mirror of
https://github.com/luxfi/kms.git
synced 2026-10-30 16:23:36 +00:00
zeekayandHanzo Dev
d052125f89
Against the live service, `?prefix=deploy&env=prod` returns 577 rows — the whole prod store — because `prefix` is not a parameter this endpoint knows and an unknown parameter was silently dropped. The caller asked one question and was answered a different, much wider one, with a 200. `prefix` is not a typo: it is the spelling both shipped first-party SDKs emit against this exact route (the Go kmsclient's httpList, and the generated hanzoai Python client). So it is now accepted as what it always meant — the subtree root, `path` — and that same request returns the 8 records under deploy. Segment boundary and all: `prefix=deploy` reaches deploy/ci and never deployfoo, so the legacy spelling can only ever narrow, never widen. `secretPath` and `environment` are dropped. They belong to the Infisical /api/v3 shape this server does not serve, nothing addresses this route with them, and keeping unused synonyms is how one value ends up with four names. A client sending them is talking to a different API and is better told so: the refusal names the offending key AND the accepted vocabulary, so one round trip corrects it. The route comments claimed the org-less door's tenant "is the TOKEN's". That was the reasoning that left the store open to every brand the shared IAM serves. Both doors gate on the same thing — whether the caller's own org authorizes this deployment's home org — and the comments now say so. Co-authored-by: Hanzo Dev <[email protected]>
2 lines
8 B
Plaintext
2 lines
8 B
Plaintext
1.12.16
|