9 Commits

Include renames

Author	SHA1	Message	Date
mrhid6	6ee203f5e9	chore: replace em dashes with hyphens, add no-em-dash rule to CLAUDE.md	2026-09-10 09:18:55 +00:00
mrhid6	e5b9894384	feat: surface the mcp endpoint and its scopes on the api keys page	2026-09-08 14:14:44 +00:00
mrhid6	2d6b5bd8a3	feat: restrict an api key to tagged servers from the create dialog	2026-09-08 14:12:10 +00:00
mrhid6	ac9cc57e7e	feat: rebuild the create key dialog around a scope matrix and a preview	2026-09-08 14:10:37 +00:00
mrhid6	a0641e8ecb	feat: summarise key posture above the ledger	2026-09-08 14:09:00 +00:00
mrhid6	67ac029354	feat: redesign the api key list as a ledger with lifetime bars	2026-09-08 14:07:56 +00:00
mrhid6	aedc388535	refactor: split the api keys panel into ledger, chips, lifetime and dialog	2026-09-08 14:06:02 +00:00
mrhid6	18495dba68	feat: Restyle the API keys page onto the shared list patterns ... The page was hand-rolling its loading spinner, error line and empty paragraph while the rest of the console routes these through AsyncBoundary with a TableSkeleton and an EmptyState — the same drift Async.tsx was written to end. It also passed className="p-0" where Card takes padding={false}. The admin-only scope switch becomes the vulnerabilities page's pill filter rather than a loose checkbox: seeing everyone's keys is a filter over the list, not a preference, and someone who has learned one control has now learned both. Scopes collapse to one chip per resource with an r/rw qualifier. Sixteen badges made the row taller than everything around it and still had to be read one at a time. In the create dialog Copy is now the primary action and Done the quiet one, because the value is unrecoverable once the dialog closes, and the result panel repeats the role, scopes and expiry that were just granted.	2026-08-13 08:59:06 +00:00
mrhid6	689d0e1d5b	feat: Give API keys their own page and group the sidebar ... The token management card sat on /settings, which is owner|admin throughout, so it hid a capability every member already had: the API has never required a role to mint or revoke your own key. It is now the /api-keys page, reachable at every role, with the instance-wide lifetime cap left behind on /settings because that is policy rather than one person's credentials — and that split is what lets the page be ungated. The sidebar gains groups: Fleet, Access, Automation, Instance, each with a small-caps heading and a rule above it. Grouping is by what the operator is doing rather than by which service answers, so SSH keys, secrets and API keys sit together as credentials. A group whose every item is admin-only disappears whole for a member; a labelled section with nothing under it reads as a failure rather than a restriction. The UI says keys while the collection, prefix and routes still say tokens. Renaming a published endpoint to match a nav label would break every script already written against it.	2026-08-13 08:54:42 +00:00