feat: add multi-key scoped API access

[ECWireless]

Summary

• allow multiple labeled API keys per node with read-write or read-only access
• preserve full scoped tree and report reads for read-only clients while rejecting mutations, and publish an OpenAPI description
• add accessible dashboard controls for creating, rotating, and revoking keys plus a secret-free client-agent setup prompt
• preserve legacy v1 compatibility and add deterministic migration and authorization-race coverage

Verification

• pnpm db:check
• pnpm lint
• pnpm typecheck
• pnpm test — 116 tests
• pnpm test:integration — 107 tests
• pnpm build
• agent-access Playwright suite — 5 desktop and 5 Pixel 5 scenarios
• manual browser QA — desktop, Pixel 5, and 350px
• independent technical, experience/accessibility, and security/privacy reviews

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
timetree	Ready	Preview	Oct 7, 2026 10:37pm UTC

[Copilot]

🔵 Needs a closer look

The broad authentication, migration, concurrency, and secret-management changes warrant final human security review.

0 open findings

What changed in this PR

Adds multi-key, scoped API access with read-only/read-write permissions while preserving legacy key compatibility.

Changes:

• Adds labeled v2 credentials, migration, authorization, and race protections.
• Publishes OpenAPI documentation and read-only client setup guidance.
• Expands dashboard key management and automated coverage.

File	Description
SPEC.md	Defines the multi-key security and UX model.
vitest.config.ts	Adds the source alias for unit tests.
drizzle/​0003_old_molly_hayes.sql	Migrates credentials to labels and access levels.
drizzle/​meta/​0003_snapshot.json	Records the migrated database schema.
drizzle/​meta/​_journal.json	Registers migration 0003.
src/​db/​schema.ts	Models multiple labeled, permissioned keys.
src/​lib/​agent/​contracts.ts	Adds access-level and multi-key contracts.
src/​lib/​agent/​openapi.ts	Defines the Agent API OpenAPI document.
src/​lib/​agent/​setup.ts	Generates secret-free read-only setup prompts.
src/​lib/​server/​agent-api-token.ts	Implements v2 domain-separated credentials.
src/​lib/​server/​agent-api-key-service.ts	Implements multi-key lifecycle operations.
src/​lib/​server/​agent-api-keys.ts	Exposes owner-authorized metadata listing.
src/​lib/​server/​agent-api-authorization.ts	Enforces key versions and write permissions.
src/​lib/​server/​agent-api-http.ts	Adds the insufficient-scope response.
src/​app/​actions/​agent-api-keys.ts	Validates and executes key management actions.
src/​app/​api/​agent/​v1/​openapi.json/​route.ts	Serves the public OpenAPI document.
src/​app/​api/​agent/​v1/​nodes/​route.ts	Requires write access for node creation.
src/​app/​api/​agent/​v1/​nodes/​[nodeId]/​timer/​route.ts	Requires write access for timer mutations.
src/​app/​page.tsx	Loads all keys for the selected node.
src/​components/​dashboard-shell.tsx	Displays multi-key status and opens management.
src/​components/​agent-access-dialog.tsx	Adds accessible multi-key management controls.
src/​app/​globals.css	Styles the expanded key-management interface.
tests/​unit/​agent-setup.test.ts	Tests secret-free setup prompts.
tests/​unit/​agent-openapi.test.ts	Tests OpenAPI coverage and serving.
tests/​integration/​schema.test.ts	Tests new credential constraints and indexing.
tests/​integration/​agent-api.test.ts	Tests read-only and legacy authorization.
tests/​integration/​agent-api-races.test.ts	Tests authorization mutation races.
tests/​integration/​agent-api-keys.test.ts	Tests multi-key lifecycle and token behavior.
tests/​integration/​agent-api-key-migration.test.ts	Tests deterministic legacy migration.
tests/​integration/​agent-api-key-actions.test.ts	Tests owner-facing multi-key actions.
tests/​e2e/​agent-access.spec.ts	Tests accessible multi-key dashboard workflows.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.