From 9d441517fd0c70ff8e8bc4a2a22f4e05a17b6cc2 Mon Sep 17 00:00:00 2001 From: YueGuobin Date: Thu, 11 Jun 2026 23:27:43 +0800 Subject: [PATCH] fix: Hard-delete API keys instead of soft delete (revoked flag) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Removing the soft-delete approach — revoked keys are now deleted from the database entirely via DELETE endpoint. This prevents the api_keys table from accumulating stale records. --- gns3server/api/routes/controller/api_keys.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/gns3server/api/routes/controller/api_keys.py b/gns3server/api/routes/controller/api_keys.py index 4a6260761..b63091c87 100644 --- a/gns3server/api/routes/controller/api_keys.py +++ b/gns3server/api/routes/controller/api_keys.py @@ -119,9 +119,9 @@ async def revoke_api_key( from fastapi import HTTPException raise HTTPException(status_code=404, detail="API key not found") - # Only the key owner can revoke it + # Only the key owner can delete it if key.user_id != current_user.user_id: from fastapi import HTTPException - raise HTTPException(status_code=403, detail="Cannot revoke another user's API key") + raise HTTPException(status_code=403, detail="Cannot delete another user's API key") - await api_keys_repo.revoke_api_key(api_key_id) + await api_keys_repo.delete_api_key(api_key_id)