supabase / supabase / 41855320578

87%

Build Type

push

github

Committed by web-flow

Commit Message

feat(studio): add reveal refinement for api-keys and split queries (#52723)

Part 1 of 4 in a stack for
[FE-4694](https://linear.app/supabase/issue/FE-4694/pilot-split-api-keys-queries-and-add-first-refinement-reveal-variant).
Later PRs migrate the api-keys consumers onto grants.

## Stack
1. 👉 Reveal refinement and split api-keys queries
2. #52724 API keys settings UI and command menu
3. #52727 Database and edge functions consumers that reveal secret keys
4. #52728 Storage, cron, and Realtime consumers; remove the transitional
reveal path

## Changes
- Adds a `reveal` variant for `GET /v1/projects/{ref}/api-keys` in
`lib/fga-refinements.ts`. It requires `api_gateway_keys_secret_read` on
top of the base annotation, and owns the `reveal` query param: the fetch
wrapper sets it to `'true'` for a reveal grant and `'false'` otherwise
(including `unguarded`), so passing `reveal` by hand is a type error.
- Splits the query into `apiKeysQueryOptions` (plain grant) and
`revealedApiKeysQueryOptions` (reveal grant). Both use `skipToken`
without a grant, and the grant stays out of the query key.
- `useAPIKeysQuery` and `useAPIKeys` stay as deprecated transitional
hooks that mint the matching grant with `useGrant`. They can't use
`unguarded.migrating`: with `reveal` owned by the wrapper, that would
silently return unrevealed keys to consumers that need secrets.
- Marks the variant type parameter `const` in `getGrant`, `useGrant`,
`ensureGrant`, and `testGrant`. Adding a second refinement with variants
widened inference of the branch variants to a union.
- Adds `tests/lib/project-grant-mocks.ts` for component tests that need
`useGrant` to resolve, and updates tests that partially mocked the V2
permissions hook.

## Testing
Adds the type and runtime tests deferred from FE-4689 to
`data/guarded-fetch.test.ts`: type equality with the raw client for
plain and reveal grants, `reveal` rejected as a caller-supplied param, a
reveal grant rejected on an endpoint without tha... (continued)

Coverage Stats

1990 of 2360 branches covered (84.32%)

Branch coverage included in aggregate %.

1 of 1 new or added line in 1 file covered. (100.0%)

1 existing line in 1 file now uncovered.

2805 of 3164 relevant lines covered (88.65%)

197.14 hits per line