supabase / supabase / 41869272496

87%

push

github

feat(studio): gate storage, cron, and realtime key consumers on grants (#52728)

Part 4 of 4 in a stack for
[FE-4694](https://linear.app/supabase/issue/FE-4694/pilot-split-api-keys-queries-and-add-first-refinement-reveal-variant).
Based on #52727.

## Stack
1. #52723 Reveal refinement and split api-keys queries
2. #52724 API keys settings UI and command menu
3. #52727 Database and edge functions consumers that reveal secret keys
4. 👉 Storage, cron, and Realtime consumers; remove the transitional
reveal path

## Changes
Moves the remaining consumers that need secret keys onto the `reveal`
grant with `revealedApiKeysQueryOptions`, replacing their V2 permission
checks:
- Analytics bucket configuration details and the update catalog token
dialog
- The Iceberg wrapper create mutation. Its V2 check only covered
`api_gateway_keys_secret_read`, which didn't match the endpoint's
requirement. Without keys it used to save a placeholder as the vault
token; it now throws unless the grant is granted, and returns the grant
so callers can explain why. The bucket create form disables Create and
the missing-wrapper callout disables "Install wrapper", both showing
`ApiKeysAccessNote`. The `storage_config_write` check is unchanged.
- Cron job HTTP headers (edge function variant)

`RealtimeTokensPopover` only reads the anon and publishable keys, so it
moves to the plain grant and `apiKeysQueryOptions` instead of requesting
revealed keys.

With no `reveal: true` callers left, the transitional `useAPIKeysQuery`
/ `useAPIKeys` hooks drop their reveal path and only mint a plain grant.
They remain for the publishable-only consumers until FE-4731.

## Testing
- `iceberg-wrapper-create-mutation.platform.test.tsx`: `mutateAsync`
throws without the reveal grant and makes no credentials request; the
granted case exposes the grant.
- `BucketCallouts.platform.test.tsx`: "Install wrapper" is enabled when
granted, and disabled with the note when denied or with an error when
the permiss... (continued)

1991 of 2360 branches covered (84.36%)

Branch coverage included in aggregate %.

2806 of 3164 relevant lines covered (88.69%)

197.42 hits per line