fix(security): enforce management-plane isolation for API tokens, fix team scoping, and fix blocked usage logging#3414

Merged

crivetimihai merged 13 commits intomainfrom

fix/3291-api-token-management-plane-isolation

Mar 6, 2026

Commits on Mar 5, 2026

fix: block API tokens from token management, fix team_id inheritance, and fix blocked/revoked usage logging

shoummu1
authored and
crivetimihai
committed
update test coverage

shoummu1
authored and
crivetimihai
committed
test(security): add differential coverage for 401/403 middleware paths and list_team_tokens
crivetimihai
committed
style: apply linter formatting to tokens.py
crivetimihai
committed
fix(security): enforce token revocation by propagating 401 from auth middleware
crivetimihai
committed
fix(security): cross-worker revocation via Redis revoke key check
crivetimihai
committed
fix(security): validate JTI before logging, preserve browser redirect, scope blocked to 4xx
crivetimihai
committed
style: fix import ordering in token_usage_middleware
crivetimihai
committed
test(security): achieve 100% diff coverage for auth middleware, cache, and usage logging
crivetimihai
committed