adevwithpurpose 2b4720fa98 fix(dashboard): media playground cards stop sending masked API key as Bearer ...

The 9 media *ExampleCard components under media-providers/components used
the masked value from useApiKey() (sk-xxxx****yyyy) as an Authorization:
Bearer header, which the gateway always rejects (AUTH_002) once
REQUIRE_API_KEY is enabled. Mirror the LlmChatCard fix (#3503): authenticate
via the dashboard session (credentials: "same-origin") and forward the
selected key's id via x-omniroute-playground-key-id instead of its secret.
buildCurl now keeps the <your-api-key> placeholder instead of the masked
value.

Adds tests/unit/bug-9935-masked-bearer.test.ts as the permanent regression
guard (asserts none of the 9 cards embed apiKey as a raw Bearer token).

Refs #9935

2026-08-15 02:33:57 -03:00

..

_helpers

…

_setup

…

benchmarks

…

boundary

…

e2e

feat(providers): integrate audited free-tier gateways (#9210)

2026-08-12 16:19:25 -03:00

fixtures

fix(radar): refresh entitlement-sensitive state (#9776)

2026-08-10 20:10:12 -03:00

golden-set

…

helpers

…

homolog

…

integration

feat(codex): add OAuth fingerprint convergence modes (#10243)

2026-08-14 00:57:23 -03:00

live

…

llm-security

…

load

…

manual

…

security

…

snapshots

refactor(providers): remove the Puter provider at its owner's request (#10210)

2026-08-12 16:54:50 -03:00

translator

…

unit

fix(dashboard): media playground cards stop sending masked API key as Bearer

2026-08-15 02:33:57 -03:00

_cp_mock_hook.mts

…

_cp_mock_module.mts

…

_run_dns_guard_test.sh

…

e2e-tool-calls.sh

…

theoldllm-stress.test.ts

…