Merge origin/staging (#9879) into improvement/platform-core-chat

Removes the api-key-read-only flag from the Platform surface too: the
surface contract, organization surface resolver, the read-only key hook,
and both create-key modals now always offer read-only access.

Author: waleedlatif1

apps/docs/content/docs/api-reference/authentication.mdx

@@ -44,7 +44,7 @@ A read-only key cannot change workspace resources or run, resume, or cancel work
 
 A refused request fails with `403` and the message `This API key is read-only and cannot perform this operation`. Where the surface carries a code, it is `READ_ONLY_API_KEY`: in `error.details.code` on the v2 API and the Sim MCP server, in `details.code` on the v1 API and workflow execution, and in `error.data.code` on a workflow MCP server.
 
-Access narrows a key; it never grants more than the key's identity already has. Access is fixed at creation, so create a new key to change it. Keys created before access levels existed have full access. Keys created from the deploy modal or for a workflow MCP server always have full access, because they exist to run workflows. If **Access** isn't shown when you create a key, read-only keys aren't available on your deployment yet.
+Access narrows a key; it never grants more than the key's identity already has. Access is fixed at creation, so create a new key to change it. Keys created before access levels existed have full access. Keys created from the deploy modal or for a workflow MCP server always have full access, because they exist to run workflows.
 
 ### Expiration [#key-expiration]
 

apps/sim/app/(product)/_components/destinations.test.ts

@@ -84,7 +84,6 @@ function organization({
       'mothership-memory-spaces': false,
       projects: false,
       'platform-preview': false,
-      'api-key-read-only': false,
     },
     settingsSections: [],
   }

apps/sim/app/(product)/o/[organizationId]/search/_components/search-surface/live-search-route.dom.test.tsx

@@ -102,7 +102,6 @@ const NARROW_MEMBER_SURFACE = {
     'mothership-memory-spaces': false,
     projects: false,
     'platform-preview': false,
-    'api-key-read-only': false,
   },
   settingsSections: [],
 } satisfies PlatformOrganization

apps/sim/app/(product)/workspace/[workspaceId]/_components/create-api-key-modal/create-api-key-modal.tsx

@@ -13,7 +13,6 @@ import {
   createLogger,
   DAY_MS,
   useCreateApiKey,
-  useReadOnlyApiKeysEnabled,
 } from '@/platform/lib/data/api-keys'
 
 const logger = createLogger('CreateApiKeyModal')
@@ -65,7 +64,7 @@ export function CreateApiKeyModal({
   const [keyType, setKeyType] = useState<KeyType>(defaultKeyType)
   const [access, setAccess] = useState<ApiKeyAccessLevel>('write')
   const [expiry, setExpiry] = useState<ExpiryOption>('never')
-  const canChooseAccess = useReadOnlyApiKeysEnabled() && !fullAccessOnly
+  const canChooseAccess = !fullAccessOnly
   const [created, setCreated] = useState<CreatedApiKey | null>(null)
   const canCreate =
     keyType === 'personal' ? allowPersonalApiKeys : canManageWorkspaceKeys && Boolean(workspaceId)

apps/sim/app/(site)/account/settings/layout.test.tsx

@@ -1,6 +1,5 @@
 import { redirect } from 'next/navigation'
 import { StandaloneSettingsShell } from '@/components/settings/standalone-settings-shell'
-import { isReadOnlyApiKeyCreationEnabled } from '@/lib/api-key/feature-flag'
 import { getSession } from '@/lib/auth'
 import { resolveDeploymentShape } from '@/lib/core/config/deployment-shape'
 import { FeatureFlagsProvider } from '@/lib/core/config/feature-flags-context'
@@ -9,10 +8,7 @@ import { isPlatformAdmin } from '@/lib/permissions/super-user'
 export default async function AccountSettingsLayout({ children }: { children: React.ReactNode }) {
   const session = await getSession()
   if (!session?.user) redirect('/login')
-  const [isSuperUser, readOnlyApiKeysEnabled] = await Promise.all([
-    isPlatformAdmin(session.user.id),
-    isReadOnlyApiKeyCreationEnabled(),
-  ])
+  const isSuperUser = await isPlatformAdmin(session.user.id)
 
   /** Account settings host no workspace surface, so only the flags its sections read are on. */
   return (
@@ -22,7 +18,6 @@ export default async function AccountSettingsLayout({ children }: { children: Re
         'workflow-tests': false,
         'mothership-model-selector': false,
         'mothership-plan-mode': false,
-        'api-key-read-only': readOnlyApiKeysEnabled,
       }}
     >
       <StandaloneSettingsShell

apps/sim/app/(site)/account/settings/layout.tsx

@@ -15,7 +15,6 @@ import {
 import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
 import { type ApiKeyAccessLevel, DAY_MS } from '@/lib/api/contracts/api-keys'
-import { useFeatureFlag } from '@/lib/core/config/feature-flags-context'
 import { type CreatedApiKey, useCreateApiKey } from '@/hooks/queries/api-keys'
 
 const logger = createLogger('CreateApiKeyModal')
@@ -54,7 +53,6 @@ export function CreateApiKeyModal({
   const [newKey, setNewKey] = useState<CreatedApiKey | null>(null)
   const [showNewKeyDialog, setShowNewKeyDialog] = useState(false)
   const createApiKeyMutation = useCreateApiKey()
-  const readOnlyKeysEnabled = useFeatureFlag('api-key-read-only')
 
   /**
    * The form is reset when the modal OPENS, not when this component mounts: it
@@ -92,7 +90,7 @@ export function CreateApiKeyModal({
       const data = await createApiKeyMutation.mutateAsync({
         keyType: 'personal',
         name: trimmedName,
-        access: readOnlyKeysEnabled ? access : 'write',
+        access,
         expiresAt: expiresAtFor(expiry),
       })
 
@@ -138,17 +136,15 @@ export function CreateApiKeyModal({
             autoComplete='off'
             required
           />
-          {readOnlyKeysEnabled && (
-            <ChipModalField type='custom' title='Access'>
-              <ChipButtonGroup
-                value={access}
-                onValueChange={(value) => setAccess(value as ApiKeyAccessLevel)}
-              >
-                <ChipButtonGroupItem value='write'>Full access</ChipButtonGroupItem>
-                <ChipButtonGroupItem value='read'>Read only</ChipButtonGroupItem>
-              </ChipButtonGroup>
-            </ChipModalField>
-          )}
+          <ChipModalField type='custom' title='Access'>
+            <ChipButtonGroup
+              value={access}
+              onValueChange={(value) => setAccess(value as ApiKeyAccessLevel)}
+            >
+              <ChipButtonGroupItem value='write'>Full access</ChipButtonGroupItem>
+              <ChipButtonGroupItem value='read'>Read only</ChipButtonGroupItem>
+            </ChipButtonGroup>
+          </ChipModalField>
           <ChipModalField
             type='dropdown'
             title='Expires'

apps/sim/components/settings/sections/api-keys/components/create-api-key-modal/create-api-key-modal.tsx

@@ -22,7 +22,7 @@ import {
 } from '@sim/db/schema'
 import { deleteWorkspaceFixture, insertWorkspaceFixture } from '@sim/db/testing/workspace-fixtures'
 import { authMock, authMockFns } from '@sim/testing'
-import { featureFlagsMock, featureFlagsMockFns } from '@sim/testing/mocks/feature-flags.mock'
+import { featureFlagsMock } from '@sim/testing/mocks/feature-flags.mock'
 import { generateId } from '@sim/utils/id'
 import { eq } from 'drizzle-orm'
 import { NextRequest } from 'next/server'
@@ -60,7 +60,6 @@ const expiredKey = `sk-sim-fixture-${generateId()}`
 
 let readPersonalKey = ''
 let readWorkspaceKey = ''
-let readOnlyKeysEnabled = false
 
 type RouteHandler = (request: NextRequest, context: { params: Promise<never> }) => Promise<Response>
 
@@ -176,9 +175,6 @@ describe('read-only and expiring API keys in PostgreSQL', () => {
       displayName: 'Topic',
       fieldType: 'text',
     })
-    featureFlagsMockFns.mockIsFeatureEnabled.mockImplementation(
-      async (flag) => flag === 'api-key-read-only' && readOnlyKeysEnabled
-    )
     await db.insert(apiKey).values([
       {
         id: generateId(),
@@ -231,22 +227,6 @@ describe('read-only and expiring API keys in PostgreSQL', () => {
     expect(after).toHaveLength(before.length)
   })
 
-  it('refuses to create a read-only key while the api-key-read-only flag is off', async () => {
-    const before = await db.select({ id: apiKey.id }).from(apiKey).where(eq(apiKey.userId, userId))
-    const personal = await call(createPersonalKey, '/api/users/me/api-keys', {
-      body: { name: `Flag off personal ${generateId()}`, access: 'read' },
-    })
-    expect(personal.status).toBe(400)
-    expect(personal.body).toEqual({ error: 'Read-only API keys are not available yet' })
-    const scoped = await call(createWorkspaceKey, `/api/workspaces/${workspaceId}/api-keys`, {
-      body: { name: `Flag off workspace ${generateId()}`, access: 'read' },
-      params: { id: workspaceId },
-    })
-    expect(scoped.status).toBe(400)
-    const after = await db.select({ id: apiKey.id }).from(apiKey).where(eq(apiKey.userId, userId))
-    expect(after).toHaveLength(before.length)
-  })
-
   it('reserves the delegation key-name prefix', async () => {
     const created = await call(createPersonalKey, '/api/users/me/api-keys', {
       body: { name: `mothership-delegation:${userId}`, access: 'write' },
@@ -255,7 +235,6 @@ describe('read-only and expiring API keys in PostgreSQL', () => {
   })
 
   it('mints read-only personal and workspace keys that report their access and expiry', async () => {
-    readOnlyKeysEnabled = true
     const expiresAt = new Date(Date.now() + 30 * DAY_MS).toISOString()
     const personal = await call(createPersonalKey, '/api/users/me/api-keys', {
       body: { name: `Read personal ${generateId()}`, access: 'read', expiresAt },

apps/sim/lib/api-key/__integration__/read-only-access.integration.ts

@@ -9,7 +9,6 @@ import { and, eq } from 'drizzle-orm'
 import { DAY_MS } from '@/lib/api/contracts/api-keys'
 import { createApiKey, createWorkspaceApiKey } from '@/lib/api-key/auth'
 import { hashApiKey } from '@/lib/api-key/crypto'
-import { isReadOnlyApiKeyCreationEnabled } from '@/lib/api-key/feature-flag'
 import { DELEGATION_KEY_NAME_PREFIX } from '@/lib/api-key/reserved-names'
 import { PlatformEvents } from '@/lib/core/telemetry'
 
@@ -70,16 +69,13 @@ type ResolvedIssueSettings =
   | { ok: false; error: string }
 
 /** Validates what a caller asked a new key to be, before anything is written. */
-async function resolveIssueSettings(
+function resolveIssueSettings(
   params: ApiKeyIssueSettings & { name: string }
-): Promise<ResolvedIssueSettings> {
+): ResolvedIssueSettings {
   if (params.name.startsWith(DELEGATION_KEY_NAME_PREFIX)) {
     return { ok: false, error: `API key names may not start with "${DELEGATION_KEY_NAME_PREFIX}"` }
   }
   const access = params.access ?? 'write'
-  if (access === 'read' && !(await isReadOnlyApiKeyCreationEnabled())) {
-    return { ok: false, error: 'Read-only API keys are not available yet' }
-  }
   const expiry = resolveApiKeyExpiry(params.expiresAt)
   if (!expiry.ok) return expiry
   return { ok: true, access, expiresAt: expiry.expiresAt }
@@ -131,7 +127,7 @@ export interface PerformCreatePersonalApiKeyResult {
 export async function performCreatePersonalApiKey(
   params: PerformCreatePersonalApiKeyParams
 ): Promise<PerformCreatePersonalApiKeyResult> {
-  const settings = await resolveIssueSettings(params)
+  const settings = resolveIssueSettings(params)
   if (!settings.ok) return { success: false, errorCode: 'validation', error: settings.error }
   const { access, expiresAt } = settings
   try {
@@ -216,7 +212,7 @@ export async function performCreatePersonalApiKey(
 export async function performCreateWorkspaceApiKey(
   params: PerformCreateWorkspaceApiKeyParams
 ): Promise<PerformCreateWorkspaceApiKeyResult> {
-  const settings = await resolveIssueSettings(params)
+  const settings = resolveIssueSettings(params)
   if (!settings.ok) return { success: false, errorCode: 'validation', error: settings.error }
   const { access, expiresAt } = settings
   try {