SUM-SEC-10 [P1][10/20][Med] API key expiry, scopes, and one-shot display hardening

[CHINMAYVIVEK]

ID: SUM-SEC-10
Wave: P1
Severity: Medium
Labels: security, api-key, P1, medium
Branch: fix/SUM-SEC-10-apikey-lifecycle-flash
Languages: Go
CWE: CWE-262 / CWE-522

Summary

Leaked sk_… is full user power until manual deactivate (no expires_at, scopes, or last_used_at). Creation flash embeds plaintext key in HTML (apikey_flash) — any XSS in the next ~120s steals it. Bearer auth correctly skips CSRF; hashing (SHA-256 of strong random) is fine.

Acceptance criteria

• Optional/required expires_at; reject expired keys in apikey.go
• Optional scopes (at least read vs write / model allowlist MVP)
• Update last_used_at; rate-limit failed key auth
• Never put raw key in shared shell flash HTML — dedicated one-shot page or clipboard-only masked UI; shorten TTL
• Tests for expiry + flash not containing raw key in general layout

Files to check / change

• sumeru/core/server/web/apikey.go
• sumeru/core/server/web/apikey_create.go
• sumeru/core/server/web/apikey_flash.go
• sumeru/core/server/web/page_flash.go
• sumeru/addons/base/models/ (apikey model if present)