(feat/partner-integrations) Rotate endpoint

[nickscamara]

Summary by cubic

Adds a secure endpoint for partner integrations to rotate a leaked API key. It deletes the old key and returns a new key for the same team and owner.

• New Features
  • POST /admin/integration/rotate-api-key
  • Auth via Bearer token; SHA-256 hash matched to integration key
  • Validates apiKey input and ensures the team belongs to the integration
  • Deletes the provided key and creates a new “Default” key
  • Responds with { apiKey } in FC format; returns 400/401/404/500 on errors

^{Written for commit 1c49a8c. Summary will update automatically on new commits.}

[cubic-dev-ai]

1 issue found across 2 files

Prompt for AI agents (all 1 issues)

Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="apps/api/src/controllers/v0/admin/rotate-api-key.ts">

<violation number="1" location="apps/api/src/controllers/v0/admin/rotate-api-key.ts:101">
P1: Non-atomic delete/insert creates data loss risk. If the insert fails after the delete succeeds, the user permanently loses their API key. Consider creating the new key first, then deleting the old one on success, or implementing a soft-delete/recovery mechanism.</violation>
</file>

_{Reply to cubic to teach it or ask questions. Re-run a review with @cubic-dev-ai review this PR}

[nickscamara]

@cubic re-run

[cubic-dev-ai]

@cubic re-run

@nickscamara I've started the AI code review. It'll take a few minutes to complete.

[cubic-dev-ai]

1 issue found across 2 files

Prompt for AI agents (all 1 issues)

Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="apps/api/src/controllers/v0/admin/rotate-api-key.ts">

<violation number="1" location="apps/api/src/controllers/v0/admin/rotate-api-key.ts:120">
P1: Security issue: When delete fails for a leaked API key, the endpoint still returns success. The caller will believe the leaked key was revoked when it remains active. Consider returning an error response or at least including a warning in the response body when the old key couldn&#39;t be deleted.</violation>
</file>

_{Reply to cubic to teach it or ask questions. Re-run a review with @cubic-dev-ai review this PR}