fix(security): M2-008 Valkey key audit — SCAN over KEYS, restrict /gc to admin (#298)

Co-authored-by: Jason Woltje <jason@diversecanvas.com> Co-committed-by: Jason Woltje <jason@diversecanvas.com>
2026-03-21 20:45:43 +00:00
parent 02ff3b3256
commit 5b089392fd
5 changed files with 58 additions and 26 deletions
--- a/apps/gateway/src/commands/command-registry.service.ts
+++ b/apps/gateway/src/commands/command-registry.service.ts
@@ -190,9 +190,9 @@ export class CommandRegistryService implements OnModuleInit {
      },
      {
        name: 'gc',
-        description: 'Trigger garbage collection sweep (user-scoped)',
+        description: 'Trigger garbage collection sweep (admin only — system-wide)',
        aliases: [],
-        scope: 'core',
+        scope: 'admin',
        execution: 'socket',
        available: true,
      },