---
id: w4/m6/t005
title: "Authorization: secrets verbs enforced through m4's Checker; values never leak to logs/responses"
worker: worker4
status: done
estimate: 25m
depends_on: [w4/m6/t004]
---

## Objective

Secrets are the most sensitive verbs on the API: gate read and write env-vars operations through m4's `Checker` seam (manage-scope on the service), keeping the nil-checker allow-all fallback identical to the rest of the API; and audit the whole path so secret values never appear in request logs, error messages, or responses beyond Render's documented visibility semantics.

## Context

- m4 t004 defines the `Checker` seam and how the three adapters enforce it — follow the same enforcement points.
- `api.IdentityFrom` (m3) supplies the subject.
- Leak audit surface: bex-api request logging middleware, error wrapping in the Core, GraphQL error paths.

## Steps

1. Add the check calls to the secrets Core methods (or adapter enforcement points, matching m4's pattern).
2. Unit tests with the fake checker: allow, deny (403), nil-checker allow-all.
3. Audit the logging + error paths for value leakage; redact where needed; test that a failed PUT's error output contains keys at most, never values.

## Files

- `operator/internal/api/` (secrets Core + enforcement, logging middleware)

## Acceptance criteria

- [ ] Deny ⇒ 403 on all three adapters; nil checker ⇒ today's behavior.
- [ ] No test or manual path shows a secret value in logs or error bodies.

## Out of scope

- New OpenFGA model relations beyond what m4 shipped (reuse manage scope).
