preseetId hardening

Author: carderne

apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.apikeys/route.tsx

@@ -101,7 +101,7 @@ const CreateApiKeySchema = z.object({
       .refine((date) => date.getTime() > Date.now(), "Expiration must be in the future")
       .optional()
   ),
-  presetId: z.string().trim().min(1).optional(),
+  presetId: z.string().trim().min(1),
   taskScope: z.enum(["all", "selected"]).optional(),
   taskIdentifiers: z
     .array(z.string())
@@ -562,7 +562,7 @@ function NewApiKeyDialog({
   const [open, setOpen] = useState(false);
   const [name, setName] = useState("");
   const [expiresAt, setExpiresAt] = useState<Date>();
-  const defaultPresetId = presets?.find((preset) => preset.available)?.id ?? "";
+  const defaultPresetId = presets?.find((preset) => preset.available)?.id ?? "FULL_ACCESS";
   const [presetId, setPresetId] = useState(defaultPresetId);
   const [taskScope, setTaskScope] = useState<"all" | "selected">("all");
   const [selectedTasks, setSelectedTasks] = useState<string[]>([]);

apps/webapp/app/services/apiKeyPresetValidation.server.ts

@@ -24,17 +24,14 @@ export function validateCreateApiKeyPreset({
   const fullAccess = { presetId: FULL_ACCESS_PRESET_ID, usesTaskSelection: false };
 
   if (presets === null) {
-    if (presetId !== undefined || hasTaskParameters) {
+    if (presetId !== FULL_ACCESS_PRESET_ID || hasTaskParameters) {
       throw new Error("API key access presets are not available");
     }
     return fullAccess;
   }
 
   if (!presetId) {
-    if (hasTaskParameters) {
-      throw new Error("A preset is required when selecting tasks");
-    }
-    return fullAccess;
+    throw new Error("A preset is required");
   }
 
   const preset = presets.find((candidate) => candidate.id === presetId);