tapimo 0.7.1 → 0.8.0

package/src/Scope.test.ts

@@ -1,5 +1,23 @@
 import * as Scope from './Scope.js'
 
+describe('schema.Zone', () => {
+  test('accepts concrete read and write scopes', () => {
+    expect(
+      ['zone:421700005:read', 'zone:421700005:write'].map((scope) =>
+        Scope.schema.Zone.safeParse(scope),
+      ),
+    ).toMatchObject([{ success: true }, { success: true }])
+  })
+
+  test('rejects templates and unsupported access levels', () => {
+    expect(
+      ['zone:<chainId>:read', 'zone:421700005:admin'].map((scope) =>
+        Scope.schema.Zone.safeParse(scope),
+      ),
+    ).toMatchObject([{ success: false }, { success: false }])
+  })
+})
+
 describe('extend', () => {
   test('appends host scopes to the built-in catalog', () => {
     expect(
@@ -13,6 +31,7 @@ describe('extend', () => {
     ).toEqual([
       ...Scope.catalog,
       Scope.zoneEntry,
+      Scope.zoneWriteEntry,
       {
         description: 'Read project accounts.',
         scope: 'accounts:read',

package/src/Scope.ts

@@ -33,6 +33,16 @@ export const catalog = [
     scope: 'data:read',
     selfServe: true,
   },
+  {
+    description: 'Read organization funding transfers, deposit addresses, and deposits.',
+    scope: 'funding:read',
+    selfServe: false,
+  },
+  {
+    description: 'Create funding transfers and register their source transactions.',
+    scope: 'funding:write',
+    selfServe: false,
+  },
   {
     description: 'Run ad-hoc queries against the raw indexer passthrough.',
     scope: 'indexer:query',
@@ -50,7 +60,7 @@ export const catalog = [
     selfServe: true,
   },
   {
-    description: 'Validate and broadcast MPP payment credentials through the Tempo relay.',
+    description: 'Validate and broadcast MPP credentials through Tempo.',
     scope: 'mpp:write',
     selfServe: true,
   },
@@ -76,28 +86,35 @@ export const catalog = [
   },
 ] as const satisfies readonly Entry[]
 
-/**
- * Templated `/v1/scopes` entry for per-zone read scopes. Concrete grants use
- * `zone:<chainId>:read` and are never self-serve.
- */
+/** Templated `/v1/scopes` entry for per-zone read scopes. */
 export const zoneEntry = {
   description: 'Read RPC and indexed data for one zone chain id.',
   scope: 'zone:<chainId>:read',
   selfServe: false,
 } as const satisfies Entry
 
+/** Templated `/v1/scopes` entry for per-zone transaction broadcast scopes. */
+export const zoneWriteEntry = {
+  description: 'Broadcast signed transactions to one zone chain id.',
+  scope: 'zone:<chainId>:write',
+  selfServe: false,
+} as const satisfies Entry
+
 /** Zod schemas owned by the scope vocabulary. */
 export namespace schema {
-  /** A concrete per-zone read scope (`zone:421700001:read`). */
+  /** A concrete per-zone read or write scope. */
   export const Zone = z
-    .templateLiteral(['zone:', z.int(), ':read'])
+    .union([
+      z.templateLiteral(['zone:', z.int(), ':read']),
+      z.templateLiteral(['zone:', z.int(), ':write']),
+    ])
     .check(
-      z.regex(/^zone:[1-9]\d*:read$/),
-      z.describe('Per-zone read scope (`zone:<chainId>:read`).'),
+      z.regex(/^zone:[1-9]\d*:(read|write)$/),
+      z.describe('Per-zone read or write scope (`zone:<chainId>:read|write`).'),
     )
 }
 
-/** Per-zone read scope, granting access to one zone chain id. */
+/** Per-zone read or write scope, granting access to one zone chain id. */
 export type Zone = z.output<typeof schema.Zone>
 
 /** Issuable API-key scope identifier, including host-defined scopes. */
@@ -123,7 +140,7 @@ export const selfServe: readonly Id[] = catalog
  */
 export function extend(entries: readonly Entry[] = []): Catalog {
   const identifiers = new Set<string>()
-  const result = [...catalog, zoneEntry, ...entries]
+  const result = [...catalog, zoneEntry, zoneWriteEntry, ...entries]
   for (const entry of result) {
     if (!entry.scope.trim()) throw new Error('Scope identifier must not be empty.')
     if (identifiers.has(entry.scope)) throw new Error(`Duplicate scope \`${entry.scope}\`.`)

package/src/Webhooks.test.ts

@@ -47,4 +47,29 @@ describe('createPoller', () => {
       ]
     `)
   })
+
+  test('clamps a creation checkpoint to genesis', async () => {
+    const db = TestApp.database()
+    const subscription = await Webhooks.createSubscription(
+      db,
+      {
+        chainId: 42431,
+        destination: { type: 'url', url: 'https://hooks.example.com/x' },
+        eventType: 'block:created',
+        owner: { orgId: 'org_test', type: 'api_key' },
+      },
+      { startBlockNumber: 1 },
+    )
+    const poller = Webhooks.createPoller({
+      db,
+      defaultChainId: 42431,
+    })
+
+    await poller.tick({
+      eventTypes: ['block:created'],
+      headBlockNumber: 1,
+    })
+
+    expect(decodeCursor(await Webhooks.getCursor(db, subscription.id))).toEqual([0, 2_147_483_647])
+  })
 })

package/src/Webhooks.ts

@@ -126,7 +126,7 @@ export declare namespace createPoller {
 
   /** Knobs shared by every {@link Poller.tick}; each is overridable per tick. */
   type Defaults = {
-    /** Max matching rows scanned per subscription per tick (default 100). */
+    /** Max matching rows scanned per subscription per tick (default 200). */
     batchSize?: number | undefined
     /** Reorg-safety window: only emit blocks this far behind head (default 2). */
     confirmations?: number | undefined

package/src/admin/App.test.ts

@@ -1,4 +1,5 @@
 import { Hono } from 'hono'
+import * as Organizations from '../db/tables/organizations.js'
 import * as TestAdmin from '../../test/Admin.js'
 
 // Route behavior (mint/list/revoke, the scope catalog) is covered in
@@ -18,6 +19,11 @@ describe('create', () => {
           method: 'POST',
         }),
         new Request('http://admin/api-keys/key_x', { method: 'DELETE' }),
+        new Request('http://admin/earn/verified-vaults', {
+          body: JSON.stringify({}),
+          headers: { 'content-type': 'application/json' },
+          method: 'PUT',
+        }),
         new Request('http://admin/organizations'),
         new Request('http://admin/organizations/org_x'),
         new Request('http://admin/organizations/org_x/billing-sources/stripe', { method: 'PUT' }),
@@ -61,9 +67,10 @@ describe('create', () => {
     })
 
     test('verified identity is recorded as createdBy on minted keys', async () => {
-      const { app } = TestAdmin.setup({ identify: () => ({ email: 'ops@tempo.xyz' }) })
+      const { app, db } = TestAdmin.setup({ identify: () => ({ email: 'ops@tempo.xyz' }) })
+      await Organizations.create(db, { id: 'org', name: 'Operations' })
       const response = await app.request('http://admin/api-keys', {
-        body: JSON.stringify({ orgId: 'org', scopes: ['data:read'] }),
+        body: JSON.stringify({ name: 'Operations', orgId: 'org', scopes: ['data:read'] }),
         headers: { 'content-type': 'application/json' },
         method: 'POST',
       })

package/src/admin/App.ts

@@ -1,6 +1,7 @@
 import { type Context, Hono, type Next } from 'hono'
 import { HTTPException } from 'hono/http-exception'
 import { requestId, type RequestIdVariables } from 'hono/request-id'
+import type { Chain } from 'viem'
 
 import * as ApiKey from '../ApiKey.js'
 import type * as Assets from '../Assets.js'
@@ -9,9 +10,12 @@ import * as Db from '../db/Db.js'
 import * as AdminAuditLogs from '../db/tables/adminAuditLogs.js'
 import type * as Store from '../internal/Store.js'
 import * as Response from '../internal/Response.js'
+import * as Viem from '../internal/Viem.js'
+import * as Zones from '../apps/Zones.js'
 
 import { apiKeys } from './apps/api-keys.js'
 import { earlyAccess } from './apps/early-access.js'
+import { earnVaults } from './apps/earn-vaults.js'
 import { organizations } from './apps/organizations.js'
 import { scopes } from './apps/scopes.js'
 import { verifiedTokens } from './apps/verified-tokens.js'
@@ -30,12 +34,18 @@ export type Environment = {
     analytics: Analytics.Source
     /** Static-asset writer (e.g. the R2 icon bucket), when configured. */
     assets: create.Assets | undefined
+    /** Path where the admin app is mounted. */
+    basePath: string
     /** Authoritative Postgres store, or a per-request factory. Resolve at the leaf with `Db.get`. */
     db: Db.Source
-    /** KV state store backing API-key records (mint/list/revoke). */
-    kv: { store: Store.State }
+    /** Gets a Tempo RPC client for a chain id. */
+    getClient: Viem.GetClient
     /** The admin identity, or `null` when unauthenticated (gated routes reject). */
     identity: Identity | null
+    /** KV state store backing API-key records (mint/list/revoke). */
+    kv: { store: Store.State }
+    /** Zone chains available to admin routes. */
+    zones: readonly Chain[]
   }
 }
 
@@ -45,6 +55,10 @@ export type App = ReturnType<typeof create>
 /** Creates the admin portal Hono app. */
 export function create(options: create.Options) {
   const { identify } = options
+
+  const zones = options.zones === true ? Zones.chains : (options.zones ?? [])
+  const getClient = Viem.createGetClient({ rpc: options.rpc, zones })
+
   // `false` (disabled) collapses to `undefined` so only a real config surfaces
   // `loginUrl`/`logoutUrl` in `/config.json`.
   const ui = options.ui || undefined
@@ -62,8 +76,11 @@ export function create(options: create.Options) {
     c.header('Cache-Control', 'no-store')
     c.set('analytics', options.analytics)
     c.set('assets', options.assets)
+    c.set('basePath', c.req.routePath.replace(/\*$/, '').replace(/\/$/, ''))
     c.set('db', options.db)
+    c.set('getClient', getClient)
     c.set('kv', options.kv)
+    c.set('zones', zones)
     c.set('identity', await identify(c.req.raw))
     return next()
   })
@@ -83,13 +100,12 @@ export function create(options: create.Options) {
   // Renders the public SPA shell: stamps its hydration-safe base and auth
   // placeholders with request values. `<` is escaped to keep the config script.
   const serveShell = (c: Context<Environment>) => {
-    const mount = c.req.routePath.replace(/\*$/, '').replace(/\/$/, '')
     const config = JSON.stringify(authConfig(c.get('identity'))).replaceAll('<', '\\u003c')
     return c.html(
       Ui.shell
         .replace(
           '<base data-tempo-base="true" href="/"/>',
-          `<base data-tempo-base="true" href="${mount}/"/>`,
+          `<base data-tempo-base="true" href="${c.get('basePath')}/"/>`,
         )
         .replace('window.__TEMPO_API_CONFIG__=undefined', `window.__TEMPO_API_CONFIG__=${config}`),
     )
@@ -120,6 +136,8 @@ export function create(options: create.Options) {
     '/api-keys/*',
     '/early-access',
     '/early-access/*',
+    '/earn/verified-vaults',
+    '/earn/verified-vaults/*',
     '/organizations',
     '/organizations/*',
     '/scopes',
@@ -156,6 +174,7 @@ export function create(options: create.Options) {
     .get('/config.json', (c) => c.json(authConfig(c.get('identity')), 200))
     .route('/api-keys', apiKeys())
     .route('/early-access', earlyAccess())
+    .route('/earn/verified-vaults', earnVaults())
     .route('/organizations', organizations())
     .route('/scopes', scopes())
     .route('/verified-tokens', verifiedTokens())
@@ -222,22 +241,26 @@ export declare namespace create {
      * (`() => Db.postgres(...)`) on Workers.
      */
     db: Db.Source
-    /**
-     * KV state store backing API-key records (shared with the main API's
-     * `kv` option), provisioned against by the `/api-keys` routes.
-     */
-    kv: { store: Store.State }
     /**
      * Extracts the verified admin identity from a request, or `null` to deny.
      * Must only return an identity for an already-authenticated request (a
      * verified Access JWT, or a header set by a trusted proxy).
      */
     identify: (request: Request) => Identity | null | Promise<Identity | null>
+    /**
+     * KV state store backing API-key records (shared with the main API's
+     * `kv` option), provisioned against by the `/api-keys` routes.
+     */
+    kv: { store: Store.State }
+    /** Tempo RPC options used by onchain verification. */
+    rpc?: Viem.getClient.Rpc | undefined
     /**
      * Admin UI options, or `false` to disable the bundled UI (JSON API only).
      * `loginUrl`/`logoutUrl` are surfaced in `GET /config.json`.
      */
     ui?: Ui | false | undefined
+    /** Zone chains available to admin routes. Pass true to use the hosted Zone list. */
+    zones?: true | readonly Chain[] | undefined
   }
 
   /** Admin UI options surfaced to the SPA via `GET /config.json`. */

package/src/admin/apps/api-keys.test.ts

@@ -1,16 +1,19 @@
 import * as ApiKey from '../../ApiKey.js'
 import * as core_ApiKeys from '../../ApiKeys.js'
+import * as Organizations from '../../db/tables/organizations.js'
+import * as Projects from '../../db/tables/projects.js'
+import * as Users from '../../db/tables/users.js'
 
 import * as TestAdmin from '../../../test/Admin.js'
 import * as TestApp from '../../../test/App.js'
 import * as ApiKeys from './api-keys.js'
 
 /** Minimal valid mint payload. */
-const validBody = { orgId: 'org_test', scopes: ['data:read'] } as const
+const validBody = { name: 'CI', orgId: 'org_test', scopes: ['data:read'] } as const
 
 describe('POST /api-keys', () => {
   test('mints a key, returns the token once, persists a hashed record', async () => {
-    const { client, store } = TestAdmin.setup()
+    const { client, store } = await setup()
     const response = await client['api-keys'].$post({ json: { ...validBody, name: 'CI' } })
     const body = await TestApp.json(response, ApiKeys.schema.createApiKey.Response)
 
@@ -21,6 +24,7 @@ describe('POST /api-keys', () => {
     expect(body.createdBy).toBe(TestAdmin.identity.email)
     expect(TestAdmin.redact(body)).toMatchInlineSnapshot(`
       {
+        "allowedIps": [],
         "createdAt": "<createdAt>",
         "createdBy": "admin@tempo.xyz",
         "environment": "production",
@@ -44,7 +48,7 @@ describe('POST /api-keys', () => {
   })
 
   test('defaults to the production environment', async () => {
-    const { client, store } = TestAdmin.setup()
+    const { client, store } = await setup()
     const response = await client['api-keys'].$post({ json: validBody })
     const body = await TestApp.json(response, ApiKeys.schema.createApiKey.Response)
 
@@ -53,8 +57,17 @@ describe('POST /api-keys', () => {
     expect((await core_ApiKeys.list(store))[0]?.environment).toBe('production')
   })
 
+  test('requires a human-readable name', async () => {
+    const { client } = await setup()
+    const response = await client['api-keys'].$post({
+      json: { orgId: 'org_test', scopes: ['data:read'] } as never,
+    })
+
+    expect(response.status).toBe(400)
+  })
+
   test('persists a sandbox environment when provided', async () => {
-    const { client, store } = TestAdmin.setup()
+    const { client, store } = await setup()
     const response = await client['api-keys'].$post({
       json: { ...validBody, environment: 'sandbox' },
     })
@@ -68,21 +81,21 @@ describe('POST /api-keys', () => {
     expect(resolved?.environment).toBe('sandbox')
   })
 
-  test('mints a key with a concrete Zone read scope', async () => {
-    const { client, store } = TestAdmin.setup()
-    const scope = 'zone:421700001:read' as const
+  test('mints a key with concrete Zone read and write scopes', async () => {
+    const { client, store } = await setup()
+    const scopes = ['zone:421700001:read', 'zone:421700001:write'] as const
     const response = await client['api-keys'].$post({
-      json: { ...validBody, scopes: [scope] },
+      json: { ...validBody, scopes },
     })
     const body = await TestApp.json(response, ApiKeys.schema.createApiKey.Response)
 
     expect(response.status).toBe(200)
-    expect(body.scopes).toEqual([scope])
-    expect((await core_ApiKeys.resolve(store, body.token))?.scopes).toEqual([scope])
+    expect(body.scopes).toEqual(scopes)
+    expect((await core_ApiKeys.resolve(store, body.token))?.scopes).toEqual(scopes)
   })
 
   test('records the expiry when provided', async () => {
-    const { client, store } = TestAdmin.setup()
+    const { client, store } = await setup()
     const expiresAt = '2100-01-01T00:00:00.000Z'
     const response = await client['api-keys'].$post({ json: { ...validBody, expiresAt } })
     const body = await TestApp.json(response, ApiKeys.schema.createApiKey.Response)
@@ -93,7 +106,7 @@ describe('POST /api-keys', () => {
   })
 
   test('rejects an unknown scope with 400', async () => {
-    const { client } = TestAdmin.setup()
+    const { client } = await setup()
     const response = await client['api-keys'].$post({
       // Cast past the typed client to exercise runtime validation.
       json: { ...validBody, scopes: ['nope:read'] } as never,
@@ -105,8 +118,13 @@ describe('POST /api-keys', () => {
   })
 
   test('rejects non-concrete or non-canonical Zone scopes with 400', async () => {
-    for (const scope of ['zone:<chainId>:read', 'zone:0:read', 'zone:000421700001:read']) {
-      const { client } = TestAdmin.setup()
+    for (const scope of [
+      'zone:<chainId>:read',
+      'zone:0:read',
+      'zone:0:write',
+      'zone:000421700001:read',
+    ]) {
+      const { client } = await setup()
       const response = await client['api-keys'].$post({
         // Cast past the typed client to exercise runtime validation.
         json: { ...validBody, scopes: [scope] } as never,
@@ -119,7 +137,7 @@ describe('POST /api-keys', () => {
   })
 
   test('ignores a client-supplied createdBy (audit trail is server-set)', async () => {
-    const { client } = TestAdmin.setup()
+    const { client } = await setup()
     const response = await client['api-keys'].$post({
       // Cast past the typed client: the body schema omits createdBy, so an
       // unknown key is stripped and the server records the verified identity.
@@ -130,8 +148,68 @@ describe('POST /api-keys', () => {
     expect(response.status).toBe(200)
     expect(body.createdBy).toBe(TestAdmin.identity.email)
   })
+
+  test('allows a one-off key without organization attribution', async () => {
+    const { client, store } = TestAdmin.setup()
+    const response = await client['api-keys'].$post({
+      json: { name: 'Trial', scopes: ['data:read'] },
+    })
+    const body = await TestApp.json(response, ApiKeys.schema.createApiKey.Response)
+
+    expect(response.status).toBe(200)
+    expect(body.orgId).toBe(body.id)
+    expect((await core_ApiKeys.resolve(store, body.token))?.orgId).toBe(body.id)
+  })
+
+  test('rejects an unknown organization', async () => {
+    const { client } = TestAdmin.setup()
+    const response = await client['api-keys'].$post({ json: validBody })
+
+    expect(response.status).toBe(404)
+  })
+
+  test('infers organization attribution from a project', async () => {
+    const { client, db, store } = TestAdmin.setup()
+    const organization = await Organizations.create(db, { name: 'Project owner' })
+    const project = await Projects.create(db, { name: 'Project', orgId: organization.id })
+    const response = await client['api-keys'].$post({
+      json: { name: 'Project key', projectId: project.id, scopes: ['data:read'] },
+    })
+    const body = await TestApp.json(response, ApiKeys.schema.createApiKey.Response)
+
+    expect(response.status).toBe(200)
+    expect(body.orgId).toBe(organization.id)
+    expect(body.projectId).toBe(project.id)
+    expect((await core_ApiKeys.resolve(store, body.token))?.orgId).toBe(organization.id)
+  })
+
+  test('rejects an unknown project', async () => {
+    const { client } = await setup()
+    const response = await client['api-keys'].$post({
+      json: { ...validBody, projectId: 'prj_missing' },
+    })
+
+    expect(response.status).toBe(404)
+  })
+
+  test('rejects a project owned by another organization', async () => {
+    const { client, db } = await setup()
+    const other = await Organizations.create(db, { name: 'Other' })
+    const project = await Projects.create(db, { name: 'Other project', orgId: other.id })
+    const response = await client['api-keys'].$post({
+      json: { ...validBody, projectId: project.id },
+    })
+
+    expect(response.status).toBe(404)
+  })
 })
 
+async function setup() {
+  const context = TestAdmin.setup()
+  await Organizations.create(context.db, { id: validBody.orgId, name: 'Test' })
+  return context
+}
+
 describe('GET /api-keys', () => {
   test('lists records as metadata only (never the token)', async () => {
     const { client, store } = TestAdmin.setup()
@@ -142,6 +220,11 @@ describe('GET /api-keys', () => {
 
     expect(response.status).toBe(200)
     expect(body.data).toHaveLength(1)
+    expect(body.data[0]).toMatchObject({
+      createdByLabel: null,
+      organizationName: null,
+      projectName: null,
+    })
     // No record (and no serialized response) may carry the plaintext token.
     expect(body.data[0]).not.toHaveProperty('token')
     expect(JSON.stringify(body)).not.toContain(token)
@@ -157,6 +240,30 @@ describe('GET /api-keys', () => {
 
     expect(body.data.map((record) => record.orgId)).toEqual(['org_a'])
   })
+
+  test('resolves organization, project, and creator display labels', async () => {
+    const { client, db, store } = TestAdmin.setup()
+    const user = await Users.upsertByAddress(db, { address: `0x${'aa'.repeat(20)}` })
+    await Users.setEmail(db, user.id, 'alex@tempo.xyz')
+    const organization = await Organizations.create(db, { name: 'Tempo' })
+    const project = await Projects.create(db, { name: 'Explorer', orgId: organization.id })
+    await core_ApiKeys.mint(store, {
+      createdBy: user.id,
+      name: 'Explorer testnet',
+      orgId: organization.id,
+      projectId: project.id,
+      scopes: ['data:read'],
+    })
+
+    const response = await client['api-keys'].$get({ query: {} })
+    const body = await TestApp.json(response, ApiKeys.schema.listApiKeys.Response)
+
+    expect(body.data[0]).toMatchObject({
+      createdByLabel: 'alex@tempo.xyz',
+      organizationName: 'Tempo',
+      projectName: 'Explorer',
+    })
+  })
 })
 
 describe('DELETE /api-keys/:id', () => {
@@ -184,22 +291,83 @@ describe('DELETE /api-keys/:id', () => {
 })
 
 describe('PATCH /api-keys/:id', () => {
-  test('re-attributes a key to an org and project', async () => {
+  test('preserves the allowlist when omitted', async () => {
     const { client, store } = TestAdmin.setup()
-    const { record, token } = await core_ApiKeys.mint(store, validBody)
+    const { record } = await core_ApiKeys.mint(store, {
+      allowedIps: ['203.0.113.0/24'],
+      name: 'Restricted',
+      scopes: ['data:read'],
+    })
+
+    const response = await client['api-keys'][':id'].$patch({
+      json: { name: 'Renamed' },
+      param: { id: record.id },
+    })
+
+    expect(response.status).toBe(200)
+    expect((await core_ApiKeys.get(store, record.id))?.allowedIps).toEqual(['203.0.113.0/24'])
+  })
+
+  test('renames and associates a one-off key without changing its token', async () => {
+    const { client, db, store } = TestAdmin.setup()
+    const organization = await Organizations.create(db, { name: 'Tempo' })
+    const { record, token } = await core_ApiKeys.mint(store, {
+      name: 'Trial',
+      scopes: ['data:read'],
+    })
 
     const response = await client['api-keys'][':id'].$patch({
-      json: { orgId: 'org_real', projectId: 'prj_real' },
+      json: {
+        allowedIps: ['203.0.113.0/24'],
+        name: 'Explorer',
+        orgId: organization.id,
+        projectId: 'prj_real',
+      },
       param: { id: record.id },
     })
     expect(response.status).toBe(200)
     const body = await TestApp.json(response, core_ApiKeys.schema.Record)
-    expect(body.orgId).toBe('org_real')
+    expect(body.name).toBe('Explorer')
+    expect(body.allowedIps).toEqual(['203.0.113.0/24'])
+    expect(body.orgId).toBe(organization.id)
     expect(body.projectId).toBe('prj_real')
 
-    // The original token keeps resolving, now carrying the attribution.
-    const resolved = await core_ApiKeys.resolve(store, token)
-    expect(resolved?.projectId).toBe('prj_real')
+    expect((await core_ApiKeys.resolve(store, token))?.orgId).toBe(organization.id)
+    expect(await core_ApiKeys.listByOrg(store, record.id)).toEqual([])
+    expect((await core_ApiKeys.listByOrg(store, organization.id)).map(({ id }) => id)).toEqual([
+      record.id,
+    ])
+  })
+
+  test('rejects an unknown organization without changing the key', async () => {
+    const { client, store } = TestAdmin.setup()
+    const { record } = await core_ApiKeys.mint(store, { scopes: ['data:read'] })
+    const response = await client['api-keys'][':id'].$patch({
+      json: { orgId: 'org_missing' },
+      param: { id: record.id },
+    })
+
+    expect(response.status).toBe(404)
+    expect((await core_ApiKeys.get(store, record.id))?.orgId).toBe(record.id)
+  })
+
+  test('rejects changing an assigned organization', async () => {
+    const { client, db, store } = TestAdmin.setup()
+    const organization = await Organizations.create(db, { name: 'Tempo' })
+    const other = await Organizations.create(db, { name: 'Other' })
+    const { record, token } = await core_ApiKeys.mint(store, {
+      orgId: organization.id,
+      scopes: ['data:read'],
+    })
+    const response = await client['api-keys'][':id'].$patch({
+      json: { orgId: other.id },
+      param: { id: record.id },
+    })
+    const body = (await response.json()) as { error?: { code?: string } }
+
+    expect(response.status).toBe(409)
+    expect(body.error?.code).toBe('organization_already_assigned')
+    expect((await core_ApiKeys.resolve(store, token))?.orgId).toBe(organization.id)
   })
 
   test('unknown id → 404', async () => {