feat(credential): expose the full accepted key set via AcceptedKeys

Add AcceptedKey (type, value, optional identifier, optional expiry) and
KeyType, plus Rotator.AcceptedKeys() to snapshot every accepted SDK and
mobile key — anchor and primary mobile key included — and an EnvContext
GetAcceptedKeys() accessor that delegates to it. The status endpoint will
partition this set by type to build the sdkKeys[] / mobileKeys[] arrays.

Author: aaron-zeisler

internal/credential/rotator.go

@@ -14,6 +14,32 @@ type acceptedKeyInfo struct {
 	key    *string    // wire "key" identifier — non-secret human-readable name; nil when absent
 }
 
+// KeyType distinguishes a server-side SDK key from a mobile key in an AcceptedKey. Client-side IDs
+// are not part of the accepted-set model and so have no KeyType.
+type KeyType int
+
+const (
+	// KeyTypeServer is a server-side SDK key.
+	KeyTypeServer KeyType = iota
+	// KeyTypeMobile is a mobile key.
+	KeyTypeMobile
+)
+
+// AcceptedKey is metadata for one accepted credential, returned by AcceptedKeys. The status endpoint
+// uses it to populate the sdkKeys[] / mobileKeys[] response arrays.
+type AcceptedKey struct {
+	// Type is the kind of key — server-side SDK or mobile.
+	Type KeyType
+	// Value is the credential secret (what the wire calls "value"). Plain, not obscured; the status
+	// handler obscures it before serialising.
+	Value string
+	// Key is the non-secret human-readable identifier (the wire "key" field). Nil when the source
+	// carried no identifier — manual configuration, or an old-format payload predating concurrent keys.
+	Key *string
+	// Expiry is the key's expiry time. Nil means the key is permanent.
+	Expiry *time.Time
+}
+
 type Rotator struct {
 	loggers ldlog.Loggers
 
@@ -120,12 +146,10 @@ func (r *Rotator) allCredentials() []SDKCredential {
 
 // DeprecatedCredentials returns the SDK keys being phased out — every accepted SDK key, other than the
 // anchor, that carries a future expiry. (Per-key expiry is stored as data on the accepted entry; the
-// cleanup ticker drops the key once it elapses.) EnvContext.GetDeprecatedCredentials delegates here to
-// populate the status endpoint's expiringSdkKey field.
+// cleanup ticker drops the key once it elapses.)
 //
 // Mobile keys are deliberately not returned even though they expire the same way SDK keys do — carried
-// as per-key expiry and dropped by the same cleanup ticker. They are omitted only because the status
-// endpoint has no expiringMobileKey field to populate, not because mobile-key expiry is unimplemented.
+// as per-key expiry and dropped by the same cleanup ticker.
 func (r *Rotator) DeprecatedCredentials() []SDKCredential {
 	r.mu.RLock()
 	defer r.mu.RUnlock()
@@ -314,3 +338,25 @@ func (r *Rotator) reconcileEnvironmentID(set AcceptedSet) {
 	r.primaryEnvironmentID = set.envID
 	r.additions = append(r.additions, set.envID)
 }
+
+// acceptedKeysOf snapshots one accepted-key map (SDK or mobile) into a slice of AcceptedKey tagged
+// with kind. Order is unspecified — the status endpoint does not depend on it. The caller must hold
+// at least the read lock.
+func acceptedKeysOf[K ~string](accepted map[K]*acceptedKeyInfo, kind KeyType) []AcceptedKey {
+	out := make([]AcceptedKey, 0, len(accepted))
+	for key, info := range accepted {
+		out = append(out, AcceptedKey{Type: kind, Value: string(key), Key: info.key, Expiry: info.expiry})
+	}
+	return out
+}
+
+// AcceptedKeys returns every accepted credential — all server-side SDK keys and all mobile keys,
+// including the anchor and the primary mobile key. The status endpoint partitions the result by Type
+// to populate the full sdkKeys[] / mobileKeys[] arrays. Order is unspecified.
+func (r *Rotator) AcceptedKeys() []AcceptedKey {
+	r.mu.RLock()
+	defer r.mu.RUnlock()
+
+	keys := acceptedKeysOf(r.acceptedSDKKeys, KeyTypeServer)
+	return append(keys, acceptedKeysOf(r.acceptedMobileKeys, KeyTypeMobile)...)
+}

internal/credential/rotator_test.go

@@ -266,3 +266,93 @@ func TestReconcileDeExpiryRestoresKey(t *testing.T) {
 	assert.Empty(t, expirations)
 	assert.Contains(t, r.AllCredentials(), SDKCredential(key))
 }
+
+// findAcceptedKey returns the entry with the given value, or nil. Used because AcceptedKeys order is
+// unspecified.
+func findAcceptedKey(entries []AcceptedKey, value string) *AcceptedKey {
+	for i := range entries {
+		if entries[i].Value == value {
+			return &entries[i]
+		}
+	}
+	return nil
+}
+
+// TestAcceptedKeys verifies that AcceptedKeys returns the full accepted set — every server and mobile
+// key, including the anchor and primary mobile key — with type, identifier, and expiry populated.
+func TestAcceptedKeys(t *testing.T) {
+	t.Run("single anchor plus primary mobile", func(t *testing.T) {
+		r := newTestRotator()
+		r.Reconcile(mustBuild(t, NewAcceptedSetBuilder().
+			WithAnchor(SDKKeyParams{Value: "sdk-anchor", Key: util.PtrOrNil("default")}).
+			WithPrimaryMobileKey(MobileKeyParams{Value: "mob-primary", Key: util.PtrOrNil("mob-1")})), time.Unix(0, 0))
+
+		entries := r.AcceptedKeys()
+		require.Len(t, entries, 2)
+
+		anchor := findAcceptedKey(entries, "sdk-anchor")
+		require.NotNil(t, anchor)
+		assert.Equal(t, KeyTypeServer, anchor.Type)
+		require.NotNil(t, anchor.Key)
+		assert.Equal(t, "default", *anchor.Key)
+		assert.Nil(t, anchor.Expiry)
+
+		mob := findAcceptedKey(entries, "mob-primary")
+		require.NotNil(t, mob)
+		assert.Equal(t, KeyTypeMobile, mob.Type)
+		require.NotNil(t, mob.Key)
+		assert.Equal(t, "mob-1", *mob.Key)
+	})
+
+	t.Run("multiple keys include the anchor; expiry populated", func(t *testing.T) {
+		r := newTestRotator()
+		expiry := time.Date(2099, 6, 1, 0, 0, 0, 0, time.UTC)
+		r.Reconcile(mustBuild(t, NewAcceptedSetBuilder().
+			WithAnchor(SDKKeyParams{Value: "sdk-anchor", Key: util.PtrOrNil("default")}).
+			WithSDKKey(SDKKeyParams{Value: "sdk-b", Key: util.PtrOrNil("b-service")}).
+			WithSDKKey(SDKKeyParams{Value: "sdk-old", Key: util.PtrOrNil("old-key"), Expiry: util.PtrOrNil(expiry)}).
+			WithPrimaryMobileKey(MobileKeyParams{Value: "mob-primary"})), time.Unix(0, 0))
+
+		entries := r.AcceptedKeys()
+		require.Len(t, entries, 4) // anchor + sdk-b + sdk-old + mob-primary
+		assert.NotNil(t, findAcceptedKey(entries, "sdk-anchor"), "anchor must be present in the full set")
+
+		old := findAcceptedKey(entries, "sdk-old")
+		require.NotNil(t, old)
+		require.NotNil(t, old.Expiry)
+		assert.Equal(t, expiry, *old.Expiry)
+
+		// A key with no identifier (the primary mobile here) carries a nil Key.
+		mob := findAcceptedKey(entries, "mob-primary")
+		require.NotNil(t, mob)
+		assert.Nil(t, mob.Key)
+	})
+}
+
+// TestReconcileClearsStaleKeyIdentifier verifies that when a later reconcile carries no identifier for
+// a key that previously had one (e.g. an old-format payload after a new-format one), the rotator
+// clears the stale identifier rather than retaining it — so /status never shows an identifier the
+// current credential set no longer carries.
+func TestReconcileClearsStaleKeyIdentifier(t *testing.T) {
+	r := newTestRotator()
+	now := time.Unix(0, 0)
+
+	// First reconcile: sdk-b carries the identifier "b-service".
+	r.Reconcile(mustBuild(t, NewAcceptedSetBuilder().
+		WithAnchor(SDKKeyParams{Value: "sdk-anchor"}).
+		WithSDKKey(SDKKeyParams{Value: "sdk-b", Key: util.PtrOrNil("b-service")})), now)
+
+	b := findAcceptedKey(r.AcceptedKeys(), "sdk-b")
+	require.NotNil(t, b)
+	require.NotNil(t, b.Key)
+	assert.Equal(t, "b-service", *b.Key)
+
+	// Second reconcile: same credential value, but no identifier this time.
+	r.Reconcile(mustBuild(t, NewAcceptedSetBuilder().
+		WithAnchor(SDKKeyParams{Value: "sdk-anchor"}).
+		WithSDKKey(SDKKeyParams{Value: "sdk-b"})), now)
+
+	b = findAcceptedKey(r.AcceptedKeys(), "sdk-b")
+	require.NotNil(t, b)
+	assert.Nil(t, b.Key, "identifier must be cleared when the new payload carries none")
+}

internal/relayenv/env_context.go

@@ -50,6 +50,11 @@ type EnvContext interface {
 	// several accepted mobile keys (primary + expiring) in nondeterministic order.
 	GetMobileKey() config.MobileKey
 
+	// GetAcceptedKeys returns metadata for every accepted credential — all server-side SDK keys and
+	// all mobile keys, including the anchor and the primary mobile key. The status endpoint partitions
+	// the result by type to populate the full sdkKeys[] / mobileKeys[] arrays.
+	GetAcceptedKeys() []credential.AcceptedKey
+
 	// ReconcileCredentials atomically reconciles the environment's accepted credentials to match
 	// newSet. The set names its own anchor (the SDK key that owns the upstream connection) and
 	// primary mobile key. The method owns the order of operations internally (add → re-anchor →

internal/relayenv/env_context_impl.go

@@ -640,6 +640,10 @@ func (c *envContextImpl) GetDeprecatedCredentials() []credential.SDKCredential {
 	return c.keyRotator.DeprecatedCredentials()
 }
 
+func (c *envContextImpl) GetAcceptedKeys() []credential.AcceptedKey {
+	return c.keyRotator.AcceptedKeys()
+}
+
 func (c *envContextImpl) GetClient() sdks.LDClientContext {
 	c.mu.RLock()
 	defer c.mu.RUnlock()