A read-scoped project key, so a Stacks dashboard can read logs without a person's credentials

app/Models/Project.tsmodified+6-0

Changes to app/Models/Project.ts

		⋯26 linesShow the 26 lines above this hunk@@ -27,6 +27,12 @@ export default defineModel({
27	27	// Public ingest key: the SDK sends it as `X-LogHQ-Key` so reports can only
28	28	// be written to a project that presents its key (revocable, not a secret).
29	29	ingest_key: { fillable: true, validation: { rule: schema.string().optional() }, factory: () => globalThis.crypto.randomUUID().replace(/-/g, '') },
	30	+ // Secret read key: a machine presents it as `Authorization: Bearer` to read
	31	+ // this project without a person's credentials (#14). Not fillable and with
	32	+ // no factory — it is issued on demand from project settings, and revoking
	33	+ // it is setting it back to null. See app/Support/read-key.ts.
	34	+ read_key: { fillable: false, validation: { rule: schema.string().optional() } },
	35	+ read_key_last_used_at: { fillable: false, validation: { rule: schema.string().optional() } },
30	36	owner_id: { fillable: true, validation: { rule: schema.number().optional() } },
31	37	is_active: { fillable: true, validation: { rule: schema.boolean().optional() }, factory: () => true },
32	38	},