Unleash / unleash / 39934505532

88%

master: 91%

Build Type

push

github

Committed by web-flow

Commit Message

fix(api-tokens): fail v2 token expiry update and delete when the transaction rolls back

## Summary
Updating a v2 API token's expiry or deleting it answers 200 even when
the change rolls back. Both routes run the token change and its audit
event in one transaction. A failed event write or any database error
rolls that transaction back. The routes wrap the transaction in a
`catch` that drops any error, so the caller still sees a success. For a
delete, that's the worst case: someone revokes a leaked token, the API
says it's gone, and the token keeps working. This is
[EG-4865](https://linear.app/unleash/issue/EG-4865/updating-a-v2-api-tokens-expiry-or-deleting-it-returns-200-when-the).

This PR drops the `catch` from both routes, so the error fails the
request. The project-scoped token delete already fails the request the
same way.

The `catch` says it falls through to legacy storage. The legacy call
only runs for v1 tokens, so for a v2 token nothing falls through.

## Key points
- `PUT` and `DELETE` on `/api/admin/api-tokens/:token` now answer 500
instead of 200 when the transaction that saves a v2 token's change
fails.

## Testing
A new route test updates and deletes a v2 token while the event writes
in both requests fail. Both answer 500, where `main` answers 200. The
test builds the app on fake stores. I fail the write with a fake instead
of a spy on the real event store, since `oss/AGENTS.md` prefers fakes
over mocking.

Coverage Stats

4076 of 5178 branches covered (78.72%)

5 of 5 new or added lines in 1 file covered. (100.0%)

2 existing lines in 1 file now uncovered.

16504 of 18719 relevant lines covered (88.17%)

790.95 hits per line