hanzoai/cloud
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

deps: take ai v1.832.12, where an sk- key reaches IAM at all

Browse Source 
A valid, funded sk- key could not buy one token of inference. IAM resolved it
correctly — get-user?accessKey returned {"status":"ok","data":{"owner":…}} —
while POST /v1/chat/completions answered 401 "invalid API key" for the same key
in the same second.

Both answers were right. They were answering different questions, because the
inference path never asked IAM.

ai v1.832.10 is what this module pinned, and there isIAMApiKey(token) meant
strings.HasPrefix(token, "hk-"). Once hk- was retired estate-wide, IAM minted
only pk-/sk-, so every key a customer can hold missed that branch and fell to
the dispatch default — which read sk- as an UPSTREAM VENDOR key, looked it up in
the provider table, missed, and returned the bare authError("invalid API key").
The bare string with no ": %s" suffix is the fingerprint: it is the one refusal
on that path that carries no cause, because a provider-table miss has none to
give. IAM was never consulted, which is exactly why querying IAM directly
disagreed with the endpoint.

ai v1.832.11 fixed it by asking the STORE rather than the spelling: the provider
table first (an exact lookup, so it can never claim a key it does not hold), and
anything it misses is put to IAM, whose refusal names the cure where a provider
miss can only say "invalid". That fix has been tagged and unreachable since —
this module still pinned .10, and so did v1.801.375, so rolling that tag would
have shipped the same 401.

Nothing here weakens the door. The two shapes and their guards are unchanged and
still covered: pk- authenticates nothing (KeyWrongDoor, never a principal — it
ships in client JS), sk- keeps its same-tenant pin (KeyForeignUser still fires on
a cross-tenant reference), and an hk--shaped string is simply not a key and takes
the generic key_unknown path that renders "mint a new one at cloud.hanzo.ai/keys"
— no branch of its own, so the third family cannot come back.

Co-authored-by: Hanzo Dev <dev@hanzo.ai>
This commit is contained in:
antje
2026-08-02 14:31:29 -07:00
co-authored by hanzo-dev
parent 3b50091c77
commit d5d768f121
2 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
go.mod
+1 -1
View File
@@ -683,7 +683,7 @@ require (
github.com/hanzo-ds/go v1.0.1
github.com/hanzo-ds/native v0.72.0 // indirect
github.com/hanzoai/agent v0.1.3
github.com/hanzoai/ai v1.832.10
github.com/hanzoai/ai v1.832.12
github.com/hanzoai/authz v1.10.29
github.com/hanzoai/base v1.5.11
github.com/hanzoai/licensing v0.1.5
go.sum
+4
View File
@@ -993,6 +993,10 @@ github.com/hanzoai/agent v0.1.3 h1:zzV4t8kN/m/wTLrqzEy0fxxONSZbx3XSVH7TIR9gZNU=
github.com/hanzoai/agent v0.1.3/go.mod h1:Z3hCBdSeN/nGV4o+3F4psQ2bbFk17+tMP5l+G2ssNNA=
github.com/hanzoai/ai v1.832.10 h1:9hVYw8YOuTEFWFBpwIIMqi/nxGhCx/BlxCuPPhzKpZc=
github.com/hanzoai/ai v1.832.10/go.mod h1:Dr2pwcJxy+/4fitSPdVpJla56SjeWpPv9ofJY+ryQJU=
github.com/hanzoai/ai v1.832.11 h1:ttgETZqc1B4hLHs2i4ExRBjdnF8rzB1QHYrRm41SVZM=
github.com/hanzoai/ai v1.832.11/go.mod h1:Dr2pwcJxy+/4fitSPdVpJla56SjeWpPv9ofJY+ryQJU=
github.com/hanzoai/ai v1.832.12 h1:AeVUPAq0mWONyLPVdcevqmPZd7V42uLmp5KlfGa9twA=
github.com/hanzoai/ai v1.832.12/go.mod h1:Dr2pwcJxy+/4fitSPdVpJla56SjeWpPv9ofJY+ryQJU=
github.com/hanzoai/authz v1.10.29 h1:b4vWtI9g4Mvay1zizW7cwly/hDk06r+oAdA/y+317Do=
github.com/hanzoai/authz v1.10.29/go.mod h1:xkzFdiIFx4UQMlU0NkmSRz0dgRQYqSXpKgVjn8ijn3E=
github.com/hanzoai/base v1.5.11 h1:AZxGFPQN7sus/f5phZHoeC5pz7iNLDmwf1NoE/1hSvk=