api_keys 0.2.1 → 0.4.0

data/SECURITY.md

@@ -0,0 +1,33 @@
+# Security Policy
+
+`api_keys` handles authentication credentials. Please report suspected vulnerabilities privately and avoid including real API keys, production data, or customer information in any report.
+
+## Supported versions
+
+Security fixes are released for the latest published version. The maintained test matrix covers Ruby 3.3, 3.4, and 4.0 with patched Rails 7.2, 8.0, and 8.1 releases. Older Ruby and Rails versions may remain installable for compatibility, but runtimes that no longer receive upstream security fixes are not security-supported.
+
+## Reporting a vulnerability
+
+Use GitHub's **Report a vulnerability** button on the [`api_keys` security advisories page](https://github.com/rameerez/api_keys/security/advisories) so the report and any proposed fix remain private. If GitHub's private reporting flow is unavailable, email `rubygems@rameerez.com` with the subject `api_keys security report`.
+
+Include:
+
+- the affected version and environment;
+- a minimal reproduction or proof of concept;
+- the impact you believe is possible; and
+- any suggested mitigation or patch.
+
+Do not open a public issue for an undisclosed vulnerability. We will acknowledge the report, investigate it, and coordinate disclosure and credit with you. If the issue affects downstream applications, we will prioritize a patched release and clear upgrade guidance.
+
+## Operational security
+
+Applications remain responsible for:
+
+- trusted TLS/proxy configuration, endpoint authorization, and request rate limiting;
+- encrypted, `Secure`, `HttpOnly`, appropriately `SameSite` session cookies for the one-time dashboard token handoff;
+- database, cache, queue, log, backup, and observability access controls;
+- filtering any query-parameter credential name from application and proxy logs if that opt-in transport is enabled;
+- classifying every permission on a `public: true` key type as safe for an untrusted public client and maintaining a disable/replacement procedure for non-revocable identifiers; and
+- prompt dependency/runtime patching and a durable background-job backend where callbacks or usage statistics are required.
+
+The gem bounds authentication work, but applications should still rate-limit credential endpoints. Do not treat a key prefix, last four characters, cache entry, or public key as proof of authorization.

data/app/controllers/api_keys/application_controller.rb

@@ -1,11 +1,13 @@
 # frozen_string_literal: true
 
+require "securerandom"
+
 module ApiKeys
   # Base controller for the ApiKeys engine.
   # Inherits from the host application's configured controller
   # (defaults to ::ApplicationController).
   # Includes common engine functionality.
-  class ApplicationController < ApiKeys::Engine.config.parent_controller.constantize
+  class ApplicationController < ApiKeys.configuration.parent_controller_class
     # Protect from forgery if the parent controller does
     # This ensures CSRF protection behaves consistently with the host app.
     protect_from_forgery with: :exception if respond_to?(:protect_from_forgery)
@@ -13,28 +15,61 @@ module ApiKeys
     # Include the main controller concern which bundles authentication and tenant resolution
     include ApiKeys::Controller
 
+    # The dashboard renders credential material, so give it an enforcing,
+    # self-contained CSP even when the host application has not configured one.
+    # Preserve any host directives we do not explicitly tighten.
+    before_action :prepare_api_keys_content_security_policy_nonce
+    if respond_to?(:content_security_policy)
+      content_security_policy do |policy|
+        policy.default_src :none
+        policy.base_uri :none
+        policy.object_src :none
+        policy.frame_ancestors :none
+        policy.frame_src :none
+        policy.form_action :self
+        # Rails appends the per-request nonce to these directives. `none` leaves
+        # the nonce as the only effective source instead of trusting every
+        # same-origin script or stylesheet.
+        policy.script_src :none
+        policy.style_src :none
+        policy.img_src :self, :data
+        policy.connect_src :self
+      end
+      content_security_policy_report_only false
+    end
+
     # Ensure the owner is authenticated for all actions within this engine
     # This uses the configured authentication method (defaults to authenticate_user!)
     before_action :authenticate_api_keys_owner!
+    after_action :set_api_keys_security_headers
 
     private
 
+    def prepare_api_keys_content_security_policy_nonce
+      return unless request.respond_to?(:content_security_policy_nonce_generator=)
+
+      request.content_security_policy_nonce_generator ||= ->(_request) { SecureRandom.base64(16) }
+      directives = Array(request.content_security_policy_nonce_directives)
+      request.content_security_policy_nonce_directives = directives | %w[script-src style-src]
+      request.content_security_policy_nonce
+    end
+
     # Authenticates the owner accessing the engine.
     # Uses the configured authentication method from ApiKeys.configuration
     def authenticate_api_keys_owner!
       auth_method = ApiKeys.configuration.authenticate_owner_method
 
-      # Try to call the configured authentication method
-      if auth_method && respond_to?(auth_method, true)
-        send(auth_method)
-      elsif auth_method && defined?(auth_method)
-        send(auth_method)
-      else
-        # Fallback: check if owner is present
-        unless current_api_keys_owner
-          redirect_to main_app.root_path, alert: "You need to sign in before continuing." rescue render plain: "Unauthorized", status: :unauthorized
+      if auth_method.present?
+        unless respond_to?(auth_method, true)
+          log_error "[ApiKeys Security] Configured owner authentication method is unavailable."
+          return render_api_keys_unauthorized
         end
+
+        send(auth_method)
+        return if performed?
       end
+
+      render_api_keys_unauthorized unless current_api_keys_owner
     end
 
     # Helper method to access the current owner from the host application.
@@ -52,5 +87,18 @@ module ApiKeys
     # Expose current_api_keys_owner as a helper method for views
     helper_method :current_api_keys_owner
 
+    def render_api_keys_unauthorized
+      render plain: "Unauthorized", status: :unauthorized
+    end
+
+    def set_api_keys_security_headers
+      response.headers["Cache-Control"] = "no-store, private"
+      response.headers["Pragma"] = "no-cache"
+      response.headers["Referrer-Policy"] = "no-referrer"
+      response.headers["X-Content-Type-Options"] = "nosniff"
+      response.headers["X-Frame-Options"] = "DENY"
+      response.headers["Permissions-Policy"] = "camera=(), microphone=(), geolocation=()"
+    end
+
   end
 end

data/app/controllers/api_keys/keys_controller.rb

@@ -4,13 +4,31 @@ module ApiKeys
   # Controller for managing API keys belonging to the current owner.
   class KeysController < ApplicationController
     before_action :set_api_key, only: [:show, :edit, :update, :revoke]
+    helper_method :key_types_feature_enabled?
 
     # GET /keys
     def index
-      # Fetch only active keys for the main list, maybe sorted by creation date
-      @api_keys = current_api_keys_owner.api_keys.active.order(created_at: :desc)
+      # Start with all keys for the owner
+      base_scope = current_api_keys_owner.api_keys
+
+      # Filter by environment if key_types feature is enabled and cross-environment is disabled
+      if key_types_feature_enabled? && !ApiKeys.configuration.dashboard_allow_cross_environment
+        current_env = resolve_current_environment
+        base_scope = base_scope.where(environment: [current_env.to_s, nil, ""])
+      end
+
+      # Fetch only active keys for the main list, sorted by creation date
+      @api_keys = base_scope.active.order(created_at: :desc)
       # Optionally, fetch inactive ones for a separate section or filter
-      @inactive_api_keys = current_api_keys_owner.api_keys.inactive.order(created_at: :desc)
+      @inactive_api_keys = base_scope.inactive.order(created_at: :desc)
+
+      # When key_types feature is enabled, separate publishable and secret keys
+      if key_types_feature_enabled?
+        @publishable_keys = @api_keys.select(&:public_key_type?)
+        @secret_keys = @api_keys.reject(&:public_key_type?)
+        @inactive_publishable_keys = @inactive_api_keys.select(&:public_key_type?)
+        @inactive_secret_keys = @inactive_api_keys.reject(&:public_key_type?)
+      end
     end
 
     # GET /keys/:id
@@ -21,7 +39,7 @@ module ApiKeys
       # We need to retrieve the plaintext token stored temporarily
       # after creation. This relies on how we handle creation.
       # We'll likely store it in the session flash or pass it directly.
-      @plaintext_token = session.delete(:plaintext_api_key) # Retrieve and delete from session
+      @plaintext_token = ApiKeys::TokenSession.retrieve_once(session, api_key: @api_key)
       unless @plaintext_token
         # If accessed directly without the token, redirect or show an error
         redirect_to keys_path, alert: "API key token can only be shown once immediately after creation."
@@ -35,21 +53,21 @@ module ApiKeys
 
     # POST /keys
     def create
+      submitted_params = api_key_params
+
       # Use the HasApiKeys helper method to create the key
       begin
         # create_api_key! now returns the ApiKey instance
         @api_key = current_api_keys_owner.create_api_key!(
-          name: api_key_params[:name],
-          scopes: api_key_params[:scopes],
-          expires_at: parse_expiration(api_key_params[:expires_at_preset])
+          name: submitted_params[:name],
+          scopes: submitted_params[:scopes],
+          expires_at: parse_expiration(submitted_params[:expires_at_preset]),
+          key_type: submitted_params[:key_type].presence
           # Metadata could be added here if needed
         )
 
-        # Get the plaintext token from the instance's attr_reader
-        plaintext_token = @api_key.token
-
         # Store the plaintext token in session to display on the show page
-        session[:plaintext_api_key] = plaintext_token
+        ApiKeys::TokenSession.store(session, @api_key)
 
         redirect_to key_path(@api_key)
       rescue ActiveRecord::RecordInvalid => e
@@ -57,11 +75,18 @@ module ApiKeys
         @api_key = e.record # Get the invalid ApiKey instance
         flash.now[:alert] = "Failed to create API key: #{e.record.errors.full_messages.join(', ')}"
         render :new, status: :unprocessable_entity
-      rescue => e # Catch other potential errors
-        flash.now[:alert] = "An unexpected error occurred: #{e.message}"
-        @api_key = current_api_keys_owner.api_keys.build(api_key_params) # Rebuild form
+      rescue ArgumentError
+        flash.now[:alert] = "Failed to create API key: invalid options."
+        @api_key = rebuild_api_key_for_form(submitted_params)
+        render :new, status: :unprocessable_entity
+      rescue StandardError => error
+        log_error "[ApiKeys Dashboard] Unexpected key creation failure (#{error.class}); request ID: #{request.uuid}"
+        flash.now[:alert] = "An unexpected error occurred while creating the API key."
+        @api_key = rebuild_api_key_for_form(submitted_params)
         render :new, status: :unprocessable_entity
       end
+    rescue ActionController::ParameterMissing
+      head :bad_request
     end
 
     # GET /keys/:id/edit
@@ -77,16 +102,19 @@ module ApiKeys
         flash.now[:alert] = "Failed to update API key: #{@api_key.errors.full_messages.join(', ')}"
         render :edit, status: :unprocessable_entity
       end
+    rescue ActionController::ParameterMissing
+      head :bad_request
     end
 
     # POST /keys/:id/revoke
     def revoke
-      if @api_key.revoke!
-        redirect_to keys_path, notice: "API key revoked successfully."
-      else
-        # This shouldn't typically fail unless there's a callback issue
-        redirect_to keys_path, alert: "Failed to revoke API key."
-      end
+      @api_key.revoke!
+      redirect_to keys_path, notice: "API key revoked successfully."
+    rescue ApiKeys::Errors::KeyNotRevocableError
+      redirect_to keys_path, alert: "This API key cannot be revoked."
+    rescue StandardError => error
+      log_error "[ApiKeys Dashboard] Unexpected key revocation failure (#{error.class}); key ID: #{@api_key&.id}; request ID: #{request.uuid}"
+      redirect_to keys_path, alert: "Failed to revoke API key."
     end
 
     private
@@ -100,15 +128,22 @@ module ApiKeys
 
     # Only allow a list of trusted parameters through for creation.
     # Added :expires_at_preset for the dropdown selector.
+    # Added :key_type for the key types feature.
     def api_key_params
-      permitted_params = params.require(:api_key).permit(:name, :expires_at_preset, scopes: [])
+      submitted = params.require(:api_key)
+      raise ActionController::ParameterMissing, :api_key unless submitted.respond_to?(:permit)
+
+      permitted_params = submitted.permit(:name, :expires_at_preset, :key_type, scopes: [])
       permitted_params[:scopes]&.reject!(&:blank?) # Filter out blank strings
       permitted_params
     end
 
     # Only allow updating name and scopes.
     def api_key_update_params
-      permitted_params = params.require(:api_key).permit(:name, scopes: [])
+      submitted = params.require(:api_key)
+      raise ActionController::ParameterMissing, :api_key unless submitted.respond_to?(:permit)
+
+      permitted_params = submitted.permit(:name, scopes: [])
       permitted_params[:scopes]&.reject!(&:blank?) # Filter out blank strings
       permitted_params
     end
@@ -122,8 +157,27 @@ module ApiKeys
       when "90_days" then 90.days.from_now
       when "365_days" then 365.days.from_now
       when "no_expiration" then nil
-      else nil # Default to no expiration if invalid preset
+      when nil, "" then nil
+      else raise ArgumentError, "Invalid expiration preset"
       end
     end
+
+    def rebuild_api_key_for_form(submitted_params)
+      current_api_keys_owner.api_keys.build(
+        name: submitted_params[:name],
+        scopes: submitted_params[:scopes]
+      )
+    end
+
+    # Check if key types feature is enabled
+    def key_types_feature_enabled?
+      ApiKeys.configuration.key_types.present? && ApiKeys.configuration.key_types.any?
+    end
+
+    # Get the current environment from configuration
+    def resolve_current_environment
+      env_config = ApiKeys.configuration.current_environment
+      env_config.respond_to?(:call) ? env_config.call : env_config
+    end
   end
 end

data/app/controllers/api_keys/security_controller.rb

@@ -6,11 +6,19 @@ module ApiKeys
     # Skip the user authentication requirement for these static pages
     # as they contain general information.
     skip_before_action :authenticate_api_keys_owner!, only: [:best_practices]
+    helper_method :key_types_feature_enabled?
 
     # GET /security/best-practices
     def best_practices
       # Renders app/views/api_keys/security/best_practices.html.erb
       # The view will contain the static content.
     end
+
+    private
+
+    # Check if key types feature is enabled
+    def key_types_feature_enabled?
+      ApiKeys.configuration.key_types.present? && ApiKeys.configuration.key_types.any?
+    end
   end
 end

data/app/views/api_keys/keys/_empty_state.html.erb

@@ -0,0 +1,9 @@
+<%# Partial for displaying empty state when no keys exist %>
+<%# Locals: message (optional) - Custom message to display %>
+
+<% message ||= "You don't have any API keys yet!" %>
+
+<div class="api-keys-empty-state">
+  <h4><%= message %></h4>
+  <p>Create your first API key to get started.</p>
+</div>

data/app/views/api_keys/keys/_form.html.erb

@@ -1,7 +1,7 @@
 <%# Shared form for creating and editing API Keys %>
 <%= form_with(model: [:keys, api_key], url: (api_key.persisted? ? key_path(api_key) : keys_path), local: true) do |form| %>
   <% if api_key.errors.any? %>
-    <div style="color: red;">
+    <div class="api-keys-form-errors">
       <strong><%= pluralize(api_key.errors.count, "error") %> prohibited this API key from being saved:</strong>
       <ul>
         <% api_key.errors.full_messages.each do |message| %>
@@ -13,6 +13,35 @@
 
   <%# Fields only available on NEW %>
   <% unless api_key.persisted? %>
+    <%# Key Type selector (only shown when key_types feature is enabled) %>
+    <% if ApiKeys.configuration.key_types.present? && ApiKeys.configuration.key_types.any? %>
+      <div>
+        <%= form.label :key_type, "Key Type" %>
+        <%= form.select :key_type,
+            options_for_select(
+              ApiKeys.configuration.key_types.map { |type, config|
+                label = type.to_s.humanize
+                label += " (#{config[:prefix]}_)" if config[:prefix]
+                [label, type.to_s]
+              },
+              api_key.key_type
+            ),
+            { prompt: "Select key type..." }
+        %>
+        <% ApiKeys.configuration.key_types.each do |type, config| %>
+          <% if config[:permissions] != :all %>
+            <small class="api-keys-form-help">
+              <strong><%= type.to_s.humanize %>:</strong>
+              Limited to <%= config[:permissions]&.join(", ") || "no" %> permissions
+              <% unless config.fetch(:revocable, true) %>
+                <em>(cannot be revoked)</em>
+              <% end %>
+            </small>
+          <% end %>
+        <% end %>
+      </div>
+    <% end %>
+
     <div>
       <%= form.label :name, "Name (optional)" %>
       <%= form.text_field :name, placeholder: "e.g., myproject-production-key" %>
@@ -52,7 +81,7 @@
                                scope, # Value submitted when checked
                                nil # Value submitted when unchecked (not needed here)
                                %>
-            <%= form.label "scopes_#{scope.parameterize}", scope.humanize, class: "form-check-label" %>
+            <%= form.label "scopes_#{scope.parameterize}", class: "form-check-label" do %><code><%= scope %></code><% end %>
           </div>
         <% end %>
       </div>
@@ -85,7 +114,7 @@
                                nil # Value submitted when unchecked (not needed here)
                                %>
             <%# Using the scope name directly for the label's `for` attribute requires matching the checkbox ID %>
-            <%= form.label "scopes_#{scope.parameterize}_edit", scope.humanize, class: "form-check-label" %>
+            <%= form.label "scopes_#{scope.parameterize}_edit", class: "form-check-label" do %><code><%= scope %></code><% end %>
           </div>
         <% end %>
       </div>
@@ -103,4 +132,4 @@
       <%= link_to "Cancel", keys_path %>
     <% end %>
   </div>
-<% end %> 
+<% end %>

data/app/views/api_keys/keys/_key_actions.html.erb

@@ -0,0 +1,20 @@
+<%# Partial for displaying key action buttons (edit, revoke) %>
+<%# Locals: key (required) - The ApiKey record %>
+
+<% if key.active? %>
+  <%= link_to edit_key_path(key), title: "Edit Key", class: "api-keys-action-edit" do %>
+    <svg xmlns="http://www.w3.org/2000/svg" width="1em" height="1em" fill="currentColor" viewBox="0 0 24 24"><path fill-rule="evenodd" d="M16.793 2.793a3.121 3.121 0 1 1 4.414 4.414l-8.5 8.5A1 1 0 0 1 12 16H9a1 1 0 0 1-1-1v-3a1 1 0 0 1 .293-.707l8.5-8.5Zm3 1.414a1.121 1.121 0 0 0-1.586 0L10 12.414V14h1.586l8.207-8.207a1.121 1.121 0 0 0 0-1.586ZM6 5a1 1 0 0 0-1 1v12a1 1 0 0 0 1 1h12a1 1 0 0 0 1-1v-4a1 1 0 1 1 2 0v4a3 3 0 0 1-3 3H6a3 3 0 0 1-3-3V6a3 3 0 0 1 3-3h4a1 1 0 1 1 0 2H6Z" clip-rule="evenodd"></path></svg>
+  <% end %>
+
+  <% if key.revocable? %>
+    <%= button_to revoke_key_path(key), title: "Revoke Key", class: "api-keys-action-revoke", data: { turbo_method: :post, turbo_confirm: "Are you sure you want to revoke this key? It will stop working immediately." } do %>
+      <svg xmlns="http://www.w3.org/2000/svg" width="1em" height="1em" fill="currentColor" viewBox="0 0 24 24"><path fill-rule="evenodd" d="M10.556 4a1 1 0 0 0-.97.751l-.292 1.14h5.421l-.293-1.14A1 1 0 0 0 13.453 4h-2.897Zm6.224 1.892-.421-1.639A3 3 0 0 0 13.453 2h-2.897A3 3 0 0 0 7.65 4.253l-.421 1.639H4a1 1 0 1 0 0 2h.1l1.215 11.425A3 3 0 0 0 8.3 22h7.4a3 3 0 0 0 2.984-2.683l1.214-11.425H20a1 1 0 1 0 0-2h-3.22Zm1.108 2H6.112l1.192 11.214A1 1 0 0 0 8.3 20h7.4a1 1 0 0 0 .995-.894l1.192-11.214ZM10 10a1 1 0 0 1 1 1v5a1 1 0 1 1-2 0v-5a1 1 0 0 1 1-1Zm4 0a1 1 0 0 1 1 1v5a1 1 0 1 1-2 0v-5a1 1 0 0 1 1-1Z" clip-rule="evenodd"></path></svg>
+    <% end %>
+  <% else %>
+    <span title="This key cannot be revoked" class="api-keys-action-disabled">
+      <svg xmlns="http://www.w3.org/2000/svg" width="1em" height="1em" fill="currentColor" viewBox="0 0 24 24"><path fill-rule="evenodd" d="M12 2C6.48 2 2 6.48 2 12s4.48 10 10 10 10-4.48 10-10S17.52 2 12 2zm1 15h-2v-2h2v2zm0-4h-2V7h2v6z" clip-rule="evenodd"></path></svg>
+    </span>
+  <% end %>
+<% else %>
+  &mdash;
+<% end %>

data/app/views/api_keys/keys/_key_badges.html.erb

@@ -0,0 +1,17 @@
+<%# Partial for displaying key type and environment badges %>
+<%# Locals: key (required) - The ApiKey record %>
+
+<% if key.key_type.present? %>
+  <% type_config = key.key_type_config %>
+  <% is_publishable = type_config&.dig(:revocable) == false %>
+  <span class="api-keys-badge api-keys-badge-type <%= is_publishable ? 'api-keys-badge-publishable' : 'api-keys-badge-secret' %>">
+    <%= key.key_type.humanize %>
+  </span>
+<% end %>
+
+<% if key.environment.present? %>
+  <% is_live = key.environment == 'live' %>
+  <span class="api-keys-badge api-keys-badge-env <%= is_live ? 'api-keys-badge-live' : 'api-keys-badge-test' %>">
+    <%= key.environment.upcase %>
+  </span>
+<% end %>

data/app/views/api_keys/keys/_key_row.html.erb

@@ -1,27 +1,25 @@
-<tr>
-  <td>
-    <%# Status indicator (no text originally, keeping it that way unless specified otherwise) %>
-    <% if key.active? %>
-      <span style="color: green;"></span>
-    <% elsif key.revoked? %>
-      <span style="color: orange;">[Revoked]</span>
-    <% elsif key.expired? %>
-      <span style="color: red;">[Expired]</span>
-    <% end %>
-    <%= key.name.presence || "Secret key" %>
+<%# Partial for displaying a single API key row in the table %>
+<%# Locals: key (required) - The ApiKey record %>
+
+<tr class="api-keys-row <%= 'api-keys-row-inactive' if defined?(inactive) && inactive %>">
+  <td class="api-keys-cell-name">
+    <%= render partial: 'api_keys/keys/key_status', locals: { key: key } %>
+    <%= key.name.presence || (key.key_type.present? ? "#{key.key_type.humanize} key" : "API key") %>
+    <%= render partial: 'api_keys/keys/key_badges', locals: { key: key } %>
   </td>
-  <td><code><%= key.masked_token %></code></td>
 
+  <td class="api-keys-cell-token api-keys-token-cell">
+    <%= render partial: 'api_keys/keys/token_display', locals: { key: key } %>
+  </td>
 
-  <td title="<%= key.created_at.strftime('%Y-%m-%d %H:%M:%S %Z') %>">
+  <td class="api-keys-cell-created" title="<%= key.created_at.strftime('%Y-%m-%d %H:%M:%S %Z') %>">
     <%= time_ago_in_words(key.created_at) %> ago
   </td>
 
-
-  <td>
+  <td class="api-keys-cell-expires">
     <% if key.expires_at? %>
       <% if key.expired? %>
-        <strong style="color: red;" title="<%= key.expires_at.strftime('%Y-%m-%d %H:%M:%S %Z') %>">
+        <strong class="api-keys-expired-text" title="<%= key.expires_at.strftime('%Y-%m-%d %H:%M:%S %Z') %>">
           Expired <%= time_ago_in_words(key.expires_at) %> ago
         </strong>
       <% else %>
@@ -34,39 +32,27 @@
     <% end %>
   </td>
 
-
-  <td>
+  <td class="api-keys-cell-last-used">
     <% if key.last_used_at? %>
       <span title="<%= key.last_used_at.strftime('%Y-%m-%d %H:%M:%S %Z') %>">
         <%= time_ago_in_words(key.last_used_at) %> ago
       </span>
-      <%# TODO: Add relative time check (e.g., "within last 3 months") %>
     <% else %>
       <em>Never used</em>
     <% end %>
   </td>
 
-
-  <td>
+  <td class="api-keys-cell-scopes">
     <% if key.scopes.present? %>
       <% key.scopes.each do |scope| %>
-        <kbd class="tag is-small"><%= scope %></kbd>
+        <kbd class="api-keys-scope-tag tag is-small"><%= scope %></kbd>
       <% end %>
     <% else %>
       &mdash;
     <% end %>
   </td>
-  <td class="api-keys-action-buttons">
-    <% if key.active? %>
-      <%= link_to api_keys.edit_key_path(key), title: "Edit Key" do %>
-        <svg xmlns="http://www.w3.org/2000/svg" width="1em" height="1em" fill="currentColor" viewBox="0 0 24 24"><path fill-rule="evenodd" d="M16.793 2.793a3.121 3.121 0 1 1 4.414 4.414l-8.5 8.5A1 1 0 0 1 12 16H9a1 1 0 0 1-1-1v-3a1 1 0 0 1 .293-.707l8.5-8.5Zm3 1.414a1.121 1.121 0 0 0-1.586 0L10 12.414V14h1.586l8.207-8.207a1.121 1.121 0 0 0 0-1.586ZM6 5a1 1 0 0 0-1 1v12a1 1 0 0 0 1 1h12a1 1 0 0 0 1-1v-4a1 1 0 1 1 2 0v4a3 3 0 0 1-3 3H6a3 3 0 0 1-3-3V6a3 3 0 0 1 3-3h4a1 1 0 1 1 0 2H6Z" clip-rule="evenodd"></path></svg>
-      <% end %>
-      <%= button_to api_keys.revoke_key_path(key), title: "Revoke Key", data: { turbo_method: :post, turbo_confirm: "Are you sure you want to revoke this key? It will stop working immediately." } do %>
-        <svg xmlns="http://www.w3.org/2000/svg" width="1em" height="1em" fill="currentColor" viewBox="0 0 24 24"><path fill-rule="evenodd" d="M10.556 4a1 1 0 0 0-.97.751l-.292 1.14h5.421l-.293-1.14A1 1 0 0 0 13.453 4h-2.897Zm6.224 1.892-.421-1.639A3 3 0 0 0 13.453 2h-2.897A3 3 0 0 0 7.65 4.253l-.421 1.639H4a1 1 0 1 0 0 2h.1l1.215 11.425A3 3 0 0 0 8.3 22h7.4a3 3 0 0 0 2.984-2.683l1.214-11.425H20a1 1 0 1 0 0-2h-3.22Zm1.108 2H6.112l1.192 11.214A1 1 0 0 0 8.3 20h7.4a1 1 0 0 0 .995-.894l1.192-11.214ZM10 10a1 1 0 0 1 1 1v5a1 1 0 1 1-2 0v-5a1 1 0 0 1 1-1Zm4 0a1 1 0 0 1 1 1v5a1 1 0 1 1-2 0v-5a1 1 0 0 1 1-1Z" clip-rule="evenodd"></path></svg>
-      <% end %>
-    <% else %>
-      <%# No actions available for inactive/revoked/expired keys %>
-      &mdash;
-    <% end %>
+
+  <td class="api-keys-cell-actions api-keys-action-buttons">
+    <%= render partial: 'api_keys/keys/key_actions', locals: { key: key } %>
   </td>
-</tr>
+</tr>

data/app/views/api_keys/keys/_key_status.html.erb

@@ -0,0 +1,10 @@
+<%# Partial for displaying key status indicator %>
+<%# Locals: key (required) - The ApiKey record %>
+
+<% if key.active? %>
+  <span class="api-keys-status api-keys-status-active"></span>
+<% elsif key.revoked? %>
+  <span class="api-keys-status api-keys-status-revoked">[Revoked]</span>
+<% elsif key.expired? %>
+  <span class="api-keys-status api-keys-status-expired">[Expired]</span>
+<% end %>

data/app/views/api_keys/keys/_keys_table.html.erb

@@ -12,7 +12,7 @@
         <thead>
           <tr>
             <th>Name</th>
-            <th>Secret Key</th>
+            <th>API Key</th>
             <th>Created</th>
             <th>Expires</th>
             <th>Last Used</th>
@@ -28,9 +28,6 @@
 
           <%# Render inactive keys below, visually distinct %>
           <% if inactive_keys.any? %>
-            <%# Optional: Add a visual separator if desired %>
-            <%# <tr><td colspan="7" style="border-top: 2px solid #ccc; text-align: center; padding-top: 1em; color: #555;">Inactive Keys</td></tr> %>
-
             <% inactive_keys.each do |key| %>
               <%= render partial: 'api_keys/keys/key_row', locals: { key: key, inactive: true } %>
             <% end %>
@@ -38,15 +35,10 @@
         </tbody>
       </table>
     <% else %>
-      <div style="text-align: center; padding: 2em;">
-        <h4>You don't have any API keys yet!</h4>
-        <p>Create your first API key to get started.</p>
-        <%# Consider adding a primary "Create Key" button here %>
-        <%#= link_to "Create New API Key", new_key_path, class: "button primary" %>
-      </div>
+      <%= render partial: 'api_keys/keys/empty_state' %>
     <% end %>
   </div>
 
 </section>
 
-<%# The separate inactive keys section is now removed as they are integrated above. %>
+<%# The separate inactive keys section is now removed as they are integrated above. %>

data/app/views/api_keys/keys/_publishable_keys.html.erb

@@ -0,0 +1,40 @@
+<%# Partial for displaying publishable keys section %>
+<%# Locals: active_keys (Active publishable keys), inactive_keys (Inactive publishable keys) %>
+
+<section class="api-keys-section api-keys-publishable-section" aria-labelledby="publishable-keys-heading">
+  <h2 id="publishable-keys-heading">Publishable Keys</h2>
+  <p class="api-keys-section-description">
+    These keys are safe to embed in client-side applications and browser code.
+    You can view them anytime.
+  </p>
+
+  <div class="api-keys-table-wrapper">
+    <% all_keys = active_keys + inactive_keys %>
+    <% if all_keys.any? %>
+      <table>
+        <thead>
+          <tr>
+            <th>Name</th>
+            <th>API Key</th>
+            <th>Created</th>
+            <th>Expires</th>
+            <th>Last Used</th>
+            <th>Permissions</th>
+            <th>Actions</th>
+          </tr>
+        </thead>
+        <tbody>
+          <% active_keys.each do |key| %>
+            <%= render partial: 'api_keys/keys/key_row', locals: { key: key } %>
+          <% end %>
+
+          <% inactive_keys.each do |key| %>
+            <%= render partial: 'api_keys/keys/key_row', locals: { key: key, inactive: true } %>
+          <% end %>
+        </tbody>
+      </table>
+    <% else %>
+      <%= render partial: 'api_keys/keys/empty_state', locals: { message: "No publishable keys yet." } %>
+    <% end %>
+  </div>
+</section>