProviders.tsx"],"names":[],"mappings":"AAQA;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,QAAQ,EAAE,EAAE;IAAE,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAA;CAAE,2CAW7E"}
+{"version":3,"file":"DashboardProviders.d.ts","sourceRoot":"","sources":["../../src/providers/DashboardProviders.tsx"],"names":[],"mappings":"AAQA;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,QAAQ,EAAE,EAAE;IAAE,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAA;CAAE,2CAiB7E"}

package/dist/providers/DashboardProviders.js

@@ -1,11 +1,15 @@
 "use client";
-import { jsx, jsxs } from "react/jsx-runtime";
+import { Fragment, jsx, jsxs } from "react/jsx-runtime";
 import { Suspense } from "react";
 import { QueryProvider } from "./query-provider.js";
-import { TeamProvider } from "../contexts/TeamContext.js";
+import { TeamProvider, useOptionalTeamContext } from "../contexts/TeamContext.js";
 import { SubscriptionProvider } from "../contexts/SubscriptionContext.js";
 import { Toaster } from "../components/ui/sonner.js";
 function DashboardProviders({ children }) {
+  const rootTeamContext = useOptionalTeamContext();
+  if (rootTeamContext) {
+    return /* @__PURE__ */ jsx(Fragment, { children });
+  }
   return /* @__PURE__ */ jsx(QueryProvider, { children: /* @__PURE__ */ jsx(TeamProvider, { children: /* @__PURE__ */ jsxs(SubscriptionProvider, { children: [
     children,
     /* @__PURE__ */ jsx(Suspense, { children: /* @__PURE__ */ jsx(Toaster, { position: "bottom-left" }) })

package/dist/providers/theme-provider.d.ts

@@ -1,3 +1,20 @@
-import { type ThemeProviderProps } from "next-themes";
-export declare function ThemeProvider({ children, ...props }: ThemeProviderProps): import("react/jsx-runtime").JSX.Element;
+import { type ThemeProviderProps as NextThemesProviderProps } from "next-themes";
+import { type ForcedThemeRoutes } from "../lib/theme/forced-theme";
+export interface ThemeProviderProps extends NextThemesProviderProps {
+    /**
+     * Routes whose theme is forced regardless of user/system preference
+     * (`theme.config.ts` → `forcedThemeRoutes`).
+     *
+     * Resolved here, on the client, against `usePathname()` instead of once in
+     * the root layout from request headers: the root layout does not re-render
+     * on client-side navigations, so a server-computed value would go stale as
+     * soon as the user navigated into or out of a forced route. On the initial
+     * request this component is still server-rendered, so next-themes' blocking
+     * script receives the forced value and there is no flash.
+     *
+     * Takes precedence over the plain `forcedTheme` prop.
+     */
+    forcedThemeRoutes?: ForcedThemeRoutes;
+}
+export declare function ThemeProvider({ children, forcedThemeRoutes, forcedTheme, ...props }: ThemeProviderProps): import("react/jsx-runtime").JSX.Element;
 //# sourceMappingURL=theme-provider.d.ts.map

package/dist/providers/theme-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"theme-provider.d.ts","sourceRoot":"","sources":["../../src/providers/theme-provider.tsx"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAErD,wBAAgB,aAAa,CAAC,EAAE,QAAQ,EAAE,GAAG,KAAK,EAAE,EAAE,kBAAkB,2CAEvE"}
+{"version":3,"file":"theme-provider.d.ts","sourceRoot":"","sources":["../../src/providers/theme-provider.tsx"],"names":[],"mappings":"AAIA,OAAO,EAAE,KAAK,kBAAkB,IAAI,uBAAuB,EAAE,MAAM,aAAa,CAAA;AAChF,OAAO,EAAsB,KAAK,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAEtF,MAAM,WAAW,kBAAmB,SAAQ,uBAAuB;IACjE;;;;;;;;;;;;OAYG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAA;CACtC;AAED,wBAAgB,aAAa,CAAC,EAAE,QAAQ,EAAE,iBAAiB,EAAE,WAAW,EAAE,GAAG,KAAK,EAAE,EAAE,kBAAkB,2CASvG"}

package/dist/providers/theme-provider.js

@@ -1,8 +1,12 @@
 "use client";
 import { jsx } from "react/jsx-runtime";
+import { usePathname } from "next/navigation";
 import { ThemeProvider as NextThemesProvider } from "next-themes";
-function ThemeProvider({ children, ...props }) {
-  return /* @__PURE__ */ jsx(NextThemesProvider, { ...props, children });
+import { resolveForcedTheme } from "../lib/theme/forced-theme.js";
+function ThemeProvider({ children, forcedThemeRoutes, forcedTheme, ...props }) {
+  const pathname = usePathname();
+  const routeForcedTheme = resolveForcedTheme(pathname, forcedThemeRoutes);
+  return /* @__PURE__ */ jsx(NextThemesProvider, { ...props, forcedTheme: routeForcedTheme ?? forcedTheme, children });
 }
 export {
   ThemeProvider

package/dist/templates/app/(auth)/signup/page.tsx

@@ -4,6 +4,7 @@ import { redirect } from 'next/navigation'
 import { SignupForm } from '@nextsparkjs/core/components/auth/forms/SignupForm'
 import { getTemplateOrDefault, getMetadataOrDefault } from '@nextsparkjs/core/lib/template-resolver'
 import { AUTH_CONFIG } from '@nextsparkjs/core/lib/config'
+import { resolveAuthMethods } from '@nextsparkjs/core/lib/auth/auth-methods'
 import { TeamService } from '@nextsparkjs/core/lib/services'
 
 // This page reads DB state (TeamService.hasGlobal) and redirect()s during render,
@@ -23,6 +24,13 @@ export const metadata: Metadata = getMetadataOrDefault(
 async function SignupPageContent() {
   const registrationMode = AUTH_CONFIG?.registration?.mode ?? 'open'
 
+  // Passwordless preset (no 'email-password' in auth.methods): the account is
+  // created by the first one-time-code sign-in, so there is no password signup
+  // form to show — send people to /login instead.
+  if (!resolveAuthMethods(AUTH_CONFIG).includes('email-password')) {
+    redirect('/login')
+  }
+
   // In invitation-only mode, allow the first user to register
   // (when no global team exists yet). Subsequent users need invitations.
   if (registrationMode === 'invitation-only') {

package/dist/templates/app/(public)/[...slug]/page.tsx

@@ -13,7 +13,6 @@
  * 2. Falls back to default PageRenderer if no template
  */
 
-import { Suspense } from 'react'
 import { notFound } from 'next/navigation'
 import { query } from '@nextsparkjs/core/lib/db'
 import { PageRenderer } from '@nextsparkjs/core/components/public/pageBuilder'
@@ -249,9 +248,16 @@ export async function generateMetadata({
 }
 
 /**
- * Main catch-all page content (async, wrapped in Suspense by parent)
+ * Main catch-all page component
+ *
+ * Not wrapped in Suspense: this route's entire content depends on whether the
+ * slug resolves to a published item, so notFound() must be able to run before
+ * any part of the response commits to a 200. A Suspense boundary here would
+ * let Next.js flush the (null) fallback with a 200 status ahead of the
+ * DB-backed lookup, so a later notFound() inside the boundary could no longer
+ * change the status code — see #129.
  */
-async function DynamicPublicPageContent({
+export default async function DynamicPublicPage({
   params,
   searchParams,
 }: PageProps) {
@@ -378,14 +384,3 @@ async function DynamicPublicPageContent({
   // No match found
   notFound()
 }
-
-/**
- * Main catch-all page component — wraps async content in Suspense for PPR compatibility
- */
-export default function DynamicPublicPage(props: PageProps) {
-  return (
-    <Suspense fallback={null}>
-      <DynamicPublicPageContent {...props} />
-    </Suspense>
-  )
-}

package/dist/templates/app/api/auth/[...all]/route.ts

@@ -9,6 +9,7 @@ import { TeamService } from "@nextsparkjs/core/lib/services";
 import { wrapAuthHandlerWithCors, handleCorsPreflightRequest, addCorsHeaders } from "@nextsparkjs/core/lib/api/helpers";
 import { checkDistributedRateLimit } from "@nextsparkjs/core/lib/api/rate-limit";
 import { withSignupContext } from "@nextsparkjs/core/lib/auth-context";
+import { dispatchSecurityNotificationsForRequest } from "@nextsparkjs/core/lib/auth/security-notifications";
 
 const handlers = toNextJsHandler(auth);
 
@@ -181,11 +182,32 @@ export async function POST(req: NextRequest) {
       ? (req.cookies.get('signup-intent')?.value || undefined)
       : undefined;
 
+  // Clone the request BEFORE the handler consumes its body. The
+  // security-notifications dispatcher (below) needs the original request's
+  // headers (UA/IP) and, for change-email, its body (newEmail) — but
+  // handlers.POST(req) reads req's body exactly once.
+  const securityReq = req.clone() as NextRequest;
+
   // Wrap with CORS headers for cross-origin requests (mobile apps, etc.)
-  return wrapAuthHandlerWithCors(
+  const response = await wrapAuthHandlerWithCors(
     signupIntent
       ? () => withSignupContext({ signupIntent }, () => handlers.POST(req))
       : () => handlers.POST(req),
     req
   );
+
+  // Built-in security email notifications (issue #75): after a successful
+  // sign-in / change-password / change-email, queue the matching security
+  // email. Guarded by AUTH_CONFIG.securityNotifications.enabled and wrapped in
+  // try/catch — a notification failure must NEVER change the auth response
+  // status (the dispatcher is itself best-effort, this is defense in depth).
+  if (AUTH_CONFIG.securityNotifications?.enabled) {
+    try {
+      await dispatchSecurityNotificationsForRequest(securityReq, response);
+    } catch (error) {
+      console.error("[auth] security-notifications dispatch error:", error);
+    }
+  }
+
+  return response;
 }

package/dist/templates/app/api/health/route.ts

@@ -24,8 +24,10 @@ export const GET = withRateLimitTier(async (request: NextRequest) => {
     timestamp: new Date().toISOString(),
   };
 
-  // Check if caller is authenticated for detailed info
-  const authResult = await authenticateRequest(request);
+  // Check if caller is authenticated for detailed info. Public endpoint: any
+  // valid API key (whatever its scopes) may see the detailed status, so the
+  // scope-agnostic opt-out is explicit here (#93).
+  const authResult = await authenticateRequest(request, { allowAnyScope: true });
   const isAuthenticated = authResult.success && authResult.user;
 
   if (!isAuthenticated) {

package/dist/templates/app/api/internal/user-metadata/route.ts

@@ -1,14 +1,16 @@
 import { NextRequest, NextResponse } from 'next/server'
 import { MetaService } from '@nextsparkjs/core/lib/services/meta.service'
 import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
-import { authenticateRequest } from '@nextsparkjs/core/lib/api/auth/dual-auth'
+import { authenticateRequest, createAuthFailureResponse } from '@nextsparkjs/core/lib/api/auth/dual-auth'
 
 // Endpoint interno para crear metadata default después del signup
 export const POST = withRateLimitTier(async (req: NextRequest) => {
   try {
-    const authResult = await authenticateRequest(req)
+    // The API-key scope is declared at the entry point, which fails closed
+    // for keys that lack it (#93).
+    const authResult = await authenticateRequest(req, { requiredScope: 'users:write' })
     if (!authResult.success || !authResult.user) {
-      return NextResponse.json({ error: 'Authentication required' }, { status: 401 })
+      return createAuthFailureResponse(authResult)
     }
 
     const body = await req.json()

package/dist/templates/app/api/mcp/route.ts

@@ -106,7 +106,10 @@ async function handleMcpPost(request: NextRequest): Promise<NextResponse> {
     return jsonRpcError(403, -32000, 'Origin not allowed')
   }
 
-  const authResult = await authenticateRequest(request)
+  // Transport-level auth only: per-tool scopes (`<entity>:read/write/delete`)
+  // are enforced by the generic entity handlers the executor invokes for each
+  // tool call, so this entry point accepts any valid key explicitly (#93).
+  const authResult = await authenticateRequest(request, { allowAnyScope: true })
   if (!authResult.success || authResult.type !== 'api-key' || !authResult.user) {
     return jsonRpcError(401, -32001, API_KEY_HELP)
   }

package/dist/templates/app/api/superadmin/subscriptions/route.ts

@@ -230,6 +230,7 @@ export const GET = withRateLimitTier(async (request: NextRequest) => {
     const totalPages = Math.ceil(total / limit);
 
     // Format subscriptions
+    const billingGateway = await getBillingGateway()
     const subscriptions = subscriptionsResult.map(sub => ({
       id: sub.id,
       team: {
@@ -257,7 +258,7 @@ export const GET = withRateLimitTier(async (request: NextRequest) => {
       cancelAtPeriodEnd: sub.cancelAtPeriodEnd,
       externalSubscriptionId: sub.externalSubscriptionId,
       paymentProvider: sub.paymentProvider,
-      providerDashboardUrl: getBillingGateway().getSubscriptionDashboardUrl(sub.externalSubscriptionId),
+      providerDashboardUrl: billingGateway.getSubscriptionDashboardUrl(sub.externalSubscriptionId),
       createdAt: sub.createdAt
     }));
 

package/dist/templates/app/api/superadmin/teams/[teamId]/route.ts

@@ -204,6 +204,7 @@ export const GET = withRateLimitTier(async (
     const subscription = subscriptionResult[0] || null;
 
     // Prepare response data
+    const billingGateway = subscription ? await getBillingGateway() : null
     const responseData = {
       team: {
         id: team.id,
@@ -225,7 +226,7 @@ export const GET = withRateLimitTier(async (
         role: member.role,
         joinedAt: member.joinedAt
       })),
-      subscription: subscription ? {
+      subscription: subscription && billingGateway ? {
         id: subscription.id,
         plan: {
           id: subscription.planId,
@@ -246,8 +247,8 @@ export const GET = withRateLimitTier(async (
         externalSubscriptionId: subscription.externalSubscriptionId,
         externalCustomerId: subscription.externalCustomerId,
         paymentProvider: subscription.paymentProvider,
-        providerName: getBillingGateway().getProviderName(),
-        providerDashboardUrl: getBillingGateway().getSubscriptionDashboardUrl(subscription.externalSubscriptionId),
+        providerName: billingGateway.getProviderName(),
+        providerDashboardUrl: billingGateway.getSubscriptionDashboardUrl(subscription.externalSubscriptionId),
         createdAt: subscription.createdAt
       } : null,
       billingHistory: billingEventsResult.map((event) => ({

package/dist/templates/app/api/superadmin/users/[userId]/route.ts

@@ -129,11 +129,18 @@ export const GET = withRateLimitTier(async (request: NextRequest, { params }: Ro
       ORDER BY "metaKey"
     `;
 
-    // Execute all queries in parallel
+    // Execute all queries in parallel.
+    //
+    // The team_members queries run on the service (RLS-bypass) pool: team_members
+    // has no superadmin/developer bypass policy, so with the acting admin's own
+    // id as RLS context the SELECT policy silently ANDs "teams the actor belongs
+    // to" on top of WHERE "userId" = $1 and under-reports multi-team users.
+    // Authorization is already enforced above (superadmin/developer role check)
+    // and the WHERE clause scopes the rows to the subject user.
     const [userResults, teamsResults, countsResults, metasResults] = await Promise.all([
       queryWithRLS(userQuery, [userId], session.user.id) as Promise<UserResult[]>,
-      queryWithRLS(teamsQuery, [userId], session.user.id) as Promise<TeamMembershipResult[]>,
-      queryWithRLS(countsQuery, [userId], session.user.id) as Promise<{
+      queryWithRLS(teamsQuery, [userId], session.user.id, { service: true }) as Promise<TeamMembershipResult[]>,
+      queryWithRLS(countsQuery, [userId], session.user.id, { service: true }) as Promise<{
         totalTeams: number;
         ownedTeams: number;
       }[]>,

package/dist/templates/app/api/v1/api-keys/[id]/route.ts

@@ -20,12 +20,13 @@ import {
   handleCorsPreflightRequest,
   addCorsHeaders
 } from '@nextsparkjs/core/lib/api/helpers';
-import { authenticateRequest, hasRequiredScope } from '@nextsparkjs/core/lib/api/auth/dual-auth';
+import { authenticateRequest, createAuthFailureResponse } from '@nextsparkjs/core/lib/api/auth/dual-auth';
+import { invalidateApiKeyCache } from '@nextsparkjs/core/lib/api/auth';
 import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit';
 
 // Handle CORS preflight
-export async function OPTIONS() {
-  return handleCorsPreflightRequest();
+export async function OPTIONS(request: NextRequest) {
+  return handleCorsPreflightRequest(request);
 }
 
 // GET /api/v1/api-keys/:id - Get specific API key details
@@ -34,34 +35,23 @@ export const GET = withRateLimitTier(withApiLogging(async (
   { params }: { params: Promise<{ id: string }> }
 ): Promise<NextResponse> => {
   try {
-    // Authenticate using dual auth
-    const authResult = await authenticateRequest(req);
-    
+    // Authenticate using dual auth; the API-key scope is declared at the entry
+    // point, which fails closed for keys that lack it (#93).
+    const authResult = await authenticateRequest(req, { requiredScope: 'admin:api-keys' });
+
     if (!authResult.success) {
-      return NextResponse.json(
-        { success: false, error: 'Authentication required', code: 'AUTHENTICATION_FAILED' },
-        { status: 401 }
-      );
+      return createAuthFailureResponse(authResult);
     }
 
     if (authResult.rateLimitResponse) {
       return authResult.rateLimitResponse as NextResponse;
     }
 
-    // Check required permissions - session users have admin access, API key users need specific scope
-    const hasPermission = authResult.type === 'session' || 
-      (authResult.type === 'api-key' && hasRequiredScope(authResult, 'admin:api-keys'));
-
-    if (!hasPermission) {
-      const response = createApiError('Insufficient permissions. Admin access required for API key management.', 403);
-      return addCorsHeaders(response);
-    }
-
     const { id } = await params;
 
     if (!id || id.trim() === '') {
       const response = createApiError('API key ID is required', 400, null, 'MISSING_API_KEY_ID');
-      return addCorsHeaders(response);
+      return addCorsHeaders(response, req);
     }
 
     const apiKey = await queryOneWithRLS(
@@ -74,7 +64,7 @@ export const GET = withRateLimitTier(withApiLogging(async (
 
     if (!apiKey) {
       const response = createApiError('API key not found', 404, null, 'API_KEY_NOT_FOUND');
-      return addCorsHeaders(response);
+      return addCorsHeaders(response, req);
     }
 
     // Get detailed usage statistics
@@ -129,11 +119,11 @@ export const GET = withRateLimitTier(withApiLogging(async (
         success_rate: null
       }
     });
-    return addCorsHeaders(response);
+    return addCorsHeaders(response, req);
   } catch (error) {
     console.error('Error fetching API key:', error);
     const response = createApiError('Internal server error', 500);
-    return addCorsHeaders(response);
+    return addCorsHeaders(response, req);
   }
 }), 'strict');
 
@@ -143,34 +133,23 @@ export const PATCH = withRateLimitTier(withApiLogging(async (
   { params }: { params: Promise<{ id: string }> }
 ): Promise<NextResponse> => {
   try {
-    // Authenticate using dual auth
-    const authResult = await authenticateRequest(req);
-    
+    // Authenticate using dual auth; the API-key scope is declared at the entry
+    // point, which fails closed for keys that lack it (#93).
+    const authResult = await authenticateRequest(req, { requiredScope: 'admin:api-keys' });
+
     if (!authResult.success) {
-      return NextResponse.json(
-        { success: false, error: 'Authentication required', code: 'AUTHENTICATION_FAILED' },
-        { status: 401 }
-      );
+      return createAuthFailureResponse(authResult);
     }
 
     if (authResult.rateLimitResponse) {
       return authResult.rateLimitResponse as NextResponse;
     }
 
-    // Check required permissions - session users have admin access, API key users need specific scope
-    const hasPermission = authResult.type === 'session' || 
-      (authResult.type === 'api-key' && hasRequiredScope(authResult, 'admin:api-keys'));
-
-    if (!hasPermission) {
-      const response = createApiError('Insufficient permissions. Admin access required for API key management.', 403);
-      return addCorsHeaders(response);
-    }
-
     const { id } = await params;
 
     if (!id || id.trim() === '') {
       const response = createApiError('API key ID is required', 400, null, 'MISSING_API_KEY_ID');
-      return addCorsHeaders(response);
+      return addCorsHeaders(response, req);
     }
 
     const body = await req.json();
@@ -185,11 +164,11 @@ export const PATCH = withRateLimitTier(withApiLogging(async (
       if (body[field] !== undefined) {
         if (field === 'name' && typeof body[field] !== 'string') {
           const response = createApiError('Name must be a string', 400, null, 'INVALID_NAME_TYPE');
-          return addCorsHeaders(response);
+          return addCorsHeaders(response, req);
         }
         if (field === 'status' && !['active', 'inactive', 'expired'].includes(body[field])) {
           const response = createApiError('status must be active, inactive, or expired', 400, null, 'INVALID_STATUS_TYPE');
-          return addCorsHeaders(response);
+          return addCorsHeaders(response, req);
         }
         
         updates.push(`"${field}" = $${paramCount++}`);
@@ -199,7 +178,7 @@ export const PATCH = withRateLimitTier(withApiLogging(async (
 
     if (updates.length === 0) {
       const response = createApiError('No valid fields to update', 400, null, 'NO_FIELDS');
-      return addCorsHeaders(response);
+      return addCorsHeaders(response, req);
     }
 
     updates.push(`"updatedAt" = CURRENT_TIMESTAMP`);
@@ -209,22 +188,28 @@ export const PATCH = withRateLimitTier(withApiLogging(async (
       UPDATE "api_key" 
       SET ${updates.join(", ")}
       WHERE id = $${paramCount} AND "userId" = $${paramCount + 1}
-      RETURNING id, "keyPrefix", name, scopes, status, "lastUsedAt", "expiresAt", "createdAt", "updatedAt"
+      RETURNING id, "keyPrefix", "keyHash", name, scopes, status, "lastUsedAt", "expiresAt", "createdAt", "updatedAt"
     `;
 
     const result = await mutateWithRLS(query, values, authResult.user!.id);
 
     if (result.rows.length === 0) {
       const response = createApiError('API key not found', 404, null, 'API_KEY_NOT_FOUND');
-      return addCorsHeaders(response);
+      return addCorsHeaders(response, req);
     }
 
-    const response = createApiResponse(result.rows[0]);
-    return addCorsHeaders(response);
+    // A status change must take effect immediately: drop the cached validation
+    // entry so the next request re-reads the row (see #92). keyHash is only
+    // used for the invalidation and never returned to the client.
+    const { keyHash, ...updatedApiKey } = result.rows[0] as { keyHash: string } & Record<string, unknown>;
+    invalidateApiKeyCache(keyHash);
+
+    const response = createApiResponse(updatedApiKey);
+    return addCorsHeaders(response, req);
   } catch (error) {
     console.error('Error updating API key:', error);
     const response = createApiError('Internal server error', 500);
-    return addCorsHeaders(response);
+    return addCorsHeaders(response, req);
   }
 }), 'strict');
 
@@ -234,34 +219,23 @@ export const DELETE = withRateLimitTier(withApiLogging(async (
   { params }: { params: Promise<{ id: string }> }
 ): Promise<NextResponse> => {
   try {
-    // Authenticate using dual auth
-    const authResult = await authenticateRequest(req);
-    
+    // Authenticate using dual auth; the API-key scope is declared at the entry
+    // point, which fails closed for keys that lack it (#93).
+    const authResult = await authenticateRequest(req, { requiredScope: 'admin:api-keys' });
+
     if (!authResult.success) {
-      return NextResponse.json(
-        { success: false, error: 'Authentication required', code: 'AUTHENTICATION_FAILED' },
-        { status: 401 }
-      );
+      return createAuthFailureResponse(authResult);
     }
 
     if (authResult.rateLimitResponse) {
       return authResult.rateLimitResponse as NextResponse;
     }
 
-    // Check required permissions - session users have admin access, API key users need specific scope
-    const hasPermission = authResult.type === 'session' || 
-      (authResult.type === 'api-key' && hasRequiredScope(authResult, 'admin:api-keys'));
-
-    if (!hasPermission) {
-      const response = createApiError('Insufficient permissions. Admin access required for API key management.', 403);
-      return addCorsHeaders(response);
-    }
-
     const { id } = await params;
 
     if (!id || id.trim() === '') {
       const response = createApiError('API key ID is required', 400, null, 'MISSING_API_KEY_ID');
-      return addCorsHeaders(response);
+      return addCorsHeaders(response, req);
     }
 
     // For API key auth, prevent deletion of the current API key being used
@@ -272,7 +246,7 @@ export const DELETE = withRateLimitTier(withApiLogging(async (
         null, 
         'SELF_REVOKE_FORBIDDEN'
       );
-      return addCorsHeaders(response);
+      return addCorsHeaders(response, req);
     }
 
     // Soft delete - just mark as inactive
@@ -280,25 +254,30 @@ export const DELETE = withRateLimitTier(withApiLogging(async (
       `UPDATE "api_key" 
        SET status = 'inactive', "updatedAt" = CURRENT_TIMESTAMP
        WHERE id = $1 AND "userId" = $2
-       RETURNING id, name`,
+       RETURNING id, name, "keyHash"`,
       [id, authResult.user!.id],
       authResult.user!.id
     );
 
     if (result.rows.length === 0) {
       const response = createApiError('API key not found', 404, null, 'API_KEY_NOT_FOUND');
-      return addCorsHeaders(response);
+      return addCorsHeaders(response, req);
     }
 
+    const revokedRow = result.rows[0] as { name: string; keyHash: string };
+
+    // Revocation must be effective right away, not after the 5 min cache TTL (see #92)
+    invalidateApiKeyCache(revokedRow.keyHash);
+
     const response = createApiResponse({ 
       revoked: true, 
       id,
-      name: (result.rows[0] as { name: string }).name
+      name: revokedRow.name
     });
-    return addCorsHeaders(response);
+    return addCorsHeaders(response, req);
   } catch (error) {
     console.error('Error revoking API key:', error);
     const response = createApiError('Internal server error', 500);
-    return addCorsHeaders(response);
+    return addCorsHeaders(response, req);
   }
 }), 'strict');