Repository navigation
Track API key usage per orgId and emit security events on suspicious patterns #220
Description
Problem Statement. The ApiKey model carries lastUsedAt but the wider security
story reads only that timestamp. There is no aggregation of "this key was used 10 000 times
in 60 s across 30 countries." Without that, usage-based PII exfiltration from a stolen key
is invisible.
Why it matters. A stolen key is the most likely attack vector in a service-to-service
realm; usage analytics turn it from a quiet exfiltration to a loud anomaly.
Technical Context. request-correlation.middleware.ts already provides
correlationId. The existing Prometheus metrics middleware can be extended.
Expected Outcome. A sliding-usage aggregator that, when distinctClientCountries > 3
for a key in 15 min, emits a security event into the existing AuditLog and a
security_event_total{kind=api_key_anomaly} counter.
Acceptance Criteria.
- New Redis key per API key named
usage:<keyId>:15mstoring distinct (ip-cc, ts). - Workers in
JobsModuleflush the window toAuditLogonce an hour. - A test seeds the synthetic data; the worker writes the expected
AuditLogrow.
Implementation Notes. Geo lookup is best done offline with a static MaxMind DB; doing
it online would be a privacy and rate-limit disaster.
Files or modules likely to be affected. src/jobs/security-event.job.ts (new),
src/observability/usage-tracker/* (new), app/backend/test/security-events.e2e-spec.ts.
Difficulty. Hard
Estimated effort. M
Backlog item #12 from `docs/maintainer-issue-backlog.md.
Activity
Clement-coder commentedon Jul 20, 2026
Hi,
I’m a full-stack software and blockchain engineer with hands-on experience delivering production-ready solutions across frontend, backend, and blockchain systems.
I’d like to take ownership of this issue. I’ve reviewed the requirements and can implement a scalable, maintainable, and well-tested solution that fully satisfies the acceptance criteria.
Ready to start immediately and keep the team updated throughout the process.
ameeribro4-sudo commentedon Jul 21, 2026
I can resolve this issue, assign me.
grantfox-oss commentedon Jul 21, 2026
🦊 GrantFox — @ameeribro4-sudo has been assigned to this issue as part of the Official Campaign | FWC26 campaign!
Next steps:
Closes #220)Good luck! Track your progress on GrantFox.
feat(security): track API key usage per orgId and emit security events
feat(security): track API key usage per orgId and emit security events
feat(security): track API key usage per orgId and emit security events
feat(security): track API key usage per orgId and emit security events (
grantfox-oss commentedon Jul 22, 2026
🎉 This issue has been marked as completed on GrantFox as part of the Official Campaign | FWC26 campaign!
@ameeribro4-sudo's PR #406 was approved and merged by @kilodesodiq-arch.
🏆 @ameeribro4-sudo: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (118 total points). Track your full progress on GrantFox.
👏 Great work, @ameeribro4-sudo! Keep contributing to ChainForgee.
feat(security): track API key usage per orgId and emit security events (