supabase / supabase / 41862542266

87%

push

github

feat(studio): gate database and functions reveal consumers on grants (#52727)

Part 3 of 4 in a stack for
[FE-4694](https://linear.app/supabase/issue/FE-4694/pilot-split-api-keys-queries-and-add-first-refinement-reveal-variant).
Based on #52724.

## Stack
1. #52723 Reveal refinement and split api-keys queries
2. #52724 API keys settings UI and command menu
3. 👉 Database and edge functions consumers that reveal secret keys
4. #52728 Storage, cron, and Realtime consumers; remove the transitional
reveal path

## Changes
Moves the database and edge functions consumers that need secret keys
off the V2 permission checks and onto `useGrant('GET
/v1/projects/{ref}/api-keys', scope, { variant: 'reveal' })` with
`revealedApiKeysQueryOptions`:
- Database webhooks (`Database/Hooks/HTTPHeaders`, `FormContents`)
- Replication destination form (Analytics Bucket catalog token prefill)
- Edge function tester sheet

Adds `components/ui/ApiKeysAccessNote`, a small inline note shown when
the reveal grant is denied, and an `AlertError` when the permission
check fails. It doesn't block the rest of the form: users without
secret-key access can still fill in headers or the catalog token
manually, where before the keys were silently missing.

## Testing
- Adds `HTTPHeaders.platform.test.tsx` covering granted (requests keys
with `reveal=true`, no note), denied (note shown, form still usable, no
request), and permission-check error.
- Removes the partial V2 permissions mock from the DestinationForm test,
which no longer needs it.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude <noreply@anthropic.com>

1990 of 2360 branches covered (84.32%)

Branch coverage included in aggregate %.

2805 of 3164 relevant lines covered (88.65%)

197.35 hits per line