feat(status): surface full sdkKeys[]/mobileKeys[] arrays on /status

Add a KeyStatus representation and sdkKeys[]/mobileKeys[] arrays to
EnvironmentStatusRep, populated from GetAcceptedKeys() partitioned by
type. Each entry carries the obscured value, the optional wire identifier,
and an optional Unix-millisecond expiry. The arrays are always present
(never null); a server-only environment has an empty mobileKeys.

expiringSdkKey is now computed from the accepted set as the soonest-
expiring non-anchor SDK key, with a (expiry, value) tie-break so the pick
is deterministic when several keys share an expiry.

Author: aaron-zeisler

internal/api/status_reps.go

@@ -15,17 +15,41 @@ type StatusRep struct {
 	ClientVersion string                          `json:"clientVersion"`
 }
 
+// KeyStatus is the JSON representation of one accepted SDK or mobile key in the status endpoint's
+// sdkKeys[] / mobileKeys[] arrays.
+//
+// Key is the non-secret human-readable identifier from the wire format (the "key" field of a
+// sdkKeys/mobileKeys entry); it is omitted when the source carried no identifier (manual config, or
+// an old-format payload predating concurrent keys). Value is the obscured credential secret (via
+// sdks.ObscureKey). Expiry carries the Unix-millisecond expiry timestamp when the key is being phased
+// out; it is omitted for permanent keys.
+type KeyStatus struct {
+	Key    string `json:"key,omitempty"`
+	Value  string `json:"value"`
+	Expiry *int64 `json:"expiry,omitempty"`
+}
+
 // EnvironmentStatusRep is the per-environment JSON representation returned by the status endpoint.
 //
 // This is exported for use in integration test code.
 type EnvironmentStatusRep struct {
-	SDKKey           string               `json:"sdkKey"`
-	EnvID            string               `json:"envId,omitempty"`
-	EnvKey           string               `json:"envKey,omitempty"`
-	EnvName          string               `json:"envName,omitempty"`
-	ProjKey          string               `json:"projKey,omitempty"`
-	ProjName         string               `json:"projName,omitempty"`
-	MobileKey        string               `json:"mobileKey,omitempty"`
+	// SDKKey is the obscured anchor SDK key — the key relay uses for its upstream connection. It
+	// designates which SDKKeys entry is the anchor.
+	SDKKey string `json:"sdkKey"`
+	// SDKKeys carries the full accepted set of server-side SDK keys — including the anchor — with their
+	// identifiers, obscured values, and optional expiry. Always present; always contains at least the
+	// anchor.
+	SDKKeys  []KeyStatus `json:"sdkKeys"`
+	EnvID    string      `json:"envId,omitempty"`
+	EnvKey   string      `json:"envKey,omitempty"`
+	EnvName  string      `json:"envName,omitempty"`
+	ProjKey  string      `json:"projKey,omitempty"`
+	ProjName string      `json:"projName,omitempty"`
+	// MobileKey is the obscured primary mobile key. It designates which MobileKeys entry is the primary.
+	MobileKey string `json:"mobileKey,omitempty"`
+	// MobileKeys carries the full accepted set of mobile keys — including the primary. Always present;
+	// empty for an environment with no mobile keys (e.g. server-side only).
+	MobileKeys       []KeyStatus          `json:"mobileKeys"`
 	ExpiringSDKKey   string               `json:"expiringSdkKey,omitempty"`
 	Status           string               `json:"status"`
 	ConnectionStatus ConnectionStatusRep  `json:"connectionStatus"`

relay/endpoints_status.go

@@ -3,10 +3,13 @@ package relay
 import (
 	"encoding/json"
 	"net/http"
+	"slices"
+	"strings"
 	"time"
 
 	"github.com/launchdarkly/ld-relay/v8/config"
 	"github.com/launchdarkly/ld-relay/v8/internal/api"
+	"github.com/launchdarkly/ld-relay/v8/internal/credential"
 	"github.com/launchdarkly/ld-relay/v8/internal/relayenv"
 	"github.com/launchdarkly/ld-relay/v8/internal/sdks"
 
@@ -46,9 +49,7 @@ func statusHandler(relay *Relay) http.Handler {
 				ProjName: identifiers.ProjName,
 			}
 
-			// Use the anchor SDK key and primary mobile key specifically — GetCredentials() may return
-			// multiple SDK and mobile keys (primary + expiring), so iterating it for these singular
-			// status fields would give a non-deterministic result.
+			// Scalar fields: anchor SDK key and primary mobile key.
 			if key := clientCtx.GetAnchorKey(); key.Defined() {
 				status.SDKKey = sdks.ObscureKey(string(key))
 			}
@@ -60,11 +61,45 @@ func statusHandler(relay *Relay) http.Handler {
 					status.EnvID = string(envID)
 				}
 			}
-			for _, c := range clientCtx.GetDeprecatedCredentials() {
-				if key, ok := c.(config.SDKKey); ok {
-					status.ExpiringSDKKey = sdks.ObscureKey(string(key))
+
+			// sdkKeys[] / mobileKeys[]: the full accepted set — including the anchor and primary mobile
+			// key — partitioned by type. The scalar sdkKey/mobileKey above designate which entry is the
+			// anchor/primary. Order is unspecified.
+			anchor := string(clientCtx.GetAnchorKey())
+			var expiringCandidates []credential.AcceptedKey
+			for _, k := range clientCtx.GetAcceptedKeys() {
+				ks := keyStatus(k)
+				switch k.Type {
+				case credential.KeyTypeServer:
+					status.SDKKeys = append(status.SDKKeys, ks)
+					// expiringSdkKey considers non-anchor server keys that carry an expiry.
+					if k.Value != anchor && k.Expiry != nil {
+						expiringCandidates = append(expiringCandidates, k)
+					}
+				case credential.KeyTypeMobile:
+					status.MobileKeys = append(status.MobileKeys, ks)
 				}
 			}
+			// Arrays are always present (never null): a server-only env has an empty mobileKeys.
+			if status.SDKKeys == nil {
+				status.SDKKeys = []api.KeyStatus{}
+			}
+			if status.MobileKeys == nil {
+				status.MobileKeys = []api.KeyStatus{}
+			}
+
+			// expiringSdkKey: the soonest-expiring non-anchor SDK key. Comparing by expiry then by value
+			// gives a total order, so the chosen key is deterministic even when several keys share the
+			// same expiry (map iteration order, and hence MinFunc's pick on a tie, is otherwise unstable).
+			if len(expiringCandidates) > 0 {
+				earliest := slices.MinFunc(expiringCandidates, func(a, b credential.AcceptedKey) int {
+					if c := a.Expiry.Compare(*b.Expiry); c != 0 {
+						return c
+					}
+					return strings.Compare(a.Value, b.Value)
+				})
+				status.ExpiringSDKKey = sdks.ObscureKey(earliest.Value)
+			}
 
 			client := clientCtx.GetClient()
 			if client == nil {
@@ -155,3 +190,17 @@ func statusHandler(relay *Relay) http.Handler {
 		_, _ = w.Write(data)
 	})
 }
+
+// keyStatus converts an accepted key into its status-endpoint JSON representation, obscuring the
+// secret value and surfacing the optional identifier and expiry.
+func keyStatus(k credential.AcceptedKey) api.KeyStatus {
+	ks := api.KeyStatus{Value: sdks.ObscureKey(k.Value)}
+	if k.Key != nil {
+		ks.Key = *k.Key
+	}
+	if k.Expiry != nil {
+		ms := k.Expiry.UnixMilli()
+		ks.Expiry = &ms
+	}
+	return ks
+}

relay/endpoints_status_test.go

@@ -5,12 +5,14 @@ import (
 	"testing"
 	"time"
 
+	"github.com/launchdarkly/ld-relay/v8/internal/credential"
 	"github.com/launchdarkly/ld-relay/v8/internal/sdkauth"
 
 	c "github.com/launchdarkly/ld-relay/v8/config"
 	"github.com/launchdarkly/ld-relay/v8/internal/sdks"
 	st "github.com/launchdarkly/ld-relay/v8/internal/sharedtest"
 	"github.com/launchdarkly/ld-relay/v8/internal/sharedtest/testclient"
+	"github.com/launchdarkly/ld-relay/v8/internal/util"
 
 	ct "github.com/launchdarkly/go-configtypes"
 	"github.com/launchdarkly/go-sdk-common/v3/ldtime"
@@ -56,6 +58,36 @@ func TestEndpointsStatus(t *testing.T) {
 			st.AssertJSONPathMatch(t, p.relay.version, status, "version")
 			st.AssertJSONPathMatch(t, ld.Version, status, "clientVersion")
 		})
+
+		t.Run("sdkKeys/mobileKeys arrays carry the full accepted set including the anchor", func(t *testing.T) {
+			var config c.Config
+			config.Environment = st.MakeEnvConfigs(st.EnvMain, st.EnvMobile)
+
+			withStartedRelay(t, config, func(p relayTestParams) {
+				r, _ := http.NewRequest("GET", "http://localhost/status", nil)
+				result, body := st.DoRequest(r, p.relay)
+				assert.Equal(t, http.StatusOK, result.StatusCode)
+				status := ldvalue.Parse(body)
+
+				// EnvMain is a manually-configured single-key env: sdkKeys[] is present and contains
+				// exactly the anchor (full set includes it); manual config carries no key identifier.
+				sdkKeys := status.GetByKey("environments").GetByKey(st.EnvMain.Name).GetByKey("sdkKeys")
+				require.Equal(t, 1, sdkKeys.Count(), "sdkKeys must contain the anchor")
+				assert.Equal(t, sdks.ObscureKey(string(st.EnvMain.Config.SDKKey)),
+					sdkKeys.GetByIndex(0).GetByKey("value").StringValue())
+
+				// EnvMain has no mobile key — mobileKeys is present but empty.
+				mobileKeys := status.GetByKey("environments").GetByKey(st.EnvMain.Name).GetByKey("mobileKeys")
+				assert.Equal(t, 0, mobileKeys.Count())
+				assert.Equal(t, ldvalue.ArrayType, mobileKeys.Type(), "mobileKeys present (not null) even when empty")
+
+				// EnvMobile has both: its mobile key appears in mobileKeys[].
+				mobMobileKeys := status.GetByKey("environments").GetByKey(st.EnvMobile.Name).GetByKey("mobileKeys")
+				require.Equal(t, 1, mobMobileKeys.Count())
+				assert.Equal(t, sdks.ObscureKey(string(st.EnvMobile.Config.MobileKey)),
+					mobMobileKeys.GetByIndex(0).GetByKey("value").StringValue())
+			})
+		})
 	})
 
 	t.Run("connection interruption - less than DisconnectedStatusTime", func(t *testing.T) {
@@ -131,3 +163,124 @@ func TestEndpointsStatus(t *testing.T) {
 		})
 	})
 }
+
+// findKeyStatusByValue returns the sdkKeys[]/mobileKeys[] entry whose obscured "value" matches, or a
+// null value. Array entry order is unspecified, so callers look entries up by value.
+func findKeyStatusByValue(arr ldvalue.Value, obscuredValue string) ldvalue.Value {
+	for i := 0; i < arr.Count(); i++ {
+		if arr.GetByIndex(i).GetByKey("value").StringValue() == obscuredValue {
+			return arr.GetByIndex(i)
+		}
+	}
+	return ldvalue.Null()
+}
+
+// TestEndpointsStatusExpiringSDKKey drives a multi-key environment through the real /status handler:
+// it reconciles an env to an anchor plus two non-anchor expiring SDK keys and asserts the
+// expiringSdkKey selection, the per-key expiry/identifier serialization in sdkKeys[], and that the
+// soonest-expiry pick is deterministic on an exact expiry tie.
+func TestEndpointsStatusExpiringSDKKey(t *testing.T) {
+	getStatus := func(t *testing.T, p relayTestParams, set credential.AcceptedSet) ldvalue.Value {
+		env, err := p.relay.getEnvironment(sdkauth.New(st.EnvMain.Config.SDKKey))
+		require.NoError(t, err)
+		require.NotNil(t, env)
+		env.ReconcileCredentials(set)
+
+		r, _ := http.NewRequest("GET", "http://localhost/status", nil)
+		result, body := st.DoRequest(r, p.relay)
+		require.Equal(t, http.StatusOK, result.StatusCode)
+		return ldvalue.Parse(body).GetByKey("environments").GetByKey(st.EnvMain.Name)
+	}
+
+	t.Run("soonest-expiring non-anchor key, with expiry and identifier surfaced", func(t *testing.T) {
+		var config c.Config
+		config.Environment = st.MakeEnvConfigs(st.EnvMain)
+		withStartedRelay(t, config, func(p relayTestParams) {
+			anchor := st.EnvMain.Config.SDKKey
+			soon := time.Now().Add(1 * time.Hour)
+			later := time.Now().Add(2 * time.Hour)
+			set, err := credential.NewAcceptedSetBuilder().
+				WithAnchor(credential.SDKKeyParams{Value: anchor}).
+				WithSDKKey(credential.SDKKeyParams{Value: "sdk-soon", Key: util.PtrOrNil("soon-key"), Expiry: util.PtrOrNil(soon)}).
+				WithSDKKey(credential.SDKKeyParams{Value: "sdk-later", Expiry: util.PtrOrNil(later)}).
+				Build()
+			require.NoError(t, err)
+
+			envStatus := getStatus(t, p, set)
+
+			// expiringSdkKey is the obscured soonest-expiring non-anchor key.
+			st.AssertJSONPathMatch(t, sdks.ObscureKey("sdk-soon"), envStatus, "expiringSdkKey")
+
+			// sdkKeys[] carries the full set (anchor + both non-anchor keys).
+			sdkKeys := envStatus.GetByKey("sdkKeys")
+			require.Equal(t, 3, sdkKeys.Count())
+
+			// The expiring key surfaces its identifier and Unix-millis expiry.
+			soonEntry := findKeyStatusByValue(sdkKeys, sdks.ObscureKey("sdk-soon"))
+			require.False(t, soonEntry.IsNull())
+			assert.Equal(t, "soon-key", soonEntry.GetByKey("key").StringValue())
+			assert.Equal(t, float64(soon.UnixMilli()), soonEntry.GetByKey("expiry").Float64Value())
+
+			// A key with no identifier omits "key" entirely (omitempty, nil pointer).
+			laterEntry := findKeyStatusByValue(sdkKeys, sdks.ObscureKey("sdk-later"))
+			require.False(t, laterEntry.IsNull())
+			assert.True(t, laterEntry.GetByKey("key").IsNull(), `"key" must be omitted when the source carried no identifier`)
+		})
+	})
+
+	t.Run("tie on expiry resolves deterministically to the smaller value", func(t *testing.T) {
+		var config c.Config
+		config.Environment = st.MakeEnvConfigs(st.EnvMain)
+		withStartedRelay(t, config, func(p relayTestParams) {
+			anchor := st.EnvMain.Config.SDKKey
+			sameExpiry := time.Now().Add(1 * time.Hour)
+			set, err := credential.NewAcceptedSetBuilder().
+				WithAnchor(credential.SDKKeyParams{Value: anchor}).
+				WithSDKKey(credential.SDKKeyParams{Value: "sdk-bbb", Expiry: util.PtrOrNil(sameExpiry)}).
+				WithSDKKey(credential.SDKKeyParams{Value: "sdk-aaa", Expiry: util.PtrOrNil(sameExpiry)}).
+				Build()
+			require.NoError(t, err)
+
+			envStatus := getStatus(t, p, set)
+			// With equal expiries, the smaller value (sdk-aaa) wins deterministically.
+			st.AssertJSONPathMatch(t, sdks.ObscureKey("sdk-aaa"), envStatus, "expiringSdkKey")
+		})
+	})
+}
+
+// TestKeyStatus verifies the helper that converts an accepted key into its status-endpoint JSON form.
+func TestKeyStatus(t *testing.T) {
+	strptr := func(s string) *string { return &s }
+
+	t.Run("permanent key with identifier", func(t *testing.T) {
+		ks := keyStatus(credential.AcceptedKey{
+			Type: credential.KeyTypeServer, Value: "sdk-abc123", Key: strptr("default"),
+		})
+		assert.Equal(t, "default", ks.Key)
+		assert.Equal(t, sdks.ObscureKey("sdk-abc123"), ks.Value)
+		assert.Nil(t, ks.Expiry)
+	})
+
+	t.Run("nil identifier yields empty Key (omitted in JSON)", func(t *testing.T) {
+		ks := keyStatus(credential.AcceptedKey{
+			Type: credential.KeyTypeServer, Value: "sdk-legacy", Key: nil,
+		})
+		assert.Equal(t, "", ks.Key)
+	})
+
+	t.Run("expiring key has expiry in Unix milliseconds", func(t *testing.T) {
+		expiry := time.Date(2099, 6, 1, 12, 0, 0, 0, time.UTC)
+		ks := keyStatus(credential.AcceptedKey{
+			Type: credential.KeyTypeServer, Value: "sdk-old", Key: strptr("old-key"), Expiry: &expiry,
+		})
+		require.NotNil(t, ks.Expiry)
+		assert.Equal(t, expiry.UnixMilli(), *ks.Expiry)
+	})
+
+	t.Run("mobile key value is obscured", func(t *testing.T) {
+		ks := keyStatus(credential.AcceptedKey{
+			Type: credential.KeyTypeMobile, Value: "mob-secret", Key: strptr("mob-1"),
+		})
+		assert.Equal(t, sdks.ObscureKey("mob-secret"), ks.Value)
+	})
+}