---
id: w4/m8/t004
title: "Dashboard tests per dashboard/CLAUDE.md conventions + docs cross-links"
worker: worker4
status: done
estimate: 30m
depends_on: [w4/m8/t003]
---

## Objective

Test and document the surface: component/integration tests following the dashboard's existing test conventions (see `dashboard/src/routes/__tests__/`) covering list, revoke-with-confirmation, mint-once-visibility (secret gone after dismiss), and error states; docs cross-links so the feature is discoverable (`docs/ADR006-bex-api.md` dashboard note, `docs/ADR012-auth.md` API-key section pointer).

## Context

- Mock the GraphQL layer the way existing dashboard tests do; assert behavior (secret absent after dismiss), not snapshots.
- Markdown prettier rule applies to doc edits.

## Steps

1. Write the four behavior tests against the api-keys module.
2. Add the doc cross-links; `npx prettier@3.4.2 --write "**/*.md"`.
3. Full dashboard test suite green.

## Files

- `dashboard/src/features/` api-keys tests
- `docs/ADR006-bex-api.md`, `docs/ADR012-auth.md`

## Acceptance criteria

- [x] Tests assert mint-once-visibility, revoke flow, and error states; suite green.
- [x] Docs updated and prettier-clean.

## Out of scope

- E2E browser automation beyond the existing conventions.

## Resolution

17 tests across `src/features/api-keys/{hooks,components}/__tests__/`: `use-api-keys` (list mapping, nulls, no-secret-in-view), `use-create-api-key` (no-cache fetchPolicy, success, mutation error, empty-secret response), `use-revoke-api-key` (success, failure, revoking-state reset), `create-api-key-dialog` (secret shown once, gone after dismiss+reopen, failure keeps the name step, empty-name disabled), `api-key-row` (confirmation gates revoke, cancel, disabled-while-revoking), `api-keys-panel` (list, empty, forbidden, generic error, failed revoke leaves the key listed, successful revoke refetches). Full suite green: `yarn test` — 62 files / 421 tests. Docs cross-links added: `docs/ADR006-bex-api.md`'s API-keys paragraph gets a "Dashboard surface (w4/m8)" note pointing at `dashboard/src/features/api-keys/` and flagging the workspace-shared (not per-user) list; `docs/ADR012-auth.md`'s session-callers paragraph links back to it. `npx prettier@3.4.2 --check "docs/*.md"` clean.
