From c1771dc271bd1c0f7ce0ce88fb3152856e1da588 Mon Sep 17 00:00:00 2001 From: Joseph Doherty Date: Fri, 31 Jul 2026 14:06:13 -0400 Subject: [PATCH] docs(acl): correct the API-key revocation warning after live verification (#520) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The /apikeys page claimed revocation "takes effect on a node only after the next deployment". The live gate showed that is wrong for the node the operator is most likely looking at: revoking through the UI denied the key on the VERY NEXT request against the fused admin+driver node, because ConfigDbApiKeyStore reads per request. The deployment delay applies only to driver-only nodes, whose keys ride the artifact. Reworded to say both, and to tell an operator to assume the slower behaviour when revoking a compromised key — which is the decision the warning exists to inform. Found by doing the thing rather than reasoning about it: the previous wording looked obviously correct until the revoked key was actually re-presented. Claude-Session: https://claude.ai/code/session_015p7wGqy3YpZNCpDzTpGMKo --- .../Components/Pages/ApiKeys.razor | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Pages/ApiKeys.razor b/src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Pages/ApiKeys.razor index e96e0b8a..8fc31a67 100644 --- a/src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Pages/ApiKeys.razor +++ b/src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Pages/ApiKeys.razor @@ -15,8 +15,11 @@ whose password is the key below. The key resolves to a principal; ACL rows naming that principal are what grant it permissions.
- Revoking a key takes effect on a node only after the next deployment — driver-only - nodes have no config database, so keys travel inside the deployment artifact. + Revocation is not uniform across the fleet. A node with a config database (a fused + admin+driver node such as this one) applies it immediately, because it reads keys per + request. A driver-only node has no config database, so its keys travel inside the + deployment artifact and a revocation reaches it only on the next deployment. + Assume the slower behaviour when revoking a compromised key. @if (_created is not null)