fix(webapp): cap a public API key's query scope like a public access token

pk_ is browser-shipped and environment-bound. Nothing routes it to the query
API today, so the cap costs no caller anything and the helper stops promising
the wrong thing.

Author: kathiekiwi

apps/webapp/app/v3/queryScope.ts

@@ -37,9 +37,14 @@ export function resolveQueryScope(args: {
   };
 }
 
-/** A public access token is environment-bound; every other bearer credential isn't. */
+/**
+ * A public credential is environment-bound; a secret key isn't. `PUBLIC` is the deprecated
+ * `pk_*` key — same threat model as a public access token, so it caps the same way. It cannot
+ * reach the query API today (the bearer resolver 401s `pk_*`), which is why capping it costs
+ * no caller anything and why the helper must not promise it is uncapped.
+ */
 export function queryScopeCeilingFor(
   authenticationType: ApiAuthenticationResultSuccess["type"]
 ): QueryScopeCeiling {
-  return authenticationType === "PUBLIC_JWT" ? "environment" : "unbounded";
+  return authenticationType === "PRIVATE" ? "unbounded" : "environment";
 }

apps/webapp/test/queryScope.test.ts

@@ -9,16 +9,22 @@ describe("the query scope ceiling", () => {
     expect(queryScopeCeilingFor("PUBLIC_JWT")).toBe("environment");
   });
 
-  it("leaves every other bearer credential uncapped", () => {
+  // `PUBLIC` is the deprecated `pk_*` key: browser-shipped and environment-bound, the same
+  // shape of credential a public access token is. Nothing routes it here today, so this is
+  // the helper refusing to hand it the organization if anything ever does.
+  it("caps a public API key at its own environment", () => {
+    expect(queryScopeCeilingFor("PUBLIC")).toBe("environment");
+  });
+
+  it("leaves the secret key uncapped", () => {
     expect(queryScopeCeilingFor("PRIVATE")).toBe("unbounded");
-    expect(queryScopeCeilingFor("PUBLIC")).toBe("unbounded");
   });
 
-  // Compile-time: the fallback is "uncapped", so a misspelled credential kind must not
-  // be able to reach it.
+  // Compile-time: the fallback is the cap, but a misspelled credential kind must still not
+  // be able to name itself into the uncapped branch.
   it("takes only the credential kinds that exist", () => {
     // @ts-expect-error not an authentication type
-    expect(() => queryScopeCeilingFor("public_jwt")).not.toThrow();
+    expect(() => queryScopeCeilingFor("private")).not.toThrow();
   });
 });