Tom Moor 4883071059 Allow viewers to create and access API keys (#12278) ...

* Allow viewers to create and access API keys

Still guarded by their view permissions

* Drop Member role gate from apiKeys routes

Lets viewers reach the createApiKey/listApiKeys/delete policy checks now
that the policy itself permits them. Updates CleanupDemotedUserTask to
retain viewer keys and adds coverage for viewer create + guest reject.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* Tighten apiKeys test assertions and broaden viewer coverage

- Use not.toBeNull() instead of toBeTruthy() for retention check
- Add viewer coverage for apiKeys.list and apiKeys.delete

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

2026-05-06 19:35:59 -04:00

..

apiKeys.test.ts

Allow viewers to create and access API keys (#12278)

2026-05-06 19:35:59 -04:00

apiKeys.ts

Allow viewers to create and access API keys (#12278)

2026-05-06 19:35:59 -04:00

index.ts

refactor: add server side validation schema for apiKeys (#4859)

2023-02-11 15:02:52 -08:00

schema.ts

Move "Webhook" settings to table (#12119)

2026-04-19 19:27:32 -04:00