Service accounts and API keys - #1989
Conversation
6c847e6 to
f0bebb8
Compare
d60c562 to
4db5bdd
Compare
96f4766 to
2329fe9
Compare
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| secret: tokenResult.data.createServiceAccountToken.secret, | ||
| description: keyDesc || 'API key', | ||
| expires: formatExpiryFromNow(keyLife), | ||
| account: catalogName, |
❌ Code HealthIntroduces 48 Unused files
64 Unused exports
|
The admin area's four pages were reached through a tab bar rendered at the top of each page. They now appear as sub-items of the Admin entry in the sidebar, so the sidebar shows where you are within the section instead of the page repeating its own navigation. While the sidebar is expanded, the sub-items list beneath the active section as indented labels without icons, and the section header drops its selected background so only the current page reads as selected. On the collapsed rail there is no room for the labels, so hovering or focusing the section opens them in a flyout beside the rail; the flyout closes on a short delay to let the pointer reach it, and ArrowRight moves focus into it for keyboard users. Billing remains gated on hasAnyAccess, as it was in the tab bar. The access grants page title is now "Account Access" to match its nav label, which the tab bar had already been using. NavigationTabProps is no longer exported now that the deleted admin tabs were its only outside consumer, and NavLink stays local to NavItems since the sidebar reaches it through the wrapper.
Service accounts are non-human identities that hold their own grants and API keys, so automation can authenticate as a durable principal with a scoped capability set. This adds the admin UI for managing them, replacing the Admin > API tab. Admin > Service accounts (`/admin/serviceAccounts`): - List of accounts as cards, with an empty state that offers both direct and guided creation - Details view (`/admin/serviceAccounts/details`) with an API keys section and a grants section, each supporting create and revoke/remove - CreateDialog for the full account creation flow (name, capability selection, prefix grants, key lifetime), plus CreateApiKeyDialog and GrantDialog for adding to an existing account - SecretRevealModal shows a newly minted key once; the value is deliberately not cached - ExpiryWarning and UsageIndicator surface key lifetime and usage at a glance - Accounts get a stable monogram avatar color derived from their name (`src/utils/stableColor.ts`), and generated account names come from an alliterative word list (`src/utils/alliterate.ts`) GraphQL (`src/api/gql/serviceAccounts.ts`) covers the serviceAccounts query and the createServiceAccount, createApiKey, revokeApiKey, revokeAllApiKeys, addServiceAccountGrant and removeServiceAccountGrant mutations, with URQL cache entries for ServiceAccount, ServiceAccountApiKey, UserGrant, and a null-keyed CreateApiKeyResult so the one-time secret stays uncached. The personal refresh-token UI moves out of the admin area to `/settings/personalTokens`, reachable from the user menu, and the flowctl auth flow gets its own page at `/flowctl/accessToken`.
List: cap the account cards at 300px wide (`repeat(auto-fill, minmax(240px, 400px))` for the main grid, `minmax(200px, 300px)` for the "No access" compacts) so they keep a consistent size instead of stretching to fill the row. CreateDialog: the full-name preview's color is derived from the name, so it changed on every keystroke. The text still updates immediately, but the color now settles 300ms after typing stops and crossfades over a second. Adds `useDebouncedValue`. Details: show the selected account's leaf name as a trailing breadcrumb segment in the content header. `TopBar` gains a `headerDetail` field, set through `usePageTitle` and rendered by `PageContainer` after a "/" separator; it holds a resolved string rather than a message id, since entity names aren't translatable. The details page reads the name from the URL param so the breadcrumb is populated on first render rather than when the query lands, and the header segment is pluralized to "Service Accounts" so the trail names the parent section. Also adds "mercurial" to the alliterative name library.
e89b75d to
8f05c41
Compare
2 participants
Summary
New Service Accounts admin section (replaces the CLI-API tab): create accounts with scoped capabilities on catalog prefixes, manage grants, and issue/revoke API keys — key secrets are shown once at creation and can't be retrieved again.
The old CLI-API tab splits into two:
/flowctl/accessTokenpage with a copy-to-clipboard button (token is never rendered on screen);/admin/apiredirects here./settings/personalTokens, linked from the user menu.Rebased onto current
main; uses the deployedapiKeyservice-account GraphQL API with regenerated GQL types.Test plan
/admin/apiredirects to/flowctl/accessToken; copy works, token not shown