Add admin API key management UI #59

Merged

erik merged 1 commit from feat/task-931b710f-admin-api-key-ui into main

2026-05-22 14:02:42 -05:00

erik commented

2026-05-22 14:00:41 -05:00

Owner

Summary

Add protected /admin/api-keys list/create UI.
Add protected API key creation action that shows the raw key only in the creation response.
Add protected API key revocation action.
Keep list views metadata-only with no raw keys or hashes.
Add tests for anonymous access protection, metadata redaction, one-time raw key display, revocation, and revoked-key verification failure.

Testing

make check
./scripts/pre-pr.sh

Task: #task-931b710f

## Summary - Add protected `/admin/api-keys` list/create UI. - Add protected API key creation action that shows the raw key only in the creation response. - Add protected API key revocation action. - Keep list views metadata-only with no raw keys or hashes. - Add tests for anonymous access protection, metadata redaction, one-time raw key display, revocation, and revoked-key verification failure. ## Testing - `make check` - `./scripts/pre-pr.sh` Task: #task-931b710f

erik added 1 commit

2026-05-22 14:00:41 -05:00

feat: add admin API key UI

CI / build-lint-test (pull_request) Successful in 24s

Details

9f2de7837f

Task: #task-931b710f

erik commented

2026-05-22 14:01:50 -05:00

Author

Owner

PR Review: Approved

Summary

Reviewed PR #59 at commit 9f2de78. The PR adds the protected admin API key management UI: authenticated owners can list API key metadata, create a key and see the raw key only in the creation response, and revoke keys. Anonymous access redirects to login, list views avoid raw keys and hashes, and revocation prevents future API key verification.

Acceptance Criteria

Authenticated site owner can create an API key and copy the raw key once.
API key list shows metadata only and does not expose raw keys or hashes.
Anonymous users cannot access API key management pages or actions.
Site owner can revoke an API key.
Revoked keys can no longer authenticate protected API requests.
Tests cover creation display, list redaction, revocation, anonymous access protection, and raw-key one-time display behavior.
Relevant lint/test checks pass — make check, ./scripts/pre-pr.sh, and Forgejo CI passed.

Blocking Issues

None.

Warnings

None.

Verdict

Approved for merge.

## PR Review: Approved ### Summary Reviewed PR #59 at commit `9f2de78`. The PR adds the protected admin API key management UI: authenticated owners can list API key metadata, create a key and see the raw key only in the creation response, and revoke keys. Anonymous access redirects to login, list views avoid raw keys and hashes, and revocation prevents future API key verification. ### Acceptance Criteria - [x] Authenticated site owner can create an API key and copy the raw key once. - [x] API key list shows metadata only and does not expose raw keys or hashes. - [x] Anonymous users cannot access API key management pages or actions. - [x] Site owner can revoke an API key. - [x] Revoked keys can no longer authenticate protected API requests. - [x] Tests cover creation display, list redaction, revocation, anonymous access protection, and raw-key one-time display behavior. - [x] Relevant lint/test checks pass — `make check`, `./scripts/pre-pr.sh`, and Forgejo CI passed. ### Blocking Issues None. ### Warnings None. ### Verdict Approved for merge.

erik merged commit c6aa85cf45 into main

2026-05-22 14:02:42 -05:00

erik referenced this pull request from a commit

2026-05-22 14:02:44 -05:00

Merge pull request 'Add admin API key management UI' (#59) from feat/task-931b710f-admin-api-key-ui into main

erik referenced this pull request

2026-05-22 14:05:34 -05:00

Add admin API key management UI #54

erik referenced this pull request

2026-05-22 14:05:34 -05:00

Add admin API key management UI #54