fix(api-keys): provide feature flags to account settings and clarify meta scopes

- The account settings layout resolves api-key-read-only and wraps its sections in
  FeatureFlagsProvider, as the workspace and organization layouts do, so personal API
  key settings no longer throw from the create modal's flag read
- The /api/v2/meta scopes description says read-only keys are also refused every
  operation that declares no API scope; OpenAPI regenerated

Author: waleedlatif1

apps/docs/openapi-v2-resources.json

@@ -18651,7 +18651,7 @@
               "type": "string",
               "enum": ["api:read", "api:write", "search:read"]
             },
-            "description": "API scopes the calling credential holds. A read-only API key holds only api:read and is refused every operation that changes state; a full-access key holds api:read and api:write; an OAuth access token holds what it was granted."
+            "description": "API scopes the calling credential holds. A read-only API key holds only api:read: it is refused every operation that changes state and every operation that declares no API scope, so api:read alone does not authorize those. A full-access key holds api:read and api:write; an OAuth access token holds what it was granted."
           }
         },
         "required": ["v2Enabled", "keyType", "expiresAt", "scopes"],

apps/sim/app/account/settings/layout.test.tsx

@@ -0,0 +1,45 @@
+import type { ReactNode } from 'react'
+import { authMockFns } from '@sim/testing'
+import { featureFlagsMock, featureFlagsMockFns } from '@sim/testing/mocks/feature-flags.mock'
+import { nextNavigationMock } from '@sim/testing/mocks/next-navigation.mock'
+import { renderToStaticMarkup } from 'react-dom/server'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+vi.mock('next/navigation', () => nextNavigationMock)
+vi.mock('@/lib/core/config/feature-flags', () => featureFlagsMock)
+vi.mock('@/lib/permissions/super-user', () => ({ isPlatformAdmin: vi.fn(async () => false) }))
+vi.mock('@/components/settings/standalone-settings-shell', () => ({
+  StandaloneSettingsShell: ({ children }: { children: ReactNode }) => children,
+}))
+
+import AccountSettingsLayout from '@/app/account/settings/layout'
+import { useFeatureFlag } from '@/app/workspace/[workspaceId]/providers/feature-flags-provider'
+
+/** Stands in for the personal API keys page, whose create modal reads this flag on every render. */
+function ReadOnlyKeysFlag() {
+  return <span>{`read-only keys ${useFeatureFlag('api-key-read-only') ? 'on' : 'off'}`}</span>
+}
+
+async function renderAccountSettings(): Promise<string> {
+  const element = await AccountSettingsLayout({ children: <ReadOnlyKeysFlag /> })
+  return renderToStaticMarkup(element)
+}
+
+describe('AccountSettingsLayout', () => {
+  beforeEach(() => {
+    authMockFns.mockGetSession.mockResolvedValue({
+      user: { id: 'viewer-1' },
+      session: { id: 'session-1' },
+    })
+  })
+
+  it.each([
+    [true, 'on'],
+    [false, 'off'],
+  ])('gives account sections the read-only key flag (%s)', async (enabled, rendered) => {
+    featureFlagsMockFns.mockIsFeatureEnabled.mockImplementation(
+      async (flag) => flag === 'api-key-read-only' && enabled
+    )
+    expect(await renderAccountSettings()).toContain(`read-only keys ${rendered}`)
+  })
+})

apps/sim/app/account/settings/layout.tsx

@@ -1,21 +1,38 @@
 import { redirect } from 'next/navigation'
 import { StandaloneSettingsShell } from '@/components/settings/standalone-settings-shell'
+import { isReadOnlyApiKeyCreationEnabled } from '@/lib/api-key/feature-flag'
 import { getSession } from '@/lib/auth'
 import { resolveDeploymentShape } from '@/lib/core/config/deployment-shape'
 import { isPlatformAdmin } from '@/lib/permissions/super-user'
+import { FeatureFlagsProvider } from '@/app/workspace/[workspaceId]/providers/feature-flags-provider'
 
 export default async function AccountSettingsLayout({ children }: { children: React.ReactNode }) {
   const session = await getSession()
   if (!session?.user) redirect('/login')
-  const isSuperUser = await isPlatformAdmin(session.user.id)
+  const [isSuperUser, readOnlyApiKeysEnabled] = await Promise.all([
+    isPlatformAdmin(session.user.id),
+    isReadOnlyApiKeyCreationEnabled(),
+  ])
 
+  /** Account settings host no workspace surface, so only the flags its sections read are on. */
   return (
-    <StandaloneSettingsShell
-      plane='account'
-      isSuperUser={isSuperUser}
-      deployment={resolveDeploymentShape()}
+    <FeatureFlagsProvider
+      flags={{
+        dashboards: false,
+        'workflow-tests': false,
+        changelog: false,
+        'mothership-model-selector': false,
+        'mothership-plan-mode': false,
+        'api-key-read-only': readOnlyApiKeysEnabled,
+      }}
     >
-      {children}
-    </StandaloneSettingsShell>
+      <StandaloneSettingsShell
+        plane='account'
+        isSuperUser={isSuperUser}
+        deployment={resolveDeploymentShape()}
+      >
+        {children}
+      </StandaloneSettingsShell>
+    </FeatureFlagsProvider>
   )
 }

apps/sim/lib/api/contracts/v2/meta.ts

@@ -25,7 +25,7 @@ export const v2MetaSchema = z
     scopes: z
       .array(z.enum(['api:read', 'api:write', 'search:read']))
       .describe(
-        'API scopes the calling credential holds. A read-only API key holds only api:read and is refused every operation that changes state; a full-access key holds api:read and api:write; an OAuth access token holds what it was granted.'
+        'API scopes the calling credential holds. A read-only API key holds only api:read: it is refused every operation that changes state and every operation that declares no API scope, so api:read alone does not authorize those. A full-access key holds api:read and api:write; an OAuth access token holds what it was granted.'
       ),
   })
   .meta({