okengine 0.15.2 → 0.16.0

package/src/kernel/api-key-host-persist.test.ts

@@ -0,0 +1,143 @@
+/**
+ * Host API-key durability — standalone `oke()` (no Console).
+ *
+ * Creates a key via `fx.auth.createApiKey`, stops, boots a fresh app against
+ * the same SQL URL, and verifies Bearer on the new `gate.auth.apiKeyStore`.
+ * Production uses postgres + `DATABASE_URL`; this suite uses file-backed
+ * PGlite at that same URL so the restart is hermetic.
+ */
+
+import { afterEach, describe, expect, test } from "bun:test";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { AUTH_TABLES } from "../auth/tables.ts";
+import { gate } from "../elements/gate.ts";
+import { resetStores, store } from "../elements/store/declare.ts";
+import { oke } from "./app.ts";
+import { flow, resetFlowSeq } from "./flow.ts";
+import { on, resetBindings } from "./on.ts";
+import { http } from "./triggers.ts";
+
+const PEPPER = "oke-host-api-key-persist-pepper";
+const member = gate.policy("member", ({ auth }) => !!auth.verified);
+
+function resetIsolated(): void {
+  resetBindings();
+  resetFlowSeq();
+  resetStores();
+}
+
+afterEach(() => {
+  resetIsolated();
+});
+
+describe("host API key persist via store.sql()", () => {
+  test("standalone oke() persists keys across restart; Bearer verifies on a fresh store", async () => {
+    const dir = await mkdtemp(join(tmpdir(), "oke-host-keys-"));
+    const sqlUrl = join(dir, "pgdata");
+    const prevDb = process.env.DATABASE_URL;
+    const prevPglite = process.env.OKE_PGLITE_URL;
+    process.env.DATABASE_URL = sqlUrl;
+    process.env.OKE_PGLITE_URL = sqlUrl;
+
+    try {
+      resetIsolated();
+      const db1 = store.sql("app", { schema: {} });
+      on(
+        http.post("/keys").gate(member),
+        flow("keys.create", {
+          effects: { writes: ["auth:api-keys"] },
+          do: (_input, fx) => fx.auth.createApiKey({ name: "prod-ci", scopes: ["member"] }),
+        }),
+      );
+      on(
+        http.get("/secure").gate(member),
+        flow("secure.ping", {
+          effects: {},
+          do: () => ({ ok: true }),
+        }),
+      );
+
+      const first = oke({
+        name: "host-keys-first",
+        stores: [db1],
+        gate: {
+          auth: { secret: PEPPER, http: false },
+          policies: [member],
+        },
+        env: "test",
+        startScheduler: false,
+      });
+      await first.boot({ env: "test", startScheduler: false });
+      expect(first.apiKeys?.persist).toBeTypeOf("function");
+
+      const created = await first.execute(
+        first.flow("keys.create")!,
+        {},
+        http.post("/keys").gate(member),
+        {
+          principal: {
+            plane: "user",
+            userId: "u_issuer",
+            scopes: new Set(["member"]),
+            verified: true,
+          },
+        },
+      );
+      expect(created.failure).toBeUndefined();
+      const secret = (created.output as { secret?: string } | undefined)?.secret;
+      expect(secret?.startsWith("oke_")).toBe(true);
+
+      const firstStore = first.bootResult?.store;
+      await first.stop();
+      await firstStore?.close();
+
+      resetIsolated();
+      const db2 = store.sql("app", { schema: {} });
+      on(
+        http.get("/secure").gate(member),
+        flow("secure.ping", {
+          effects: {},
+          do: () => ({ ok: true }),
+        }),
+      );
+      const second = oke({
+        name: "host-keys-second",
+        stores: [db2],
+        gate: {
+          auth: { secret: PEPPER, http: false },
+          policies: [member],
+        },
+        env: "test",
+        startScheduler: false,
+      });
+      await second.boot({ env: "test", startScheduler: false });
+      expect(second.apiKeys).not.toBe(first.apiKeys);
+      expect(second.apiKeys?.keys.size).toBeGreaterThan(0);
+
+      const conn = await second.bootResult?.store?.primarySql();
+      const rows = await conn?.query(`SELECT id, name FROM ${AUTH_TABLES.apiKeys}`);
+      expect(rows?.some((r) => r.name === "prod-ci")).toBe(true);
+
+      const res = await second.fetch(
+        new Request("http://localhost/secure", {
+          method: "GET",
+          headers: { authorization: `Bearer ${secret}` },
+        }),
+      );
+      expect(res.status).toBe(200);
+      expect(await res.json()).toEqual({ data: { ok: true }, error: null });
+
+      const secondStore = second.bootResult?.store;
+      await second.stop();
+      await secondStore?.close();
+    } finally {
+      if (prevDb === undefined) delete process.env.DATABASE_URL;
+      else process.env.DATABASE_URL = prevDb;
+      if (prevPglite === undefined) delete process.env.OKE_PGLITE_URL;
+      else process.env.OKE_PGLITE_URL = prevPglite;
+      await rm(dir, { recursive: true, force: true });
+    }
+  }, 20_000);
+});

package/src/kernel/app.ts

@@ -24,6 +24,7 @@ import {
 import type { BootOptions, BootResult, ElementRuntimes } from "./boot.ts";
 import type { CapabilityToken } from "./capability.ts";
 import type { AppAuthBinding } from "./auth-resolve.ts";
+import type { ApiKeyStore } from "../auth/api-keys.ts";
 import type { AuthHttpMaterialization } from "../auth/bindings.ts";
 import type { WiredGateAuth } from "./app-auth.ts";
 import {
@@ -371,6 +372,8 @@ export interface OkeApp<D extends Record<string, unknown> = {}, R extends AppRou
    * Builtin auth binding after boot (session store + secret), when configured.
    */
   readonly authBinding: AppAuthBinding | undefined;
+  /** Shared API key store when `gate.auth` is enabled. */
+  readonly apiKeys: ApiKeyStore | undefined;
   /**
    * Attach a plugin app-wide. Scope is the attachment point.
    * Types accumulate — decorations are visible on downstream handlers.
@@ -1176,6 +1179,10 @@ export function oke(options: OkeOptions): OkeApp {
     };
     const result = await bootApplication(merged);
     bootResult = result;
+    if (gateConfig.auth?.apiKeyStore && result.store) {
+      const { bindHostApiKeySqlFromStore } = await import("../auth/api-key-sql.ts");
+      await bindHostApiKeySqlFromStore(result.store, gateConfig.auth.apiKeyStore);
+    }
     // otp() provider / app mode capability — fail loud at boot, never silent downgrade.
     if (result.channel) {
       const { assertOtpPluginCapability } = await import("../auth/otp-capability.ts");
@@ -1365,6 +1372,7 @@ export function oke(options: OkeOptions): OkeApp {
           userId: options.fx?.auth?.userId ?? null,
           scopes: new Set(options.fx?.auth?.scopes ?? []),
           verified: options.fx?.auth?.verified,
+          apiKeyId: options.fx?.auth?.apiKeyId,
         },
         operator: { id: options.fx?.operator?.id ?? null },
       };
@@ -1393,7 +1401,8 @@ export function oke(options: OkeOptions): OkeApp {
           : {}),
         verifyBearer:
           binding && wiredAuth
-            ? async (token) => wiredAuth.verifyBearerOrApiKey(binding, token, apiKeyStore)
+            ? (token, request) =>
+                wiredAuth.verifyBearerOrApiKey(binding, token, apiKeyStore, request)
             : undefined,
         // Phase 1a: opt-in cookie → Bearer when Authorization is absent.
         resolveToken:
@@ -1450,7 +1459,8 @@ export function oke(options: OkeOptions): OkeApp {
         catalogs: loadMessages().getMessageCatalogs(),
         ...options.fx?.i18n,
       },
-      ...(principals ? { auth: principals.auth as FxAuth, operator: principals.operator } : {}),
+      ...(principals ? { auth: principals.auth, operator: principals.operator } : {}),
+      apiKeyStore: gateConfig.auth?.apiKeyStore,
       ...(extras?.originPrincipal ? { principal: extras.originPrincipal } : {}),
       ...(extras?.trustedInvoke === true && extras.revealPii === true ? { revealPii: true } : {}),
       rlsGateNames: gateNamesOf(trigger),
@@ -1604,6 +1614,7 @@ export function oke(options: OkeOptions): OkeApp {
           }
           return await invoke(ctx.input);
         } catch (err) {
+          if (isFlowFailure(err)) return err;
           // A durable sleep that has not yet elapsed suspends the run — this
           // is a park, not a pipeline failure, so it must not throw upward.
           if (flowDef.durable && journalSession && isJournalSuspend(err)) {
@@ -1780,6 +1791,7 @@ export function oke(options: OkeOptions): OkeApp {
     get authBinding() {
       return authBinding;
     },
+    apiKeys: gateConfig.auth?.apiKeyStore,
     async resumeDurable(now) {
       const t = now ?? bootResult?.clock?.now() ?? options.fx?.now?.() ?? Date.now();
       const { store, instanceId, leaseMs } = activeJournal();

package/src/kernel/auth-resolve.ts

@@ -6,7 +6,7 @@
  * separately in the pipeline (`allowTestPrincipals`).
  */
 
-import { authenticateApiKey, type ApiKeyStore } from "../auth/api-keys.ts";
+import { authenticateApiKey, clientIpFromRequest, type ApiKeyStore } from "../auth/api-keys.ts";
 import type { ApiKeyRow } from "../auth/tables.ts";
 import {
   createSessionStore,
@@ -89,7 +89,9 @@ export function claimsToPrincipal(claims: AccessClaims): ResolvedPrincipal {
 
 /**
  * Map an authenticated API key row to the pipeline principal shape.
- * Uses the bare key id so Access `runTouchesKey` matches `WideEvent.principal`.
+ *
+ * The key is the issuer with fewer gates: `userId` / `operatorId` is
+ * {@link ApiKeyRow.creatorId}. The credential id is {@link ResolvedPrincipal.apiKeyId}.
  *
  * @param row - Authenticated key
  */
@@ -97,7 +99,7 @@ export function apiKeyRowToPrincipal(row: ApiKeyRow): ResolvedPrincipal {
   if (row.plane === "operator") {
     return {
       plane: "operator",
-      operatorId: row.id,
+      operatorId: row.creatorId,
       userId: null,
       scopes: row.scopes,
       verified: true,
@@ -106,7 +108,7 @@ export function apiKeyRowToPrincipal(row: ApiKeyRow): ResolvedPrincipal {
   }
   return {
     plane: "user",
-    userId: row.id,
+    userId: row.creatorId,
     scopes: row.scopes,
     verified: true,
     apiKeyId: row.id,
@@ -119,17 +121,20 @@ export function apiKeyRowToPrincipal(row: ApiKeyRow): ResolvedPrincipal {
  * @param auth - Session binding
  * @param token - Raw Bearer token
  * @param apiKeys - Optional key store
+ * @param request - Incoming request (allowlist IP is read here, not in `oke()`)
  */
 export async function verifyBearerOrApiKey(
   auth: AppAuthBinding,
   token: string,
   apiKeys?: ApiKeyStore,
+  request?: Request,
 ): Promise<ResolvedPrincipal> {
   try {
     return await verifyBearerToken(auth, token);
   } catch (err) {
     if (apiKeys) {
-      const row = await authenticateApiKey(apiKeys, token, auth.now);
+      const ip = request ? clientIpFromRequest(request) : undefined;
+      const row = await authenticateApiKey(apiKeys, token, { now: auth.now, ip });
       if (row) return apiKeyRowToPrincipal(row);
     }
     throw err;

package/src/kernel/boot.test.ts

@@ -79,7 +79,7 @@ describe("boot — lazy element needs", () => {
     expect(needs.signal).toBe(false);
   });
 
-  test("oke() Store-only graph stays under the prior 48 kB baseline", async () => {
+  test("oke() Store-only graph stays under the prior 50 kB baseline", async () => {
     const dir = await mkdtemp(join(tmpdir(), "oke-store-only-"));
     const entry = join(dir, "entry.ts");
     const appPath = join(import.meta.dir, "app.ts");
@@ -116,9 +116,9 @@ describe("boot — lazy element needs", () => {
         if (raw.byteLength === 0) continue;
         total += Bun.gzipSync(new Uint8Array(raw)).byteLength;
       }
-      // Rebased after clock / gate / kv / index auto-drain on `oke()`.
-      // (~48.3 kB gzip with export externals).
-      expect(total).toBeLessThan(49_000);
+      // Rebased after host API-key persist + allowlist on `oke()`.
+      // (~50.3 kB gzip with export externals).
+      expect(total).toBeLessThan(51_000);
     } finally {
       await rm(dir, { recursive: true, force: true });
     }

package/src/kernel/fx-auth-keys.test.ts

@@ -0,0 +1,88 @@
+/**
+ * Session-only `fx.auth` key methods — issuer derived, never from flow input.
+ */
+
+import { describe, expect, test } from "bun:test";
+import { AttenuationError } from "../auth/attenuation.ts";
+import { createApiKey, createApiKeyStore } from "../auth/api-keys.ts";
+import { isFlowFailure } from "./hooks.ts";
+import { createFx } from "./fx.ts";
+
+describe("fx.auth key methods", () => {
+  test("createApiKey derives creator from the live session and rejects broader scopes", async () => {
+    const store = createApiKeyStore();
+    const fx = createFx({
+      flow: "keys.create",
+      effects: { writes: ["auth:api-keys"] },
+      apiKeyStore: store,
+      auth: { userId: "u1", scopes: new Set(["member"]), apiKeyId: null },
+    });
+    const created = await fx.auth.createApiKey({ name: "mine", scopes: ["member"] });
+    expect(created.key.scopes).toEqual(["member"]);
+    expect(created.secret.startsWith("oke_")).toBe(true);
+    expect(store.keys.get(created.key.id)?.creatorId).toBe("u1");
+
+    await expect(fx.auth.createApiKey({ name: "wide", scopes: ["admin"] })).rejects.toBeInstanceOf(
+      AttenuationError,
+    );
+  });
+
+  test("key-authenticated caller cannot create / list / revoke / rotate / update", async () => {
+    const store = createApiKeyStore();
+    await createApiKey(store, {
+      plane: "user",
+      name: "existing",
+      scopes: ["member"],
+      creatorId: "u1",
+      creatorScopes: ["member"],
+      id: "key_existing",
+    });
+    const fx = createFx({
+      flow: "keys.as-key",
+      effects: { reads: ["auth:api-keys"], writes: ["auth:api-keys"] },
+      apiKeyStore: store,
+      auth: { userId: "u1", scopes: new Set(["member"]), apiKeyId: "key_existing" },
+    });
+    for (const call of [
+      () => fx.auth.createApiKey({ name: "nested", scopes: ["member"] }),
+      () => fx.auth.listApiKeys(),
+      () => fx.auth.revokeApiKey("key_existing"),
+      () => fx.auth.rotateApiKey("key_existing"),
+      () => fx.auth.updateApiKey("key_existing", { name: "nope" }),
+    ]) {
+      try {
+        await call();
+        throw new Error("expected Forbidden");
+      } catch (err) {
+        expect(isFlowFailure(err)).toBe(true);
+        if (isFlowFailure(err)) expect(err.error.code).toBe("Forbidden");
+      }
+    }
+  });
+
+  test("list is self-only; cross-user revoke is Forbidden", async () => {
+    const store = createApiKeyStore();
+    await createApiKey(store, {
+      plane: "user",
+      name: "theirs",
+      scopes: ["member"],
+      creatorId: "u2",
+      creatorScopes: ["member"],
+      id: "key_theirs",
+    });
+    const fx = createFx({
+      flow: "keys.list",
+      effects: { reads: ["auth:api-keys"], writes: ["auth:api-keys"] },
+      apiKeyStore: store,
+      auth: { userId: "u1", scopes: new Set(["member"]), apiKeyId: null },
+    });
+    expect(await fx.auth.listApiKeys()).toEqual([]);
+    try {
+      await fx.auth.revokeApiKey("key_theirs");
+      throw new Error("expected Forbidden");
+    } catch (err) {
+      expect(isFlowFailure(err)).toBe(true);
+      if (isFlowFailure(err)) expect(err.error.code).toBe("Forbidden");
+    }
+  });
+});

package/src/kernel/fx-auth-keys.ts

@@ -0,0 +1,198 @@
+/**
+ * `fx.auth` key-management methods — session-only, attenuated, one store.
+ */
+
+import {
+  AUTH_API_KEYS_RESOURCE,
+  createApiKey,
+  getApiKey,
+  listApiKeys,
+  revokeApiKey,
+  rotateApiKey,
+  toApiKeyPublicRow,
+  updateApiKey,
+  type ApiKeyPublicRow,
+  type ApiKeyStore,
+  type CreatedApiKey,
+} from "../auth/api-keys.ts";
+import { parseDurationMs } from "../elements/clock/duration.ts";
+import type { EffectKind } from "./effects.ts";
+import { fail, type FlowFailure } from "./errors.ts";
+
+/**
+ * Identity bag on {@link FxAuth} before key-management methods attach.
+ * Passed into {@link createFx} / {@link attach}.
+ */
+export interface FxAuthIdentity {
+  /** User-plane subject id, or null when unauthenticated. */
+  readonly userId: string | null;
+  /** Granted scopes for the live principal. */
+  readonly scopes: ReadonlySet<string>;
+  /** Whether the identity has completed verification (email / MFA). */
+  readonly verified?: boolean;
+  /** Authenticating API key id when Bearer was a key secret; otherwise null. */
+  readonly apiKeyId?: string | null;
+}
+
+/** Options for {@link FxAuth.createApiKey}. */
+export interface FxCreateApiKeyInput {
+  readonly name: string;
+  readonly scopes: readonly string[];
+  readonly expiresIn?: string;
+  readonly ipAllowlist?: readonly string[];
+  readonly rateLimit?: { max: number; per: string } | null;
+}
+
+/** Options for {@link FxAuth.updateApiKey}. */
+export interface FxUpdateApiKeyInput {
+  readonly name?: string;
+  readonly scopes?: readonly string[];
+  readonly expiresIn?: string;
+  readonly ipAllowlist?: readonly string[];
+  readonly rateLimit?: { max: number; per: string } | null;
+}
+
+/** Create result for `fx.auth.createApiKey` / `rotateApiKey`. */
+export interface FxCreatedApiKey {
+  readonly key: ApiKeyPublicRow;
+  readonly secret: string;
+}
+
+/**
+ * Session-only key management attached onto {@link FxAuthIdentity}.
+ * Methods throw {@link FlowFailure} values (`Unauthorized` / `Forbidden`).
+ */
+export interface FxAuthKeyMethods {
+  createApiKey(input: FxCreateApiKeyInput): Promise<FxCreatedApiKey>;
+  listApiKeys(): Promise<readonly ApiKeyPublicRow[]>;
+  revokeApiKey(id: string): Promise<ApiKeyPublicRow>;
+  rotateApiKey(id: string): Promise<FxCreatedApiKey>;
+  updateApiKey(id: string, input: FxUpdateApiKeyInput): Promise<ApiKeyPublicRow>;
+}
+
+/** Dependencies for {@link attach}. */
+export interface AttachAuthKeyMethodsOptions {
+  readonly auth: FxAuthIdentity;
+  readonly store: ApiKeyStore | undefined;
+  readonly now: () => number;
+  readonly gated: <T>(kind: EffectKind, resource: string, body: () => T | Promise<T>) => Promise<T>;
+}
+
+function sessionOnly(auth: FxAuthIdentity): FlowFailure | null {
+  if (auth.apiKeyId) {
+    return fail("Forbidden", { gate: AUTH_API_KEYS_RESOURCE, reason: "session_only" });
+  }
+  if (!auth.userId) {
+    return fail("Unauthorized", {});
+  }
+  return null;
+}
+
+function requireStore(store: ApiKeyStore | undefined): ApiKeyStore {
+  if (!store) {
+    throw fail("Forbidden", { gate: AUTH_API_KEYS_RESOURCE, reason: "no_store" });
+  }
+  return store;
+}
+
+function requireOwned(
+  store: ApiKeyStore,
+  id: string,
+  userId: string,
+): ReturnType<typeof getApiKey> {
+  const row = getApiKey(store, id);
+  if (!row || row.creatorId !== userId) {
+    throw fail("Forbidden", { gate: AUTH_API_KEYS_RESOURCE, reason: "not_owner" });
+  }
+  return row;
+}
+
+function expiresAtFrom(expiresIn: string | undefined, now: () => number): number | undefined {
+  if (expiresIn === undefined) return undefined;
+  return now() + parseDurationMs(expiresIn);
+}
+
+/**
+ * Attach create / list / revoke / rotate / update onto a live identity bag.
+ *
+ * @param options - Auth bag + store + capability gate
+ */
+export function attach(options: AttachAuthKeyMethodsOptions): FxAuthIdentity & FxAuthKeyMethods {
+  const { auth, now, gated } = options;
+
+  const methods: FxAuthKeyMethods = {
+    createApiKey(input) {
+      return gated("write", AUTH_API_KEYS_RESOURCE, async () => {
+        const denied = sessionOnly(auth);
+        if (denied) throw denied;
+        const store = requireStore(options.store);
+        const created: CreatedApiKey = await createApiKey(store, {
+          plane: "user",
+          name: input.name,
+          scopes: input.scopes,
+          creatorId: auth.userId!,
+          creatorScopes: auth.scopes,
+          expiresAt: expiresAtFrom(input.expiresIn, now) ?? null,
+          rateLimit: input.rateLimit ?? null,
+          ipAllowlist: input.ipAllowlist,
+          now,
+        });
+        return { key: toApiKeyPublicRow(created.row), secret: created.secret };
+      });
+    },
+    listApiKeys() {
+      return gated("read", AUTH_API_KEYS_RESOURCE, async () => {
+        const denied = sessionOnly(auth);
+        if (denied) throw denied;
+        const store = requireStore(options.store);
+        return listApiKeys(store, auth.userId!).map(toApiKeyPublicRow);
+      });
+    },
+    revokeApiKey(id) {
+      return gated("write", AUTH_API_KEYS_RESOURCE, async () => {
+        const denied = sessionOnly(auth);
+        if (denied) throw denied;
+        const store = requireStore(options.store);
+        requireOwned(store, id, auth.userId!);
+        const row = revokeApiKey(store, id, now);
+        if (!row) throw fail("Forbidden", { gate: AUTH_API_KEYS_RESOURCE, reason: "not_owner" });
+        return toApiKeyPublicRow(row);
+      });
+    },
+    rotateApiKey(id) {
+      return gated("write", AUTH_API_KEYS_RESOURCE, async () => {
+        const denied = sessionOnly(auth);
+        if (denied) throw denied;
+        const store = requireStore(options.store);
+        requireOwned(store, id, auth.userId!);
+        const rotated = await rotateApiKey(store, id, { now });
+        if (!rotated)
+          throw fail("Forbidden", { gate: AUTH_API_KEYS_RESOURCE, reason: "not_owner" });
+        return { key: toApiKeyPublicRow(rotated.row), secret: rotated.secret };
+      });
+    },
+    updateApiKey(id, input) {
+      return gated("write", AUTH_API_KEYS_RESOURCE, async () => {
+        const denied = sessionOnly(auth);
+        if (denied) throw denied;
+        const store = requireStore(options.store);
+        const existing = requireOwned(store, id, auth.userId!);
+        if (!existing)
+          throw fail("Forbidden", { gate: AUTH_API_KEYS_RESOURCE, reason: "not_owner" });
+        const ceiling = new Set([...existing.creatorScopes].filter((s) => auth.scopes.has(s)));
+        const row = updateApiKey(store, id, {
+          ceiling,
+          name: input.name,
+          scopes: input.scopes,
+          expiresAt: expiresAtFrom(input.expiresIn, now),
+          rateLimit: input.rateLimit,
+          ipAllowlist: input.ipAllowlist,
+        });
+        if (!row) throw fail("Forbidden", { gate: AUTH_API_KEYS_RESOURCE, reason: "not_owner" });
+        return toApiKeyPublicRow(row);
+      });
+    },
+  };
+
+  return Object.assign(auth, methods);
+}

package/src/kernel/fx.test.ts

@@ -432,7 +432,23 @@ describe("fx — wholesale swap", () => {
       t: (key) => key,
       locale: "en",
       id: () => "fixed-id",
-      auth: { userId: "u1", scopes: new Set(["a"]) },
+      auth: {
+        userId: "u1",
+        scopes: new Set(["a"]),
+        createApiKey: async () => {
+          throw new Error("auth.createApiKey must not be used");
+        },
+        listApiKeys: async () => [],
+        revokeApiKey: async () => {
+          throw new Error("auth.revokeApiKey must not be used");
+        },
+        rotateApiKey: async () => {
+          throw new Error("auth.rotateApiKey must not be used");
+        },
+        updateApiKey: async () => {
+          throw new Error("auth.updateApiKey must not be used");
+        },
+      },
       operator: { id: null },
       principal: { userId: "u1", operatorId: null, scopes: new Set(["a"]) },
       tenant: { id: "t1" },