Merge branch 'main' into security/frontend-cves

.github/aur/stirling-pdf-desktop/PKGBUILD

@@ -1,6 +1,6 @@
 # Maintainer: Stirling PDF Inc <contact@stirlingpdf.com>
 pkgname=stirling-pdf-desktop
-pkgver=2.14.2
+pkgver=2.14.1
 pkgrel=1
 pkgdesc="Locally hosted, web-based PDF manipulation tool (Tauri desktop app, official Stirling PDF Inc build)"
 arch=('x86_64')

.github/aur/stirling-pdf-server-bin/PKGBUILD

@@ -1,6 +1,6 @@
 # Maintainer: Stirling PDF Inc <contact@stirlingpdf.com>
 pkgname=stirling-pdf-server-bin
-pkgver=2.14.2
+pkgver=2.14.1
 pkgrel=1
 pkgdesc="Locally hosted, web-based PDF manipulation tool (server JAR, prebuilt)"
 arch=('any')

.github/workflows/multiOSReleases.yml

@@ -510,7 +510,6 @@ jobs:
       # cargo output unsigned, so checking it produces false negatives.
       - name: Verify Windows Code Signature
         if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master') }}
-        timeout-minutes: 15
         shell: pwsh
         run: |
           $allSigned = $true
@@ -532,26 +531,11 @@ jobs:
 
           # Extract MSI and verify the inner exe (the file that actually gets installed).
           # This is the critical check - AV flags the installed exe at runtime.
-          # Use lessmsi, not `msiexec /a`: msiexec serializes on the global
-          # _MSIExecute mutex and hangs forever on hosted runners when another
-          # installer is busy. lessmsi reads MSI tables directly - no mutex, no service.
           $msi = $msiFiles[0].FullName
           $extractDir = Join-Path $env:RUNNER_TEMP "msi-verify"
           if (Test-Path $extractDir) { Remove-Item $extractDir -Recurse -Force }
-          New-Item -ItemType Directory -Force -Path $extractDir | Out-Null
-
-          choco install lessmsi -y --no-progress --limit-output | Out-Null
-
-          # Bound the extraction and kill on hang (defence in depth over timeout-minutes).
-          $proc = Start-Process lessmsi -ArgumentList 'x', "`"$msi`"", "`"$extractDir\`"" -PassThru -NoNewWindow
-          if (-not $proc.WaitForExit(120000)) {
-            try { $proc.Kill() } catch {}
-            Write-Host "[ERROR] MSI extraction timed out after 120s"
-            $allSigned = $false
-          } elseif ($proc.ExitCode -ne 0) {
-            Write-Host "[ERROR] Failed to extract MSI for verification (exit code: $($proc.ExitCode))"
-            $allSigned = $false
-          } else {
+          $proc = Start-Process msiexec.exe -ArgumentList '/a', $msi, '/qn', "TARGETDIR=$extractDir" -Wait -PassThru -NoNewWindow
+          if ($proc.ExitCode -eq 0) {
             $innerExe = Get-ChildItem -Path $extractDir -Filter "stirling-pdf.exe" -Recurse -File | Select-Object -First 1
             if ($innerExe) {
               $sig = Get-AuthenticodeSignature -FilePath $innerExe.FullName
@@ -564,6 +548,9 @@ jobs:
               Write-Host "[ERROR] Could not find stirling-pdf.exe inside MSI"
               $allSigned = $false
             }
+          } else {
+            Write-Host "[ERROR] Failed to extract MSI for verification (exit code: $($proc.ExitCode))"
+            $allSigned = $false
           }
 
           if (-not $allSigned) {
@@ -813,11 +800,7 @@ jobs:
         uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
         with:
           tag_name: v${{ needs.determine-matrix.outputs.version }}
-          # Don't regenerate/append notes on re-runs, and don't force this into the
-          # "Latest" slot - leave the release body and latest marker as they are.
-          generate_release_notes: false
-          append_body: false
-          make_latest: false
+          generate_release_notes: true
           fail_on_unmatched_files: true
           # Installers + updater payloads + manifest. .sig contents are embedded
           # in latest.json so the .sig files themselves are not uploaded.

app/proprietary/src/main/java/stirling/software/proprietary/config/CustomAuditEventRepository.java

@@ -54,21 +54,10 @@ public class CustomAuditEventRepository implements AuditEventRepository {
                 return;
             }
             String rid = MDC.get("requestId");
-            String apiKeyLabel =
-                    MDC.get(
-                            stirling.software.proprietary.security.service
-                                    .ApiKeyAuthenticationService.AUDIT_LABEL_MDC_KEY);
 
-            if (rid != null || apiKeyLabel != null) {
+            if (rid != null) {
                 clean = new java.util.HashMap<>(clean);
-                if (rid != null) {
-                    clean.put("requestId", rid);
-                }
-                // Named key that made the request; surfaces as the doc source in the processor
-                // feed.
-                if (apiKeyLabel != null) {
-                    clean.put("__apiKeyLabel", apiKeyLabel);
-                }
+                clean.put("requestId", rid);
             }
 
             String source = MDC.get("auditSource");

app/proprietary/src/main/java/stirling/software/proprietary/controller/api/PortalApiKeysController.java

@@ -1,54 +0,0 @@
-package stirling.software.proprietary.controller.api;
-
-import org.springframework.http.ResponseEntity;
-import org.springframework.web.bind.annotation.DeleteMapping;
-import org.springframework.web.bind.annotation.GetMapping;
-import org.springframework.web.bind.annotation.PathVariable;
-import org.springframework.web.bind.annotation.PostMapping;
-import org.springframework.web.bind.annotation.RequestBody;
-import org.springframework.web.bind.annotation.RequestParam;
-
-import io.swagger.v3.oas.annotations.Operation;
-
-import lombok.RequiredArgsConstructor;
-
-import stirling.software.common.annotations.api.ProprietaryUiDataApi;
-import stirling.software.proprietary.model.api.apikey.CreateApiKeyRequest;
-import stirling.software.proprietary.model.api.apikey.CreatedApiKeyDto;
-import stirling.software.proprietary.model.api.apikey.PortalApiKeysResponse;
-import stirling.software.proprietary.security.service.ApiKeyManagementService;
-
-/**
- * Real backing for the portal Infrastructure → API Keys tab: list/create/revoke named, personal API
- * keys. Replaces the former portal-only mock endpoint. Not gated behind an Enterprise license - API
- * keys are a core auth feature available on every self-hosted instance.
- */
-@ProprietaryUiDataApi
-@RequiredArgsConstructor
-public class PortalApiKeysController {
-
-    private final ApiKeyManagementService apiKeyManagementService;
-
-    // tier accepted for endpoint symmetry with the other infra tabs; ignored here.
-    @GetMapping("/infrastructure/api-keys")
-    @Operation(summary = "List API keys", description = "The caller's personal API keys.")
-    public ResponseEntity<PortalApiKeysResponse> list(
-            @RequestParam(value = "tier", required = false) String tier) {
-        return ResponseEntity.ok(apiKeyManagementService.listVisibleKeys());
-    }
-
-    @PostMapping("/infrastructure/api-keys")
-    @Operation(
-            summary = "Create an API key",
-            description = "Mints a personal key and returns its one-time secret.")
-    public ResponseEntity<CreatedApiKeyDto> create(@RequestBody CreateApiKeyRequest request) {
-        return ResponseEntity.ok(apiKeyManagementService.createKey(request));
-    }
-
-    @DeleteMapping("/infrastructure/api-keys/{id}")
-    @Operation(summary = "Revoke an API key", description = "Disables a key the caller owns.")
-    public ResponseEntity<Void> revoke(@PathVariable("id") Long id) {
-        apiKeyManagementService.revokeKey(id);
-        return ResponseEntity.noContent().build();
-    }
-}

app/proprietary/src/main/java/stirling/software/proprietary/integration/service/IntegrationConfigService.java

@@ -43,10 +43,6 @@ public class IntegrationConfigService {
     private final OwnershipService ownership;
     private final SecretMasker secretMasker;
     private final ResourceGrantRepository grantRepository;
-    // Bean-discovered extension points: features that understand a type contribute its config
-    // schema and report what still references a config, without this module depending on them.
-    private final List<IntegrationConfigValidator> validators;
-    private final List<IntegrationConfigUsageCheck> usageChecks;
 
     // ---- commands ----
 
@@ -70,21 +66,13 @@ public class IntegrationConfigService {
                         ? DefaultAccessPolicy.EXPLICIT_ONLY
                         : request.defaultAccess());
 
-        // TEAM scope may omit the team id: default to the caller's own team so clients (the
-        // portal) need not know it. assignOwnership still enforces admin-or-leader of that team.
-        Long ownerTeamId = request.ownerTeamId();
-        if (ownerTeamId == null && scope == OwnerScope.TEAM && currentUser.getTeam() != null) {
-            ownerTeamId = currentUser.getTeam().getId();
-        }
         ownership.assignOwnership(
                 cfg,
                 scope,
-                ownerTeamId,
+                request.ownerTeamId(),
                 currentUser,
                 () -> lockedServerExists(cfg.getIntegrationType()));
-        Map<String, Object> config = secretMasker.sanitize(request.config());
-        validateConfig(cfg.getIntegrationType(), config);
-        cfg.setConfig(writeJson(config));
+        cfg.setConfig(writeJson(secretMasker.sanitize(request.config())));
         return repository.save(cfg);
     }
 
@@ -113,10 +101,8 @@ public class IntegrationConfigService {
             cfg.setDefaultAccess(request.defaultAccess());
         }
         if (request.config() != null) {
-            Map<String, Object> merged =
-                    secretMasker.merge(readJson(cfg.getConfig()), request.config());
-            validateConfig(cfg.getIntegrationType(), merged);
-            cfg.setConfig(writeJson(merged));
+            cfg.setConfig(
+                    writeJson(secretMasker.merge(readJson(cfg.getConfig()), request.config())));
         }
         return repository.save(cfg);
     }
@@ -127,15 +113,6 @@ public class IntegrationConfigService {
         if (!ownership.canManage(TYPE, cfg, currentUser)) {
             throw forbidden("You cannot manage this integration");
         }
-        // Refuse to pull a connection out from under whatever still references it.
-        List<String> usages =
-                usageChecks.stream()
-                        .flatMap(check -> check.usagesOf(cfg.getId()).stream())
-                        .toList();
-        if (!usages.isEmpty()) {
-            throw new ResponseStatusException(
-                    HttpStatus.CONFLICT, "Integration is in use by: " + String.join(", ", usages));
-        }
         // Drop grants sharing this config so they do not dangle as dead rows.
         grantRepository.deleteByResourceTypeAndResourceId(TYPE, String.valueOf(cfg.getId()));
         repository.delete(cfg);
@@ -211,19 +188,6 @@ public class IntegrationConfigService {
 
     // ---- integration-specific glue ----
 
-    /** Runs every registered validator for the type; unknown types save free-form. */
-    private void validateConfig(IntegrationType type, Map<String, Object> config) {
-        for (IntegrationConfigValidator validator : validators) {
-            if (validator.type() == type) {
-                try {
-                    validator.validate(config == null ? Map.of() : config);
-                } catch (IllegalArgumentException e) {
-                    throw new ResponseStatusException(HttpStatus.BAD_REQUEST, e.getMessage());
-                }
-            }
-        }
-    }
-
     /** A non-admin can't create a personal config of a type an admin has locked at server scope. */
     private boolean lockedServerExists(IntegrationType type) {
         return repository.findByScope(OwnerScope.SERVER).stream()

app/proprietary/src/main/java/stirling/software/proprietary/integration/service/IntegrationConfigUsageCheck.java

@@ -1,15 +0,0 @@
-package stirling.software.proprietary.integration.service;
-
-import java.util.List;
-
-/**
- * Reports what still references an integration config, so deletion can be refused instead of
- * pulling a connection out from under a live consumer. Implementations are beans discovered by
- * {@link IntegrationConfigService} (e.g. the policy subsystem reporting sources and pipelines that
- * reference a connection).
- */
-public interface IntegrationConfigUsageCheck {
-
-    /** Human-readable labels of everything still using the config; empty when unreferenced. */
-    List<String> usagesOf(long configId);
-}

app/proprietary/src/main/java/stirling/software/proprietary/integration/service/IntegrationConfigValidator.java

@@ -1,23 +0,0 @@
-package stirling.software.proprietary.integration.service;
-
-import java.util.Map;
-
-import stirling.software.proprietary.integration.model.IntegrationType;
-
-/**
- * Validates one integration type's config map at save time. Implementations are beans discovered by
- * {@link IntegrationConfigService}, so the feature that understands a type (e.g. the policy S3
- * backend) owns its schema without the integration module depending on it. Types with no registered
- * validator save free-form.
- */
-public interface IntegrationConfigValidator {
-
-    /** The type this validator understands. */
-    IntegrationType type();
-
-    /**
-     * Validates the config as it will be stored (secrets already sanitized/merged, so values are
-     * real, never the redaction mask). Throws {@link IllegalArgumentException} on bad config.
-     */
-    void validate(Map<String, Object> config);
-}

app/proprietary/src/main/java/stirling/software/proprietary/mcp/security/McpApiKeyAuthFilter.java

@@ -24,8 +24,8 @@ import stirling.software.proprietary.security.model.User;
 import stirling.software.proprietary.security.service.UserService;
 
 /**
- * API-key auth for the MCP endpoint: validates a Stirling API key and binds the request to that
- * user with the MCP scopes.
+ * API-key auth for the MCP endpoint: validates a Stirling per-user API key and binds the request to
+ * that user with the MCP scopes.
  */
 @Slf4j
 public class McpApiKeyAuthFilter extends OncePerRequestFilter {

app/proprietary/src/main/java/stirling/software/proprietary/model/api/apikey/CreateApiKeyRequest.java

@@ -1,4 +0,0 @@
-package stirling.software.proprietary.model.api.apikey;
-
-/** Create-key request body from the portal: just a display name for the new personal key. */
-public record CreateApiKeyRequest(String name) {}

app/proprietary/src/main/java/stirling/software/proprietary/model/api/apikey/CreatedApiKeyDto.java

@@ -1,7 +0,0 @@
-package stirling.software.proprietary.model.api.apikey;
-
-import lombok.Builder;
-
-/** Returned once when a key is created: the row plus the plaintext secret, never persisted. */
-@Builder
-public record CreatedApiKeyDto(PortalApiKeyDto key, String secret) {}

app/proprietary/src/main/java/stirling/software/proprietary/model/api/apikey/PortalApiKeyDto.java

@@ -1,21 +0,0 @@
-package stirling.software.proprietary.model.api.apikey;
-
-import lombok.Builder;
-
-/**
- * One API key as shown in the portal Infrastructure → API Keys tab. Never carries the secret; that
- * is returned once from {@link CreatedApiKeyDto} at creation time.
- */
-@Builder
-public record PortalApiKeyDto(
-        String id,
-        String name,
-        String prefix,
-        String created,
-        String lastUsed,
-        /** "active" | "revoked". */
-        String status,
-        long usageToday,
-        long usageMonth,
-        /** Lifetime request count for the key. */
-        long usageTotal) {}

app/proprietary/src/main/java/stirling/software/proprietary/model/api/apikey/PortalApiKeysResponse.java

@@ -1,9 +0,0 @@
-package stirling.software.proprietary.model.api.apikey;
-
-import java.util.List;
-
-import lombok.Builder;
-
-/** Payload for the API Keys tab: the personal keys the caller owns. */
-@Builder
-public record PortalApiKeysResponse(List<PortalApiKeyDto> keys) {}

app/proprietary/src/main/java/stirling/software/proprietary/policy/controller/PolicyController.java

@@ -120,7 +120,6 @@ public class PolicyController {
             throws IOException {
         stampPolicyAudit(definition);
         requireRunnable(definition);
-        validateAdHocOutput(definition);
         PolicyInputs inputs = toInputs(files);
         PolicyRunHandle handle =
                 policyRunner.runAdHoc(definition, inputs, PolicyProgressListener.NOOP);
@@ -141,7 +140,6 @@ public class PolicyController {
             throws IOException {
         stampPolicyAudit(definition);
         requireRunnable(definition);
-        validateAdHocOutput(definition);
         PolicyInputs inputs = toInputs(files);
 
         SseEmitter emitter =
@@ -532,24 +530,6 @@ public class PolicyController {
         }
     }
 
-    /**
-     * Authorization-check an ad-hoc run's output while the caller's principal is present (this
-     * request thread). The worker thread that later delivers carries no security context, so an S3
-     * output's connection-access check would be skipped there; without this gate a caller could
-     * reference another tenant's connection by id and write to it (confused deputy). Stored
-     * policies are covered by save-time {@link PolicyValidator#validate} instead.
-     */
-    private void validateAdHocOutput(PipelineDefinition definition) {
-        if (definition.output() == null) {
-            return;
-        }
-        try {
-            policyValidator.validateOutput(definition.output());
-        } catch (IllegalArgumentException e) {
-            throw new ResponseStatusException(HttpStatus.BAD_REQUEST, e.getMessage());
-        }
-    }
-
     /**
      * Ad-hoc runs (AI / one-off pipelines) are still editor activity, so their supplied documents
      * feed the same virtual editor source as stored editor policies, counted against the caller's

app/proprietary/src/main/java/stirling/software/proprietary/policy/engine/PolicyValidator.java

@@ -52,19 +52,7 @@ public class PolicyValidator {
             InputSpec spec = source.toInputSpec();
             inputSourceFor(spec).validate(spec);
         }
-        validateOutput(policy.output());
-    }
-
-    /**
-     * Validate an output spec against its sink. Must be called on a request thread (caller's
-     * principal present) so an S3 output's connection is authorization-checked against the caller -
-     * ad-hoc runs are never persisted and so never hit {@link #validate(Policy)}, and the worker
-     * thread that later delivers has no principal, so this is their only access gate.
-     *
-     * @throws IllegalArgumentException if the type is unknown or the config is invalid/inaccessible
-     */
-    public void validateOutput(OutputSpec output) {
-        outputSinkFor(output).validate(output);
+        outputSinkFor(policy.output()).validate(policy.output());
     }
 
     private PolicyTrigger triggerFor(TriggerConfig config) {

app/proprietary/src/main/java/stirling/software/proprietary/policy/input/S3InputSource.java

@@ -18,7 +18,6 @@ import stirling.software.proprietary.policy.model.InputSpec;
 import stirling.software.proprietary.policy.model.PolicyInputs;
 import stirling.software.proprietary.policy.s3.S3Config;
 import stirling.software.proprietary.policy.s3.S3ConnectionPool;
-import stirling.software.proprietary.policy.s3.S3ConnectionResolver;
 import stirling.software.proprietary.policy.s3.S3Identities;
 
 import software.amazon.awssdk.core.exception.SdkException;
@@ -37,14 +36,15 @@ import software.amazon.awssdk.services.s3.model.S3Object;
  * Reads input files from an Amazon S3 (or S3-compatible) bucket; each listed object is its own unit
  * of work, claimed through the {@link ResolveContext} ledger and tracked in place. Identity and
  * version gate come from {@link S3Identities}, so the steady-state sweep never downloads content.
- * Options: "connectionId" references the stored S3 connection (an {@code IntegrationConfig} owning
- * bucket, region, endpoint, and credentials - resolved by {@link S3ConnectionResolver}); "prefix"
- * (only keys starting with it are read) and "mode" are per-source, where mode is "consume"
- * (default: a processed object is deleted once every policy that claimed it has settled
- * successfully and it is still the version that ran; failures stay in place and are not retried
- * until they change) or "snapshot" (stateless, every run sees the full set). Keys ending in "/"
- * (folder placeholders) and keys with a dot-prefixed path segment are never picked up, mirroring
- * the folder source's hidden-file rule.
+ * Options (see {@link S3Config}): "bucket" (required), "region" (default us-east-1), "prefix" (only
+ * keys starting with it are read), "endpoint" (S3-compatible stores such as MinIO; path-style
+ * addressing is used automatically), "accessKeyId" and "secretAccessKey" (required; requests are
+ * never signed with the server's own AWS identity), and "mode" which is "consume" (default: a
+ * processed object is deleted once every policy that claimed it has settled successfully and it is
+ * still the version that ran; failures stay in place and are not retried until they change) or
+ * "snapshot" (stateless, every run sees the full set). Keys ending in "/" (folder placeholders) and
+ * keys with a dot-prefixed path segment are never picked up, mirroring the folder source's
+ * hidden-file rule.
  */
 @Slf4j
 @Service
@@ -55,7 +55,6 @@ public class S3InputSource implements InputSource {
     private static final String TYPE = "s3";
 
     private final S3ConnectionPool connectionPool;
-    private final S3ConnectionResolver connectionResolver;
 
     @Override
     public String type() {
@@ -68,12 +67,12 @@ public class S3InputSource implements InputSource {
     }
 
     /**
-     * Fails fast at save time: an unknown/disabled/unusable connection, bad config shape, a private
-     * endpoint without the operator opt-in, or a bucket the connection cannot list.
+     * Fails fast at save time: bad config shape, a private endpoint without the operator opt-in, or
+     * a bucket the supplied credentials cannot list.
      */
     @Override
     public void validate(InputSpec spec) {
-        S3Config config = connectionResolver.resolve(spec.options());
+        S3Config config = S3Config.from(spec.options());
         try {
             connectionPool.clientFor(config).listObjectsV2(listRequest(config).maxKeys(1).build());
         } catch (SdkException e) {
@@ -90,7 +89,7 @@ public class S3InputSource implements InputSource {
 
     @Override
     public List<ResolvedInput> resolve(InputSpec spec, ResolveContext ctx) throws IOException {
-        S3Config config = connectionResolver.resolve(spec.options());
+        S3Config config = S3Config.from(spec.options());
         S3Client client = connectionPool.clientFor(config);
         // A listing failure propagates so the sweep reads it as "could not list" (which vetoes
         // presence cleanup), never as "verifiably no objects".

app/proprietary/src/main/java/stirling/software/proprietary/policy/output/S3OutputSink.java

@@ -27,7 +27,6 @@ import stirling.software.proprietary.policy.ledger.ProcessedLedger;
 import stirling.software.proprietary.policy.model.OutputSpec;
 import stirling.software.proprietary.policy.s3.S3Config;
 import stirling.software.proprietary.policy.s3.S3ConnectionPool;
-import stirling.software.proprietary.policy.s3.S3ConnectionResolver;
 import stirling.software.proprietary.policy.s3.S3Identities;
 
 import software.amazon.awssdk.core.exception.SdkException;
@@ -60,7 +59,6 @@ public class S3OutputSink implements PolicyOutputSink {
     private static final String TYPE = "s3";
 
     private final S3ConnectionPool connectionPool;
-    private final S3ConnectionResolver connectionResolver;
     private final ProcessedLedger processedLedger;
 
     @Override
@@ -74,19 +72,19 @@ public class S3OutputSink implements PolicyOutputSink {
     }
 
     /**
-     * Connection resolution (including the saving user's right to use it) and endpoint guard only -
-     * no network probe, since write-only credentials (s3:PutObject without s3:ListBucket) are a
-     * legitimate setup for an output bucket and a listing probe would wrongly reject them.
+     * Config shape and endpoint guard only - no network probe, since write-only credentials
+     * (s3:PutObject without s3:ListBucket) are a legitimate setup for an output bucket and a
+     * listing probe would wrongly reject them.
      */
     @Override
     public void validate(OutputSpec spec) {
-        connectionPool.clientFor(connectionResolver.resolve(spec.options()));
+        connectionPool.clientFor(S3Config.from(spec.options()));
     }
 
     @Override
     public List<ResultFile> deliver(
             OutputDelivery delivery, List<Resource> outputs, OutputSpec spec) throws IOException {
-        S3Config config = connectionResolver.resolve(spec.options());
+        S3Config config = S3Config.from(spec.options());
         S3Client client = connectionPool.clientFor(config);
 
         List<ResultFile> results = new ArrayList<>();

app/proprietary/src/main/java/stirling/software/proprietary/policy/s3/EmbeddedS3CredentialMigration.java

@@ -1,212 +0,0 @@
-package stirling.software.proprietary.policy.s3;
-
-import java.util.LinkedHashMap;
-import java.util.List;
-import java.util.Map;
-
-import org.springframework.boot.autoconfigure.condition.ConditionalOnBooleanProperty;
-import org.springframework.boot.context.event.ApplicationReadyEvent;
-import org.springframework.context.event.EventListener;
-import org.springframework.stereotype.Component;
-import org.springframework.transaction.annotation.Transactional;
-
-import lombok.RequiredArgsConstructor;
-import lombok.extern.slf4j.Slf4j;
-
-import stirling.software.proprietary.access.model.DefaultAccessPolicy;
-import stirling.software.proprietary.access.model.OwnerScope;
-import stirling.software.proprietary.integration.model.IntegrationConfig;
-import stirling.software.proprietary.integration.model.IntegrationType;
-import stirling.software.proprietary.integration.repository.IntegrationConfigRepository;
-import stirling.software.proprietary.model.Team;
-import stirling.software.proprietary.policy.model.OutputSpec;
-import stirling.software.proprietary.policy.model.Policy;
-import stirling.software.proprietary.policy.source.Source;
-import stirling.software.proprietary.policy.source.SourceStore;
-import stirling.software.proprietary.policy.store.PolicyStore;
-import stirling.software.proprietary.security.repository.TeamRepository;
-
-import tools.jackson.databind.ObjectMapper;
-
-/**
- * One-time, idempotent extraction of legacy embedded S3 credentials into stored connections:
- * sources and policy outputs written before connections shipped carry bucket/credentials in their
- * own options; this rewrites each to reference a (deduplicated) S3 {@link IntegrationConfig} and
- * keeps only per-use options (prefix, mode). MUST be programmatic - the option JSON is encrypted at
- * the application layer, so no SQL migration can read it.
- *
- * <p>Idempotent by construction: rewritten rows no longer embed credentials, so re-runs find
- * nothing to do. Connections are deduplicated against both this run's extractions and existing S3
- * connections; a concurrent multi-node boot can at worst create a redundant connection row, never
- * corrupt a source. Ownership follows the owning row: team-scoped when the source/policy has a
- * team, server-scoped otherwise (single-operator self-hosted).
- */
-@Slf4j
-@Component
-@RequiredArgsConstructor
-@ConditionalOnBooleanProperty(name = "policies.enabled")
-public class EmbeddedS3CredentialMigration {
-
-    private static final ObjectMapper OBJECT_MAPPER = new ObjectMapper();
-    private static final List<String> CONNECTION_OPTIONS =
-            List.of("bucket", "region", "endpoint", "accessKeyId", "secretAccessKey");
-    // Field separator for the dedup key: a unit-separator control char that cannot appear in a
-    // bucket/region/endpoint/credential, so distinct field sets can never collide.
-    private static final char DELIMITER = '\u001f';
-
-    private final SourceStore sourceStore;
-    private final PolicyStore policyStore;
-    private final IntegrationConfigRepository connections;
-    private final TeamRepository teamRepository;
-
-    @EventListener(ApplicationReadyEvent.class)
-    @Transactional
-    public void migrate() {
-        Map<String, IntegrationConfig> byCredentialKey = indexExistingConnections();
-        int migrated = 0;
-        for (Source source : sourceStore.all()) {
-            if (!"s3".equals(source.type()) || !embedsCredentials(source.options())) {
-                continue;
-            }
-            IntegrationConfig connection =
-                    connectionFor(source.options(), source.teamId(), byCredentialKey);
-            sourceStore.save(withOptions(source, referencing(connection, source.options(), true)));
-            migrated++;
-        }
-        for (Policy policy : policyStore.all()) {
-            OutputSpec output = policy.output();
-            if (!"s3".equals(output.type()) || !embedsCredentials(output.options())) {
-                continue;
-            }
-            IntegrationConfig connection =
-                    connectionFor(output.options(), policy.teamId(), byCredentialKey);
-            policyStore.save(
-                    withOutput(
-                            policy,
-                            new OutputSpec(
-                                    output.type(),
-                                    referencing(connection, output.options(), false))));
-            migrated++;
-        }
-        if (migrated > 0) {
-            log.info("Extracted embedded S3 credentials from {} row(s) into connections", migrated);
-        }
-    }
-
-    private static boolean embedsCredentials(Map<String, Object> options) {
-        return options.get("accessKeyId") != null;
-    }
-
-    /** Reuses an existing connection with identical coordinates+credentials, else creates one. */
-    private IntegrationConfig connectionFor(
-            Map<String, Object> options, Long teamId, Map<String, IntegrationConfig> byKey) {
-        String key = credentialKey(options);
-        IntegrationConfig existing = byKey.get(key);
-        if (existing != null) {
-            return existing;
-        }
-        IntegrationConfig connection = new IntegrationConfig();
-        connection.setIntegrationType(IntegrationType.S3);
-        connection.setName(connectionName(options, byKey));
-        connection.setEnabled(true);
-        connection.setLocked(false);
-        connection.setDefaultAccess(DefaultAccessPolicy.EXPLICIT_ONLY);
-        Team team = teamId == null ? null : teamRepository.findById(teamId).orElse(null);
-        if (team != null) {
-            connection.setScope(OwnerScope.TEAM);
-            connection.setOwnerTeam(team);
-        } else {
-            // No team (teamless self-hosted, or a source whose team was since deleted): server
-            // scope, i.e. admin-owned. An orphaned-team source's non-admin editor would then need
-            // an admin to re-share the connection - acceptable for the narrow orphaned case.
-            connection.setScope(OwnerScope.SERVER);
-        }
-        Map<String, Object> config = new LinkedHashMap<>();
-        for (String option : CONNECTION_OPTIONS) {
-            Object value = options.get(option);
-            if (value != null && !value.toString().isBlank()) {
-                config.put(option, value);
-            }
-        }
-        connection.setConfig(OBJECT_MAPPER.writeValueAsString(config));
-        IntegrationConfig saved = connections.save(connection);
-        byKey.put(key, saved);
-        return saved;
-    }
-
-    /** The rewritten options: the connection reference plus per-use settings only. */
-    private static Map<String, Object> referencing(
-            IntegrationConfig connection, Map<String, Object> legacy, boolean keepMode) {
-        Map<String, Object> options = new LinkedHashMap<>();
-        options.put(S3ConnectionResolver.CONNECTION_ID_OPTION, connection.getId());
-        Object prefix = legacy.get("prefix");
-        if (prefix != null && !prefix.toString().isBlank()) {
-            options.put("prefix", prefix);
-        }
-        Object mode = legacy.get("mode");
-        if (keepMode && mode != null && !mode.toString().isBlank()) {
-            options.put("mode", mode);
-        }
-        return options;
-    }
-
-    private Map<String, IntegrationConfig> indexExistingConnections() {
-        Map<String, IntegrationConfig> byKey = new LinkedHashMap<>();
-        for (IntegrationConfig connection : connections.findAll()) {
-            if (connection.getIntegrationType() != IntegrationType.S3) {
-                continue;
-            }
-            try {
-                Map<String, Object> config =
-                        OBJECT_MAPPER.readValue(connection.getConfig(), Map.class);
-                byKey.putIfAbsent(credentialKey(config), connection);
-            } catch (Exception e) {
-                log.debug(
-                        "Skipping unreadable S3 connection {} while indexing: {}",
-                        connection.getId(),
-                        e.getMessage());
-            }
-        }
-        return byKey;
-    }
-
-    private static String credentialKey(Map<String, Object> options) {
-        StringBuilder key = new StringBuilder();
-        for (String option : CONNECTION_OPTIONS) {
-            Object value = options.get(option);
-            key.append(value == null ? "" : value.toString().trim()).append(DELIMITER);
-        }
-        return key.toString();
-    }
-
-    private static String connectionName(
-            Map<String, Object> options, Map<String, IntegrationConfig> byKey) {
-        String base = "S3: " + options.getOrDefault("bucket", "bucket");
-        long sameName = byKey.values().stream().filter(c -> c.getName().startsWith(base)).count();
-        return sameName == 0 ? base : base + " (" + (sameName + 1) + ")";
-    }
-
-    private static Source withOptions(Source source, Map<String, Object> options) {
-        return new Source(
-                source.id(),
-                source.name(),
-                source.type(),
-                options,
-                source.enabled(),
-                source.owner(),
-                source.teamId());
-    }
-
-    private static Policy withOutput(Policy policy, OutputSpec output) {
-        return new Policy(
-                policy.id(),
-                policy.name(),
-                policy.owner(),
-                policy.enabled(),
-                policy.trigger(),
-                policy.sourceIds(),
-                policy.steps(),
-                output,
-                policy.teamId());
-    }
-}

app/proprietary/src/main/java/stirling/software/proprietary/policy/s3/PolicyS3ConnectionUsageCheck.java

@@ -1,56 +0,0 @@
-package stirling.software.proprietary.policy.s3;
-
-import java.util.ArrayList;
-import java.util.List;
-import java.util.Map;
-
-import org.springframework.boot.autoconfigure.condition.ConditionalOnBooleanProperty;
-import org.springframework.stereotype.Component;
-
-import lombok.RequiredArgsConstructor;
-
-import stirling.software.proprietary.integration.service.IntegrationConfigUsageCheck;
-import stirling.software.proprietary.policy.model.Policy;
-import stirling.software.proprietary.policy.source.Source;
-import stirling.software.proprietary.policy.source.SourceStore;
-import stirling.software.proprietary.policy.store.PolicyStore;
-
-/**
- * Reports the policy sources and pipeline outputs referencing an S3 connection, so the connection
- * cannot be deleted out from under them (mirrors {@code SourceController}'s referenced-source
- * delete guard). Scans in memory - fine at admin-dashboard scale, always consistent with the live
- * stores.
- */
-@Component
-@RequiredArgsConstructor
-@ConditionalOnBooleanProperty(name = "policies.enabled")
-public class PolicyS3ConnectionUsageCheck implements IntegrationConfigUsageCheck {
-
-    private final SourceStore sourceStore;
-    private final PolicyStore policyStore;
-
-    @Override
-    public List<String> usagesOf(long configId) {
-        List<String> usages = new ArrayList<>();
-        for (Source source : sourceStore.all()) {
-            if (references(source.options(), configId)) {
-                usages.add("source '" + source.name() + "'");
-            }
-        }
-        for (Policy policy : policyStore.all()) {
-            if (references(policy.output().options(), configId)) {
-                usages.add("pipeline '" + policy.name() + "'");
-            }
-        }
-        return usages;
-    }
-
-    private static boolean references(Map<String, Object> options, long configId) {
-        try {
-            Long reference = S3ConnectionResolver.connectionId(options);
-            return reference != null && reference == configId;
-        } catch (IllegalArgumentException unparseable) {
-            return false;
-        }
-    }
-}

app/proprietary/src/main/java/stirling/software/proprietary/policy/s3/S3Config.java

@@ -5,12 +5,10 @@ import java.net.URISyntaxException;
 import java.util.Map;
 
 /**
- * The fully resolved connection settings the S3 input source and output sink run with - normally
- * produced by {@link S3ConnectionResolver} merging a stored connection (bucket, region, endpoint,
- * credentials) with per-use options (prefix, mode), or parsed directly from legacy options that
- * still embed credentials. Credentials are required: there is deliberately no fallback to the
- * server's own AWS credential chain, so user-supplied config can never borrow the host's identity.
- * {@code snapshot} is input-only and ignored by the sink.
+ * Connection settings shared by the S3 input source and output sink, parsed from a spec's options
+ * map. Credentials are required: there is deliberately no fallback to the server's own AWS
+ * credential chain, so user-supplied config can never borrow the host's identity. {@code snapshot}
+ * is input-only and ignored by the sink.
  */
 public record S3Config(
         String bucket,

app/proprietary/src/main/java/stirling/software/proprietary/policy/s3/S3ConnectionResolver.java

@@ -1,151 +0,0 @@
-package stirling.software.proprietary.policy.s3;
-
-import java.util.LinkedHashMap;
-import java.util.Map;
-
-import org.springframework.boot.autoconfigure.condition.ConditionalOnBooleanProperty;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.core.context.SecurityContextHolder;
-import org.springframework.security.core.userdetails.UserDetails;
-import org.springframework.stereotype.Service;
-import org.springframework.transaction.annotation.Transactional;
-
-import lombok.RequiredArgsConstructor;
-import lombok.extern.slf4j.Slf4j;
-
-import stirling.software.proprietary.access.model.ResourceType;
-import stirling.software.proprietary.access.service.OwnershipService;
-import stirling.software.proprietary.integration.model.IntegrationConfig;
-import stirling.software.proprietary.integration.model.IntegrationType;
-import stirling.software.proprietary.integration.repository.IntegrationConfigRepository;
-import stirling.software.proprietary.security.model.User;
-import stirling.software.proprietary.security.service.UserService;
-
-import tools.jackson.core.type.TypeReference;
-import tools.jackson.databind.ObjectMapper;
-
-/**
- * Turns a source's or output's options into a full {@link S3Config} by dereferencing its {@code
- * connectionId} to a stored S3 {@link IntegrationConfig} (the connection owns bucket, region,
- * endpoint, and credentials; the options own per-use settings such as prefix and mode). Options
- * with no {@code connectionId} fall back to legacy embedded credentials, so rows written before
- * connections shipped keep working until {@link EmbeddedS3CredentialMigration} rewrites them.
- *
- * <p>When an authenticated caller is present (save-time validation), they must be allowed to use
- * the connection. Background sweeps and deliveries run with no caller and skip that check: the
- * referencing source or policy was access-checked when it was saved.
- */
-@Slf4j
-@Service
-@RequiredArgsConstructor
-@Transactional(readOnly = true)
-@ConditionalOnBooleanProperty(name = "policies.enabled")
-public class S3ConnectionResolver {
-
-    static final String CONNECTION_ID_OPTION = "connectionId";
-    private static final String PREFIX_OPTION = "prefix";
-    private static final String MODE_OPTION = "mode";
-    private static final ObjectMapper OBJECT_MAPPER = new ObjectMapper();
-
-    private final IntegrationConfigRepository connections;
-    private final OwnershipService ownership;
-    private final UserService userService;
-
-    public S3Config resolve(Map<String, Object> options) {
-        Long connectionId = connectionId(options);
-        if (connectionId == null) {
-            // Legacy embedded credentials, pending migration.
-            return S3Config.from(options);
-        }
-        IntegrationConfig connection =
-                connections
-                        .findById(connectionId)
-                        .filter(cfg -> cfg.getIntegrationType() == IntegrationType.S3)
-                        .filter(this::usableByCurrentUser)
-                        // Existence and access collapse into one error: a caller must not be able
-                        // to tell "no such connection" from "someone else's connection" and
-                        // enumerate ids. The id/name are never echoed.
-                        .orElseThrow(
-                                () ->
-                                        new IllegalArgumentException(
-                                                "unknown or inaccessible s3 connection"));
-        if (!connection.isEnabled()) {
-            throw new IllegalArgumentException("s3 connection is disabled");
-        }
-        Map<String, Object> merged = new LinkedHashMap<>(connectionConfig(connection));
-        copyPerUseOption(options, merged, PREFIX_OPTION);
-        copyPerUseOption(options, merged, MODE_OPTION);
-        return S3Config.from(merged);
-    }
-
-    /** The {@code connectionId} option as a long, or null when the options are legacy-embedded. */
-    static Long connectionId(Map<String, Object> options) {
-        Object reference = options.get(CONNECTION_ID_OPTION);
-        if (reference == null || (reference instanceof String s && s.isBlank())) {
-            return null;
-        }
-        if (reference instanceof Number number) {
-            return number.longValue();
-        }
-        try {
-            return Long.valueOf(reference.toString().trim());
-        } catch (NumberFormatException e) {
-            throw new IllegalArgumentException(
-                    "s3 'connectionId' is not a valid connection reference: " + reference);
-        }
-    }
-
-    /**
-     * Whether the current caller may use this connection. With no principal - a background sweep or
-     * delivery on a worker thread that carries no {@code SecurityContext} - access is treated as
-     * already established: stored policies are validated with the caller present at save time, and
-     * ad-hoc runs are validated on the request thread before dispatch (see {@code
-     * PolicyValidator#validateOutput}). A missing principal must therefore never be the ONLY thing
-     * standing between a caller and a connection, or the check becomes a confused deputy.
-     */
-    private boolean usableByCurrentUser(IntegrationConfig connection) {
-        User user = currentUser();
-        return user == null || ownership.canUse(ResourceType.INTEGRATION_CONFIG, connection, user);
-    }
-
-    // Mirrors ResourceAccessSecurity's principal resolution; null when unauthenticated.
-    private User currentUser() {
-        Authentication auth = SecurityContextHolder.getContext().getAuthentication();
-        if (auth == null || !auth.isAuthenticated()) {
-            return null;
-        }
-        Object principal = auth.getPrincipal();
-        if (principal instanceof User user) {
-            return user;
-        }
-        if (principal instanceof UserDetails userDetails) {
-            return userService.findByUsername(userDetails.getUsername()).orElse(null);
-        }
-        if (principal instanceof String username && !"anonymousUser".equals(username)) {
-            return userService.findByUsername(username).orElse(null);
-        }
-        return null;
-    }
-
-    private static Map<String, Object> connectionConfig(IntegrationConfig connection) {
-        String json = connection.getConfig();
-        if (json == null || json.isBlank()) {
-            return Map.of();
-        }
-        try {
-            return OBJECT_MAPPER.readValue(
-                    json, new TypeReference<LinkedHashMap<String, Object>>() {});
-        } catch (Exception e) {
-            throw new IllegalArgumentException(
-                    "s3 connection '" + connection.getName() + "' has unreadable config", e);
-        }
-    }
-
-    private static void copyPerUseOption(
-            Map<String, Object> options, Map<String, Object> merged, String key) {
-        Object value = options.get(key);
-        if (value != null && !value.toString().isBlank()) {
-            merged.put(key, value);
-        }
-    }
-}

app/proprietary/src/main/java/stirling/software/proprietary/policy/s3/S3IntegrationValidator.java

@@ -1,51 +0,0 @@
-package stirling.software.proprietary.policy.s3;
-
-import java.net.URI;
-import java.util.Map;
-
-import org.springframework.boot.autoconfigure.condition.ConditionalOnBooleanProperty;
-import org.springframework.stereotype.Component;
-
-import lombok.RequiredArgsConstructor;
-
-import stirling.software.common.model.ApplicationProperties;
-import stirling.software.proprietary.cluster.s3.S3Clients;
-import stirling.software.proprietary.integration.model.IntegrationType;
-import stirling.software.proprietary.integration.service.IntegrationConfigValidator;
-
-/**
- * The S3 connection schema, enforced when an S3 {@link IntegrationType} config is saved: bucket and
- * credentials required, endpoint an http(s) URL that must not reach private addresses without the
- * operator opt-in - the same rules {@link S3ConnectionPool} enforces before signing, moved to save
- * time so a bad connection fails in the form rather than in a sweep.
- */
-@Component
-@RequiredArgsConstructor
-@ConditionalOnBooleanProperty(name = "policies.enabled")
-public class S3IntegrationValidator implements IntegrationConfigValidator {
-
-    private final ApplicationProperties applicationProperties;
-
-    @Override
-    public IntegrationType type() {
-        return IntegrationType.S3;
-    }
-
-    @Override
-    public void validate(Map<String, Object> config) {
-        S3Config parsed = S3Config.from(config);
-        if (parsed.endpoint() == null) {
-            return;
-        }
-        try {
-            S3Clients.validateEndpointHost(
-                    URI.create(parsed.endpoint()),
-                    applicationProperties.getPolicies().isAllowPrivateS3Endpoints(),
-                    "S3 connection endpoint",
-                    "set policies.allowPrivateS3Endpoints=true to opt in (e.g. for a local"
-                            + " MinIO).");
-        } catch (IllegalStateException e) {
-            throw new IllegalArgumentException(e.getMessage(), e);
-        }
-    }
-}

app/proprietary/src/main/java/stirling/software/proprietary/security/configuration/SecurityConfiguration.java

@@ -57,7 +57,6 @@ import stirling.software.proprietary.security.oauth2.TauriAuthorizationRequestRe
 import stirling.software.proprietary.security.saml2.CustomSaml2AuthenticationFailureHandler;
 import stirling.software.proprietary.security.saml2.CustomSaml2AuthenticationSuccessHandler;
 import stirling.software.proprietary.security.saml2.CustomSaml2ResponseAuthenticationConverter;
-import stirling.software.proprietary.security.service.ApiKeyAuthenticationService;
 import stirling.software.proprietary.security.service.CustomOAuth2UserService;
 import stirling.software.proprietary.security.service.CustomUserDetailsService;
 import stirling.software.proprietary.security.service.JwtServiceInterface;
@@ -485,14 +484,12 @@ public class SecurityConfiguration {
     }
 
     @Bean
-    public JwtAuthenticationFilter jwtAuthenticationFilter(
-            ApiKeyAuthenticationService apiKeyAuthenticationService) {
+    public JwtAuthenticationFilter jwtAuthenticationFilter() {
         return new JwtAuthenticationFilter(
                 jwtService,
                 userService,
                 userDetailsService,
                 jwtAuthenticationEntryPoint,
-                securityProperties,
-                apiKeyAuthenticationService);
+                securityProperties);
     }
 }

app/proprietary/src/main/java/stirling/software/proprietary/security/filter/JwtAuthenticationFilter.java

@@ -11,7 +11,6 @@ import java.sql.SQLException;
 import java.util.Map;
 import java.util.Optional;
 
-import org.slf4j.MDC;
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.AuthenticationException;
@@ -34,9 +33,8 @@ import stirling.software.common.model.ApplicationProperties;
 import stirling.software.common.model.exception.UnsupportedProviderException;
 import stirling.software.proprietary.security.model.ApiKeyAuthenticationToken;
 import stirling.software.proprietary.security.model.AuthenticationType;
+import stirling.software.proprietary.security.model.User;
 import stirling.software.proprietary.security.model.exception.AuthenticationFailureException;
-import stirling.software.proprietary.security.service.ApiKeyAuthenticationService;
-import stirling.software.proprietary.security.service.ApiKeyAuthenticationService.ApiKeyAuthentication;
 import stirling.software.proprietary.security.service.CustomUserDetailsService;
 import stirling.software.proprietary.security.service.JwtServiceInterface;
 import stirling.software.proprietary.security.service.UserService;
@@ -50,15 +48,11 @@ public class JwtAuthenticationFilter extends OncePerRequestFilter {
     private final CustomUserDetailsService userDetailsService;
     private final AuthenticationEntryPoint authenticationEntryPoint;
     private final ApplicationProperties.Security securityProperties;
-    private final ApiKeyAuthenticationService apiKeyAuthenticationService;
 
     @Override
     protected void doFilterInternal(
             HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
             throws ServletException, IOException {
-        // Start clean so a pooled thread can't inherit a prior request's key label. This filter
-        // runs before UserAuthenticationFilter, so in JWT mode it owns the API-key label lifecycle.
-        MDC.remove(ApiKeyAuthenticationService.AUDIT_LABEL_MDC_KEY);
         if (!jwtService.isJwtEnabled()) {
             filterChain.doFilter(request, response);
             return;
@@ -137,14 +131,9 @@ public class JwtAuthenticationFilter extends OncePerRequestFilter {
 
             if (apiKey != null && !apiKey.isBlank()) {
                 try {
-                    // Resolve through the shared service so the multi-key table (then the legacy
-                    // per-user key) is consulted and per-key usage is recorded; the key runs as its
-                    // owner. It also yields a per-key label for the processor's document
-                    // attribution.
-                    Optional<ApiKeyAuthentication> resolved =
-                            apiKeyAuthenticationService.authenticate(apiKey);
+                    Optional<User> user = userService.getUserByApiKey(apiKey);
 
-                    if (resolved.isEmpty()) {
+                    if (user.isEmpty()) {
                         handleAuthenticationFailure(
                                 request,
                                 response,
@@ -154,13 +143,8 @@ public class JwtAuthenticationFilter extends OncePerRequestFilter {
 
                     authentication =
                             new ApiKeyAuthenticationToken(
-                                    resolved.get().user(), apiKey, resolved.get().authorities());
+                                    user.get(), apiKey, user.get().getAuthorities());
                     SecurityContextHolder.getContext().setAuthentication(authentication);
-                    if (resolved.get().auditLabel() != null) {
-                        MDC.put(
-                                ApiKeyAuthenticationService.AUDIT_LABEL_MDC_KEY,
-                                resolved.get().auditLabel());
-                    }
                     return true;
                 } catch (AuthenticationException e) {
                     handleAuthenticationFailure(

app/proprietary/src/main/java/stirling/software/proprietary/security/filter/UserAuthenticationFilter.java

@@ -6,7 +6,6 @@ import java.io.IOException;
 import java.util.List;
 import java.util.Optional;
 
-import org.slf4j.MDC;
 import org.springframework.beans.factory.annotation.Qualifier;
 import org.springframework.context.annotation.Lazy;
 import org.springframework.context.annotation.Profile;
@@ -34,8 +33,6 @@ import stirling.software.common.util.RequestUriUtils;
 import stirling.software.proprietary.security.model.ApiKeyAuthenticationToken;
 import stirling.software.proprietary.security.model.User;
 import stirling.software.proprietary.security.saml2.CustomSaml2AuthenticatedPrincipal;
-import stirling.software.proprietary.security.service.ApiKeyAuthenticationService;
-import stirling.software.proprietary.security.service.ApiKeyAuthenticationService.ApiKeyAuthentication;
 import stirling.software.proprietary.security.service.UserService;
 import stirling.software.proprietary.security.session.SessionPersistentRegistry;
 
@@ -44,24 +41,18 @@ import stirling.software.proprietary.security.session.SessionPersistentRegistry;
 @Profile("!saas")
 public class UserAuthenticationFilter extends OncePerRequestFilter {
 
-    /** MDC key carrying the resolved key's label into audit events for the processor feed. */
-    public static final String API_KEY_LABEL_MDC = ApiKeyAuthenticationService.AUDIT_LABEL_MDC_KEY;
-
     private final ApplicationProperties.Security securityProp;
     private final UserService userService;
-    private final ApiKeyAuthenticationService apiKeyAuthenticationService;
     private final SessionPersistentRegistry sessionPersistentRegistry;
     private final boolean loginEnabledValue;
 
     public UserAuthenticationFilter(
             @Lazy ApplicationProperties.Security securityProp,
             @Lazy UserService userService,
-            ApiKeyAuthenticationService apiKeyAuthenticationService,
             SessionPersistentRegistry sessionPersistentRegistry,
             @Qualifier("loginEnabled") boolean loginEnabledValue) {
         this.securityProp = securityProp;
         this.userService = userService;
-        this.apiKeyAuthenticationService = apiKeyAuthenticationService;
         this.sessionPersistentRegistry = sessionPersistentRegistry;
         this.loginEnabledValue = loginEnabledValue;
     }
@@ -71,14 +62,6 @@ public class UserAuthenticationFilter extends OncePerRequestFilter {
             HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
             throws ServletException, IOException {
 
-        // Start each request clean so a pooled thread can't inherit a prior request's key label -
-        // but keep a label an upstream filter (JwtAuthenticationFilter) already set for a request
-        // it API-key-authenticated, otherwise per-key attribution is lost on the JWT path.
-        if (!(SecurityContextHolder.getContext().getAuthentication()
-                instanceof ApiKeyAuthenticationToken)) {
-            MDC.remove(API_KEY_LABEL_MDC);
-        }
-
         if (!loginEnabledValue) {
             // If login is not enabled, just pass all requests without authentication
             filterChain.doFilter(request, response);
@@ -106,23 +89,18 @@ public class UserAuthenticationFilter extends OncePerRequestFilter {
             String apiKey = request.getHeader("X-API-KEY");
             if (apiKey != null && !apiKey.trim().isEmpty()) {
                 try {
-                    // Resolves the multi-key table then the legacy key, records usage, and yields a
-                    // per-key label for the processor's document-source attribution.
-                    Optional<ApiKeyAuthentication> resolved =
-                            apiKeyAuthenticationService.authenticate(apiKey);
-                    if (resolved.isEmpty()) {
+                    // Use API key to authenticate. This requires you to have an authentication
+                    // provider for API keys.
+                    Optional<User> user = userService.getUserByApiKey(apiKey);
+                    if (user.isEmpty()) {
                         response.setStatus(HttpStatus.UNAUTHORIZED.value());
                         response.getWriter().write("Invalid API Key.");
                         return;
                     }
-                    User user = resolved.get().user();
                     authentication =
                             new ApiKeyAuthenticationToken(
-                                    user, apiKey, resolved.get().authorities());
+                                    user.get(), apiKey, user.get().getAuthorities());
                     SecurityContextHolder.getContext().setAuthentication(authentication);
-                    if (resolved.get().auditLabel() != null) {
-                        MDC.put(API_KEY_LABEL_MDC, resolved.get().auditLabel());
-                    }
                 } catch (AuthenticationException e) {
                     // If API key authentication fails, deny the request
                     response.setStatus(HttpStatus.UNAUTHORIZED.value());

app/proprietary/src/main/java/stirling/software/proprietary/security/filter/UserBasedRateLimitingFilter.java

@@ -11,6 +11,7 @@ import org.springframework.http.HttpStatus;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.GrantedAuthority;
 import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.security.core.userdetails.UserDetails;
 import org.springframework.stereotype.Component;
 import org.springframework.web.filter.OncePerRequestFilter;
 
@@ -57,25 +58,23 @@ public class UserBasedRateLimitingFilter extends OncePerRequestFilter {
             filterChain.doFilter(request, response);
             return;
         }
-        // Bucket by the resolved user (the auth filter runs first and populates the context, even
-        // for X-API-KEY requests), so all of a user's API keys share ONE per-user quota - minting
-        // extra keys can't multiply the daily limit. Fall back to the raw key / IP only when the
-        // request is unauthenticated.
         String identifier = null;
-        Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
-        if (authentication != null
-                && authentication.isAuthenticated()
-                && !"anonymousUser".equals(authentication.getName())) {
-            identifier = authentication.getName();
-        }
-        if (identifier == null) {
-            String apiKey = request.getHeader("X-API-KEY");
-            if (apiKey != null && !apiKey.trim().isEmpty()) {
-                identifier = "API_KEY_" + apiKey;
-            } else {
-                identifier = request.getRemoteAddr();
+        // Check for API key in the request headers
+        String apiKey = request.getHeader("X-API-KEY");
+        if (apiKey != null && !apiKey.trim().isEmpty()) {
+            identifier = // Prefix to distinguish between API keys and usernames
+                    "API_KEY_" + apiKey;
+        } else {
+            Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
+            if (authentication != null && authentication.isAuthenticated()) {
+                UserDetails userDetails = (UserDetails) authentication.getPrincipal();
+                identifier = userDetails.getUsername();
             }
         }
+        // If neither API key nor an authenticated user is present, use IP address
+        if (identifier == null) {
+            identifier = request.getRemoteAddr();
+        }
         Role userRole =
                 getRoleFromAuthentication(SecurityContextHolder.getContext().getAuthentication());
         if (request.getHeader("X-API-KEY") != null) {

app/proprietary/src/main/java/stirling/software/proprietary/security/model/ApiKey.java

@@ -1,72 +0,0 @@
-package stirling.software.proprietary.security.model;
-
-import java.io.Serializable;
-import java.time.Instant;
-
-import jakarta.persistence.*;
-
-import lombok.AllArgsConstructor;
-import lombok.Builder;
-import lombok.Getter;
-import lombok.NoArgsConstructor;
-import lombok.Setter;
-
-/**
- * A named, personal API key belonging to a user. The raw secret is shown once at creation and never
- * stored; only its SHA-256 hash is persisted, so a leaked database row cannot be replayed. Distinct
- * from the legacy single {@code users.apiKey} column, which stays a per-user key for backward
- * compatibility and is lazily represented here.
- */
-@Entity
-@Table(
-        name = "api_keys",
-        indexes = {
-            @Index(name = "idx_api_key_hash", columnList = "key_hash", unique = true),
-            @Index(name = "idx_api_key_owner", columnList = "owner_user_id")
-        })
-@Getter
-@Setter
-@Builder
-@NoArgsConstructor
-@AllArgsConstructor
-public class ApiKey implements Serializable {
-
-    private static final long serialVersionUID = 1L;
-
-    @Id
-    @GeneratedValue(strategy = GenerationType.IDENTITY)
-    @Column(name = "id")
-    private Long id;
-
-    @Column(name = "name", nullable = false, length = 100)
-    private String name;
-
-    /** SHA-256 hex of the raw key; the raw value is never persisted. */
-    @Column(name = "key_hash", nullable = false, unique = true, length = 64)
-    private String keyHash;
-
-    /** Non-secret leading fragment of the raw key, shown in listings (e.g. {@code sk_a1b2c3d4}). */
-    @Column(name = "prefix", nullable = false, length = 32)
-    private String prefix;
-
-    /** The user who created and owns the key; the key authenticates as this user. */
-    @Column(name = "owner_user_id", nullable = false)
-    private Long ownerUserId;
-
-    @Column(name = "enabled", nullable = false)
-    private boolean enabled;
-
-    @Column(name = "created_at", nullable = false)
-    private Instant createdAt;
-
-    @Column(name = "last_used_at")
-    private Instant lastUsedAt;
-
-    @Column(name = "revoked_at")
-    private Instant revokedAt;
-
-    /** Active = enabled and not revoked; only active keys authenticate. */
-    public boolean isActive() {
-        return enabled && revokedAt == null;
-    }
-}

app/proprietary/src/main/java/stirling/software/proprietary/security/model/ApiKeyAuthenticationToken.java

@@ -5,7 +5,6 @@ import java.util.Collection;
 import org.springframework.security.authentication.AbstractAuthenticationToken;
 import org.springframework.security.core.GrantedAuthority;
 
-/** Authentication produced from an {@code X-API-KEY} header; runs as the key's owner. */
 public class ApiKeyAuthenticationToken extends AbstractAuthenticationToken {
 
     private final Object principal;

app/proprietary/src/main/java/stirling/software/proprietary/security/model/ApiKeyDailyUsage.java

@@ -1,45 +0,0 @@
-package stirling.software.proprietary.security.model;
-
-import java.io.Serializable;
-
-import jakarta.persistence.Column;
-import jakarta.persistence.Entity;
-import jakarta.persistence.Id;
-import jakarta.persistence.IdClass;
-import jakarta.persistence.Table;
-
-import lombok.Getter;
-import lombok.NoArgsConstructor;
-import lombok.Setter;
-
-/**
- * One UTC day's request tally for an API key. Rolling "today"/"this month" usage is summed from
- * these rows, keeping the table at one row per key per active day rather than one per request.
- */
-@Entity
-@Table(name = "api_key_daily_usage")
-@IdClass(ApiKeyDailyUsageId.class)
-@Getter
-@Setter
-@NoArgsConstructor
-public class ApiKeyDailyUsage implements Serializable {
-
-    private static final long serialVersionUID = 1L;
-
-    @Id
-    @Column(name = "api_key_id")
-    private Long apiKeyId;
-
-    @Id
-    @Column(name = "epoch_day")
-    private long epochDay;
-
-    @Column(name = "count")
-    private long count;
-
-    public ApiKeyDailyUsage(Long apiKeyId, long epochDay, long count) {
-        this.apiKeyId = apiKeyId;
-        this.epochDay = epochDay;
-        this.count = count;
-    }
-}

app/proprietary/src/main/java/stirling/software/proprietary/security/model/ApiKeyDailyUsageId.java

@@ -1,36 +0,0 @@
-package stirling.software.proprietary.security.model;
-
-import java.io.Serializable;
-import java.util.Objects;
-
-/** Composite key for {@link ApiKeyDailyUsage}: one row per key per UTC day. */
-public class ApiKeyDailyUsageId implements Serializable {
-
-    private static final long serialVersionUID = 1L;
-
-    private Long apiKeyId;
-    private long epochDay;
-
-    public ApiKeyDailyUsageId() {}
-
-    public ApiKeyDailyUsageId(Long apiKeyId, long epochDay) {
-        this.apiKeyId = apiKeyId;
-        this.epochDay = epochDay;
-    }
-
-    @Override
-    public boolean equals(Object o) {
-        if (this == o) {
-            return true;
-        }
-        if (!(o instanceof ApiKeyDailyUsageId other)) {
-            return false;
-        }
-        return epochDay == other.epochDay && Objects.equals(apiKeyId, other.apiKeyId);
-    }
-
-    @Override
-    public int hashCode() {
-        return Objects.hash(apiKeyId, epochDay);
-    }
-}

app/proprietary/src/main/java/stirling/software/proprietary/security/model/User.java

@@ -103,6 +103,7 @@ public class User implements UserDetails, Serializable {
 
     @ElementCollection
     @MapKeyColumn(name = "setting_key")
+    @Lob
     @Column(name = "setting_value", columnDefinition = "text")
     @CollectionTable(name = "user_settings", joinColumns = @JoinColumn(name = "user_id"))
     @JsonIgnore

app/proprietary/src/main/java/stirling/software/proprietary/security/repository/ApiKeyDailyUsageRepository.java

@@ -1,55 +0,0 @@
-package stirling.software.proprietary.security.repository;
-
-import java.util.Collection;
-import java.util.List;
-
-import org.springframework.data.jpa.repository.JpaRepository;
-import org.springframework.data.jpa.repository.Modifying;
-import org.springframework.data.jpa.repository.Query;
-import org.springframework.data.repository.query.Param;
-import org.springframework.stereotype.Repository;
-
-import stirling.software.proprietary.security.model.ApiKeyDailyUsage;
-import stirling.software.proprietary.security.model.ApiKeyDailyUsageId;
-
-@Repository
-public interface ApiKeyDailyUsageRepository
-        extends JpaRepository<ApiKeyDailyUsage, ApiKeyDailyUsageId> {
-
-    /** Atomically bump today's tally; returns 0 when no row exists yet (caller then inserts). */
-    @Modifying
-    @Query(
-            "UPDATE ApiKeyDailyUsage u SET u.count = u.count + 1 "
-                    + "WHERE u.apiKeyId = :apiKeyId AND u.epochDay = :epochDay")
-    int incrementIfPresent(@Param("apiKeyId") Long apiKeyId, @Param("epochDay") long epochDay);
-
-    @Query(
-            "SELECT COALESCE(SUM(u.count), 0) FROM ApiKeyDailyUsage u "
-                    + "WHERE u.apiKeyId = :apiKeyId AND u.epochDay >= :fromDayInclusive")
-    long sumSince(
-            @Param("apiKeyId") Long apiKeyId, @Param("fromDayInclusive") long fromDayInclusive);
-
-    @Query(
-            "SELECT u.count FROM ApiKeyDailyUsage u "
-                    + "WHERE u.apiKeyId = :apiKeyId AND u.epochDay = :epochDay")
-    Long countForDay(@Param("apiKeyId") Long apiKeyId, @Param("epochDay") long epochDay);
-
-    /** Batched today-count for many keys in one query (avoids N+1 when listing keys). */
-    @Query(
-            "SELECT u.apiKeyId AS apiKeyId, u.count AS total FROM ApiKeyDailyUsage u "
-                    + "WHERE u.apiKeyId IN :ids AND u.epochDay = :epochDay")
-    List<ApiKeyUsageSum> countForDayByIds(
-            @Param("ids") Collection<Long> ids, @Param("epochDay") long epochDay);
-
-    /** Batched trailing-window sum for many keys in one query. */
-    @Query(
-            "SELECT u.apiKeyId AS apiKeyId, SUM(u.count) AS total FROM ApiKeyDailyUsage u "
-                    + "WHERE u.apiKeyId IN :ids AND u.epochDay >= :fromDayInclusive "
-                    + "GROUP BY u.apiKeyId")
-    List<ApiKeyUsageSum> sumSinceByIds(
-            @Param("ids") Collection<Long> ids, @Param("fromDayInclusive") long fromDayInclusive);
-
-    void deleteByApiKeyId(Long apiKeyId);
-
-    List<ApiKeyDailyUsage> findByApiKeyId(Long apiKeyId);
-}

app/proprietary/src/main/java/stirling/software/proprietary/security/repository/ApiKeyRepository.java

@@ -1,19 +0,0 @@
-package stirling.software.proprietary.security.repository;
-
-import java.util.List;
-import java.util.Optional;
-
-import org.springframework.data.jpa.repository.JpaRepository;
-import org.springframework.stereotype.Repository;
-
-import stirling.software.proprietary.security.model.ApiKey;
-
-@Repository
-public interface ApiKeyRepository extends JpaRepository<ApiKey, Long> {
-
-    Optional<ApiKey> findByKeyHash(String keyHash);
-
-    boolean existsByKeyHash(String keyHash);
-
-    List<ApiKey> findByOwnerUserIdOrderByCreatedAtDesc(Long ownerUserId);
-}

app/proprietary/src/main/java/stirling/software/proprietary/security/repository/ApiKeyUsageSum.java

@@ -1,8 +0,0 @@
-package stirling.software.proprietary.security.repository;
-
-/** Projection: a key id and a usage total, for batching per-key usage into one query. */
-public interface ApiKeyUsageSum {
-    Long getApiKeyId();
-
-    Long getTotal();
-}

app/proprietary/src/main/java/stirling/software/proprietary/security/service/ApiKeyAuthenticationService.java

@@ -1,107 +0,0 @@
-package stirling.software.proprietary.security.service;
-
-import java.time.Instant;
-import java.util.Collection;
-import java.util.Optional;
-
-import org.springframework.security.core.GrantedAuthority;
-import org.springframework.stereotype.Service;
-import org.springframework.transaction.annotation.Transactional;
-
-import lombok.RequiredArgsConstructor;
-
-import stirling.software.proprietary.security.database.repository.UserRepository;
-import stirling.software.proprietary.security.model.ApiKey;
-import stirling.software.proprietary.security.model.User;
-import stirling.software.proprietary.security.repository.ApiKeyRepository;
-
-/**
- * Resolves an incoming {@code X-API-KEY} to its owning user and records per-key usage. Depends only
- * on repositories (never {@code UserService}) so {@code UserService} can delegate here without a
- * bean cycle.
- *
- * <p>Resolution order: the multi-key {@code api_keys} table first (by hash), then the legacy
- * per-user {@code users.apiKey} column. Legacy keys therefore keep working unchanged. Every key is
- * personal and authenticates as its owner with the owner's authorities.
- */
-@Service
-@RequiredArgsConstructor
-public class ApiKeyAuthenticationService {
-
-    /**
-     * MDC key that carries the resolved key's label into audit events so the processor's Documents
-     * feed can attribute a document to the specific key. Set by the auth filters (both flavors),
-     * read by {@code CustomAuditEventRepository}.
-     */
-    public static final String AUDIT_LABEL_MDC_KEY = "apiKeyLabel";
-
-    private final ApiKeyRepository apiKeyRepository;
-    private final ApiKeyUsageRecorder usageRecorder;
-    private final UserRepository userRepository;
-
-    /** The user a raw key authenticates as, or empty if it matches no active key. */
-    public Optional<User> resolveUser(String rawKey) {
-        return authenticate(rawKey).map(ApiKeyAuthentication::user);
-    }
-
-    /**
-     * Resolve a raw key, recording usage as a side effect. Returns the owning user, a display label
-     * for the resolved key ({@code null} for the legacy per-user key), and the owner's authorities.
-     */
-    public Optional<ApiKeyAuthentication> authenticate(String rawKey) {
-        if (rawKey == null || rawKey.isBlank()) {
-            return Optional.empty();
-        }
-
-        ApiKey key = apiKeyRepository.findByKeyHash(ApiKeyHasher.hash(rawKey)).orElse(null);
-        if (key != null) {
-            if (!key.isActive()) {
-                return Optional.empty();
-            }
-            User owner = userRepository.findById(key.getOwnerUserId()).orElse(null);
-            if (owner == null || !owner.isEnabled()) {
-                return Optional.empty();
-            }
-            usageRecorder.record(key.getId());
-            return Optional.of(
-                    new ApiKeyAuthentication(owner, auditLabel(key), owner.getAuthorities()));
-        }
-
-        // Legacy single per-user key: keep working, always a personal key for its user.
-        return userRepository
-                .findByApiKey(rawKey)
-                .filter(User::isEnabled)
-                .map(user -> new ApiKeyAuthentication(user, null, user.getAuthorities()));
-    }
-
-    /** "Production ingest (sk_a1b2c3d4)" - shown against API-sourced docs in the processor feed. */
-    private static String auditLabel(ApiKey key) {
-        return key.getName() + " (" + key.getPrefix() + ")";
-    }
-
-    /**
-     * Revoke the {@code api_keys} row that mirrors a given raw key, if any. Called when the legacy
-     * per-user key is rotated so the migrated shadow row can't keep authenticating the old secret.
-     */
-    @Transactional
-    public void revokeMigratedKey(String rawKey) {
-        if (rawKey == null || rawKey.isBlank()) {
-            return;
-        }
-        apiKeyRepository
-                .findByKeyHash(ApiKeyHasher.hash(rawKey))
-                .filter(ApiKey::isActive)
-                .ifPresent(
-                        k -> {
-                            k.setEnabled(false);
-                            k.setRevokedAt(Instant.now());
-                            apiKeyRepository.save(k);
-                        });
-    }
-
-    /**
-     * A resolved key: the user, an optional processor-feed label, and the authorities to run as.
-     */
-    public record ApiKeyAuthentication(
-            User user, String auditLabel, Collection<? extends GrantedAuthority> authorities) {}
-}

app/proprietary/src/main/java/stirling/software/proprietary/security/service/ApiKeyHasher.java

@@ -1,50 +0,0 @@
-package stirling.software.proprietary.security.service;
-
-import java.nio.charset.StandardCharsets;
-import java.security.MessageDigest;
-import java.security.NoSuchAlgorithmException;
-import java.security.SecureRandom;
-import java.util.HexFormat;
-
-/** Generates opaque API-key secrets and hashes them for storage/lookup. */
-public final class ApiKeyHasher {
-
-    /** Human-recognisable prefix so a leaked string is identifiable as a Stirling API key. */
-    public static final String KEY_PREFIX = "sk_";
-
-    /** Chars of the raw key kept for non-secret display (includes the {@code sk_} prefix). */
-    private static final int DISPLAY_PREFIX_LENGTH = 11;
-
-    private static final SecureRandom RANDOM = new SecureRandom();
-
-    private ApiKeyHasher() {}
-
-    /** A fresh opaque secret: {@code sk_} followed by 40 hex chars of cryptographic randomness. */
-    public static String generateRawKey() {
-        byte[] bytes = new byte[20];
-        RANDOM.nextBytes(bytes);
-        return KEY_PREFIX + HexFormat.of().formatHex(bytes);
-    }
-
-    /** SHA-256 hex of a raw key; the value stored and looked up, never the raw key. */
-    public static String hash(String rawKey) {
-        try {
-            byte[] digest =
-                    MessageDigest.getInstance("SHA-256")
-                            .digest(rawKey.getBytes(StandardCharsets.UTF_8));
-            return HexFormat.of().formatHex(digest);
-        } catch (NoSuchAlgorithmException e) {
-            throw new IllegalStateException("SHA-256 unavailable", e);
-        }
-    }
-
-    /** Leading, non-secret fragment shown in listings (e.g. {@code sk_a1b2c3d4}). */
-    public static String displayPrefix(String rawKey) {
-        if (rawKey == null) {
-            return "";
-        }
-        return rawKey.length() <= DISPLAY_PREFIX_LENGTH
-                ? rawKey
-                : rawKey.substring(0, DISPLAY_PREFIX_LENGTH);
-    }
-}

app/proprietary/src/main/java/stirling/software/proprietary/security/service/ApiKeyLegacyMigrator.java

@@ -1,31 +0,0 @@
-package stirling.software.proprietary.security.service;
-
-import org.springframework.stereotype.Component;
-import org.springframework.transaction.annotation.Propagation;
-import org.springframework.transaction.annotation.Transactional;
-
-import lombok.RequiredArgsConstructor;
-
-import stirling.software.proprietary.security.model.ApiKey;
-import stirling.software.proprietary.security.repository.ApiKeyRepository;
-
-/**
- * Inserts the shadow {@code api_keys} row that mirrors a user's legacy {@code users.apiKey} in its
- * OWN ({@code REQUIRES_NEW}) transaction. Kept a separate bean so the write is isolated from the
- * caller's listing transaction: when two concurrent first-loads race to insert the same hash, the
- * loser's unique-key clash rolls back only this insert instead of poisoning the caller's
- * transaction (on Postgres a failed statement aborts the whole transaction). The {@code
- * DataIntegrityViolationException} is left to propagate so the caller can treat it as "already
- * migrated".
- */
-@Component
-@RequiredArgsConstructor
-class ApiKeyLegacyMigrator {
-
-    private final ApiKeyRepository apiKeyRepository;
-
-    @Transactional(propagation = Propagation.REQUIRES_NEW)
-    public void insertMigratedKey(ApiKey key) {
-        apiKeyRepository.saveAndFlush(key);
-    }
-}

app/proprietary/src/main/java/stirling/software/proprietary/security/service/ApiKeyManagementService.java

@@ -1,235 +0,0 @@
-package stirling.software.proprietary.security.service;
-
-import java.time.Instant;
-import java.time.ZoneOffset;
-import java.time.format.DateTimeFormatter;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-
-import org.springframework.dao.DataIntegrityViolationException;
-import org.springframework.http.HttpStatus;
-import org.springframework.stereotype.Service;
-import org.springframework.transaction.annotation.Transactional;
-import org.springframework.web.server.ResponseStatusException;
-
-import lombok.RequiredArgsConstructor;
-import lombok.extern.slf4j.Slf4j;
-
-import stirling.software.proprietary.model.api.apikey.CreateApiKeyRequest;
-import stirling.software.proprietary.model.api.apikey.CreatedApiKeyDto;
-import stirling.software.proprietary.model.api.apikey.PortalApiKeyDto;
-import stirling.software.proprietary.model.api.apikey.PortalApiKeysResponse;
-import stirling.software.proprietary.security.database.repository.UserRepository;
-import stirling.software.proprietary.security.model.ApiKey;
-import stirling.software.proprietary.security.model.User;
-import stirling.software.proprietary.security.repository.ApiKeyDailyUsageRepository;
-import stirling.software.proprietary.security.repository.ApiKeyRepository;
-
-/**
- * Portal-facing CRUD for named, personal API keys: lists, creates, and revokes the caller's own
- * keys. Every key belongs to exactly one user and authenticates as that user; there is no sharing.
- *
- * <p>Every pre-existing single {@code users.apiKey} is lazily represented as a key owned by that
- * user, so historic keys list uniformly.
- */
-@Slf4j
-@Service
-@RequiredArgsConstructor
-public class ApiKeyManagementService {
-
-    private static final DateTimeFormatter CREATED_FORMAT =
-            DateTimeFormatter.ofPattern("yyyy-MM-dd").withZone(ZoneOffset.UTC);
-    private static final DateTimeFormatter LAST_USED_FORMAT =
-            DateTimeFormatter.ofPattern("yyyy-MM-dd HH:mm").withZone(ZoneOffset.UTC);
-    private static final int MONTH_WINDOW_DAYS = 30;
-
-    /** Bounds a key name so it can't bloat storage or the audit/processor feed. */
-    private static final int MAX_NAME_LENGTH = 100;
-
-    /** Caps active keys per user so key creation can't be used to multiply rate-limit budget. */
-    private static final int MAX_ACTIVE_KEYS_PER_USER = 50;
-
-    private final ApiKeyRepository apiKeyRepository;
-    private final ApiKeyDailyUsageRepository usageRepository;
-    private final UserRepository userRepository;
-    private final UserService userService;
-    private final ApiKeyLegacyMigrator legacyMigrator;
-
-    /** All keys the caller owns. */
-    @Transactional
-    public PortalApiKeysResponse listVisibleKeys() {
-        User caller = requireCaller();
-        migrateLegacyKey(caller);
-
-        List<ApiKey> visible =
-                apiKeyRepository.findByOwnerUserIdOrderByCreatedAtDesc(caller.getId());
-
-        // Batch usage for all keys into three queries rather than two-per-key (avoids N+1).
-        long today = Instant.now().atZone(ZoneOffset.UTC).toLocalDate().toEpochDay();
-        List<Long> ids = visible.stream().map(ApiKey::getId).toList();
-        Map<Long, Long> todayById = new HashMap<>();
-        Map<Long, Long> monthById = new HashMap<>();
-        Map<Long, Long> totalById = new HashMap<>();
-        if (!ids.isEmpty()) {
-            usageRepository
-                    .countForDayByIds(ids, today)
-                    .forEach(r -> todayById.put(r.getApiKeyId(), r.getTotal()));
-            usageRepository
-                    .sumSinceByIds(ids, today - (MONTH_WINDOW_DAYS - 1))
-                    .forEach(r -> monthById.put(r.getApiKeyId(), r.getTotal()));
-            usageRepository
-                    .sumSinceByIds(ids, Long.MIN_VALUE)
-                    .forEach(r -> totalById.put(r.getApiKeyId(), r.getTotal()));
-        }
-
-        List<PortalApiKeyDto> keys =
-                visible.stream()
-                        .map(
-                                k ->
-                                        toDto(
-                                                k,
-                                                zeroIfNull(todayById.get(k.getId())),
-                                                zeroIfNull(monthById.get(k.getId())),
-                                                zeroIfNull(totalById.get(k.getId()))))
-                        .toList();
-        return PortalApiKeysResponse.builder().keys(keys).build();
-    }
-
-    private static long zeroIfNull(Long value) {
-        return value == null ? 0L : value;
-    }
-
-    /** Create a personal key and return its one-time secret. */
-    @Transactional
-    public CreatedApiKeyDto createKey(CreateApiKeyRequest request) {
-        User caller = requireCaller();
-        String name = request == null ? null : request.name();
-        if (name == null || name.isBlank()) {
-            throw new ResponseStatusException(HttpStatus.BAD_REQUEST, "Key name is required");
-        }
-        if (name.trim().length() > MAX_NAME_LENGTH) {
-            throw new ResponseStatusException(
-                    HttpStatus.BAD_REQUEST,
-                    "Key name must be " + MAX_NAME_LENGTH + " characters or fewer");
-        }
-        long activeOwned =
-                apiKeyRepository.findByOwnerUserIdOrderByCreatedAtDesc(caller.getId()).stream()
-                        .filter(ApiKey::isActive)
-                        .count();
-        if (activeOwned >= MAX_ACTIVE_KEYS_PER_USER) {
-            throw new ResponseStatusException(
-                    HttpStatus.TOO_MANY_REQUESTS,
-                    "You have reached the maximum of "
-                            + MAX_ACTIVE_KEYS_PER_USER
-                            + " active API keys; revoke one before creating another");
-        }
-
-        String rawKey = ApiKeyHasher.generateRawKey();
-        ApiKey saved =
-                apiKeyRepository.save(
-                        ApiKey.builder()
-                                .name(name.trim())
-                                .keyHash(ApiKeyHasher.hash(rawKey))
-                                .prefix(ApiKeyHasher.displayPrefix(rawKey))
-                                .ownerUserId(caller.getId())
-                                .enabled(true)
-                                .createdAt(Instant.now())
-                                .build());
-
-        return CreatedApiKeyDto.builder().key(toDto(saved, 0L, 0L, 0L)).secret(rawKey).build();
-    }
-
-    /** Soft-revoke a key the caller owns; also clears the legacy column if it is that key. */
-    @Transactional
-    public void revokeKey(Long id) {
-        User caller = requireCaller();
-        ApiKey key =
-                apiKeyRepository
-                        .findById(id)
-                        .orElseThrow(
-                                () -> new ResponseStatusException(HttpStatus.NOT_FOUND, "No key"));
-        if (!key.getOwnerUserId().equals(caller.getId())) {
-            // Not-found rather than forbidden so a caller can't probe other users' key ids.
-            throw new ResponseStatusException(HttpStatus.NOT_FOUND, "No key");
-        }
-        key.setEnabled(false);
-        key.setRevokedAt(Instant.now());
-        apiKeyRepository.save(key);
-        clearLegacyColumnIfMatches(key);
-    }
-
-    /** Represent a user's pre-existing single key as a row so it lists uniformly. */
-    private void migrateLegacyKey(User user) {
-        String legacy = user.getApiKey();
-        if (legacy == null || legacy.isBlank()) {
-            return;
-        }
-        String hash = ApiKeyHasher.hash(legacy);
-        if (apiKeyRepository.existsByKeyHash(hash)) {
-            return;
-        }
-        try {
-            // Insert in its own transaction so a concurrent-insert clash can't poison this
-            // listing transaction (see ApiKeyLegacyMigrator).
-            legacyMigrator.insertMigratedKey(
-                    ApiKey.builder()
-                            .name("Default key")
-                            .keyHash(hash)
-                            .prefix(ApiKeyHasher.displayPrefix(legacy))
-                            .ownerUserId(user.getId())
-                            .enabled(true)
-                            .createdAt(Instant.now())
-                            .build());
-        } catch (DataIntegrityViolationException alreadyMigrated) {
-            // A concurrent first-load won the race and inserted the same hash; that's fine.
-            log.debug("Legacy key already migrated concurrently for user {}", user.getId());
-        }
-    }
-
-    /**
-     * If a revoked key is the owner's legacy {@code users.apiKey}, null it so it stops resolving.
-     */
-    private void clearLegacyColumnIfMatches(ApiKey key) {
-        userRepository
-                .findById(key.getOwnerUserId())
-                .ifPresent(
-                        owner -> {
-                            String legacy = owner.getApiKey();
-                            if (legacy != null
-                                    && ApiKeyHasher.hash(legacy).equals(key.getKeyHash())) {
-                                owner.setApiKey(null);
-                                userRepository.save(owner);
-                            }
-                        });
-    }
-
-    private PortalApiKeyDto toDto(ApiKey key, long usageToday, long usageMonth, long usageTotal) {
-        return PortalApiKeyDto.builder()
-                .id(String.valueOf(key.getId()))
-                .name(key.getName())
-                .prefix(key.getPrefix())
-                .created(
-                        key.getCreatedAt() == null ? "" : CREATED_FORMAT.format(key.getCreatedAt()))
-                .lastUsed(
-                        key.getLastUsedAt() == null
-                                ? "Never"
-                                : LAST_USED_FORMAT.format(key.getLastUsedAt()))
-                .status(key.isActive() ? "active" : "revoked")
-                .usageToday(usageToday)
-                .usageMonth(usageMonth)
-                .usageTotal(usageTotal)
-                .build();
-    }
-
-    private User requireCaller() {
-        String username = userService.getCurrentUsername();
-        if (username == null || username.isBlank() || "anonymousUser".equalsIgnoreCase(username)) {
-            throw new ResponseStatusException(HttpStatus.UNAUTHORIZED, "Not authenticated");
-        }
-        return userService
-                .findByUsernameIgnoreCase(username)
-                .orElseThrow(
-                        () -> new ResponseStatusException(HttpStatus.UNAUTHORIZED, "Unknown user"));
-    }
-}

app/proprietary/src/main/java/stirling/software/proprietary/security/service/ApiKeyUsageRecorder.java

@@ -1,60 +0,0 @@
-package stirling.software.proprietary.security.service;
-
-import java.time.Instant;
-import java.time.ZoneOffset;
-
-import org.springframework.scheduling.annotation.Async;
-import org.springframework.stereotype.Service;
-
-import lombok.RequiredArgsConstructor;
-import lombok.extern.slf4j.Slf4j;
-
-/**
- * Records per-key usage off the request thread. Kept a separate bean so the {@code @Async} proxy is
- * honoured (a self-invocation from the resolver would run inline). Best-effort: never fails a
- * request. The actual writes go through {@link ApiKeyUsageWriter} so each step commits in its own
- * transaction and a first-write race can't drop a count.
- */
-@Slf4j
-@Service
-@RequiredArgsConstructor
-public class ApiKeyUsageRecorder {
-
-    private final ApiKeyUsageWriter writer;
-
-    /** Bump today's tally for the key and stamp last-used. */
-    @Async("auditExecutor")
-    public void record(Long apiKeyId) {
-        if (apiKeyId == null) {
-            return;
-        }
-        try {
-            long epochDay = Instant.now().atZone(ZoneOffset.UTC).toLocalDate().toEpochDay();
-            // First writer of the day inserts the row; everyone else (and the loser of an insert
-            // race) increments. Separate transactions mean a unique-key clash never rolls back an
-            // already-counted request.
-            if (writer.increment(apiKeyId, epochDay) == 0
-                    && !firstUseInserted(apiKeyId, epochDay)) {
-                writer.increment(apiKeyId, epochDay);
-            }
-            writer.stampLastUsed(apiKeyId);
-        } catch (Exception e) {
-            log.debug("Failed to record API key usage for id={}", apiKeyId, e);
-        }
-    }
-
-    /**
-     * Whether we inserted the day's first row. A lost insert race can surface either as a {@code
-     * false} return or - when the failed flush marked the REQUIRES_NEW transaction rollback-only,
-     * so its commit throws - as an exception; both mean "someone else inserted", so we treat any
-     * failure as not-inserted and let the caller fall back to an increment rather than dropping the
-     * count.
-     */
-    private boolean firstUseInserted(Long apiKeyId, long epochDay) {
-        try {
-            return writer.tryInsertFirstUse(apiKeyId, epochDay);
-        } catch (RuntimeException raced) {
-            return false;
-        }
-    }
-}

app/proprietary/src/main/java/stirling/software/proprietary/security/service/ApiKeyUsageWriter.java

@@ -1,59 +0,0 @@
-package stirling.software.proprietary.security.service;
-
-import java.time.Instant;
-
-import org.springframework.dao.DataIntegrityViolationException;
-import org.springframework.stereotype.Component;
-import org.springframework.transaction.annotation.Propagation;
-import org.springframework.transaction.annotation.Transactional;
-
-import lombok.RequiredArgsConstructor;
-
-import stirling.software.proprietary.security.model.ApiKeyDailyUsage;
-import stirling.software.proprietary.security.repository.ApiKeyDailyUsageRepository;
-import stirling.software.proprietary.security.repository.ApiKeyRepository;
-
-/**
- * Per-step transactional writes for {@link ApiKeyUsageRecorder}. Each method runs in its own
- * ({@code REQUIRES_NEW}) transaction so a unique-key clash when two requests race to insert the
- * day's first row rolls back only that failed insert - never an already-counted request or the
- * last-used stamp.
- */
-@Component
-@RequiredArgsConstructor
-class ApiKeyUsageWriter {
-
-    private final ApiKeyRepository apiKeyRepository;
-    private final ApiKeyDailyUsageRepository usageRepository;
-
-    /** Bump today's tally if the row already exists; returns rows updated (0 if none yet). */
-    @Transactional(propagation = Propagation.REQUIRES_NEW)
-    public int increment(Long apiKeyId, long epochDay) {
-        return usageRepository.incrementIfPresent(apiKeyId, epochDay);
-    }
-
-    /**
-     * Insert today's row with a count of 1. Flushes so a concurrent first-write's unique-key clash
-     * surfaces here (returning false) instead of at commit; the caller then increments instead.
-     */
-    @Transactional(propagation = Propagation.REQUIRES_NEW)
-    public boolean tryInsertFirstUse(Long apiKeyId, long epochDay) {
-        try {
-            usageRepository.saveAndFlush(new ApiKeyDailyUsage(apiKeyId, epochDay, 1));
-            return true;
-        } catch (DataIntegrityViolationException raced) {
-            return false;
-        }
-    }
-
-    @Transactional(propagation = Propagation.REQUIRES_NEW)
-    public void stampLastUsed(Long apiKeyId) {
-        apiKeyRepository
-                .findById(apiKeyId)
-                .ifPresent(
-                        key -> {
-                            key.setLastUsedAt(Instant.now());
-                            apiKeyRepository.save(key);
-                        });
-    }
-}

app/proprietary/src/main/java/stirling/software/proprietary/security/service/UserService.java

@@ -95,7 +95,6 @@ public class UserService implements UserServiceInterface {
     private final ResourceGrantRepository resourceGrantRepository;
     private final IntegrationConfigRepository integrationConfigRepository;
     private final TeamMembershipService teamMembershipService;
-    private final ApiKeyAuthenticationService apiKeyAuthenticationService;
 
     @Transactional
     public void processSSOPostLogin(
@@ -148,16 +147,15 @@ public class UserService implements UserServiceInterface {
     }
 
     public Authentication getAuthentication(String apiKey) {
-        // Resolve through the shared service (multi-key table, then the legacy per-user column).
-        // The key runs as its owner with the owner's authorities.
-        var resolved =
-                apiKeyAuthenticationService
-                        .authenticate(apiKey)
-                        .orElseThrow(() -> new UsernameNotFoundException("API key is not valid"));
-        return new UsernamePasswordAuthenticationToken(
-                resolved.user(), // principal
-                null, // credentials (we don't expose the password or API key here)
-                resolved.authorities()); // the owner's authorities
+        Optional<User> user = getUserByApiKey(apiKey);
+        if (user.isEmpty()) {
+            throw new UsernameNotFoundException("API key is not valid");
+        }
+        // Convert the user into an Authentication object
+        return new UsernamePasswordAuthenticationToken( // principal (typically the user)
+                user, // credentials (we don't expose the password or API key here)
+                null, // user's authorities (roles/permissions)
+                getAuthorities(user.get()));
     }
 
     private Collection<? extends GrantedAuthority> getAuthorities(User user) {
@@ -175,9 +173,6 @@ public class UserService implements UserServiceInterface {
 
     public User addApiKeyToUser(String username) {
         Optional<User> userOpt = findByUsernameIgnoreCase(username);
-        // Rotating/regenerating the legacy key must also revoke its migrated api_keys shadow row,
-        // otherwise the old secret keeps authenticating (it resolves from api_keys first).
-        userOpt.map(User::getApiKey).ifPresent(apiKeyAuthenticationService::revokeMigratedKey);
         User user = saveUser(userOpt, generateApiKey());
         try {
             databaseService.exportDatabase();
@@ -225,8 +220,7 @@ public class UserService implements UserServiceInterface {
     }
 
     public Optional<User> getUserByApiKey(String apiKey) {
-        // Resolves the multi-key api_keys table first, then the legacy per-user column.
-        return apiKeyAuthenticationService.resolveUser(apiKey);
+        return userRepository.findByApiKey(apiKey);
     }
 
     public Optional<User> loadUserByApiKey(String apiKey) {

app/proprietary/src/main/java/stirling/software/proprietary/service/PortalDocumentsService.java

@@ -65,13 +65,12 @@ public class PortalDocumentsService {
             // "API". The automation marker distinguishes a policy-run step from real API traffic.
             boolean automation = isAutomation(data);
             String policyName = asString(data.get("policyName"));
-            String origin = asString(data.get("__origin"));
             String source =
                     automation
                             ? (policyName != null && !policyName.isBlank()
                                     ? "Policy: " + policyName
                                     : "Policy automation")
-                            : sourceLabel(origin, asString(data.get("__apiKeyLabel")));
+                            : sourceLabel(asString(data.get("__origin")));
             String product = automation ? "Automation" : productLabel(source);
             String action = prettyTool(path);
             boolean failed = isFailure(data);
@@ -174,12 +173,9 @@ public class PortalDocumentsService {
         return code instanceof Number n && n.intValue() >= 400;
     }
 
-    private static String sourceLabel(String origin, String apiKeyLabel) {
+    private static String sourceLabel(String origin) {
         if ("API".equals(origin)) {
-            // Attribute to the specific named key when known, else the generic API channel.
-            return apiKeyLabel != null && !apiKeyLabel.isBlank()
-                    ? "API key · " + apiKeyLabel
-                    : "API integration";
+            return "API integration";
         }
         if ("SYSTEM".equals(origin)) {
             return "System";
@@ -188,8 +184,7 @@ public class PortalDocumentsService {
     }
 
     private static String productLabel(String source) {
-        // Covers both the generic "API integration" and per-key "API key · <label>" sources.
-        return source != null && source.startsWith("API") ? "API" : "Editor";
+        return "API integration".equals(source) ? "API" : "Editor";
     }
 
     private static boolean isAutomation(Map<String, Object> data) {

app/proprietary/src/test/java/stirling/software/proprietary/integration/service/IntegrationConfigServiceTest.java

@@ -13,9 +13,9 @@ import java.util.Map;
 import java.util.Optional;
 import java.util.Set;
 
-import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.InjectMocks;
 import org.mockito.Mock;
 import org.mockito.junit.jupiter.MockitoExtension;
 import org.springframework.http.HttpStatus;
@@ -52,58 +52,7 @@ class IntegrationConfigServiceTest {
     @Mock
     private stirling.software.proprietary.access.repository.ResourceGrantRepository grantRepository;
 
-    @Mock private IntegrationConfigValidator validator;
-    @Mock private IntegrationConfigUsageCheck usageCheck;
-
-    private IntegrationConfigService service;
-
-    @BeforeEach
-    void setUp() {
-        service =
-                new IntegrationConfigService(
-                        repository,
-                        ownership,
-                        secretMasker,
-                        grantRepository,
-                        List.of(validator),
-                        List.of(usageCheck));
-    }
-
-    @Test
-    void createRejectsAConfigItsTypeValidatorRefuses() {
-        when(secretMasker.sanitize(any())).thenReturn(Map.of());
-        when(validator.type()).thenReturn(IntegrationType.API);
-        org.mockito.Mockito.doThrow(new IllegalArgumentException("api config needs a 'url'"))
-                .when(validator)
-                .validate(any());
-
-        assertThatThrownBy(
-                        () ->
-                                service.create(
-                                        request(IntegrationType.API, OwnerScope.USER, null),
-                                        user(7)))
-                .isInstanceOf(ResponseStatusException.class)
-                .satisfies(
-                        e ->
-                                assertThat(((ResponseStatusException) e).getStatusCode())
-                                        .isEqualTo(HttpStatus.BAD_REQUEST));
-    }
-
-    @Test
-    void deleteRefusedWhileAnythingStillReferencesTheConfig() {
-        IntegrationConfig cfg = config(9L);
-        when(repository.findById(9L)).thenReturn(Optional.of(cfg));
-        when(ownership.canManage(any(), eq(cfg), any())).thenReturn(true);
-        when(usageCheck.usagesOf(9L)).thenReturn(List.of("source 'Claims intake'"));
-
-        assertThatThrownBy(() -> service.delete(9L, user(7)))
-                .isInstanceOf(ResponseStatusException.class)
-                .satisfies(
-                        e ->
-                                assertThat(((ResponseStatusException) e).getStatusCode())
-                                        .isEqualTo(HttpStatus.CONFLICT));
-        verify(repository, org.mockito.Mockito.never()).delete(any(IntegrationConfig.class));
-    }
+    @InjectMocks private IntegrationConfigService service;
 
     @Test
     void createDelegatesOwnershipAndSanitizesConfig() {

app/proprietary/src/test/java/stirling/software/proprietary/policy/controller/PolicyControllerTest.java

@@ -4,7 +4,6 @@ import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.eq;
-import static org.mockito.Mockito.doThrow;
 import static org.mockito.Mockito.never;
 import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
@@ -195,29 +194,6 @@ class PolicyControllerTest {
                                     assertThat(((ResponseStatusException) e).getStatusCode())
                                             .isEqualTo(HttpStatus.BAD_REQUEST));
         }
-
-        @Test
-        @DisplayName("rejects an ad-hoc output the caller cannot use, on the request thread")
-        void rejectsUnauthorizedAdHocOutput() {
-            // The confused-deputy guard: an S3 output referencing a connection the caller may not
-            // use is validated here (principal present) and refused before any worker dispatch.
-            PipelineDefinition definition =
-                    new PipelineDefinition(
-                            "pipe",
-                            List.of(new PipelineStep("/api/v1/misc/compress-pdf", null)),
-                            new OutputSpec("s3", Map.of("connectionId", 999)));
-            doThrow(new IllegalArgumentException("unknown or inaccessible s3 connection"))
-                    .when(policyValidator)
-                    .validateOutput(any());
-
-            assertThatThrownBy(() -> controller.run(definition, new PolicyRunFiles()))
-                    .isInstanceOf(ResponseStatusException.class)
-                    .satisfies(
-                            e ->
-                                    assertThat(((ResponseStatusException) e).getStatusCode())
-                                            .isEqualTo(HttpStatus.BAD_REQUEST));
-            verify(policyRunner, never()).runAdHoc(any(), any(), any());
-        }
     }
 
     @Nested

app/proprietary/src/test/java/stirling/software/proprietary/policy/engine/PolicyValidatorTest.java

@@ -82,28 +82,6 @@ class PolicyValidatorTest {
         assertTrue(ex.getMessage().contains("schedule"));
     }
 
-    @Test
-    void validateOutputDelegatesToTheSink() {
-        when(outputSink.supports(any())).thenReturn(true);
-        OutputSpec output = new OutputSpec("s3", Map.of("connectionId", 1));
-
-        validator.validateOutput(output);
-
-        verify(outputSink).validate(output);
-    }
-
-    @Test
-    void validateOutputSurfacesAnInaccessibleConnection() {
-        when(outputSink.supports(any())).thenReturn(true);
-        doThrow(new IllegalArgumentException("unknown or inaccessible s3 connection"))
-                .when(outputSink)
-                .validate(any());
-
-        assertThrows(
-                IllegalArgumentException.class,
-                () -> validator.validateOutput(new OutputSpec("s3", Map.of("connectionId", 1))));
-    }
-
     @Test
     void rejectsAnUnknownTriggerType() {
         when(trigger.type()).thenReturn("schedule");

app/proprietary/src/test/java/stirling/software/proprietary/policy/input/S3InputSourceMinioTest.java

@@ -23,7 +23,6 @@ import stirling.software.common.model.ApplicationProperties;
 import stirling.software.proprietary.policy.ledger.InProcessProcessedLedger;
 import stirling.software.proprietary.policy.model.InputSpec;
 import stirling.software.proprietary.policy.s3.S3ConnectionPool;
-import stirling.software.proprietary.policy.s3.S3TestConnections;
 
 import software.amazon.awssdk.auth.credentials.AwsBasicCredentials;
 import software.amazon.awssdk.auth.credentials.StaticCredentialsProvider;
@@ -83,9 +82,7 @@ class S3InputSourceMinioTest {
         // The MinIO endpoint resolves to loopback, so the operator opt-in must be on.
         ApplicationProperties properties = new ApplicationProperties();
         properties.getPolicies().setAllowPrivateS3Endpoints(true);
-        source =
-                new S3InputSource(
-                        new S3ConnectionPool(properties), S3TestConnections.legacyResolver());
+        source = new S3InputSource(new S3ConnectionPool(properties));
         ledger = new InProcessProcessedLedger();
         ctx = new RecordingContext();
     }
@@ -164,9 +161,7 @@ class S3InputSourceMinioTest {
     @Test
     void aPrivateEndpointIsRejectedWithoutTheOperatorOptIn() {
         S3InputSource guarded =
-                new S3InputSource(
-                        new S3ConnectionPool(new ApplicationProperties()),
-                        S3TestConnections.legacyResolver());
+                new S3InputSource(new S3ConnectionPool(new ApplicationProperties()));
 
         assertThatThrownBy(() -> guarded.validate(spec(Map.of())))
                 .isInstanceOf(IllegalArgumentException.class)

app/proprietary/src/test/java/stirling/software/proprietary/policy/input/S3InputSourceTest.java

@@ -29,7 +29,6 @@ import stirling.software.common.model.ApplicationProperties;
 import stirling.software.proprietary.policy.ledger.InProcessProcessedLedger;
 import stirling.software.proprietary.policy.model.InputSpec;
 import stirling.software.proprietary.policy.s3.S3ConnectionPool;
-import stirling.software.proprietary.policy.s3.S3TestConnections;
 
 import software.amazon.awssdk.core.ResponseInputStream;
 import software.amazon.awssdk.core.exception.SdkClientException;
@@ -65,8 +64,7 @@ class S3InputSourceTest {
     void setUp() {
         source =
                 new S3InputSource(
-                        new S3ConnectionPool(new ApplicationProperties(), config -> s3Client),
-                        S3TestConnections.legacyResolver());
+                        new S3ConnectionPool(new ApplicationProperties(), config -> s3Client));
         ledger = new InProcessProcessedLedger();
         ctx = new RecordingContext();
     }

app/proprietary/src/test/java/stirling/software/proprietary/policy/output/S3OutputSinkMinioTest.java

@@ -28,7 +28,6 @@ import stirling.software.proprietary.policy.ledger.InProcessProcessedLedger;
 import stirling.software.proprietary.policy.model.InputSpec;
 import stirling.software.proprietary.policy.model.OutputSpec;
 import stirling.software.proprietary.policy.s3.S3ConnectionPool;
-import stirling.software.proprietary.policy.s3.S3TestConnections;
 
 import software.amazon.awssdk.auth.credentials.AwsBasicCredentials;
 import software.amazon.awssdk.auth.credentials.StaticCredentialsProvider;
@@ -91,8 +90,8 @@ class S3OutputSinkMinioTest {
         properties.getPolicies().setAllowPrivateS3Endpoints(true);
         S3ConnectionPool pool = new S3ConnectionPool(properties);
         ledger = new InProcessProcessedLedger();
-        sink = new S3OutputSink(pool, S3TestConnections.legacyResolver(), ledger);
-        source = new S3InputSource(pool, S3TestConnections.legacyResolver());
+        sink = new S3OutputSink(pool, ledger);
+        source = new S3InputSource(pool);
     }
 
     @Test

app/proprietary/src/test/java/stirling/software/proprietary/policy/output/S3OutputSinkTest.java

@@ -32,7 +32,6 @@ import stirling.software.proprietary.policy.ledger.InProcessProcessedLedger;
 import stirling.software.proprietary.policy.ledger.ProcessedFileStatus;
 import stirling.software.proprietary.policy.model.OutputSpec;
 import stirling.software.proprietary.policy.s3.S3ConnectionPool;
-import stirling.software.proprietary.policy.s3.S3TestConnections;
 
 import software.amazon.awssdk.awscore.exception.AwsServiceException;
 import software.amazon.awssdk.core.exception.SdkClientException;
@@ -67,7 +66,6 @@ class S3OutputSinkTest {
         sink =
                 new S3OutputSink(
                         new S3ConnectionPool(new ApplicationProperties(), config -> s3Client),
-                        S3TestConnections.legacyResolver(),
                         ledger);
     }
 

app/proprietary/src/test/java/stirling/software/proprietary/policy/s3/EmbeddedS3CredentialMigrationTest.java

@@ -1,212 +0,0 @@
-package stirling.software.proprietary.policy.s3;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertNull;
-import static org.mockito.ArgumentMatchers.any;
-import static org.mockito.Mockito.lenient;
-import static org.mockito.Mockito.times;
-import static org.mockito.Mockito.verify;
-import static org.mockito.Mockito.when;
-
-import java.util.List;
-import java.util.Map;
-import java.util.Optional;
-import java.util.concurrent.atomic.AtomicLong;
-
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.extension.ExtendWith;
-import org.mockito.Mock;
-import org.mockito.junit.jupiter.MockitoExtension;
-
-import stirling.software.proprietary.access.model.OwnerScope;
-import stirling.software.proprietary.integration.model.IntegrationConfig;
-import stirling.software.proprietary.integration.repository.IntegrationConfigRepository;
-import stirling.software.proprietary.model.Team;
-import stirling.software.proprietary.policy.model.OutputSpec;
-import stirling.software.proprietary.policy.model.PipelineStep;
-import stirling.software.proprietary.policy.model.Policy;
-import stirling.software.proprietary.policy.source.InProcessSourceStore;
-import stirling.software.proprietary.policy.source.Source;
-import stirling.software.proprietary.policy.store.InProcessPolicyStore;
-import stirling.software.proprietary.security.repository.TeamRepository;
-
-/**
- * Tests for {@link EmbeddedS3CredentialMigration}: legacy embedded credentials become deduplicated
- * team-scoped connections, rewritten rows keep only per-use options, and re-runs are no-ops.
- */
-@ExtendWith(MockitoExtension.class)
-class EmbeddedS3CredentialMigrationTest {
-
-    @Mock private IntegrationConfigRepository connections;
-    @Mock private TeamRepository teamRepository;
-
-    private final InProcessSourceStore sourceStore = new InProcessSourceStore();
-    private final InProcessPolicyStore policyStore = new InProcessPolicyStore();
-    private EmbeddedS3CredentialMigration migration;
-
-    @BeforeEach
-    void setUp() {
-        migration =
-                new EmbeddedS3CredentialMigration(
-                        sourceStore, policyStore, connections, teamRepository);
-        AtomicLong ids = new AtomicLong(100);
-        // Lenient: the nothing-to-migrate cases never create a connection.
-        lenient().when(connections.findAll()).thenReturn(List.of());
-        lenient()
-                .when(connections.save(any()))
-                .thenAnswer(
-                        invocation -> {
-                            IntegrationConfig saved = invocation.getArgument(0);
-                            if (saved.getId() == null) {
-                                saved.setId(ids.incrementAndGet());
-                            }
-                            return saved;
-                        });
-    }
-
-    @Test
-    void extractsSharedCredentialsIntoOneTeamScopedConnection() {
-        Team team = new Team();
-        team.setId(7L);
-        when(teamRepository.findById(7L)).thenReturn(Optional.of(team));
-        Source source =
-                sourceStore.save(
-                        new Source(
-                                null,
-                                "Claims intake",
-                                "s3",
-                                Map.of(
-                                        "bucket", "inbox",
-                                        "prefix", "incoming/",
-                                        "mode", "snapshot",
-                                        "accessKeyId", "AKIAEXAMPLE",
-                                        "secretAccessKey", "shh"),
-                                true,
-                                "alice",
-                                7L));
-        Policy policy =
-                policyStore.save(
-                        new Policy(
-                                null,
-                                "Rotate",
-                                "alice",
-                                true,
-                                null,
-                                List.of(source.id()),
-                                List.of(new PipelineStep("/api/v1/misc/compress-pdf", Map.of())),
-                                new OutputSpec(
-                                        "s3",
-                                        Map.of(
-                                                "bucket", "inbox",
-                                                "prefix", "processed/",
-                                                "accessKeyId", "AKIAEXAMPLE",
-                                                "secretAccessKey", "shh")),
-                                7L));
-
-        migration.migrate();
-
-        // Same bucket + credentials on both rows: exactly one connection extracted.
-        verify(connections, times(1)).save(any());
-        Map<String, Object> sourceOptions = sourceStore.get(source.id()).orElseThrow().options();
-        assertEquals(101L, sourceOptions.get("connectionId"));
-        assertEquals("incoming/", sourceOptions.get("prefix"));
-        assertEquals("snapshot", sourceOptions.get("mode"));
-        assertNull(sourceOptions.get("accessKeyId"));
-        assertNull(sourceOptions.get("secretAccessKey"));
-        assertNull(sourceOptions.get("bucket"));
-
-        Map<String, Object> outputOptions =
-                policyStore.get(policy.id()).orElseThrow().output().options();
-        assertEquals(101L, outputOptions.get("connectionId"));
-        assertEquals("processed/", outputOptions.get("prefix"));
-        assertNull(outputOptions.get("secretAccessKey"));
-    }
-
-    @Test
-    void connectionOwnershipFollowsTheSourceTeam() {
-        Team team = new Team();
-        team.setId(7L);
-        when(teamRepository.findById(7L)).thenReturn(Optional.of(team));
-        sourceStore.save(s3Source("teamed", 7L));
-
-        migration.migrate();
-
-        verify(connections)
-                .save(
-                        org.mockito.ArgumentMatchers.argThat(
-                                connection ->
-                                        connection.getScope() == OwnerScope.TEAM
-                                                && connection.getOwnerTeam() == team));
-    }
-
-    @Test
-    void teamlessRowsBecomeServerScopedConnections() {
-        sourceStore.save(s3Source("solo", null));
-
-        migration.migrate();
-
-        verify(connections)
-                .save(
-                        org.mockito.ArgumentMatchers.argThat(
-                                connection -> connection.getScope() == OwnerScope.SERVER));
-    }
-
-    @Test
-    void aSecondRunFindsNothingToDo() {
-        sourceStore.save(s3Source("once", null));
-
-        migration.migrate();
-        migration.migrate();
-
-        // One connection from the first run; the rewritten source no longer embeds credentials.
-        verify(connections, times(1)).save(any());
-    }
-
-    @Test
-    void nonS3AndAlreadyMigratedRowsAreUntouched() {
-        Source folder =
-                sourceStore.save(
-                        new Source(
-                                null,
-                                "Folder",
-                                "folder",
-                                Map.of("directory", "/in"),
-                                true,
-                                "alice",
-                                null));
-        Source migrated =
-                sourceStore.save(
-                        new Source(
-                                null,
-                                "Done already",
-                                "s3",
-                                Map.of("connectionId", 55L, "prefix", "in/"),
-                                true,
-                                "alice",
-                                null));
-
-        migration.migrate();
-
-        verify(connections, times(0)).save(any());
-        assertEquals(
-                Map.of("directory", "/in"), sourceStore.get(folder.id()).orElseThrow().options());
-        assertEquals(
-                Map.of("connectionId", 55L, "prefix", "in/"),
-                sourceStore.get(migrated.id()).orElseThrow().options());
-    }
-
-    private static Source s3Source(String name, Long teamId) {
-        return new Source(
-                null,
-                name,
-                "s3",
-                Map.of(
-                        "bucket", "inbox",
-                        "accessKeyId", "AKIAEXAMPLE",
-                        "secretAccessKey", "shh"),
-                true,
-                "alice",
-                teamId);
-    }
-}

app/proprietary/src/test/java/stirling/software/proprietary/policy/s3/PolicyS3ConnectionUsageCheckTest.java

@@ -1,52 +0,0 @@
-package stirling.software.proprietary.policy.s3;
-
-import static org.assertj.core.api.Assertions.assertThat;
-
-import java.util.List;
-import java.util.Map;
-
-import org.junit.jupiter.api.Test;
-
-import stirling.software.proprietary.policy.model.OutputSpec;
-import stirling.software.proprietary.policy.model.PipelineStep;
-import stirling.software.proprietary.policy.model.Policy;
-import stirling.software.proprietary.policy.source.InProcessSourceStore;
-import stirling.software.proprietary.policy.source.Source;
-import stirling.software.proprietary.policy.store.InProcessPolicyStore;
-
-/** Tests for {@link PolicyS3ConnectionUsageCheck}'s reference scan across sources and outputs. */
-class PolicyS3ConnectionUsageCheckTest {
-
-    private final InProcessSourceStore sourceStore = new InProcessSourceStore();
-    private final InProcessPolicyStore policyStore = new InProcessPolicyStore();
-    private final PolicyS3ConnectionUsageCheck check =
-            new PolicyS3ConnectionUsageCheck(sourceStore, policyStore);
-
-    @Test
-    void reportsSourcesAndOutputsReferencingTheConnection() {
-        sourceStore.save(
-                new Source(
-                        null,
-                        "Claims intake",
-                        "s3",
-                        Map.of("connectionId", 5L, "prefix", "in/"),
-                        true,
-                        "alice",
-                        null));
-        policyStore.save(
-                new Policy(
-                        null,
-                        "Rotate",
-                        "alice",
-                        true,
-                        null,
-                        List.of(),
-                        List.of(new PipelineStep("/api/v1/misc/compress-pdf", Map.of())),
-                        new OutputSpec("s3", Map.of("connectionId", "5")),
-                        null));
-
-        assertThat(check.usagesOf(5))
-                .containsExactlyInAnyOrder("source 'Claims intake'", "pipeline 'Rotate'");
-        assertThat(check.usagesOf(6)).isEmpty();
-    }
-}

app/proprietary/src/test/java/stirling/software/proprietary/policy/s3/S3ConnectionResolverTest.java

@@ -1,149 +0,0 @@
-package stirling.software.proprietary.policy.s3;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertThrows;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-import static org.mockito.ArgumentMatchers.any;
-import static org.mockito.ArgumentMatchers.eq;
-import static org.mockito.Mockito.when;
-
-import java.util.Map;
-import java.util.Optional;
-
-import org.junit.jupiter.api.AfterEach;
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.extension.ExtendWith;
-import org.mockito.Mock;
-import org.mockito.junit.jupiter.MockitoExtension;
-import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
-import org.springframework.security.core.context.SecurityContextHolder;
-
-import stirling.software.proprietary.access.service.OwnershipService;
-import stirling.software.proprietary.integration.model.IntegrationConfig;
-import stirling.software.proprietary.integration.model.IntegrationType;
-import stirling.software.proprietary.integration.repository.IntegrationConfigRepository;
-import stirling.software.proprietary.security.model.User;
-import stirling.software.proprietary.security.service.UserService;
-
-/**
- * Tests for {@link S3ConnectionResolver}: connection dereferencing with per-use overrides, the
- * legacy embedded fallback, and the save-time access check that background sweeps skip.
- */
-@ExtendWith(MockitoExtension.class)
-class S3ConnectionResolverTest {
-
-    @Mock private IntegrationConfigRepository connections;
-    @Mock private OwnershipService ownership;
-    @Mock private UserService userService;
-
-    @AfterEach
-    void clearSecurityContext() {
-        SecurityContextHolder.clearContext();
-    }
-
-    @Test
-    void resolvesAConnectionAndMergesPerUseOptions() {
-        when(connections.findById(9L)).thenReturn(Optional.of(s3Connection(9L, true)));
-
-        S3Config config =
-                resolver()
-                        .resolve(
-                                Map.of(
-                                        "connectionId", 9L,
-                                        "prefix", "incoming/",
-                                        "mode", "snapshot"));
-
-        assertEquals("inbox", config.bucket());
-        assertEquals("AKIAEXAMPLE", config.accessKeyId());
-        assertEquals("incoming/", config.prefix());
-        assertTrue(config.snapshot());
-    }
-
-    @Test
-    void acceptsAStringConnectionReference() {
-        when(connections.findById(9L)).thenReturn(Optional.of(s3Connection(9L, true)));
-
-        assertEquals("inbox", resolver().resolve(Map.of("connectionId", "9")).bucket());
-    }
-
-    @Test
-    void fallsBackToLegacyEmbeddedCredentials() {
-        S3Config config =
-                resolver()
-                        .resolve(
-                                Map.of(
-                                        "bucket", "legacy",
-                                        "accessKeyId", "AKIAEXAMPLE",
-                                        "secretAccessKey", "shh"));
-
-        assertEquals("legacy", config.bucket());
-    }
-
-    @Test
-    void rejectsUnknownDisabledOrWrongTypeConnections() {
-        when(connections.findById(1L)).thenReturn(Optional.empty());
-        assertThrows(
-                IllegalArgumentException.class,
-                () -> resolver().resolve(Map.of("connectionId", 1L)));
-
-        when(connections.findById(2L)).thenReturn(Optional.of(s3Connection(2L, false)));
-        assertThrows(
-                IllegalArgumentException.class,
-                () -> resolver().resolve(Map.of("connectionId", 2L)));
-
-        IntegrationConfig mcp = s3Connection(3L, true);
-        mcp.setIntegrationType(IntegrationType.MCP);
-        when(connections.findById(3L)).thenReturn(Optional.of(mcp));
-        assertThrows(
-                IllegalArgumentException.class,
-                () -> resolver().resolve(Map.of("connectionId", 3L)));
-    }
-
-    @Test
-    void anAuthenticatedSaverMustBeAllowedToUseTheConnection() {
-        when(connections.findById(9L)).thenReturn(Optional.of(s3Connection(9L, true)));
-        User saver = new User();
-        saver.setUsername("alice");
-        SecurityContextHolder.getContext()
-                .setAuthentication(
-                        new UsernamePasswordAuthenticationToken(saver, null, java.util.List.of()));
-        when(ownership.canUse(any(), any(IntegrationConfig.class), eq(saver))).thenReturn(false);
-
-        // Denied reads the same as unknown and never echoes the connection name, so ids can't be
-        // enumerated by probing.
-        assertThrows(
-                IllegalArgumentException.class,
-                () -> resolver().resolve(Map.of("connectionId", 9L)));
-        try {
-            resolver().resolve(Map.of("connectionId", 9L));
-        } catch (IllegalArgumentException e) {
-            org.junit.jupiter.api.Assertions.assertFalse(
-                    e.getMessage().contains("Claims bucket"),
-                    "access-denied error must not leak the connection name");
-        }
-    }
-
-    @Test
-    void backgroundSweepsWithNoUserSkipTheAccessCheck() {
-        when(connections.findById(9L)).thenReturn(Optional.of(s3Connection(9L, true)));
-
-        // No authentication in the context: resolution succeeds without consulting ownership.
-        assertEquals("inbox", resolver().resolve(Map.of("connectionId", 9L)).bucket());
-    }
-
-    private S3ConnectionResolver resolver() {
-        return new S3ConnectionResolver(connections, ownership, userService);
-    }
-
-    private static IntegrationConfig s3Connection(long id, boolean enabled) {
-        IntegrationConfig connection = new IntegrationConfig();
-        connection.setId(id);
-        connection.setIntegrationType(IntegrationType.S3);
-        connection.setName("Claims bucket");
-        connection.setEnabled(enabled);
-        connection.setConfig(
-                "{\"bucket\":\"inbox\",\"accessKeyId\":\"AKIAEXAMPLE\","
-                        + "\"secretAccessKey\":\"shh\"}");
-        return connection;
-    }
-}

app/proprietary/src/test/java/stirling/software/proprietary/policy/s3/S3IntegrationValidatorTest.java

@@ -1,71 +0,0 @@
-package stirling.software.proprietary.policy.s3;
-
-import static org.assertj.core.api.Assertions.assertThatCode;
-import static org.assertj.core.api.Assertions.assertThatThrownBy;
-
-import java.util.Map;
-
-import org.junit.jupiter.api.Test;
-
-import stirling.software.common.model.ApplicationProperties;
-import stirling.software.proprietary.integration.model.IntegrationType;
-
-/**
- * Tests for {@link S3IntegrationValidator}: the S3 connection schema fails at save time - missing
- * credentials, bad endpoints, and private endpoints without the operator opt-in.
- */
-class S3IntegrationValidatorTest {
-
-    @Test
-    void acceptsACompleteConnection() {
-        assertThatCode(
-                        () ->
-                                validator(false)
-                                        .validate(
-                                                Map.of(
-                                                        "bucket", "inbox",
-                                                        "accessKeyId", "AKIAEXAMPLE",
-                                                        "secretAccessKey", "shh")))
-                .doesNotThrowAnyException();
-    }
-
-    @Test
-    void rejectsMissingCredentialsOrBucket() {
-        assertThatThrownBy(() -> validator(false).validate(Map.of("bucket", "inbox")))
-                .isInstanceOf(IllegalArgumentException.class);
-        assertThatThrownBy(
-                        () ->
-                                validator(false)
-                                        .validate(
-                                                Map.of(
-                                                        "accessKeyId", "AKIAEXAMPLE",
-                                                        "secretAccessKey", "shh")))
-                .isInstanceOf(IllegalArgumentException.class);
-    }
-
-    @Test
-    void rejectsAPrivateEndpointWithoutTheOperatorOptIn() {
-        Map<String, Object> config =
-                Map.of(
-                        "bucket", "inbox",
-                        "accessKeyId", "AKIAEXAMPLE",
-                        "secretAccessKey", "shh",
-                        "endpoint", "http://localhost:9000");
-
-        assertThatThrownBy(() -> validator(false).validate(config))
-                .isInstanceOf(IllegalArgumentException.class)
-                .hasMessageContaining("allowPrivateS3Endpoints");
-        assertThatCode(() -> validator(true).validate(config)).doesNotThrowAnyException();
-    }
-
-    @Test
-    void itOnlyClaimsTheS3Type() {
-        org.junit.jupiter.api.Assertions.assertEquals(IntegrationType.S3, validator(false).type());
-    }
-
-    private static S3IntegrationValidator validator(boolean allowPrivateEndpoints) {
-        ApplicationProperties properties = new ApplicationProperties();
-        properties.getPolicies().setAllowPrivateS3Endpoints(allowPrivateEndpoints);
-        return new S3IntegrationValidator(properties);
-    }
-}

app/proprietary/src/test/java/stirling/software/proprietary/policy/s3/S3TestConnections.java

@@ -1,24 +0,0 @@
-package stirling.software.proprietary.policy.s3;
-
-import static org.mockito.Mockito.mock;
-
-import stirling.software.proprietary.access.service.OwnershipService;
-import stirling.software.proprietary.integration.repository.IntegrationConfigRepository;
-import stirling.software.proprietary.security.service.UserService;
-
-/** Test fixtures for S3 connection plumbing shared across the policy S3 tests. */
-public final class S3TestConnections {
-
-    private S3TestConnections() {}
-
-    /**
-     * A resolver for tests whose options embed credentials directly (the legacy pass-through path),
-     * so its collaborators are never touched.
-     */
-    public static S3ConnectionResolver legacyResolver() {
-        return new S3ConnectionResolver(
-                mock(IntegrationConfigRepository.class),
-                mock(OwnershipService.class),
-                mock(UserService.class));
-    }
-}

app/proprietary/src/test/java/stirling/software/proprietary/security/configuration/SecurityConfigurationTest.java

@@ -29,7 +29,6 @@ import stirling.software.proprietary.security.database.repository.PersistentLogi
 import stirling.software.proprietary.security.filter.IPRateLimitingFilter;
 import stirling.software.proprietary.security.filter.JwtAuthenticationFilter;
 import stirling.software.proprietary.security.filter.UserAuthenticationFilter;
-import stirling.software.proprietary.security.service.ApiKeyAuthenticationService;
 import stirling.software.proprietary.security.service.CustomUserDetailsService;
 import stirling.software.proprietary.security.service.JwtServiceInterface;
 import stirling.software.proprietary.security.service.LoginAttemptService;
@@ -161,9 +160,7 @@ class SecurityConfigurationTest {
         @Test
         @DisplayName("jwtAuthenticationFilter is created")
         void jwtAuthenticationFilter() {
-            JwtAuthenticationFilter filter =
-                    newConfig(true)
-                            .jwtAuthenticationFilter(mock(ApiKeyAuthenticationService.class));
+            JwtAuthenticationFilter filter = newConfig(true).jwtAuthenticationFilter();
             assertThat(filter).isNotNull();
         }
 

app/proprietary/src/test/java/stirling/software/proprietary/security/filter/UserAuthenticationFilterTest.java

@@ -29,8 +29,6 @@ import org.springframework.security.core.session.SessionInformation;
 import stirling.software.common.model.ApplicationProperties;
 import stirling.software.proprietary.security.model.ApiKeyAuthenticationToken;
 import stirling.software.proprietary.security.model.User;
-import stirling.software.proprietary.security.service.ApiKeyAuthenticationService;
-import stirling.software.proprietary.security.service.ApiKeyAuthenticationService.ApiKeyAuthentication;
 import stirling.software.proprietary.security.service.UserService;
 import stirling.software.proprietary.security.session.SessionPersistentRegistry;
 
@@ -39,7 +37,6 @@ import stirling.software.proprietary.security.session.SessionPersistentRegistry;
 class UserAuthenticationFilterTest {
 
     @Mock private UserService userService;
-    @Mock private ApiKeyAuthenticationService apiKeyAuthenticationService;
     @Mock private SessionPersistentRegistry sessionPersistentRegistry;
 
     private ApplicationProperties.Security securityProp;
@@ -63,11 +60,7 @@ class UserAuthenticationFilterTest {
 
     private UserAuthenticationFilter filter(boolean loginEnabled) {
         return new UserAuthenticationFilter(
-                securityProp,
-                userService,
-                apiKeyAuthenticationService,
-                sessionPersistentRegistry,
-                loginEnabled);
+                securityProp, userService, sessionPersistentRegistry, loginEnabled);
     }
 
     private static User enabledUser(String username) {
@@ -106,11 +99,7 @@ class UserAuthenticationFilterTest {
             User user = enabledUser("api-user");
             user.addAuthority(
                     new stirling.software.proprietary.security.model.Authority("ROLE_USER", user));
-            when(apiKeyAuthenticationService.authenticate("good-key"))
-                    .thenReturn(
-                            Optional.of(
-                                    new ApiKeyAuthentication(
-                                            user, "Prod (sk_demo0000)", user.getAuthorities())));
+            when(userService.getUserByApiKey("good-key")).thenReturn(Optional.of(user));
             when(userService.usernameExistsIgnoreCase("api-user")).thenReturn(true);
             when(userService.isUserDisabled("api-user")).thenReturn(false);
             when(sessionPersistentRegistry.getAllSessions(any(), anyBoolean()))
@@ -128,7 +117,7 @@ class UserAuthenticationFilterTest {
         void invalidApiKeyRejected() throws Exception {
             request.setRequestURI("/api/v1/some/protected");
             request.addHeader("X-API-KEY", "bad-key");
-            when(apiKeyAuthenticationService.authenticate("bad-key")).thenReturn(Optional.empty());
+            when(userService.getUserByApiKey("bad-key")).thenReturn(Optional.empty());
 
             filter(true).doFilter(request, response, filterChain);
 

app/proprietary/src/test/java/stirling/software/proprietary/security/filter/UserBasedRateLimitingFilterTest.java

@@ -1,95 +0,0 @@
-package stirling.software.proprietary.security.filter;
-
-import static org.assertj.core.api.Assertions.assertThat;
-
-import java.util.List;
-
-import org.junit.jupiter.api.AfterEach;
-import org.junit.jupiter.api.DisplayName;
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.extension.ExtendWith;
-import org.mockito.junit.jupiter.MockitoExtension;
-import org.springframework.mock.web.MockFilterChain;
-import org.springframework.mock.web.MockHttpServletRequest;
-import org.springframework.mock.web.MockHttpServletResponse;
-import org.springframework.security.core.authority.SimpleGrantedAuthority;
-import org.springframework.security.core.context.SecurityContextHolder;
-
-import stirling.software.common.model.enumeration.Role;
-import stirling.software.proprietary.security.model.ApiKeyAuthenticationToken;
-import stirling.software.proprietary.security.model.User;
-
-@ExtendWith(MockitoExtension.class)
-@DisplayName("UserBasedRateLimitingFilter")
-class UserBasedRateLimitingFilterTest {
-
-    @AfterEach
-    void clear() {
-        SecurityContextHolder.clearContext();
-    }
-
-    private void authenticateAs(String username) {
-        User u = new User();
-        u.setUsername(username);
-        u.setEnabled(true);
-        SecurityContextHolder.getContext()
-                .setAuthentication(
-                        new ApiKeyAuthenticationToken(
-                                u,
-                                "irrelevant",
-                                List.of(new SimpleGrantedAuthority(Role.USER.getRoleId()))));
-    }
-
-    private long remainingAfterApiPost(UserBasedRateLimitingFilter filter, String apiKey)
-            throws Exception {
-        MockHttpServletRequest req = new MockHttpServletRequest("POST", "/api/v1/general/x");
-        req.addHeader("X-API-KEY", apiKey);
-        MockHttpServletResponse res = new MockHttpServletResponse();
-        filter.doFilter(req, res, new MockFilterChain());
-        return Long.parseLong(res.getHeader("X-Rate-Limit-Remaining"));
-    }
-
-    @Test
-    @DisplayName("all of a user's keys share ONE bucket - minting keys can't multiply the quota")
-    void keysShareOnePerUserBucket() throws Exception {
-        UserBasedRateLimitingFilter filter = new UserBasedRateLimitingFilter(true);
-        authenticateAs("alice");
-
-        long afterKeyA = remainingAfterApiPost(filter, "key-A");
-        long afterKeyB = remainingAfterApiPost(filter, "key-B"); // different key, same user
-
-        // The second (different) key drew from the SAME per-user bucket, so remaining fell by one.
-        // If it were keyed per-API-key, both would report the same remaining.
-        assertThat(afterKeyB).isEqualTo(afterKeyA - 1);
-    }
-
-    @Test
-    @DisplayName("non-POST requests are not rate limited")
-    void nonPostPassesThrough() throws Exception {
-        UserBasedRateLimitingFilter filter = new UserBasedRateLimitingFilter(true);
-        authenticateAs("alice");
-        MockHttpServletRequest req = new MockHttpServletRequest("GET", "/api/v1/general/x");
-        req.addHeader("X-API-KEY", "key-A");
-        MockHttpServletResponse res = new MockHttpServletResponse();
-        MockFilterChain chain = new MockFilterChain();
-
-        filter.doFilter(req, res, chain);
-
-        assertThat(res.getHeader("X-Rate-Limit-Remaining")).isNull();
-        assertThat(chain.getRequest()).isNotNull(); // passed down the chain
-    }
-
-    @Test
-    @DisplayName("rate limiting disabled: passes through untouched")
-    void disabledPassesThrough() throws Exception {
-        UserBasedRateLimitingFilter filter = new UserBasedRateLimitingFilter(false);
-        authenticateAs("alice");
-        MockHttpServletRequest req = new MockHttpServletRequest("POST", "/api/v1/general/x");
-        req.addHeader("X-API-KEY", "key-A");
-        MockHttpServletResponse res = new MockHttpServletResponse();
-
-        filter.doFilter(req, res, new MockFilterChain());
-
-        assertThat(res.getHeader("X-Rate-Limit-Remaining")).isNull();
-    }
-}

app/proprietary/src/test/java/stirling/software/proprietary/security/service/ApiKeyAuthenticationServiceTest.java

@@ -1,148 +0,0 @@
-package stirling.software.proprietary.security.service;
-
-import static org.assertj.core.api.Assertions.assertThat;
-import static org.mockito.Mockito.verify;
-import static org.mockito.Mockito.verifyNoInteractions;
-import static org.mockito.Mockito.when;
-
-import java.time.Instant;
-import java.util.List;
-import java.util.Optional;
-
-import org.junit.jupiter.api.DisplayName;
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.extension.ExtendWith;
-import org.mockito.InjectMocks;
-import org.mockito.Mock;
-import org.mockito.junit.jupiter.MockitoExtension;
-import org.springframework.security.core.GrantedAuthority;
-
-import stirling.software.common.model.enumeration.Role;
-import stirling.software.proprietary.security.database.repository.UserRepository;
-import stirling.software.proprietary.security.model.ApiKey;
-import stirling.software.proprietary.security.model.Authority;
-import stirling.software.proprietary.security.model.User;
-import stirling.software.proprietary.security.repository.ApiKeyRepository;
-
-@ExtendWith(MockitoExtension.class)
-@DisplayName("ApiKeyAuthenticationService")
-class ApiKeyAuthenticationServiceTest {
-
-    @Mock private ApiKeyRepository apiKeyRepository;
-    @Mock private ApiKeyUsageRecorder usageRecorder;
-    @Mock private UserRepository userRepository;
-    @InjectMocks private ApiKeyAuthenticationService service;
-
-    private User user(long id, boolean enabled) {
-        User u = new User();
-        u.setId(id);
-        u.setUsername("user" + id);
-        u.setEnabled(enabled);
-        return u;
-    }
-
-    private ApiKey key(long id, long ownerId, boolean enabled, Instant revoked) {
-        return ApiKey.builder()
-                .id(id)
-                .name("Production ingest")
-                .keyHash(ApiKeyHasher.hash("raw-" + id))
-                .prefix("sk_demo0000")
-                .ownerUserId(ownerId)
-                .enabled(enabled)
-                .revokedAt(revoked)
-                .createdAt(Instant.now())
-                .build();
-    }
-
-    @Test
-    @DisplayName("resolves an active multi-key to its owner and records usage")
-    void resolvesActiveKey() {
-        String raw = "raw-1";
-        when(apiKeyRepository.findByKeyHash(ApiKeyHasher.hash(raw)))
-                .thenReturn(Optional.of(key(1, 7, true, null)));
-        when(userRepository.findById(7L)).thenReturn(Optional.of(user(7, true)));
-
-        var result = service.authenticate(raw);
-
-        assertThat(result).isPresent();
-        assertThat(result.get().user().getId()).isEqualTo(7L);
-        assertThat(result.get().auditLabel()).isEqualTo("Production ingest (sk_demo0000)");
-        verify(usageRecorder).record(1L);
-    }
-
-    @Test
-    @DisplayName("rejects a revoked key without recording usage")
-    void rejectsRevokedKey() {
-        String raw = "raw-2";
-        when(apiKeyRepository.findByKeyHash(ApiKeyHasher.hash(raw)))
-                .thenReturn(Optional.of(key(2, 7, true, Instant.now())));
-
-        assertThat(service.authenticate(raw)).isEmpty();
-        verifyNoInteractions(usageRecorder);
-    }
-
-    @Test
-    @DisplayName("rejects a key whose owner is disabled")
-    void rejectsDisabledOwner() {
-        String raw = "raw-3";
-        when(apiKeyRepository.findByKeyHash(ApiKeyHasher.hash(raw)))
-                .thenReturn(Optional.of(key(3, 8, true, null)));
-        when(userRepository.findById(8L)).thenReturn(Optional.of(user(8, false)));
-
-        assertThat(service.authenticate(raw)).isEmpty();
-    }
-
-    @Test
-    @DisplayName("falls back to the legacy per-user column, with no per-key label")
-    void legacyFallback() {
-        String raw = "legacy-key";
-        when(apiKeyRepository.findByKeyHash(ApiKeyHasher.hash(raw))).thenReturn(Optional.empty());
-        when(userRepository.findByApiKey(raw)).thenReturn(Optional.of(user(9, true)));
-
-        var result = service.authenticate(raw);
-
-        assertThat(result).isPresent();
-        assertThat(result.get().user().getId()).isEqualTo(9L);
-        assertThat(result.get().auditLabel()).isNull();
-        verifyNoInteractions(usageRecorder);
-    }
-
-    @Test
-    @DisplayName("blank keys resolve to nothing")
-    void blankKey() {
-        assertThat(service.authenticate("  ")).isEmpty();
-        assertThat(service.resolveUser(null)).isEmpty();
-    }
-
-    @Test
-    @DisplayName("a key authenticates with its owner's authorities (owner acts as self)")
-    void keyKeepsOwnerAuthorities() {
-        String raw = "raw-6";
-        User owner = user(8, true);
-        owner.addAuthority(new Authority(Role.ADMIN.getRoleId(), owner));
-        when(apiKeyRepository.findByKeyHash(ApiKeyHasher.hash(raw)))
-                .thenReturn(Optional.of(key(6, 8, true, null)));
-        when(userRepository.findById(8L)).thenReturn(Optional.of(owner));
-
-        var result = service.authenticate(raw);
-
-        List<String> auths =
-                result.get().authorities().stream().map(GrantedAuthority::getAuthority).toList();
-        assertThat(auths).contains(Role.ADMIN.getRoleId());
-    }
-
-    @Test
-    @DisplayName("revokeMigratedKey disables the shadow row so a rotated legacy key stops working")
-    void revokeMigratedKeyRevokesRow() {
-        String raw = "raw-9";
-        ApiKey shadow = key(9, 1, true, null);
-        when(apiKeyRepository.findByKeyHash(ApiKeyHasher.hash(raw)))
-                .thenReturn(Optional.of(shadow));
-
-        service.revokeMigratedKey(raw);
-
-        assertThat(shadow.isEnabled()).isFalse();
-        assertThat(shadow.getRevokedAt()).isNotNull();
-        verify(apiKeyRepository).save(shadow);
-    }
-}

app/proprietary/src/test/java/stirling/software/proprietary/security/service/ApiKeyHasherTest.java

@@ -1,38 +0,0 @@
-package stirling.software.proprietary.security.service;
-
-import static org.assertj.core.api.Assertions.assertThat;
-
-import org.junit.jupiter.api.DisplayName;
-import org.junit.jupiter.api.Test;
-
-@DisplayName("ApiKeyHasher")
-class ApiKeyHasherTest {
-
-    @Test
-    @DisplayName("generated keys are unique, prefixed, and hash deterministically")
-    void generateAndHash() {
-        String a = ApiKeyHasher.generateRawKey();
-        String b = ApiKeyHasher.generateRawKey();
-
-        assertThat(a).startsWith("sk_").isNotEqualTo(b);
-        // Same input hashes the same; SHA-256 hex is 64 chars.
-        assertThat(ApiKeyHasher.hash(a)).isEqualTo(ApiKeyHasher.hash(a)).hasSize(64);
-        assertThat(ApiKeyHasher.hash(a)).isNotEqualTo(ApiKeyHasher.hash(b));
-    }
-
-    @Test
-    @DisplayName("hash never returns the raw key")
-    void hashHidesRaw() {
-        String raw = ApiKeyHasher.generateRawKey();
-        assertThat(ApiKeyHasher.hash(raw)).isNotEqualTo(raw);
-    }
-
-    @Test
-    @DisplayName("display prefix is a short non-secret leading fragment")
-    void displayPrefix() {
-        String raw = ApiKeyHasher.generateRawKey();
-        String prefix = ApiKeyHasher.displayPrefix(raw);
-        assertThat(prefix).hasSize(11).startsWith("sk_");
-        assertThat(raw).startsWith(prefix);
-    }
-}

app/proprietary/src/test/java/stirling/software/proprietary/security/service/ApiKeyManagementServiceTest.java

@@ -1,198 +0,0 @@
-package stirling.software.proprietary.security.service;
-
-import static org.assertj.core.api.Assertions.assertThat;
-import static org.assertj.core.api.Assertions.assertThatThrownBy;
-import static org.mockito.ArgumentMatchers.any;
-import static org.mockito.ArgumentMatchers.anyLong;
-import static org.mockito.Mockito.lenient;
-import static org.mockito.Mockito.never;
-import static org.mockito.Mockito.verify;
-import static org.mockito.Mockito.when;
-
-import java.time.Instant;
-import java.util.List;
-import java.util.Optional;
-
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.DisplayName;
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.extension.ExtendWith;
-import org.mockito.ArgumentCaptor;
-import org.mockito.InjectMocks;
-import org.mockito.Mock;
-import org.mockito.junit.jupiter.MockitoExtension;
-import org.springframework.web.server.ResponseStatusException;
-
-import stirling.software.proprietary.model.api.apikey.CreateApiKeyRequest;
-import stirling.software.proprietary.model.api.apikey.CreatedApiKeyDto;
-import stirling.software.proprietary.model.api.apikey.PortalApiKeysResponse;
-import stirling.software.proprietary.security.database.repository.UserRepository;
-import stirling.software.proprietary.security.model.ApiKey;
-import stirling.software.proprietary.security.model.User;
-import stirling.software.proprietary.security.repository.ApiKeyDailyUsageRepository;
-import stirling.software.proprietary.security.repository.ApiKeyRepository;
-
-@ExtendWith(MockitoExtension.class)
-@DisplayName("ApiKeyManagementService")
-class ApiKeyManagementServiceTest {
-
-    @Mock private ApiKeyRepository apiKeyRepository;
-    @Mock private ApiKeyDailyUsageRepository usageRepository;
-    @Mock private UserRepository userRepository;
-    @Mock private UserService userService;
-    @Mock private ApiKeyLegacyMigrator legacyMigrator;
-    @InjectMocks private ApiKeyManagementService service;
-
-    private User caller;
-
-    @BeforeEach
-    void setUp() {
-        caller = new User();
-        caller.setId(1L);
-        caller.setUsername("alice");
-        lenient().when(userService.getCurrentUsername()).thenReturn("alice");
-        lenient()
-                .when(userService.findByUsernameIgnoreCase("alice"))
-                .thenReturn(Optional.of(caller));
-        lenient().when(apiKeyRepository.save(any())).thenAnswer(inv -> inv.getArgument(0));
-        lenient().when(usageRepository.countForDayByIds(any(), anyLong())).thenReturn(List.of());
-        lenient().when(usageRepository.sumSinceByIds(any(), anyLong())).thenReturn(List.of());
-    }
-
-    private ApiKey personalKey(long id, long ownerId) {
-        return ApiKey.builder()
-                .id(id)
-                .name("Key " + id)
-                .keyHash("hash" + id)
-                .prefix("sk_demo0000")
-                .ownerUserId(ownerId)
-                .enabled(true)
-                .createdAt(Instant.now())
-                .build();
-    }
-
-    // ---- migration safety ---------------------------------------------------
-
-    @Test
-    @DisplayName("an existing legacy key migrates to an owner-only row")
-    void legacyKeyMigratesAsPersonal() {
-        caller.setApiKey("legacy-raw-key");
-        when(apiKeyRepository.existsByKeyHash(ApiKeyHasher.hash("legacy-raw-key")))
-                .thenReturn(false);
-        when(apiKeyRepository.findByOwnerUserIdOrderByCreatedAtDesc(1L)).thenReturn(List.of());
-
-        service.listVisibleKeys();
-
-        // Migration insert is isolated in its own transaction (ApiKeyLegacyMigrator).
-        ArgumentCaptor<ApiKey> saved = ArgumentCaptor.forClass(ApiKey.class);
-        verify(legacyMigrator).insertMigratedKey(saved.capture());
-        ApiKey migrated = saved.getValue();
-        assertThat(migrated.getOwnerUserId()).isEqualTo(1L);
-    }
-
-    @Test
-    @DisplayName("migration is idempotent - an already-migrated legacy key is not re-saved")
-    void legacyKeyMigrationIdempotent() {
-        caller.setApiKey("legacy-raw-key");
-        when(apiKeyRepository.existsByKeyHash(ApiKeyHasher.hash("legacy-raw-key")))
-                .thenReturn(true);
-        when(apiKeyRepository.findByOwnerUserIdOrderByCreatedAtDesc(1L)).thenReturn(List.of());
-
-        service.listVisibleKeys();
-
-        verify(legacyMigrator, never()).insertMigratedKey(any());
-    }
-
-    // ---- personal isolation -------------------------------------------------
-
-    @Test
-    @DisplayName("listing scopes keys to the caller by owner id")
-    void personalKeysScopedToOwner() {
-        when(apiKeyRepository.findByOwnerUserIdOrderByCreatedAtDesc(1L))
-                .thenReturn(List.of(personalKey(10, 1L)));
-
-        PortalApiKeysResponse res = service.listVisibleKeys();
-
-        assertThat(res.keys()).singleElement().satisfies(k -> assertThat(k.id()).isEqualTo("10"));
-        // Isolation: the query is keyed by the caller's id, never a broad scan.
-        verify(apiKeyRepository).findByOwnerUserIdOrderByCreatedAtDesc(1L);
-    }
-
-    // ---- creation -----------------------------------------------------------
-
-    @Test
-    @DisplayName("a user creates a personal key and gets a one-time secret")
-    void createPersonalKey() {
-        CreatedApiKeyDto created = service.createKey(new CreateApiKeyRequest("My key"));
-
-        assertThat(created.secret()).startsWith("sk_");
-        ArgumentCaptor<ApiKey> saved = ArgumentCaptor.forClass(ApiKey.class);
-        verify(apiKeyRepository).save(saved.capture());
-        assertThat(saved.getValue().getOwnerUserId()).isEqualTo(1L);
-        assertThat(saved.getValue().getName()).isEqualTo("My key");
-    }
-
-    @Test
-    @DisplayName("rejects an over-long key name")
-    void rejectsLongName() {
-        String longName = "a".repeat(101);
-        assertThatThrownBy(() -> service.createKey(new CreateApiKeyRequest(longName)))
-                .isInstanceOf(ResponseStatusException.class)
-                .hasMessageContaining("characters or fewer");
-        verify(apiKeyRepository, never()).save(any());
-    }
-
-    @Test
-    @DisplayName("rejects a blank key name")
-    void rejectsBlankName() {
-        assertThatThrownBy(() -> service.createKey(new CreateApiKeyRequest("  ")))
-                .isInstanceOf(ResponseStatusException.class)
-                .hasMessageContaining("required");
-        verify(apiKeyRepository, never()).save(any());
-    }
-
-    @Test
-    @DisplayName("rejects creating a key past the per-user active-key cap")
-    void rejectsPastActiveKeyCap() {
-        when(apiKeyRepository.findByOwnerUserIdOrderByCreatedAtDesc(1L))
-                .thenReturn(java.util.Collections.nCopies(50, personalKey(100, 1L)));
-
-        assertThatThrownBy(() -> service.createKey(new CreateApiKeyRequest("One too many")))
-                .isInstanceOf(ResponseStatusException.class);
-        verify(apiKeyRepository, never()).save(any());
-    }
-
-    // ---- revocation ---------------------------------------------------------
-
-    @Test
-    @DisplayName("owner revokes their key and the legacy column is cleared")
-    void revokePersonalClearsLegacy() {
-        caller.setApiKey("legacy-raw-key");
-        ApiKey legacyRow = personalKey(30, 1L);
-        legacyRow.setKeyHash(ApiKeyHasher.hash("legacy-raw-key"));
-        when(apiKeyRepository.findById(30L)).thenReturn(Optional.of(legacyRow));
-        when(userRepository.findById(1L)).thenReturn(Optional.of(caller));
-
-        service.revokeKey(30L);
-
-        assertThat(legacyRow.isEnabled()).isFalse();
-        assertThat(legacyRow.getRevokedAt()).isNotNull();
-        assertThat(caller.getApiKey()).isNull();
-        verify(userRepository).save(caller);
-    }
-
-    @Test
-    @DisplayName(
-            "a non-owner cannot revoke someone else's key (404, not 403, so ids can't be probed)")
-    void revokeForeignKeyForbidden() {
-        when(apiKeyRepository.findById(31L)).thenReturn(Optional.of(personalKey(31, 999L)));
-
-        assertThatThrownBy(() -> service.revokeKey(31L))
-                .isInstanceOf(ResponseStatusException.class)
-                .satisfies(
-                        e ->
-                                assertThat(((ResponseStatusException) e).getStatusCode().value())
-                                        .isEqualTo(404));
-        verify(apiKeyRepository, never()).save(any());
-    }
-}

app/proprietary/src/test/java/stirling/software/proprietary/security/service/ApiKeyUsageRecorderTest.java

@@ -1,88 +0,0 @@
-package stirling.software.proprietary.security.service;
-
-import static org.mockito.ArgumentMatchers.anyLong;
-import static org.mockito.ArgumentMatchers.eq;
-import static org.mockito.Mockito.never;
-import static org.mockito.Mockito.times;
-import static org.mockito.Mockito.verify;
-import static org.mockito.Mockito.verifyNoInteractions;
-import static org.mockito.Mockito.when;
-
-import org.junit.jupiter.api.DisplayName;
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.extension.ExtendWith;
-import org.mockito.InjectMocks;
-import org.mockito.Mock;
-import org.mockito.junit.jupiter.MockitoExtension;
-
-/**
- * Unit tests for the increment/insert/increment race protocol. {@code @Async} has no proxy in a
- * plain Mockito test, so {@code record()} runs inline and is directly testable.
- */
-@ExtendWith(MockitoExtension.class)
-@DisplayName("ApiKeyUsageRecorder")
-class ApiKeyUsageRecorderTest {
-
-    private static final long KEY = 7L;
-
-    @Mock private ApiKeyUsageWriter writer;
-    @InjectMocks private ApiKeyUsageRecorder recorder;
-
-    @Test
-    @DisplayName("a null key id is a no-op")
-    void nullIdIsNoOp() {
-        recorder.record(null);
-        verifyNoInteractions(writer);
-    }
-
-    @Test
-    @DisplayName("row already exists: one increment, never inserts")
-    void rowExistsFastPath() {
-        when(writer.increment(eq(KEY), anyLong())).thenReturn(1);
-
-        recorder.record(KEY);
-
-        verify(writer, times(1)).increment(eq(KEY), anyLong());
-        verify(writer, never()).tryInsertFirstUse(anyLong(), anyLong());
-        verify(writer).stampLastUsed(KEY);
-    }
-
-    @Test
-    @DisplayName("first writer of the day: increment misses, insert wins, no second increment")
-    void firstWriterInserts() {
-        when(writer.increment(eq(KEY), anyLong())).thenReturn(0);
-        when(writer.tryInsertFirstUse(eq(KEY), anyLong())).thenReturn(true);
-
-        recorder.record(KEY);
-
-        verify(writer, times(1)).increment(eq(KEY), anyLong());
-        verify(writer).tryInsertFirstUse(eq(KEY), anyLong());
-        verify(writer).stampLastUsed(KEY);
-    }
-
-    @Test
-    @DisplayName(
-            "lost the insert race: falls back to a second increment so the count is not dropped")
-    void lostInsertRaceReincrements() {
-        when(writer.increment(eq(KEY), anyLong())).thenReturn(0);
-        when(writer.tryInsertFirstUse(eq(KEY), anyLong())).thenReturn(false);
-
-        recorder.record(KEY);
-
-        verify(writer, times(2)).increment(eq(KEY), anyLong());
-        verify(writer).stampLastUsed(KEY);
-    }
-
-    @Test
-    @DisplayName("insert throws (rollback-only commit): still re-increments, count not dropped")
-    void insertThrowsStillReincrements() {
-        when(writer.increment(eq(KEY), anyLong())).thenReturn(0);
-        when(writer.tryInsertFirstUse(eq(KEY), anyLong()))
-                .thenThrow(new RuntimeException("UnexpectedRollbackException"));
-
-        recorder.record(KEY);
-
-        verify(writer, times(2)).increment(eq(KEY), anyLong());
-        verify(writer).stampLastUsed(KEY);
-    }
-}

app/proprietary/src/test/java/stirling/software/proprietary/security/service/UserServiceMoreTest.java

@@ -41,7 +41,6 @@ import stirling.software.proprietary.security.model.AuthenticationType;
 import stirling.software.proprietary.security.model.Authority;
 import stirling.software.proprietary.security.model.User;
 import stirling.software.proprietary.security.repository.TeamRepository;
-import stirling.software.proprietary.security.service.ApiKeyAuthenticationService.ApiKeyAuthentication;
 import stirling.software.proprietary.security.session.SessionPersistentRegistry;
 import stirling.software.proprietary.storage.repository.FileShareAccessRepository;
 import stirling.software.proprietary.storage.repository.FileShareRepository;
@@ -77,7 +76,6 @@ class UserServiceMoreTest {
             integrationConfigRepository;
 
     @Mock private TeamMembershipService teamMembershipService;
-    @Mock private ApiKeyAuthenticationService apiKeyAuthenticationService;
 
     @InjectMocks private UserService userService;
 
@@ -101,8 +99,7 @@ class UserServiceMoreTest {
         void getAuthenticationValid() {
             User u = user("api");
             u.addAuthority(new Authority("ROLE_USER", u));
-            when(apiKeyAuthenticationService.authenticate("k"))
-                    .thenReturn(Optional.of(new ApiKeyAuthentication(u, null, u.getAuthorities())));
+            when(userRepository.findByApiKey("k")).thenReturn(Optional.of(u));
 
             assertThat(userService.getAuthentication("k")).isNotNull();
         }
@@ -110,7 +107,7 @@ class UserServiceMoreTest {
         @Test
         @DisplayName("getAuthentication throws when key is unknown")
         void getAuthenticationInvalid() {
-            when(apiKeyAuthenticationService.authenticate("bad")).thenReturn(Optional.empty());
+            when(userRepository.findByApiKey("bad")).thenReturn(Optional.empty());
 
             assertThatThrownBy(() -> userService.getAuthentication("bad"))
                     .isInstanceOf(UsernameNotFoundException.class);

app/proprietary/src/test/java/stirling/software/proprietary/security/service/UserServiceTest.java

@@ -71,7 +71,6 @@ class UserServiceTest {
             integrationConfigRepository;
 
     @Mock private TeamMembershipService teamMembershipService;
-    @Mock private ApiKeyAuthenticationService apiKeyAuthenticationService;
 
     @Spy @InjectMocks private UserService userService;
 
@@ -197,27 +196,6 @@ class UserServiceTest {
         verify(userRepository).save(user);
     }
 
-    @Test
-    void addApiKeyToUserRevokesOldMigratedShadowRow() {
-        User user = new User();
-        user.setUsername("user");
-        user.setApiKey("old-secret");
-        when(userRepository.findByUsernameIgnoreCase("user")).thenReturn(Optional.of(user));
-        when(userRepository.findByApiKey(any())).thenReturn(Optional.empty());
-        when(userRepository.save(any(User.class)))
-                .thenAnswer(invocation -> invocation.getArgument(0));
-
-        User updated = userService.addApiKeyToUser("user");
-
-        // Rotating a legacy key must revoke its migrated api_keys shadow row with the OLD secret,
-        // and do so before the new key is generated - otherwise the old secret keeps
-        // authenticating.
-        org.mockito.InOrder inOrder = inOrder(apiKeyAuthenticationService, userRepository);
-        inOrder.verify(apiKeyAuthenticationService).revokeMigratedKey("old-secret");
-        inOrder.verify(userRepository).save(user);
-        assertNotEquals("old-secret", updated.getApiKey());
-    }
-
     @Test
     void getApiKeyForUserCreatesWhenMissing() {
         User user = new User();

app/proprietary/src/test/java/stirling/software/proprietary/service/PortalDocumentsServiceTest.java

@@ -70,18 +70,4 @@ class PortalDocumentsServiceTest {
         assertThat(doc.getProduct()).isEqualTo("API");
         assertThat(doc.getSource()).isEqualTo("API integration");
     }
-
-    @Test
-    void apiDocumentIsAttributedToItsNamedKey() {
-        PortalReviewDocumentDto doc =
-                onlyDoc(
-                        "{\"path\":\"/api/v1/misc/compress-pdf\",\"__origin\":\"API\","
-                                + "\"__apiKeyLabel\":\"Production ingest (sk_demo0000)\","
-                                + "\"files\":[{\"name\":\"a.pdf\",\"type\":\"application/pdf\"}],"
-                                + "\"statusCode\":200}");
-
-        // The specific key label surfaces as the source; product stays "API".
-        assertThat(doc.getProduct()).isEqualTo("API");
-        assertThat(doc.getSource()).isEqualTo("API key · Production ingest (sk_demo0000)");
-    }
 }

app/saas/src/main/java/stirling/software/saas/security/SupabaseAuthenticationFilter.java

@@ -18,7 +18,6 @@ import java.util.Map;
 import java.util.Optional;
 import java.util.UUID;
 
-import org.slf4j.MDC;
 import org.springframework.dao.DataIntegrityViolationException;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.AuthenticationException;
@@ -44,8 +43,6 @@ import stirling.software.proprietary.security.model.ApiKeyAuthenticationToken;
 import stirling.software.proprietary.security.model.AuthenticationType;
 import stirling.software.proprietary.security.model.Authority;
 import stirling.software.proprietary.security.model.User;
-import stirling.software.proprietary.security.service.ApiKeyAuthenticationService;
-import stirling.software.proprietary.security.service.ApiKeyAuthenticationService.ApiKeyAuthentication;
 import stirling.software.proprietary.security.service.TeamService;
 import stirling.software.proprietary.security.service.UserService;
 import stirling.software.saas.model.AmrMethod;
@@ -68,7 +65,6 @@ public class SupabaseAuthenticationFilter extends OncePerRequestFilter {
     private final SupabaseUserService supabaseUserService;
     private final SaasTeamService saasTeamService;
     private final JwtDecoder jwtDecoder;
-    private final ApiKeyAuthenticationService apiKeyAuthenticationService;
     private final AuthenticationEntryPoint authenticationEntryPoint =
             new BearerTokenAuthenticationEntryPoint();
 
@@ -77,14 +73,12 @@ public class SupabaseAuthenticationFilter extends OncePerRequestFilter {
             UserService userService,
             SupabaseUserService supabaseUserService,
             SaasTeamService saasTeamService,
-            JwtDecoder jwtDecoder,
-            ApiKeyAuthenticationService apiKeyAuthenticationService) {
+            JwtDecoder jwtDecoder) {
         this.teamService = teamService;
         this.userService = userService;
         this.supabaseUserService = supabaseUserService;
         this.saasTeamService = saasTeamService;
         this.jwtDecoder = jwtDecoder;
-        this.apiKeyAuthenticationService = apiKeyAuthenticationService;
     }
 
     @Override
@@ -92,9 +86,6 @@ public class SupabaseAuthenticationFilter extends OncePerRequestFilter {
             HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
             throws ServletException, IOException {
 
-        // Start clean so a pooled thread can't inherit a prior request's API-key label.
-        MDC.remove(ApiKeyAuthenticationService.AUDIT_LABEL_MDC_KEY);
-
         if (isStaticResource(request.getContextPath(), request.getRequestURI())) {
             filterChain.doFilter(request, response);
             return;
@@ -415,22 +406,16 @@ public class SupabaseAuthenticationFilter extends OncePerRequestFilter {
             return false;
         }
 
-        // Resolves the multi-key table then the legacy key, records per-key usage, and yields a
-        // label for the processor's document-source attribution.
-        Optional<ApiKeyAuthentication> resolved = apiKeyAuthenticationService.authenticate(apiKey);
-        if (resolved.isEmpty()) {
+        Optional<User> user = userService.getUserByApiKey(apiKey);
+        if (user.isEmpty()) {
             throw new InvalidBearerTokenException("Invalid API Key.");
         }
-        User user = resolved.get().user();
 
-        userService.trackApiKeyFirstUse(user);
+        userService.trackApiKeyFirstUse(user.get());
 
         ApiKeyAuthenticationToken authToken =
-                new ApiKeyAuthenticationToken(user, apiKey, resolved.get().authorities());
+                new ApiKeyAuthenticationToken(user.get(), apiKey, user.get().getAuthorities());
         SecurityContextHolder.getContext().setAuthentication(authToken);
-        if (resolved.get().auditLabel() != null) {
-            MDC.put(ApiKeyAuthenticationService.AUDIT_LABEL_MDC_KEY, resolved.get().auditLabel());
-        }
         return true;
     }
 

app/saas/src/main/java/stirling/software/saas/security/SupabaseSecurityConfig.java

@@ -48,7 +48,6 @@ import lombok.extern.slf4j.Slf4j;
 import stirling.software.common.model.ApplicationProperties;
 import stirling.software.common.util.RequestUriUtils;
 import stirling.software.proprietary.security.model.User;
-import stirling.software.proprietary.security.service.ApiKeyAuthenticationService;
 import stirling.software.proprietary.security.service.TeamService;
 import stirling.software.proprietary.security.service.UserService;
 import stirling.software.saas.accountlink.DeviceCredentialAuthenticationFilter;
@@ -70,7 +69,6 @@ public class SupabaseSecurityConfig {
     private final SupabaseUserService supabaseUserService;
     private final SaasTeamService saasTeamService;
     private final ApplicationProperties applicationProperties;
-    private final ApiKeyAuthenticationService apiKeyAuthenticationService;
 
     @Value("${app.supabase.issuer:}")
     private String issuer;
@@ -127,8 +125,7 @@ public class SupabaseSecurityConfig {
                                 userService,
                                 supabaseUserService,
                                 saasTeamService,
-                                jwtDecoder,
-                                apiKeyAuthenticationService),
+                                jwtDecoder),
                         BearerTokenAuthenticationFilter.class)
                 .exceptionHandling(
                         ex ->

app/saas/src/main/resources/db/migration/saas/V33__api_keys.sql

@@ -1,24 +0,0 @@
--- Named, multi-key personal API keys, plus per-key daily usage.
--- Idempotent: Hibernate ddl-auto=update may already have created these on some deployments.
-
-CREATE TABLE IF NOT EXISTS api_keys (
-    id            BIGSERIAL    PRIMARY KEY,
-    name          VARCHAR(100) NOT NULL,
-    key_hash      VARCHAR(64)  NOT NULL,
-    prefix        VARCHAR(32)  NOT NULL,
-    owner_user_id BIGINT       NOT NULL,
-    enabled       BOOLEAN     NOT NULL DEFAULT TRUE,
-    created_at    TIMESTAMPTZ NOT NULL,
-    last_used_at  TIMESTAMPTZ,
-    revoked_at    TIMESTAMPTZ
-);
-
-CREATE UNIQUE INDEX IF NOT EXISTS idx_api_key_hash ON api_keys (key_hash);
-CREATE INDEX IF NOT EXISTS idx_api_key_owner ON api_keys (owner_user_id);
-
-CREATE TABLE IF NOT EXISTS api_key_daily_usage (
-    api_key_id BIGINT NOT NULL,
-    epoch_day  BIGINT NOT NULL,
-    count      BIGINT NOT NULL DEFAULT 0,
-    PRIMARY KEY (api_key_id, epoch_day)
-);

app/saas/src/test/java/stirling/software/saas/security/SupabaseAuthenticationFilterMoreTest.java

@@ -58,10 +58,6 @@ class SupabaseAuthenticationFilterMoreTest {
     @Mock private SaasTeamService saasTeamService;
     @Mock private JwtDecoder jwtDecoder;
 
-    @Mock
-    private stirling.software.proprietary.security.service.ApiKeyAuthenticationService
-            apiKeyAuthenticationService;
-
     private SupabaseAuthenticationFilter filter;
     private MockHttpServletRequest request;
     private MockHttpServletResponse response;
@@ -72,12 +68,7 @@ class SupabaseAuthenticationFilterMoreTest {
         SecurityContextHolder.clearContext();
         filter =
                 new SupabaseAuthenticationFilter(
-                        teamService,
-                        userService,
-                        supabaseUserService,
-                        saasTeamService,
-                        jwtDecoder,
-                        apiKeyAuthenticationService);
+                        teamService, userService, supabaseUserService, saasTeamService, jwtDecoder);
         request = new MockHttpServletRequest();
         response = new MockHttpServletResponse();
         chain = new MockFilterChain();
@@ -243,12 +234,7 @@ class SupabaseAuthenticationFilterMoreTest {
         @DisplayName("returns true and skips lookup when an api key sets an authenticated context")
         void apiKeyValidStillAuthenticates() throws Exception {
             User user = newUser("alice");
-            when(apiKeyAuthenticationService.authenticate("k1"))
-                    .thenReturn(
-                            Optional.of(
-                                    new stirling.software.proprietary.security.service
-                                            .ApiKeyAuthenticationService.ApiKeyAuthentication(
-                                            user, null, user.getAuthorities())));
+            when(userService.getUserByApiKey("k1")).thenReturn(Optional.of(user));
 
             request.setRequestURI("/api/v1/something");
             request.setMethod("POST");

app/saas/src/test/java/stirling/software/saas/security/SupabaseAuthenticationFilterTest.java

@@ -48,10 +48,6 @@ class SupabaseAuthenticationFilterTest {
     @Mock private stirling.software.saas.service.SaasTeamService saasTeamService;
     @Mock private JwtDecoder jwtDecoder;
 
-    @Mock
-    private stirling.software.proprietary.security.service.ApiKeyAuthenticationService
-            apiKeyAuthenticationService;
-
     private SupabaseAuthenticationFilter filter;
     private MockHttpServletRequest request;
     private MockHttpServletResponse response;
@@ -62,12 +58,7 @@ class SupabaseAuthenticationFilterTest {
         SecurityContextHolder.clearContext();
         filter =
                 new SupabaseAuthenticationFilter(
-                        teamService,
-                        userService,
-                        supabaseUserService,
-                        saasTeamService,
-                        jwtDecoder,
-                        apiKeyAuthenticationService);
+                        teamService, userService, supabaseUserService, saasTeamService, jwtDecoder);
         request = new MockHttpServletRequest();
         response = new MockHttpServletResponse();
         chain = new MockFilterChain();
@@ -94,12 +85,7 @@ class SupabaseAuthenticationFilterTest {
     void apiKeyHeaderPopulatesSecurityContext() throws Exception {
         User user = newUser("alice");
         user.setApiKey("api-key-123");
-        when(apiKeyAuthenticationService.authenticate("api-key-123"))
-                .thenReturn(
-                        Optional.of(
-                                new stirling.software.proprietary.security.service
-                                        .ApiKeyAuthenticationService.ApiKeyAuthentication(
-                                        user, null, user.getAuthorities())));
+        when(userService.getUserByApiKey("api-key-123")).thenReturn(Optional.of(user));
 
         request.setRequestURI("/api/v1/something");
         request.setMethod("POST");
@@ -117,7 +103,7 @@ class SupabaseAuthenticationFilterTest {
 
     @Test
     void invalidApiKeyTriggers401() throws Exception {
-        when(apiKeyAuthenticationService.authenticate("nope")).thenReturn(Optional.empty());
+        when(userService.getUserByApiKey("nope")).thenReturn(Optional.empty());
 
         request.setRequestURI("/api/v1/something");
         request.setMethod("POST");

app/saas/src/test/java/stirling/software/saas/security/SupabaseSecurityConfigMoreTest.java

@@ -43,18 +43,9 @@ class SupabaseSecurityConfigMoreTest {
     @Mock private SupabaseUserService supabaseUserService;
     @Mock private SaasTeamService saasTeamService;
 
-    @Mock
-    private stirling.software.proprietary.security.service.ApiKeyAuthenticationService
-            apiKeyAuthenticationService;
-
     private SupabaseSecurityConfig config(ApplicationProperties props) {
         return new SupabaseSecurityConfig(
-                userService,
-                teamService,
-                supabaseUserService,
-                saasTeamService,
-                props,
-                apiKeyAuthenticationService);
+                userService, teamService, supabaseUserService, saasTeamService, props);
     }
 
     @Nested

app/saas/src/test/java/stirling/software/saas/security/TeamSecurityExpressionsTest.java

@@ -21,7 +21,6 @@ import org.springframework.security.core.context.SecurityContextHolder;
 import stirling.software.common.model.enumeration.TeamRole;
 import stirling.software.proprietary.model.Team;
 import stirling.software.proprietary.model.TeamMembership;
-import stirling.software.proprietary.security.model.ApiKeyAuthenticationToken;
 import stirling.software.proprietary.security.model.User;
 import stirling.software.proprietary.security.repository.TeamMembershipRepository;
 import stirling.software.proprietary.security.service.UserService;
@@ -108,27 +107,6 @@ class TeamSecurityExpressionsTest {
         assertNull(expressions().currentUserTeamId());
     }
 
-    private User leaderUser() {
-        User leader = new User();
-        leader.setId(USER_ID);
-        Team team = new Team();
-        team.setId(TEAM_ID);
-        leader.setTeam(team);
-        return leader;
-    }
-
-    @Test
-    void apiKeyOfALeaderStillLeads() {
-        // A key acts as the owner; if they lead the team, the key leads.
-        SecurityContextHolder.getContext()
-                .setAuthentication(
-                        new ApiKeyAuthenticationToken(leaderUser(), "sk_personal", List.of()));
-        when(membershipRepository.findByTeamIdAndUserId(TEAM_ID, USER_ID))
-                .thenReturn(Optional.of(membershipWithRole(TeamRole.LEADER)));
-
-        assertTrue(expressions().isCurrentUserTeamLeader());
-    }
-
     @Test
     void unauthenticatedIsNotLeader() {
         // No authentication set on the context.

build.gradle

@@ -91,7 +91,7 @@ springBoot {
 
 allprojects {
     group = 'stirling.software'
-    version = '2.14.2'
+    version = '2.14.1'
 
     configurations.configureEach {
         exclude group: "org.springframework.boot", module: "spring-boot-starter-tomcat"

frontend/editor/public/locales/en-US/translation.toml

@@ -6240,10 +6240,6 @@ muted = "muted"
 nameLabel = "Name"
 namePlaceholder = "e.g. Compliance escalation"
 
-[portal.agentBuilder.status]
-draft = "Draft"
-published = "Published"
-
 [portal.agentBuilder.tabs]
 evals = "Evals"
 scenarios = "Scenarios"
@@ -6467,7 +6463,7 @@ install = "Install"
 usage = "Usage"
 
 [portal.catalogue.detail.locked]
-description = "{{name}} is included from the {{plan}}. Upgrade to embed it."
+description = "{{name}} is included from the {{tier}} plan. Upgrade to embed it."
 title = "Not available on your plan"
 
 [portal.catalogue.detail.preview]
@@ -6534,35 +6530,6 @@ title = "No components available"
 description = "GA components are available on Pay-as-you-go; a few Beta components are enterprise-only. Locked cards show an upgrade nudge."
 title = "Some components need a paid plan"
 
-[portal.connections]
-createTitle = "New S3 connection"
-delete = "Delete"
-edit = "Edit"
-editTitle = "Edit S3 connection"
-subtitle = "Reusable S3 credentials that sources and pipeline outputs connect to."
-
-[portal.connections.actions]
-new = "New connection"
-
-[portal.connections.empty]
-description = "Add an S3 connection to reuse the same bucket and credentials across sources and pipeline outputs."
-title = "No connections yet"
-
-[portal.connections.picker]
-cancel = "Cancel"
-createNew = "New connection..."
-placeholder = "Select a connection"
-save = "Save connection"
-
-[portal.connections.s3.fields]
-name = "Connection name"
-namePlaceholder = "e.g. Claims bucket"
-
-[portal.connections.table]
-bucket = "Bucket"
-name = "Name"
-region = "Region"
-
 [portal.docs.authentication]
 codeCaption = "every request"
 eyebrow = "GETTING STARTED"
@@ -6951,31 +6918,31 @@ subtitle = "Deployments, credentials, security posture, storage, and the audit t
 title = "Infrastructure"
 
 # Fixed-enum label maps rendered via t(MAP[value]) in the infrastructure tabs.
+[portal.infrastructure.apiKeyPermission]
+admin = "Admin"
+read = "Read"
+write = "Write"
+
 [portal.infrastructure.apiKeys]
 createKey = "Create key"
 heading = "API keys"
-subheading = "Personal credentials, each with its own usage tracking."
+subheading = "Scoped credentials with per-key rate limits, permissions, and IP allowlists."
 
 [portal.infrastructure.apiKeys.card]
+allowedIps = "Allowed IPs"
+anyIp = "Any IP (no allowlist)"
 created = "Created"
 lastUsed = "Last used"
-revoke = "Revoke key"
+permissions = "Permissions"
+rateLimit = "Rate limit"
+rateLimitValue = "{{value}} req/min"
 usageMonth = "Usage this month"
 usageToday = "Usage today"
 
 [portal.infrastructure.apiKeys.empty]
-description = "Create a key to start calling the Stirling API."
+description = "Create a scoped key to start calling the Stirling API."
 title = "No API keys yet"
 
-[portal.infrastructure.apiKeys.error]
-load = "Couldn't load your API keys. Please try again."
-
-[portal.infrastructure.apiKeys.revoke]
-body = "Revoke \"{{name}}\"? Any integration still using this key will immediately start receiving 401 errors. This can't be undone."
-cancel = "Cancel"
-confirm = "Revoke key"
-title = "Revoke API key"
-
 [portal.infrastructure.attestationLabel]
 attested = "Attested"
 inScope = "In scope"
@@ -7061,11 +7028,14 @@ notStarted = "Not started"
 cancel = "Cancel"
 createKey = "Create key"
 done = "Done"
+ipAllowlistHelper = "Comma-separated CIDR ranges. Leave blank to allow any IP."
+ipAllowlistLabel = "IP allowlist"
 keyNameLabel = "Key name"
-keyNamePlaceholder = "e.g. Production ingest"
+keyNamePlaceholder = "e.g. Production · ingest"
+permissionsLabel = "Permissions"
 secretKeyCaption = "Secret key"
-secretWarning = "Store this in a secrets manager. Stirling only ever stores a hash, so there is no way to recover it later."
-subtitle = "Give the key a name so you can recognise it later. You can revoke it at any time."
+secretWarning = "Store this in a secrets manager. Stirling only ever stores a hash — there is no way to recover it later."
+subtitle = "Scope the key to the minimum it needs. You can rotate or revoke at any time."
 subtitleCreated = "Copy this secret now — it won't be shown again."
 title = "Create API key"
 titleCreated = "Key created"
@@ -7114,6 +7084,7 @@ title = "No regions deployed"
 [portal.infrastructure.keyLabel]
 active = "Active"
 revoked = "Revoked"
+rotateSoon = "Rotate soon"
 
 [portal.infrastructure.modelLabel]
 active = "Active"
@@ -7370,6 +7341,10 @@ operations_one = "Operation ({{count}})"
 operations_other = "Operations ({{count}})"
 output = "Output"
 removeStep = "Remove operation"
+s3Configure = "Configure"
+s3Done = "Done"
+s3ModalTitle = "Amazon S3 output"
+s3NotConfigured = "Not configured"
 s3PrefixHelp = "Outputs are uploaded under this key prefix."
 save = "Save changes"
 scheduleEvery = "Run every"
@@ -7440,7 +7415,6 @@ manual = "Manual"
 schedule = "Scheduled"
 
 [portal.policies]
-defaultName = "{{category}} Policy"
 subtitle = "Standing automations that enforce a tool pipeline on every document. Each policy fires on upload or export, runs its tool chain, and saves the enforced version alongside the original."
 title = "Policies"
 
@@ -8012,23 +7986,12 @@ primaryNav = "Primary navigation"
 switchApp = "Switch app"
 
 [portal.sources]
-subtitle = "Reusable input connections that feed documents into Stirling. Configure a source once, then reference it from any number of pipelines."
+subtitle = "Reusable input connections that feed documents into Stirling. Configure a connection once, then reference it from any number of policies. Click a row for its config and which policies use it."
 title = "Sources"
 
 [portal.sources.actions]
 agentBuilder = "Agent Builder"
 connectSource = "Connect source"
-createApiKey = "Create API key"
-
-[portal.sources.builder]
-back = "Back to sources"
-cancel = "Cancel"
-create = "Create source"
-createTitle = "Connect a source"
-delete = "Delete"
-editTitle = "Edit source"
-enabled = "Enabled"
-save = "Save changes"
 
 [portal.sources.delete]
 body = "Delete \"{{name}}\"? This can't be undone. Policies that reference it would need to be updated."
@@ -8036,6 +7999,21 @@ cancel = "Cancel"
 confirm = "Delete"
 title = "Delete source?"
 
+[portal.sources.detail]
+closeAriaLabel = "Close detail"
+delete = "Delete source"
+docs24h = "Last 24h"
+docs30d = "Last 30 days"
+docsTotal = "Total seen"
+docsTrend = "Documents over the last 30 days"
+documents = "Documents"
+edit = "Edit"
+notReferenced = "Not referenced by any policy, so it's safe to delete."
+pause = "Pause"
+resume = "Resume"
+subtitle = "{{type}} · {{status}}"
+usedBy = "Used by"
+
 [portal.sources.empty]
 description = "Connect a folder (and, soon, cloud storage) so your policies have somewhere to pull documents from."
 title = "No sources connected yet"
@@ -8051,15 +8029,10 @@ disabled = "Disabled"
 unused = "Unused"
 
 [portal.sources.table]
-documents = "Documents"
 source = "Source"
 status = "Status"
 usedBy = "Policies"
 
-[portal.sources.tabs]
-connections = "Connections"
-sources = "Sources"
-
 [portal.sources.types.editor]
 description = "Documents your team has processed in the editor, across policy and AI runs."
 label = "Editor"
@@ -8107,10 +8080,6 @@ label = "Access key ID"
 label = "Bucket"
 placeholder = "my-company-inbox"
 
-[portal.sources.types.s3.fields.connection]
-helperText = "The stored connection holding the bucket and credentials. Reused by every source and pipeline output that references it."
-label = "Connection"
-
 [portal.sources.types.s3.fields.endpoint]
 helperText = "Leave blank for Amazon S3. Set to use an S3-compatible service such as MinIO."
 label = "Custom endpoint"
@@ -8140,14 +8109,21 @@ label = "Secret access key"
 label = "Source"
 
 [portal.sources.wizard]
+back = "Back"
+cancel = "Cancel"
+continue = "Continue"
+editTitle = "Edit source"
 name = "Name"
 namePlaceholder = "e.g. Claims intake"
+save = "Save changes"
+subtitle = "Step {{current}} of {{total}} · {{label}}"
+title = "Connect a source"
 type = "Type"
 
-[portal.tier]
-enterprise = "Enterprise plan"
-free = "Editor plan"
-pro = "Processor plan"
+[portal.sources.wizard.steps]
+chooseType = "Choose type"
+configure = "Configure"
+review = "Review & connect"
 
 [portal.usage]
 managePayment = "Manage Payment"
@@ -10163,19 +10139,6 @@ resetPw = "Reset password"
 suspend = "Suspend"
 unlock = "Unlock account"
 
-[users.activity]
-daysAgo = "{{count}}d ago"
-hoursAgo = "{{count}}h ago"
-justNow = "Just now"
-minutesAgo = "{{count}}m ago"
-monthsAgo_one = "{{count}} month ago"
-monthsAgo_other = "{{count}} months ago"
-never = "Never"
-weeksAgo_one = "{{count}} week ago"
-weeksAgo_other = "{{count}} weeks ago"
-yearsAgo_one = "{{count}} year ago"
-yearsAgo_other = "{{count}} years ago"
-
 [users.cap]
 addProcessor = "+ Processor"
 approver = "Approves policy"
@@ -10246,9 +10209,7 @@ by = "Invited by {{who}}"
 cancel = "Cancel"
 count = "{{count}} pending"
 desc = "Invited people who haven't joined yet. They hold a seat until they accept."
-expiresInDays_one = "Expires in {{count}} day"
-expiresInDays_other = "Expires in {{count}} days"
-expiresToday = "Expires today"
+expires = "Expires"
 title = "Pending invitations"
 
 [users.loadError]

frontend/editor/src-tauri/tauri.conf.json

@@ -2,7 +2,7 @@
   "$schema": "../node_modules/@tauri-apps/cli/config.schema.json",
   "productName": "Stirling PDF",
   "mainBinaryName": "Stirling-PDF",
-  "version": "2.14.2",
+  "version": "2.14.1",
   "identifier": "stirling.pdf.dev",
   "build": {
     "frontendDist": "../dist",

frontend/editor/src/core/components/shared/FileSelectorPicker.tsx

@@ -270,14 +270,12 @@ export function FileSelectorPicker({
               skipAuthRedirect: true,
             } as any,
           );
-          const ct =
-            res.headers?.["content-type"] ||
+          const ct = (res.headers?.["content-type"] ||
             res.headers?.["Content-Type"] ||
-            "";
-          const disp =
-            res.headers?.["content-disposition"] ||
+            "") as string;
+          const disp = (res.headers?.["content-disposition"] ||
             res.headers?.["Content-Disposition"] ||
-            "";
+            "") as string;
           const files = await extractLatestFilesFromBundle(
             res.data as Blob,
             parseContentDispositionFilename(disp) || "shared-file",
@@ -294,14 +292,12 @@ export function FileSelectorPicker({
               skipAuthRedirect: true,
             } as any,
           );
-          const ct =
-            res.headers?.["content-type"] ||
+          const ct = (res.headers?.["content-type"] ||
             res.headers?.["Content-Type"] ||
-            "";
-          const disp =
-            res.headers?.["content-disposition"] ||
+            "") as string;
+          const disp = (res.headers?.["content-disposition"] ||
             res.headers?.["Content-Disposition"] ||
-            "";
+            "") as string;
           const files = await extractLatestFilesFromBundle(
             res.data as Blob,
             parseContentDispositionFilename(disp) || stub.name,

frontend/editor/src/core/contexts/FileManagerContext.tsx

@@ -1003,16 +1003,14 @@ export const FileManagerProvider: React.FC<FileManagerProviderProps> = ({
             skipAuthRedirect: true,
           } as any,
         );
-        const contentType =
-          (response.headers &&
-            (response.headers["content-type"] ||
-              response.headers["Content-Type"])) ||
-          "";
-        const disposition =
-          (response.headers &&
-            (response.headers["content-disposition"] ||
-              response.headers["Content-Disposition"])) ||
-          "";
+        const contentType = ((response.headers &&
+          (response.headers["content-type"] ||
+            response.headers["Content-Type"])) ||
+          "") as string;
+        const disposition = ((response.headers &&
+          (response.headers["content-disposition"] ||
+            response.headers["Content-Disposition"])) ||
+          "") as string;
         const filename =
           parseContentDispositionFilename(disposition) ||
           file.name ||

frontend/editor/src/core/contexts/FilesModalContext.tsx

@@ -184,16 +184,13 @@ export const FilesModalProvider: React.FC<{ children: React.ReactNode }> = ({
         skipAuthRedirect: true,
       } as any,
     );
-    const contentType =
-      (response.headers &&
-        (response.headers["content-type"] ||
-          response.headers["Content-Type"])) ||
-      "";
-    const disposition =
-      (response.headers &&
-        (response.headers["content-disposition"] ||
-          response.headers["Content-Disposition"])) ||
-      "";
+    const contentType = ((response.headers &&
+      (response.headers["content-type"] || response.headers["Content-Type"])) ||
+      "") as string;
+    const disposition = ((response.headers &&
+      (response.headers["content-disposition"] ||
+        response.headers["Content-Disposition"])) ||
+      "") as string;
     const filename =
       parseContentDispositionFilename(disposition) || "server-file";
     const blob = response.data as Blob;
@@ -210,16 +207,13 @@ export const FilesModalProvider: React.FC<{ children: React.ReactNode }> = ({
         skipAuthRedirect: true,
       } as any,
     );
-    const contentType =
-      (response.headers &&
-        (response.headers["content-type"] ||
-          response.headers["Content-Type"])) ||
-      "";
-    const disposition =
-      (response.headers &&
-        (response.headers["content-disposition"] ||
-          response.headers["Content-Disposition"])) ||
-      "";
+    const contentType = ((response.headers &&
+      (response.headers["content-type"] || response.headers["Content-Type"])) ||
+      "") as string;
+    const disposition = ((response.headers &&
+      (response.headers["content-disposition"] ||
+        response.headers["Content-Disposition"])) ||
+      "") as string;
     const filename =
       parseContentDispositionFilename(disposition) || "shared-file";
     const blob = response.data as Blob;

frontend/editor/src/core/hooks/tools/shared/toolAutomation.test.ts

@@ -13,6 +13,7 @@ import {
 import {
   deserializeToolStep,
   getExecutableTools,
+  serializeStepFromEndpoint,
   serializeToolStep,
   stepRequiresUpload,
   type WorkingToolStep,
@@ -198,6 +199,41 @@ describe("serialize/deserialize round-trip", () => {
   });
 });
 
+describe("serializeStepFromEndpoint", () => {
+  test("maps a wizard step's UI params to the backend contract, filling defaults", () => {
+    // The shape the policy setup wizard holds: an endpoint plus UI-shaped params
+    // (redact's `wordsToRedact`), with several fields left to their defaults.
+    const api = serializeStepFromEndpoint(
+      "/api/v1/security/auto-redact",
+      { mode: "automatic", useRegex: true, wordsToRedact: ["ssn", "card"] },
+      dynamicRegistry,
+    );
+
+    expect(api.operation).toBe("/api/v1/security/auto-redact");
+    // wordsToRedact -> listOfText (the field the backend actually reads), and the
+    // frontend-only `mode` is dropped.
+    expect(api.parameters).toMatchObject({ listOfText: "ssn\ncard" });
+    expect(api.parameters).not.toHaveProperty("wordsToRedact");
+    expect(api.parameters).not.toHaveProperty("mode");
+    // Fields the wizard never set still get their defaults so the body is complete.
+    expect(api.parameters).toHaveProperty("wholeWordSearch");
+    expect(api.parameters).toHaveProperty("customPadding");
+  });
+
+  test("passes an unmapped endpoint's params through unchanged", () => {
+    expect(
+      serializeStepFromEndpoint(
+        "/api/v1/unknown/thing",
+        { keep: true },
+        dynamicRegistry,
+      ),
+    ).toEqual({
+      operation: "/api/v1/unknown/thing",
+      parameters: { keep: true },
+    });
+  });
+});
+
 describe("stepRequiresUpload", () => {
   const step = (params: Record<string, unknown>): WorkingToolStep => ({
     toolId: "compress" as ToolId,

frontend/editor/src/core/hooks/tools/shared/toolAutomation.ts

@@ -197,6 +197,31 @@ export function serializeToolStep(
   return { operation, parameters };
 }
 
+/**
+ * Serialize a step held as an endpoint path plus frontend-shaped params - the form the policy setup
+ * wizard keeps, where params match the tool's UI shape (e.g. redact's `wordsToRedact`) rather than
+ * the backend contract - into the backend step contract, mapping params through the tool's
+ * `toApiParams` (merged over its defaults, so fields the wizard never set still get their defaults).
+ * The endpoint maps to a tool by path, so this works for dynamic-endpoint tools whose config
+ * endpoint is a function. Endpoints that map to no known tool pass through unchanged.
+ */
+export function serializeStepFromEndpoint(
+  operation: string,
+  params: ErasedToolParams,
+  registry: Partial<ToolRegistry>,
+): ToolApiStep {
+  const match = findToolByEndpoint({ operation, parameters: params }, registry);
+  const config = match?.[1].operationConfig;
+  if (!config) return { operation, parameters: params };
+  const merged = { ...(config.defaultParameters ?? {}), ...params };
+  return {
+    operation: resolveEndpoint(config, merged) ?? operation,
+    parameters: config.toApiParams
+      ? (config.toApiParams(merged) as Record<string, unknown>)
+      : {},
+  };
+}
+
 /**
  * Find the registry tool for a stored step's endpoint: exact match for static endpoints, else
  * membership in a dynamic tool's declared `endpoints` set (replaying its function can't recover a

frontend/editor/src/core/hooks/tools/shared/toolOperationDescriptor.test.ts

@@ -1,37 +0,0 @@
-import { describe, expect, test } from "vitest";
-import { describeToolOperation } from "@app/hooks/tools/shared/toolOperationDescriptor";
-
-interface Params {
-  a: number;
-}
-
-// A minimal config that type-checks against the flatten endpoint's model.
-const CONFIG = {
-  endpoint: "/api/v1/misc/flatten" as const,
-  defaultParameters: { a: 1 } satisfies Params,
-  toApiParams: (p: Params) => ({ renderDpi: p.a }),
-  fromApiParams: (api: { renderDpi?: number }) => ({ a: api.renderDpi ?? 0 }),
-};
-
-describe("describeToolOperation", () => {
-  test("wraps the config's mappers and endpoint into a descriptor", () => {
-    const d = describeToolOperation("/api/v1/misc/flatten", CONFIG);
-    expect(d.endpoint).toBe("/api/v1/misc/flatten");
-    expect(d.toApi({ a: 200 })).toEqual({ renderDpi: 200 });
-  });
-
-  test("fromApi merges the mapped values over the defaults", () => {
-    const d = describeToolOperation("/api/v1/misc/flatten", CONFIG);
-    expect(d.fromApi({ renderDpi: 72 })).toEqual({ a: 72 });
-  });
-
-  test("throws when the config lacks a mapper", () => {
-    expect(() =>
-      describeToolOperation("/api/v1/misc/flatten", {
-        endpoint: "/api/v1/misc/flatten" as const,
-        defaultParameters: { a: 1 },
-        toApiParams: (p: Params) => ({ renderDpi: p.a }),
-      }),
-    ).toThrow(/mappers/);
-  });
-});

frontend/editor/src/core/hooks/tools/shared/toolOperationDescriptor.ts

@@ -1,59 +0,0 @@
-/**
- * Typed wrapper over a tool's `toApiParams`/`fromApiParams` mappers, binding one endpoint to safe
- * frontend<->backend parameter conversion.
- */
-
-import type { ToolApiParams, ToolEndpoint } from "@app/types/toolApiTypes";
-
-export interface ToolOperationDescriptor<E extends ToolEndpoint, TParams> {
-  readonly endpoint: E;
-  readonly defaultParameters: TParams;
-  toApi(params: TParams): ToolApiParams[E];
-  /** Backend model -> full frontend params (defaults merged under the mapped values). */
-  fromApi(api: ToolApiParams[E]): TParams;
-}
-
-/**
- * Structural subset of a tool's config. `CE` is the config's declared endpoint type, inferred from
- * the `endpoint` field: the literal for static tools, or the whole `ToolEndpoint` union for
- * dynamic-endpoint tools (whose endpoint is a function typed against the union).
- */
-export interface BidirectionalToolConfig<TParams, CE extends ToolEndpoint> {
-  endpoint: CE | null | ((params: TParams) => CE | null);
-  defaultParameters?: TParams;
-  toApiParams?(params: TParams): ToolApiParams[CE];
-  fromApiParams?(api: ToolApiParams[CE]): Partial<TParams>;
-}
-
-/**
- * Pin a config to `endpoint` (passed explicitly, since dynamic-endpoint tools declare `endpoint` as
- * a function). `E extends CE` rejects pairing a static tool's config with the wrong endpoint, while
- * allowing a dynamic tool whose `CE` is the full union. Throws when mappers or defaults are missing.
- */
-export function describeToolOperation<
-  E extends CE,
-  CE extends ToolEndpoint,
-  TParams,
->(
-  endpoint: E,
-  config: BidirectionalToolConfig<TParams, CE>,
-): ToolOperationDescriptor<E, TParams> {
-  const { toApiParams, fromApiParams, defaultParameters } = config;
-  if (!toApiParams || !fromApiParams || defaultParameters === undefined) {
-    throw new Error(
-      `describeToolOperation: "${endpoint}" is missing mappers or defaults`,
-    );
-  }
-  return {
-    endpoint,
-    defaultParameters,
-    // A dynamic tool's mapper is typed against the union; narrow to this endpoint (sound - the
-    // runtime mapper produces this endpoint's model).
-    toApi: (params) => toApiParams(params) as ToolApiParams[E],
-    fromApi: (api) =>
-      ({
-        ...defaultParameters,
-        ...fromApiParams(api as ToolApiParams[CE]),
-      }) as TParams,
-  };
-}

frontend/editor/src/core/services/signatureStorageService.ts

@@ -166,7 +166,9 @@ class SignatureStorageService {
 
             // Convert to data URL (base64) for both display and use
             const blob = new Blob([imageResponse.data], {
-              type: imageResponse.headers["content-type"] || "image/png",
+              type:
+                (imageResponse.headers["content-type"] as string) ||
+                "image/png",
             });
 
             const dataUrl = await new Promise<string>((resolve, reject) => {

frontend/editor/src/core/testing/serverExperienceSimulations.ts

@@ -38,7 +38,7 @@ const FREE_LICENSE_INFO: LicenseInfo = {
 
 const BASE_NO_LOGIN_CONFIG: AppConfig = {
   enableAnalytics: true,
-  appVersion: "2.14.2",
+  appVersion: "2.14.1",
   serverCertificateEnabled: false,
   enableAlphaFunctionality: false,
   serverPort: 8080,

frontend/editor/src/core/tokens/tokens.css

@@ -270,29 +270,8 @@
   --grad-banner: linear-gradient(135deg, #0f172a 0%, #111827 50%, #1a1535 100%);
 }
 
-/* Code palette — theme-aware: a light GitHub-style box in light mode, the dark
-   terminal palette in dark mode. (CodeBlock renders plain text, so only the
-   base colours are load-bearing; the syntax slots are kept for future Shiki. */
-:root,
-[data-theme="light"] {
-  --code-bg: #f6f8fa;
-  --code-bg-alt: #eef1f4;
-  --code-bg-header: #eaeef2;
-  --code-text: #1f2328;
-  --code-dim: #656d76;
-  --code-muted: #8c959f;
-  --code-keyword: #cf222e;
-  --code-string: #0a3069;
-  --code-number: #0550ae;
-  --code-fn: #8250df;
-  --code-type: #953800;
-  --code-property: #0550ae;
-  --code-comment: #6e7781;
-  --code-border: #d0d7de;
-  /* Window-chrome traffic-light dots in the code-block header. */
-  --code-dot: #d0d7de;
-}
-[data-theme="dark"] {
+/* Always-dark code palette. Not theme-switched. */
+:root {
   --code-bg: #0f172a;
   --code-bg-alt: #1e293b;
   --code-bg-header: #1a2332;
@@ -307,16 +286,12 @@
   --code-property: #93c5fd;
   --code-comment: #475569;
   --code-border: #1e293b;
+  /* Window-chrome traffic-light dots in the code-block header. */
   --code-dot: #475569;
 }
 
 /* Radii / typography / motion / spacing / z-index — theme-stable */
 :root {
-  /* Home hero strip navy. Theme-stable by design — the hero keeps this deep
-     navy in both light and dark (it's a branded surface, like the assistant
-     header), so it's defined once here rather than in the light/dark blocks. */
-  --color-hero-navy: #16213e;
-
   --radius-xs: 0.1875rem;
   --radius-sm: 0.25rem;
   --radius-md: 0.375rem;

frontend/editor/src/core/ui/Button.css

@@ -61,14 +61,11 @@
   background: var(--button-bg, transparent) !important;
 }
 
-/* Disabled buttons in dark read as a muted surface (not a dimmed accent that
-   still looks clickable, and not an invisible transparent pill). Covers every
-   variant so a disabled primary and a disabled secondary look alike. */
-[data-theme="dark"] .sui-btn.mantine-Button-root:disabled:not([data-loading]),
 [data-theme="dark"]
-  .sui-btn.mantine-Button-root[data-disabled]:not([data-loading]) {
-  background: var(--color-bg-muted);
-  color: var(--color-text-5);
-  border-color: transparent;
-  opacity: 1;
+  .sui-btn--primary.mantine-Button-root:disabled:not([data-loading]),
+[data-theme="dark"]
+  .sui-btn--primary.mantine-Button-root[data-disabled]:not([data-loading]) {
+  background: var(--button-bg);
+  color: var(--button-color);
+  opacity: 0.55;
 }

frontend/editor/src/core/ui/CodeBlock.css

@@ -51,8 +51,7 @@
   transition: background var(--motion-fast);
 }
 .sui-code__copy:hover {
-  /* Subtle tint that reads on both the light and dark code surfaces. */
-  background: color-mix(in srgb, var(--code-text) 8%, transparent);
+  background: rgba(255, 255, 255, 0.05);
 }
 .sui-code__pre {
   margin: 0;

frontend/editor/src/core/ui/Table.tsx

@@ -19,12 +19,6 @@ export interface TableProps<T> {
   rowKey: (row: T) => string;
   /** Makes rows interactive (hover + click + keyboard). */
   onRowClick?: (row: T) => void;
-  /**
-   * Per-row gate for interactivity, checked only when {@link onRowClick} is set. A row for which
-   * this returns false is inert: no click/keyboard, and not announced as a button. Defaults to
-   * all rows interactive.
-   */
-  isRowInteractive?: (row: T) => boolean;
   /** Rendered in place of the body when there are no rows. */
   empty?: ReactNode;
   className?: string;
@@ -41,7 +35,6 @@ export function Table<T>({
   rows,
   rowKey,
   onRowClick,
-  isRowInteractive,
   empty,
   className,
 }: TableProps<T>) {
@@ -73,42 +66,38 @@ export function Table<T>({
               </td>
             </tr>
           ) : (
-            rows.map((row) => {
-              const rowInteractive =
-                interactive && (isRowInteractive?.(row) ?? true);
-              return (
-                <tr
-                  key={rowKey(row)}
-                  className={
-                    rowInteractive
-                      ? "sui-table__row sui-table__row--interactive"
-                      : "sui-table__row"
-                  }
-                  onClick={rowInteractive ? () => onRowClick?.(row) : undefined}
-                  tabIndex={rowInteractive ? 0 : undefined}
-                  role={rowInteractive ? "button" : undefined}
-                  onKeyDown={
-                    rowInteractive
-                      ? (e) => {
-                          if (e.key === "Enter" || e.key === " ") {
-                            e.preventDefault();
-                            onRowClick?.(row);
-                          }
+            rows.map((row) => (
+              <tr
+                key={rowKey(row)}
+                className={
+                  interactive
+                    ? "sui-table__row sui-table__row--interactive"
+                    : "sui-table__row"
+                }
+                onClick={onRowClick ? () => onRowClick(row) : undefined}
+                tabIndex={interactive ? 0 : undefined}
+                role={interactive ? "button" : undefined}
+                onKeyDown={
+                  interactive
+                    ? (e) => {
+                        if (e.key === "Enter" || e.key === " ") {
+                          e.preventDefault();
+                          onRowClick?.(row);
                         }
-                      : undefined
-                  }
-                >
-                  {columns.map((c) => (
-                    <td
-                      key={c.key}
-                      className={`sui-table__td sui-table__td--${c.align ?? "left"}`}
-                    >
-                      {c.render(row)}
-                    </td>
-                  ))}
-                </tr>
-              );
-            })
+                      }
+                    : undefined
+                }
+              >
+                {columns.map((c) => (
+                  <td
+                    key={c.key}
+                    className={`sui-table__td sui-table__td--${c.align ?? "left"}`}
+                  >
+                    {c.render(row)}
+                  </td>
+                ))}
+              </tr>
+            ))
           )}
         </tbody>
       </table>

frontend/editor/src/portal/ViewRouter.tsx

@@ -5,7 +5,6 @@ import { Documents } from "@portal/views/Documents";
 import { Pipelines } from "@portal/views/Pipelines";
 import { PipelineBuilder } from "@portal/views/PipelineBuilder";
 import { Sources } from "@portal/views/Sources";
-import { SourceBuilder } from "@portal/views/SourceBuilder";
 import { AgentBuilder } from "@portal/views/AgentBuilder";
 import { Policies } from "@portal/views/Policies";
 import { Components } from "@portal/views/Components";
@@ -37,14 +36,6 @@ export function ViewRouter() {
         element={<PipelineBuilder />}
       />
       <Route path={rel(VIEW_PATHS.sources)} element={<Sources />} />
-      <Route
-        path={`${rel(VIEW_PATHS.sources)}/new`}
-        element={<SourceBuilder />}
-      />
-      <Route
-        path={`${rel(VIEW_PATHS.sources)}/:id`}
-        element={<SourceBuilder />}
-      />
       <Route
         path={rel(VIEW_PATHS["agent-builder"])}
         element={<AgentBuilder />}

frontend/editor/src/portal/api/agents.ts

@@ -99,11 +99,6 @@ export const AGENT_STATUS_TONE: Record<AgentStatus, "success" | "neutral"> = {
   draft: "neutral",
 };
 
-export const AGENT_STATUS_LABEL: Record<AgentStatus, string> = {
-  published: "portal.agentBuilder.status.published",
-  draft: "portal.agentBuilder.status.draft",
-};
-
 /**
  * Catalogue of tools an agent can be granted or denied. Surfaced as the chip
  * palette in restricted mode so the deny list is picked from a known set

frontend/editor/src/portal/api/infrastructure.ts

@@ -43,33 +43,23 @@ export interface RecentDeployment {
 /*  API Keys                                                                 */
 /* ──────────────────────────────────────────────────────────────────────── */
 
-export type ApiKeyStatus = "active" | "revoked";
+export type ApiKeyStatus = "active" | "revoked" | "rotate-soon";
+export type ApiKeyPermission = "Read" | "Write" | "Admin";
 
 export interface ApiKey {
   id: string;
   name: string;
-  /** Non-secret leading fragment, e.g. "sk_a3f81b2c". */
+  /** Masked prefix shown in the list, e.g. "sk_live_a3f8…". */
   prefix: string;
   created: string;
-  /** Formatted last-use time, or "Never". */
   lastUsed: string;
   status: ApiKeyStatus;
-  /** Requests made today (UTC). */
+  /** Requests/min ceiling. */
+  rateLimit: number;
+  permissions: ApiKeyPermission[];
+  allowedIps: string[];
   usageToday: number;
-  /** Requests in the trailing 30 days. */
   usageMonth: number;
-  /** Lifetime request count. */
-  usageTotal: number;
-}
-
-export interface ApiKeysResponse {
-  keys: ApiKey[];
-}
-
-/** Returned once on creation: the listed row plus the plaintext secret, shown once. */
-export interface CreatedApiKey {
-  key: ApiKey;
-  secret: string;
 }
 
 /* ──────────────────────────────────────────────────────────────────────── */
@@ -288,34 +278,11 @@ export async function fetchDeployments(
   );
 }
 
-const API_KEYS_PATH = "/api/v1/proprietary/ui-data/infrastructure/api-keys";
-
-/** GET the caller's personal API keys; SaaS or local, scoped server-side per user. */
-export async function fetchApiKeys(): Promise<ApiKeysResponse> {
-  return apiClient.saas.isConfigured()
-    ? apiClient.saas.json<ApiKeysResponse>(API_KEYS_PATH)
-    : apiClient.local.json<ApiKeysResponse>(API_KEYS_PATH);
-}
-
-/** POST a new key; the response carries the one-time secret. */
-export async function createApiKey(body: {
-  name: string;
-}): Promise<CreatedApiKey> {
-  const opts = { method: "POST" as const, body };
-  return apiClient.saas.isConfigured()
-    ? apiClient.saas.json<CreatedApiKey>(API_KEYS_PATH, opts)
-    : apiClient.local.json<CreatedApiKey>(API_KEYS_PATH, opts);
-}
-
-/** DELETE (revoke) a key the caller owns. */
-export async function revokeApiKey(id: string): Promise<void> {
-  const path = `${API_KEYS_PATH}/${encodeURIComponent(id)}`;
-  const opts = { method: "DELETE" as const };
-  if (apiClient.saas.isConfigured()) {
-    await apiClient.saas.json<void>(path, opts);
-  } else {
-    await apiClient.local.json<void>(path, opts);
-  }
+/** GET /v1/infrastructure/api-keys?tier=… */
+export async function fetchApiKeys(tier: Tier): Promise<ApiKey[]> {
+  return apiClient.local.json<ApiKey[]>(
+    `/v1/infrastructure/api-keys${q(tier)}`,
+  );
 }
 
 /** GET /v1/infrastructure/security?tier=… */

frontend/editor/src/portal/api/integrations.ts

@@ -1,74 +0,0 @@
-/**
- * Integrations service layer: stored connections (S3 today; MCP/API later) that
- * policy sources and pipeline outputs reference by id instead of embedding
- * credentials. Secrets are write-only - reads return them masked, and sending
- * the mask back on update keeps the stored value.
- */
-import { apiClient } from "@portal/api/http";
-
-export type IntegrationType = "S3" | "MCP" | "API";
-export type OwnerScope = "USER" | "TEAM" | "SERVER";
-
-/** Mirrors the backend IntegrationConfigResponse; `config` values are masked. */
-export interface IntegrationConfig {
-  id: number;
-  integrationType: IntegrationType;
-  name: string;
-  scope: OwnerScope;
-  ownerUserId: number | null;
-  ownerTeamId: number | null;
-  enabled: boolean;
-  locked: boolean;
-  defaultAccess: string;
-  config: Record<string, unknown>;
-  canManage: boolean;
-  createdAt: string;
-  updatedAt: string;
-}
-
-/** Create/update body; omitted fields keep their stored values on update. */
-export interface IntegrationConfigRequest {
-  integrationType?: IntegrationType;
-  name?: string;
-  scope?: OwnerScope;
-  ownerTeamId?: number | null;
-  enabled?: boolean;
-  config?: Record<string, unknown>;
-}
-
-export async function fetchIntegrations(): Promise<IntegrationConfig[]> {
-  return apiClient.local.json<IntegrationConfig[]>("/api/v1/integrations");
-}
-
-/** The S3 connections the caller may use, for source/output pickers. */
-export async function fetchS3Connections(): Promise<IntegrationConfig[]> {
-  return (await fetchIntegrations()).filter(
-    (integration) => integration.integrationType === "S3",
-  );
-}
-
-export async function createIntegration(
-  body: IntegrationConfigRequest,
-): Promise<IntegrationConfig> {
-  return apiClient.local.json<IntegrationConfig>("/api/v1/integrations", {
-    method: "POST",
-    body,
-  });
-}
-
-export async function updateIntegration(
-  id: number,
-  body: IntegrationConfigRequest,
-): Promise<IntegrationConfig> {
-  return apiClient.local.json<IntegrationConfig>(
-    `/api/v1/integrations/${encodeURIComponent(id)}`,
-    { method: "PUT", body },
-  );
-}
-
-export async function deleteIntegration(id: number): Promise<void> {
-  await apiClient.local.json<void>(
-    `/api/v1/integrations/${encodeURIComponent(id)}`,
-    { method: "DELETE" },
-  );
-}

frontend/editor/src/portal/api/policies.ts

@@ -9,12 +9,9 @@
  * approach the editor uses for its own catalogue view.
  */
 
-import type { TFunction } from "i18next";
 import { apiClient } from "@portal/api/http";
 import { fromWirePolicy, toWirePolicy } from "@app/policies/codec";
 import { runsToActivity, runsToStats } from "@app/policies/runs";
-import { policyStep, type PolicyToolStep } from "@app/policies/operations";
-import type { ToolEndpoint } from "@app/types/toolApiTypes";
 import type {
   PolicyDecodedState,
   PolicyRunView,
@@ -68,7 +65,7 @@ export interface PolicyConfigDef {
   rules: string[];
   scopeLabel: string;
   fields: PolicyField[];
-  defaultOperations: PolicyToolStep[];
+  defaultOperations: WirePipelineStep[];
 }
 
 export interface PolicyState {
@@ -130,11 +127,20 @@ export interface CatalogueEntry {
 }
 
 /* ──────────────────────────────────────────────────────────────────────── */
-/*  Endpoint display labels                                                   */
+/*  Tool → endpoint registry                                                  */
 /* ──────────────────────────────────────────────────────────────────────── */
 
-/** i18n keys keyed by {@link ToolEndpoint}; labels stored steps in the detail view. */
-export const ENDPOINT_LABELS: Partial<Record<ToolEndpoint, string>> = {
+export const TOOL_ENDPOINTS: Record<string, string> = {
+  redact: "/api/v1/security/auto-redact",
+  sanitize: "/api/v1/security/sanitize-pdf",
+  watermark: "/api/v1/security/add-watermark",
+  ocr: "/api/v1/misc/ocr-pdf",
+  flatten: "/api/v1/misc/flatten",
+  compress: "/api/v1/misc/compress-pdf",
+};
+
+/** Values are i18n keys — render with t(). */
+export const ENDPOINT_LABELS: Record<string, string> = {
   "/api/v1/security/auto-redact": "portal.policies.endpoints.autoRedact",
   "/api/v1/security/sanitize-pdf": "portal.policies.endpoints.sanitizePdf",
   "/api/v1/security/add-watermark": "portal.policies.endpoints.addWatermark",
@@ -147,8 +153,7 @@ export function humanizeEndpoint(
   path: string,
   t: (key: string) => string,
 ): string {
-  const label = ENDPOINT_LABELS[path as ToolEndpoint];
-  if (label) return t(label);
+  if (ENDPOINT_LABELS[path]) return t(ENDPOINT_LABELS[path]);
   const last = path.split("/").filter(Boolean).pop() ?? path;
   return last
     .replace(/-/g, " ")
@@ -224,7 +229,10 @@ export const POLICY_CONFIG: Record<string, PolicyConfigDef> = {
       "portal.policies.config.ingestion.rules.3",
     ],
     scopeLabel: "portal.policies.config.scopeAll",
-    defaultOperations: [policyStep("ocr"), policyStep("flatten")],
+    defaultOperations: [
+      { operation: TOOL_ENDPOINTS.ocr, parameters: {} },
+      { operation: TOOL_ENDPOINTS.flatten, parameters: {} },
+    ],
     fields: [
       {
         label: "portal.policies.config.ingestion.fields.minConfidence",
@@ -251,16 +259,32 @@ export const POLICY_CONFIG: Record<string, PolicyConfigDef> = {
     ],
     scopeLabel: "portal.policies.config.scopeAll",
     defaultOperations: [
-      // Flatten to image so redactions can't be lifted off.
-      policyStep("redact", {
-        useRegex: true,
-        convertPDFToImage: true,
-        wordsToRedact: DEFAULT_PII_PATTERNS,
-      }),
-      // JavaScript removal only; the tool enables removeEmbeddedFiles by default, so turn it off.
-      policyStep("sanitize", { removeEmbeddedFiles: false }),
-      // Bake in via image so it can't be stripped.
-      policyStep("watermark", { convertPDFToImage: true }),
+      {
+        operation: TOOL_ENDPOINTS.redact,
+        parameters: {
+          mode: "automatic",
+          useRegex: true,
+          convertPDFToImage: true,
+          wordsToRedact: DEFAULT_PII_PATTERNS,
+        },
+      },
+      {
+        operation: TOOL_ENDPOINTS.sanitize,
+        parameters: {
+          removeJavaScript: true,
+          removeEmbeddedFiles: false,
+          removeMetadata: false,
+          removeLinks: false,
+          removeFonts: false,
+        },
+      },
+      {
+        operation: TOOL_ENDPOINTS.watermark,
+        // convertPDFToImage bakes the watermark in so it can't be stripped
+        parameters: {
+          convertPDFToImage: true,
+        },
+      },
     ],
     fields: [],
   },
@@ -272,7 +296,10 @@ export const POLICY_CONFIG: Record<string, PolicyConfigDef> = {
       "portal.policies.config.compliance.rules.2",
     ],
     scopeLabel: "portal.policies.config.scopeAll",
-    defaultOperations: [policyStep("sanitize"), policyStep("flatten")],
+    defaultOperations: [
+      { operation: TOOL_ENDPOINTS.sanitize, parameters: {} },
+      { operation: TOOL_ENDPOINTS.flatten, parameters: {} },
+    ],
     fields: [
       {
         label: "portal.policies.config.compliance.fields.frameworks",
@@ -315,7 +342,7 @@ export const POLICY_CONFIG: Record<string, PolicyConfigDef> = {
       "portal.policies.config.routing.rules.2",
     ],
     scopeLabel: "portal.policies.config.scopeAll",
-    defaultOperations: [policyStep("compress")],
+    defaultOperations: [{ operation: TOOL_ENDPOINTS.compress, parameters: {} }],
     fields: [
       {
         label: "portal.policies.config.routing.fields.destination",
@@ -346,7 +373,7 @@ export const POLICY_CONFIG: Record<string, PolicyConfigDef> = {
       "portal.policies.config.retention.rules.2",
     ],
     scopeLabel: "portal.policies.config.scopeAll",
-    defaultOperations: [policyStep("compress")],
+    defaultOperations: [{ operation: TOOL_ENDPOINTS.compress, parameters: {} }],
     fields: [
       {
         label: "portal.policies.config.retention.fields.keepFor",
@@ -529,30 +556,17 @@ const DEFAULT_RETRY_DELAY = 5;
 // POST /api/v1/policies endpoint. The real backend ignores unknown fields.
 type CatalogueWireBody = WirePolicy & { categoryId: string };
 
-/**
- * The persisted policy name derived from its category, e.g. "Security Policy".
- * `category.label` is an i18n key, so translate it before building the name;
- * otherwise the raw key is persisted and surfaces in the UI (e.g. the Sources
- * "Used by" pill).
- */
-function policyDisplayName(entry: CatalogueEntry, t: TFunction): string {
-  return t("portal.policies.defaultName", {
-    category: t(entry.category.label),
-  });
-}
-
 /** Build a wire policy from a setup wizard result. */
 export function buildWireFromSetup(
   entry: CatalogueEntry,
   result: PolicySetupResult,
-  t: TFunction,
   enabled = true,
 ): CatalogueWireBody {
   return {
     categoryId: entry.category.id,
     ...toWirePolicy({
       id: entry.policy?.state.backendId ?? "",
-      name: policyDisplayName(entry, t),
+      name: `${entry.category.label} Policy`,
       enabled,
       categoryId: entry.category.id,
       sources: result.sources,
@@ -575,14 +589,13 @@ export function buildWireFromState(
   entry: CatalogueEntry,
   policy: DecoratedPolicy,
   enabled: boolean,
-  t: TFunction,
 ): CatalogueWireBody {
   const s = policy.state;
   return {
     categoryId: entry.category.id,
     ...toWirePolicy({
       id: s.backendId ?? "",
-      name: policyDisplayName(entry, t),
+      name: `${entry.category.label} Policy`,
       enabled,
       categoryId: entry.category.id,
       sources: s.sources,

frontend/editor/src/portal/api/users.ts

@@ -1,7 +1,3 @@
-// The bare i18next singleton (the same instance @app/i18n initializes at
-// startup), imported directly so this data module doesn't pull i18n's
-// init side effects into unit tests that mock react-i18next.
-import i18n from "i18next";
 import { apiClient } from "@portal/api/http";
 import type { Tier } from "@portal/contexts/TierContext";
 
@@ -273,23 +269,22 @@ function roleIdFor(u: AdminUserSummaryDto): RoleId {
 
 /** A member's last-seen time as plain language; "Never" when no session is tracked. */
 function relativeTime(value: number | string | undefined): string {
-  if (value === undefined || value === null)
-    return i18n.t("users.activity.never");
+  if (value === undefined || value === null) return "Never";
   const ts = typeof value === "string" ? Date.parse(value) : value;
-  if (!Number.isFinite(ts) || ts <= 0) return i18n.t("users.activity.never");
+  if (!Number.isFinite(ts) || ts <= 0) return "Never";
   const mins = Math.max(0, Math.round((Date.now() - ts) / 60000));
-  if (mins < 1) return i18n.t("users.activity.justNow");
-  if (mins < 60) return i18n.t("users.activity.minutesAgo", { count: mins });
+  if (mins < 1) return "Just now";
+  if (mins < 60) return `${mins}m ago`;
   const hours = Math.round(mins / 60);
-  if (hours < 24) return i18n.t("users.activity.hoursAgo", { count: hours });
+  if (hours < 24) return `${hours}h ago`;
   const days = Math.round(hours / 24);
-  if (days < 7) return i18n.t("users.activity.daysAgo", { count: days });
+  if (days < 7) return `${days}d ago`;
   const weeks = Math.round(days / 7);
-  if (weeks < 5) return i18n.t("users.activity.weeksAgo", { count: weeks });
+  if (weeks < 5) return weeks === 1 ? "1 week ago" : `${weeks} weeks ago`;
   const months = Math.round(days / 30);
-  if (months < 12) return i18n.t("users.activity.monthsAgo", { count: months });
+  if (months < 12) return months <= 1 ? "1 month ago" : `${months} months ago`;
   const years = Math.round(days / 365);
-  return i18n.t("users.activity.yearsAgo", { count: years });
+  return years <= 1 ? "1 year ago" : `${years} years ago`;
 }
 
 /** 0 / huge sentinel license values mean "no seat limit". */

frontend/editor/src/portal/components/EditorStatusCard.css

@@ -15,7 +15,7 @@
   align-items: center;
   gap: 1.25rem;
   padding: 1rem 1.25rem;
-  background: var(--color-hero-navy);
+  background: #16213e;
 }
 
 .portal-editor-hero__logo {
@@ -123,7 +123,7 @@
 .portal-editor-hero__action .portal-editor-hero__cta.sui-btn {
   background: #ffffff;
   border-color: #ffffff;
-  color: var(--color-hero-navy);
+  color: #16213e;
 }
 .portal-editor-hero__action .portal-editor-hero__cta.sui-btn:hover {
   background: rgba(255, 255, 255, 0.88);

frontend/editor/src/portal/components/ProcessingStatusStrip.tsx

@@ -26,7 +26,7 @@ export function ProcessingStatusStrip() {
           style={{ background: TIER_INFO[tier].dotColor }}
           aria-hidden
         />
-        {t(TIER_INFO[tier].labelKey)}
+        {TIER_INFO[tier].label}
       </span>
       <span className="portal-statusstrip__sep" aria-hidden>
         ·

frontend/editor/src/portal/components/WelcomeBanner.css

@@ -18,7 +18,7 @@
   gap: 1rem;
   flex-wrap: wrap;
   padding: 0.875rem 1.25rem;
-  background: var(--color-hero-navy);
+  background: #16213e;
 }
 
 .portal-welcome__brand {
@@ -90,7 +90,7 @@
 .portal-welcome__header .portal-welcome__cta.sui-btn {
   background: #ffffff;
   border-color: #ffffff;
-  color: var(--color-hero-navy);
+  color: #16213e;
 }
 .portal-welcome__header .portal-welcome__cta.sui-btn:hover {
   background: rgba(255, 255, 255, 0.88);

frontend/editor/src/portal/components/agent-builder/AgentBuilderPanel.tsx

@@ -1,11 +1,7 @@
 import { useState } from "react";
 import { useTranslation } from "react-i18next";
 import { StatusBadge, Tabs, type TabItem } from "@app/ui";
-import {
-  type Agent,
-  AGENT_STATUS_LABEL,
-  AGENT_STATUS_TONE,
-} from "@portal/api/agents";
+import { type Agent, AGENT_STATUS_TONE } from "@portal/api/agents";
 import { ScenariosPanel } from "@portal/components/agent-builder/ScenariosPanel";
 import { ToolsPanel } from "@portal/components/agent-builder/ToolsPanel";
 import { EvalsPanel } from "@portal/components/agent-builder/EvalsPanel";
@@ -56,7 +52,7 @@ export function AgentBuilderPanel({
         </div>
         <div className="portal-agents__builder-meta">
           <StatusBadge tone={AGENT_STATUS_TONE[agent.status]} size="sm">
-            {t(AGENT_STATUS_LABEL[agent.status])}
+            {agent.status}
           </StatusBadge>
           <code className="portal-agents__builder-version">
             {agent.version}

frontend/editor/src/portal/components/agent-builder/AgentSelector.tsx

@@ -1,9 +1,5 @@
 import { useTranslation } from "react-i18next";
-import {
-  type Agent,
-  AGENT_STATUS_LABEL,
-  AGENT_STATUS_TONE,
-} from "@portal/api/agents";
+import { type Agent, AGENT_STATUS_TONE } from "@portal/api/agents";
 import { Button, StatusBadge } from "@app/ui";
 import "@portal/views/AgentBuilder.css";
 
@@ -44,7 +40,7 @@ export function AgentSelector({
           </span>
           <span className="portal-agents__selector-meta">
             <StatusBadge tone={AGENT_STATUS_TONE[a.status]} size="sm">
-              {t(AGENT_STATUS_LABEL[a.status])}
+              {a.status}
             </StatusBadge>
             <code className="portal-agents__selector-version">{a.version}</code>
           </span>

frontend/editor/src/portal/components/agent-builder/VersionsPanel.tsx

@@ -1,10 +1,6 @@
 import { useTranslation } from "react-i18next";
 import { Button, StatusBadge } from "@app/ui";
-import {
-  type Agent,
-  AGENT_STATUS_LABEL,
-  AGENT_STATUS_TONE,
-} from "@portal/api/agents";
+import { type Agent, AGENT_STATUS_TONE } from "@portal/api/agents";
 import "@portal/views/AgentBuilder.css";
 
 interface VersionsPanelProps {
@@ -56,7 +52,7 @@ export function VersionsPanel({ agent, historyUnlocked }: VersionsPanelProps) {
                     {v.version}
                   </code>
                   <StatusBadge tone={AGENT_STATUS_TONE[v.status]} size="sm">
-                    {t(AGENT_STATUS_LABEL[v.status])}
+                    {v.status}
                   </StatusBadge>
                   {isCurrent && (
                     <StatusBadge tone="info" size="sm" showDot={false}>

frontend/editor/src/portal/components/catalogue/ComponentDetailModal.tsx

@@ -12,11 +12,9 @@ import {
 } from "@app/ui";
 import {
   type SdkComponent,
-  BILLING_UNIT_LABEL,
   MATURITY_META,
   formatPrice,
 } from "@portal/api/sdkComponents";
-import { TIER_INFO } from "@portal/contexts/TierContext";
 import { ComponentPropsTable } from "@portal/components/catalogue/ComponentPropsTable";
 import "@portal/views/Components.css";
 
@@ -115,7 +113,7 @@ export function ComponentDetailModal({
           title={t("portal.catalogue.detail.locked.title")}
           description={t("portal.catalogue.detail.locked.description", {
             name: component.name,
-            plan: t(TIER_INFO[component.minTier].labelKey),
+            tier: component.minTier,
           })}
         />
       )}
@@ -207,7 +205,7 @@ export function ComponentDetailModal({
               />
               <StatTile
                 label={t("portal.catalogue.detail.stats.billedOn")}
-                value={t(BILLING_UNIT_LABEL[component.pricing.unit])}
+                value={component.pricing.unit}
               />
               <StatTile
                 label={t("portal.catalogue.detail.stats.freeQuota")}
@@ -222,7 +220,7 @@ export function ComponentDetailModal({
             </div>
             <p className="portal-components__pricing-note">
               {t("portal.catalogue.detail.pricing.note", {
-                unit: t(BILLING_UNIT_LABEL[component.pricing.unit]),
+                unit: component.pricing.unit,
               })}
             </p>
           </div>