User API keys always take precedence over server env keys
Owner decision (19/07/2026): a user's own BYO key must always take precedence over the server env key, reversing the env-first behaviour documented in the PR #25 review. - getUserApiKeys: user's decrypted key overrides the env key for every provider; env is the fallback. Decrypt failure keeps the env fallback. - getUserApiKeyStatus: source "user" whenever a user key exists (even if an env key is also set); else "env"; else unconfigured. - routes/user.ts PUT /user/api-keys/:provider: drop the hasEnvApiKey 409 block so users may always save/remove their own key; removal falls back to env (source "env"). MFA gating, try/catch, generic 500 unchanged. - Frontend api-keys page: server default is now informational, not a lock - field stays editable with copy explaining the user's key takes priority; existing Remove reverts to the server default. - Docs: CLAUDE.md env registry (provider-fallback + COMPANIES_HOUSE rows) and a BUILD_LOG entry noting the reversal + the rate-bucket consequence. - Tests: userApiKeys.test.ts covers precedence, env fallback, delete revert, decrypt-failure fallback, and status sources. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
| Repository | Sloth-ninja/JessicaOSS |
|---|---|
| Author | sloth-ninja <ezanahaddis@gmail.com> |
| Authored | |
| Parents | a7b5ede3 |
| Stats | 6 files changed , +262 , -20 |
| Part of | User API keys always take precedence over server env keys |
Capture this commit into my fork
Download a Markdown prompt that tells Claude how to port this
exact commit into your working tree. Run it via
claude -p < capture-commit-37c63d85.md
from inside the repo you want the change in.