Service accounts and API keys - #1989
Conversation
6c847e6 to
f0bebb8
Compare
d60c562 to
4db5bdd
Compare
96f4766 to
2329fe9
Compare
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
❌ Code HealthIntroduces 48 Unused files
66 Unused exports
|
e89b75d to
8f05c41
Compare
9334471 to
d1c8ac7
Compare
Service accounts are non-human identities that hold their own grants and API keys, so automation can authenticate as a durable principal with a scoped capability set. This adds the admin UI for managing them, replacing the Admin > API tab. Admin > Service accounts (`/admin/serviceAccounts`): - List of accounts as cards, with an empty state that offers both direct and guided creation - Details view (`/admin/serviceAccounts/details`) with an API keys section and a grants section, each supporting create and revoke/remove - CreateDialog for the full account creation flow (name, capability selection, prefix grants, key lifetime), plus CreateApiKeyDialog and GrantDialog for adding to an existing account - SecretRevealModal shows a newly minted key once; the value is deliberately not cached - ExpiryWarning and UsageIndicator surface key lifetime and usage at a glance - Accounts get a stable monogram avatar color derived from their name (`src/utils/stableColor.ts`), and generated account names come from an alliterative word list (`src/utils/alliterate.ts`) GraphQL (`src/api/gql/serviceAccounts.ts`) covers the serviceAccounts query and the createServiceAccount, createApiKey, revokeApiKey, revokeAllApiKeys, addServiceAccountGrant and removeServiceAccountGrant mutations, with URQL cache entries for ServiceAccount, ServiceAccountApiKey, UserGrant, and a null-keyed CreateApiKeyResult so the one-time secret stays uncached. The personal refresh-token UI moves out of the admin area to `/settings/personalTokens`, reachable from the user menu, and the flowctl auth flow gets its own page at `/flowctl/accessToken`.
List: cap the account cards at 300px wide (`repeat(auto-fill, minmax(240px, 400px))` for the main grid, `minmax(200px, 300px)` for the "No access" compacts) so they keep a consistent size instead of stretching to fill the row. CreateDialog: the full-name preview's color is derived from the name, so it changed on every keystroke. The text still updates immediately, but the color now settles 300ms after typing stops and crossfades over a second. Adds `useDebouncedValue`. Details: show the selected account's leaf name as a trailing breadcrumb segment in the content header. `TopBar` gains a `headerDetail` field, set through `usePageTitle` and rendered by `PageContainer` after a "/" separator; it holds a resolved string rather than a message id, since entity names aren't translatable. The details page reads the name from the URL param so the breadcrumb is populated on first render rather than when the query lands, and the header segment is pluralized to "Service Accounts" so the trail names the parent section. Also adds "mercurial" to the alliterative name library.
The schema no longer exposes `ServiceAccountsFilter`, so the query cannot narrow the list to one organization. The list now shows every account the caller may query, across organizations. Delete `useValidatedSelectedTenant`. It existed only to gate this query on a confirmed tenant. Regenerate the GraphQL types against the current schema.
The service accounts pages reach the user through the admin tab bar that AccessGrants, Settings, and Billing already render. The CLI-API tab becomes a Service Accounts tab, and the list page renders AdminTabs so the bar stays visible while navigating the admin area. The admin.cli_api.* message ids lost their consumer when the CLI-API page was split into the flowctl access token and personal tokens pages, so they are removed.
1d25f09 to
b326b3e
Compare
2 participants
Summary
New Service Accounts admin section (replaces the CLI-API tab): create accounts with scoped capabilities on catalog prefixes, manage grants, and issue/revoke API keys — key secrets are shown once at creation and can't be retrieved again.
The old CLI-API tab splits into two:
/flowctl/accessTokenpage with a copy-to-clipboard button (token is never rendered on screen);/admin/apiredirects here./settings/personalTokens, linked from the user menu.Service Accounts is reachable as a tab in the existing admin tab bar, alongside Account Access, Settings, and Billing.
Built directly on
main, using the deployedapiKeyservice-account GraphQL API with regenerated GQL types.Test plan
/admin/apiredirects to/flowctl/accessToken; copy works, token not shown