web-mojo 2.6.1 → 2.6.2

package/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 ## Unreleased
 
+### Admin · API Key permissions: Member-parity switch editor + ApiKeyView DetailView migration (ITEM-025)
+
+- **The permissions JSON textarea is gone — it was corrupting data.** `ApiKeyForms.create`/`.edit` declared `permissions` as `type: 'textarea'`: an already-fetched permissions object string-coerced to the literal text `[object Object]` on Edit, and the raw textarea string was POSTed with no `JSON.parse` — so even a name-only save silently overwrote real permissions with a garbage string. Both dialogs (GroupView → API Keys and the standalone admin ApiKeys table) had the bug.
+- **Permissions are now edited exactly like Group Member permissions.** An API key "acts as" a member of its group, so the editor offers the Member permission catalog and nothing else: the create form embeds the live `Member.PERMISSION_TABSET` switch tabset (a `fields` getter, so app permissions registered later via `Member.registerPermissions()` appear automatically), and each switch saves a flat dotted `permissions.<name>` boolean — the same wire shape MemberView autosaves, expanded and gated per-key by django-mojo. Creates are grant-only: unchecked switches are stripped from the POST. `ApiKeyForms.edit` shrinks to name-only.
+- **`ApiKeyView` rebuilt on `DetailView`** (was a pre-DetailView hand-rolled `View`), matching the 13 sibling admin detail views: real header with × close (the old modal had no close affordance and grew a stray default "OK" footer button), `is_active` on the header active switch, kebab reduced to Edit name / Delete, and sections — Overview (key facts + token note), Permissions (autosaving `Member.PERMISSION_TABSET` FormView, the landing section), Rate Limits (read-only), Usage. Dark-theme support comes free from the DetailView primitives. `ApiKeyTablePage` completes `viewDialogOptions` with `noBodyPadding: true, buttons: []` — correct **only** together with this migration (on the old hand-rolled view those options removed all padding and every dismiss control, which is precisely how the GroupView path looked broken).
+- GroupView's one-time token-reveal dialog now receives the granted permission names extracted from the dotted create-form keys (the old dict/JSON-string juggling is gone).
+- **Known contingency:** a member holding only `"groups"` can create a key but still 403s when granting permissions until the two django-mojo companion fixes land (setter drops non-dict values; permission-gate fallback list omits base perms) — tracked in ITEM-025's notes.
+- Tests: `test/unit/ApiKey.test.js` (regression: no permissions textarea anywhere, live tabset embed, name-only edit), `test/unit/ApiKeyView.test.js` (DetailView structure, × close, live-tabset autosave FormView, corrupted-permissions guard). Docs: `models/BuiltinModels.md` (ApiKey section rewritten — correct endpoint, form helpers).
+
 ### Admin · Storage upload limit configurable — 1 GB default, app-level `max_upload_size` (ITEM-024)
 
 - **The Files page (`system/files`) upload cap is no longer hardcoded at 100 MB.** Both upload paths (drag-drop and the Add file picker) now share one resolved limit with the precedence *page option `maxFileSize` → WebApp config `max_upload_size` → 1 GB default*. A 143 MB upload that previously errored ("File size (142.93 MB) exceeds maximum (100 MB)") now passes on default config; deployments needing a different ceiling set `new WebApp({ max_upload_size: N })` (PortalApp/PortalWebApp share the same config object) or pass `maxFileSize` at `registerPage` time. Both error messages report the effective limit.