supabase / supabase / 42102651042

87%

push

github

feat(studio): add reveal refinement for single api-key reads (#52965)

Part 5 of 6 in a stack for
[FE-4731](https://linear.app/supabase/issue/FE-4731/grants-rollout-api-keys-consumers-that-only-need-publishable-keys).
Based on #52964.

## Stack
1. #52961 Docs and project API docs consumers
2. #52962 Edge functions and vector bucket examples
3. #52963 Integrations landing data
4. #52964 Connect sheet and project connection popover; remove the
transitional api-keys hooks
5. 👉 #52965 `reveal` refinement for single api-key reads; API key pill
6. #52966 API key create and delete

## Changes
- Adds a `reveal` refinement for `GET /v1/projects/{ref}/api-keys/{id}`,
mirroring the list endpoint: the `reveal` variant adds
`api_gateway_keys_secret_read`, and the wrapper owns the `reveal` query
param.
- `getAPIKeysById` takes a plain or reveal grant instead of
`unguarded.migrating` and a manual `reveal` flag.
- `useRevealedSecret` mints the reveal grant, returns it, and doesn't
request unless it's granted.
- `ApiKeyPill` uses the reveal grant instead of its V2 check. Reveal and
copy are disabled while the check loads, when denied, or when it fails.
Publishable keys aren't gated.
- `useConnectServerEnv`: the secret can only be revealed once the reveal
grant is granted.

**Guard drift:** `ApiKeyPill` checked only
`api_gateway_keys_secret_read`, but the endpoint needs
`api_gateway_keys_read` and `api_gateway_keys_secret_read`. Users with
only the secret permission saw an enabled button and got a 403; they now
see it as restricted.

## Testing
- `data/guarded-fetch.test.ts`: type tests for the by-id endpoint (plain
and reveal grants match the raw client, `reveal` rejected as a caller
param, a list-endpoint reveal grant rejected), and a runtime test that
`reveal` is set from the grant. The "variant the endpoint doesn't have"
negative now uses the branches endpoint.
- `ApiKeyPill.platform.test.tsx` (renamed from `ApiKeyPill.test.tsx`,
now on real grants through MSW): re... (continued)

2049 of 2417 branches covered (84.77%)

Branch coverage included in aggregate %.

1 of 1 new or added line in 1 file covered. (100.0%)

2846 of 3205 relevant lines covered (88.8%)

201.2 hits per line