Audit-log enrichment for static ADMIN_API_KEY paths

[bokelley]

Context

Several routes accept the static ADMIN_API_KEY as auth (synthetic user id admin_api_key, set by server/src/middleware/auth.ts:744-755). The most-exercised one is POST /api/organizations/:orgId/members/by-email (server/src/routes/organizations.ts:3008), used by internal tooling and incident scripts (e.g. scripts/incidents/2026-04-triton-promote-hayem.ts).

When the static admin key invokes one of these routes, audit log entries record:

• workos_user_id: 'admin_api_key'
• inviter_email: 'admin-api-key@internal'
• the route + verb

That tells us the static key was used but not which operator or script used it. If the key ever leaks, we can't trace which client owned the breach.

Proposal

For every static-admin-gated mutation, enrich the audit details field with:

1. req.ip (or first hop of X-Forwarded-For when behind Fly's edge).
2. A non-reversible fingerprint of the key — sha256(ADMIN_API_KEY).slice(0, 8) — so rotations show up as a fingerprint change in the log without exposing the key.
3. An optional operator-supplied X-Admin-Operator header echoed verbatim into details.operator. Internal scripts (the incident scripts in scripts/incidents/) already know who's running them; teach them to set the header.

This is a cross-cutting hardening — affects every static-admin-gated route, not just by-email. Surfaced by security-reviewer in PR #4207.

Out of scope

• Rotating or revoking the existing key (separate ops task).
• Changing the auth model to require human-in-the-loop (rejected during the same review — break-glass scripts need the static path).

Files to touch

• server/src/middleware/auth.ts — add fingerprint helper, attach req.adminKeyFingerprint alongside req.isStaticAdminApiKey.
• All routes that gate on isStaticAdminApiKey (grep isStaticAdminApiKey) — record fingerprint + IP + operator header in their recordAuditLog calls.
• scripts/incidents/* — set X-Admin-Operator so we know which script ran.

[bokelley]

Triage

Classification: Security hardening
Bucket(s): security-sensitive, admin / ops tools
Status: deferred (fold candidate — blocked on #4207)

Structural call: All three proposed file touches (auth.ts, isStaticAdminApiKey routes, scripts/incidents/*) overlap directly with the open PR #4207 diff (auth.ts + the synthetic-user path are already in scope there). Folding this before #4207 merges avoids re-opening the same files in a follow-up and keeps the audit-enrichment paired with the WorkOS invite fix that exposed the gap.

Security notes for whoever implements:

• X-Admin-Operator echoed verbatim into audit details → sanitize before writing (strip newlines and control chars) to prevent log injection from a caller who holds the key.
• IP source: prefer req.ip (Express trust proxy) over parsing X-Forwarded-For directly; confirm which header req.ip resolves to under the Fly edge config — Fly sets fly-client-ip as the authoritative first-hop.
• 8-hex-char SHA-256 prefix (32 bits) is reasonable for fingerprinting key rotations; verify it meets your audit-forensics retention requirements.

Blocked-on: #4207 — resurfaces on merge

---

Triaged by Claude Code. Session: https://claude.ai/code/${CLAUDE_CODE_REMOTE_SESSION_ID}

---

Generated by Claude Code