fix(security): M2-008 Valkey key audit — SCAN over KEYS, restrict /gc to admin (#298)

Co-authored-by: Jason Woltje <jason@diversecanvas.com> Co-committed-by: Jason Woltje <jason@diversecanvas.com>
2026-03-21 20:45:43 +00:00
parent 02ff3b3256
commit 5b089392fd
5 changed files with 58 additions and 26 deletions
--- a/apps/gateway/src/commands/command-executor.service.ts
+++ b/apps/gateway/src/commands/command-executor.service.ts
@@ -77,8 +77,8 @@ export class CommandExecutorService {
            message: 'Retry last message requested.',
          };
        case 'gc': {
-          // User-scoped sweep for non-admin; system-wide for admin
-          const result = await this.sessionGC.sweepOrphans(userId);
+          // Admin-only: system-wide GC sweep across all sessions
+          const result = await this.sessionGC.sweepOrphans();
          return {
            command: 'gc',
            success: true,