Repository navigation
fix(settings): implement API key creation form, secure generation and… - #1098
Merged
thlpkee20-wq merged 2 commits intoOct 22, 2026
Merged
thlpkee20-wq merged 2 commits into
thlpkee20-wq merged 2 commits into
Conversation
… show-once secret handling
|
@Bigclavsfx Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #1041
Summary of Changes
API Key Creation Form & Validation:
Added a creation modal form in ApiKeysSettings.tsx with fields for name (required), scopes (read, write, admin checkboxes with at least one required), and optional expiry date (validated to ensure it is in the future).
Added inline field error messages (role="alert") when validation fails.
Cryptographically Secure Key Generation (crypto.getRandomValues):
Implemented defaultGenerateApiKey using crypto.getRandomValues. All usage of Math.random() in key generation and rotation has been completely eliminated.
Made generateApiKey injectable via component props (ApiKeysSettingsProps) for testability and flexibility.
Show-Once Secret Panel:
Added a dedicated show-once modal panel with the required notice: "Copy now — you won't see it again".
The full secret is displayed only once upon key creation or rotation, allows one-click copying to clipboard, and is permanently cleared from component state upon dismissal.
The secret is never written to localStorage or output to logs.
Secret Masking & Removal of Persistent Show Toggle:
Replaced persistent Show/Hide toggles with maskApiKey which stores only the masked prefix and last 4 characters (prefix + •••••••••••••••• + last4) in the list state.
Kept the Copy button in the table to copy the masked key identifier.
Applied Same Show-Once Flow to Rotation:
Updated handleRevokeAndRotateKey to generate keys securely via generateApiKey(), store the masked value in list state, and display the show-once panel.
Tests:
Added full test coverage in ApiKeysSettings.test.tsx covering key creation success, validation errors (empty name, no scopes, past expiry), revocation and rotation, show-once panel copy/dismissal behavior, ensuring the full secret never remains in the list after dismissal, and verifying key generation uses crypto.getRandomValues rather than Math.random.