supabase / supabase / 41859383906

87%

push

github

feat(studio): gate api keys settings UI on api-keys grants (#52724)

Part 2 of 4 in a stack for
[FE-4694](https://linear.app/supabase/issue/FE-4694/pilot-split-api-keys-queries-and-add-first-refinement-reveal-variant).
Based on #52723.

## Stack
1. #52723 Reveal refinement and split api-keys queries
2. 👉 #52724 API keys settings UI and command menu
3. #52727 Database and edge functions consumers that reveal secret keys
4. #52728 Storage, cron, and Realtime consumers; remove the transitional
reveal path

## Changes
Moves the API keys settings UI off the V2 permission checks and onto
`useGrant('GET /v1/projects/{ref}/api-keys')` with the new query
options:
- `PublishableAPIKeys`, `SecretAPIKeys`, `Project/APIKeys`, and the
api-keys settings page use a plain grant. They never requested revealed
keys; individual secrets still come from the per-key endpoint.
- The command menu's API keys commands use the `reveal` grant, since
they copy secret key values.
- Each consumer renders loading, denied (`NoPermission`),
permission-check error (`AlertError`), and the existing data states.
`Project/APIKeys` now shows `NoPermission` when denied instead of a
skeleton that never resolved.

## Testing
- Migrates `PublishableAPIKeys.test.tsx`,
`CommandMenu/ApiKeys.test.tsx`, and the api-keys settings page test to
MSW and `customRender`, without mocking the data module or the V2
permissions hook.
- Adds `PublishableAPIKeys.platform.test.tsx` and
`CommandMenu/ApiKeys.platform.test.tsx` for granted, denied, and error
states. The denied test waits for the denied grant before asserting that
no api-keys request was made.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude <noreply@anthropic.com>

1991 of 2360 branches covered (84.36%)

Branch coverage included in aggregate %.

2806 of 3164 relevant lines covered (88.69%)

197.42 hits per line