sdk: updateApiKey patch data can override the target ID #76

What happened

The SDK builds the update request as { id, ...patch }, so an id property present on a runtime patch replaces the method's explicit target argument.

Reproduction:

1. Create API keys intended and victim.
2. Store a patch variable containing id: victim.id and disabled: true.
3. Call updateApiKey(intended.id, patch).
4. Inspect the request body and both credentials.

Expected: The first method argument should remain the stable target, and patch data should affect only editable fields.

Actual: The wire request targets the victim ID, the response identifies the victim, the victim is disabled, and the intended key remains enabled. TypeScript accepts an ID-bearing patch variable through structural typing.

Impact: An administrative caller intending to rename, expire, or disable one credential can mutate another credential instead. This is a targeting failure, not a privilege escalation.

dor doctor output

Not applicable — the targeting failure was reproduced through the SDK request and focused server behavior and does not depend on an installed-host diagnosis. dor doctor was not run.

Environment

• Reproduction mode: Focused-source reproduction
• Dormice commit: 4417ae14938273f5d937c476cf7cdc57e22e53a5
• Verification: Verified through the current SDK source and real server behavior at upstream main 4417ae14938273f5d937c476cf7cdc57e22e53a5.