Deactivated or expired EnvironmentAPIKeys still authenticate against SDK endpoints

[gagantrivedi]

Behaviour

EnvironmentAPIKey.active and expires_at are not checked when resolving X-Environment-Key on SDK endpoints served by Core (e.g. GET /api/v1/environment-document/, GET /api/v1/flags/). A deactivated or expired server-side key continues to authenticate until its row is deleted.

Code path

• EnvironmentKeyAuthentication.authenticate (api/environments/authentication.py) resolves the key via Environment.get_from_cache(api_key) with no validity check.
• Environment.get_from_cache filters api_keys__key=api_key only (api/environments/models.py:304) — no filter on active or expires_at.
• EnvironmentAPIKey.is_valid exists (api/environments/models.py:737-739) but is not consulted on this path.

Inconsistency with the Edge API

The hosted Edge API does enforce validity: EnvironmentService.get_client_api_key_from_server_api_key (edge-api src/environment.py) checks is_valid, so the same deactivated key gets 401 on Edge but keeps working against Core.

Impact

Deactivating a server-side SDK key in the dashboard does not stop it from fetching the environment document or flags from Core. This affects local-evaluation SDKs and the Edge Proxy pointed at self-hosted/private-cloud installs.

Found by code reading while researching Edge Proxy auto-discovery (Flagsmith/edge-proxy#128); not yet reproduced against a live instance.