fix(dashboard): persist API key across browser sessions

[SantiagoDePolonia]

Summary

• restore browser-side persistence for the dashboard API key
• load the stored key on dashboard init and persist the normalized value on submit
• update dashboard display tests to cover the restored behavior

Testing

• node --test internal/admin/dashboard/static/js/modules/dashboard-display.test.js internal/admin/dashboard/static/js/modules/dashboard-layout.test.js internal/admin/dashboard/static/js/modules/request-cancellation.test.js

Summary by CodeRabbit

• New Features

  • API key is now persisted in browser storage and automatically restored on dashboard initialization.

• Tests

  • Updated authentication tests to reflect new API key persistence behavior.

[coderabbitai]

📝 Walkthrough

Walkthrough

This change modifies API key persistence in the dashboard from memory-only storage to persisting values in localStorage under the gomodel_api_key key during both initialization and save operations, with corresponding test updates to reflect the new behavior.

Changes

Cohort / File(s)	Summary
API Key Persistence internal/admin/dashboard/static/js/dashboard.js	Added API_KEY_STORAGE_KEY constant; modified initialization to read and restore gomodel_api_key from localStorage, and save operations to persist the normalized API key back to localStorage instead of keeping it memory-only.
Test Updates internal/admin/dashboard/static/js/modules/dashboard-display.test.js	Updated init and submitApiKey test expectations to verify that API keys are now restored from and persisted to localStorage under gomodel_api_key, replacing the previous memory-only behavior.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Poem

🐰 A hop and a skip, we found the key,
Now stored in localStorage, safe for all to see!
No more lost secrets when the page does refresh,
Our dashboard remembers with this change so fresh! 🔑✨

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: implementing persistence of the API key across browser sessions using localStorage.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/dashboard-api-key-persistence-pr

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@internal/admin/dashboard/static/js/dashboard.js`:
- Around line 339-342: The code currently persists the admin bearer token to
localStorage in saveApiKey (using API_KEY_STORAGE_KEY and normalizeApiKey) which
is XSS-exfiltrable; change persistence to a safer option and ensure invalid
submissions are cleared: replace localStorage.setItem(...) with
sessionStorage.setItem(...) (or remove client-side storage and rely on an
httpOnly cookie if you opt for server-side auth), add a public "sign out" /
"forget key" handler that calls localStorage.removeItem(API_KEY_STORAGE_KEY) and
clears this.apiKey, and update submitApiKey() to also remove the stored key
(removeItem) when a submission is rejected so a previously persisted token is
not left behind.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: acadc5f3-8bd4-4b03-bc0f-a251a0a27d56

📥 Commits

Reviewing files that changed from the base of the PR and between aa0da4c and 3fbb76a.

📒 Files selected for processing (2)

• internal/admin/dashboard/static/js/dashboard.js
• internal/admin/dashboard/static/js/modules/dashboard-display.test.js