[Dashboard] Guard the vault rotation dialog against losing new keys by 0xFirekeeper · Pull Request #8921 · thirdweb-dev/js

0xFirekeeper · 2026-08-27T03:50:57Z

Rotating an ejected vault returns its new admin key and wallet access token in the response and keeps no server-side copy, so the dialog is the only place those values ever exist. Two paths in the dialog could drop them.

Changes

Hold the dialog open while the rotation request is in flight and while unconfirmed keys are on screen. Escape, backdrop click and the close button are all blocked for both states. The previous guard derived from useMutation.data, which is undefined until the response lands, so it did nothing during the request — and dismissing there calls mutation.reset() without aborting the POST, discarding a response the server has already committed.
Warn on unload in those same two states.
Branch the result on data.isManagedVault instead of on which credential fields came back. Managed keeps the masked-key panel; ejected always renders both credentials with the existing download and confirmation gate.
An ejected response missing either credential now renders an explicit error state — the rotation succeeded, the values cannot be shown again, contact support — instead of falling through to the managed "re-encrypted, your backend keeps working" success panel, which is untrue for an ejected vault.
Copy: note in the eject warning that the keys are shown once.

No API or contract change; the server response shape is unchanged.

Verification

npx tsc --noEmit from apps/dashboard — exit 0
eslint on the changed file — exit 0
biome check on the changed file — only the repo-wide CRLF format complaint this checkout produces on untouched files too; an LF-normalized copy checks clean

PR-Codex overview

This PR enhances the RotateAdminKeyButton component by adding new state variables and improving the handling of key rotation responses, including better user prompts for storing keys and handling cases where keys are not returned.

Detailed summary

Added adminKeyCopied and accessTokenCopied state variables.
Improved handling of rotateAdminKeyMutation response.
Updated logic to manage the modal's closing conditions.
Modified download functionality to use new key variables.
Enhanced user feedback for missing keys and managed vaults.
Added warnings for users to keep the dialog open until keys are stored.

✨ Ask PR-Codex anything about this PR by commenting with /codex {your question}

Summary by CodeRabbit

New Features
- Added clearer handling for ejected-vault admin key rotations.
- Ejected credentials can now be viewed and downloaded securely.
- Users are warned before closing the dialog or browser while credentials remain unconfirmed.
- Added guidance when rotated credentials cannot be recovered, including an optional masked key for support.
Bug Fixes
- Managed-vault rotations continue to display only the masked admin key.
- Prevented accidental dismissal during pending rotations or while ejected credentials remain unconfirmed.

Rotation returns an ejected vault's admin key and wallet access token once and keeps no copy. - Make the dialog non-dismissable while the request is in flight and while unconfirmed keys are on screen. The old guard derived from mutation data, so it did nothing during the request. - Warn on unload in those same two states. - Branch the result on isManagedVault rather than on which fields came back. An ejected response missing either credential now renders an explicit error state instead of the managed success panel. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

changeset-bot · 2026-08-27T03:51:01Z

⚠️ No Changeset found

Latest commit: d771fc7

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

vercel · 2026-08-27T03:51:03Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
thirdweb-www	Ready	Preview	Aug 27, 2026 4:15am

4 Skipped Deployments

Project	Deployment	Updated (UTC)
docs-v2	Skipped	Aug 27, 2026 4:15am
nebula	Skipped	Aug 27, 2026 4:15am
thirdweb_playground	Skipped	Aug 27, 2026 4:15am
wallet-ui	Skipped	Aug 27, 2026 4:15am

coderabbitai · 2026-08-27T03:53:35Z

Warning

Review limit reached

Run on-demand review

_{On-demand reviews are free for the next 25 days. After that, they cost $0.25 per reviewed file.}

Or wait 3 minutes for your next included review.

View limit details

Limit details: You’ve used all 3 included reviews currently available. Your 43 included PR review attempts over the past 7 days set your current allowance at 3 reviews per hour.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 69d05863-4b73-4b1e-b258-7842583098dc

📥 Commits

Reviewing files that changed from the base of the PR and between af35c67 and d771fc7.

📒 Files selected for processing (1)

apps/dashboard/src/app/(app)/team/[team_slug]/[project_slug]/(sidebar)/vault/components/rotate-admin-key.client.tsx

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 72188295-1c48-4431-8bdf-d41664869c0c

📥 Commits

Reviewing files that changed from the base of the PR and between 04d8c12 and af35c67.

📒 Files selected for processing (1)

apps/dashboard/src/app/(app)/team/[team_slug]/[project_slug]/(sidebar)/vault/components/rotate-admin-key.client.tsx

Included review availability: 1 review is currently available. Your included PR review attempts over the past 7 days set your current allowance at 3 reviews per hour.

Walkthrough

The rotation dialog now distinguishes ejected-vault credentials from managed-vault responses. It protects pending and unconfirmed ejected credentials from dialog or browser closure, and reports when rotated credentials cannot be recovered.

Changes

Vault rotation handling

Layer / File(s)	Summary
Classify rotation results and credential actions `apps/dashboard/src/app/(app)/team/[team_slug]/[project_slug]/(sidebar)/vault/components/rotate-admin-key.client.tsx`	The component extracts ejected-vault credentials explicitly, uses them for display and download actions, and keeps managed-vault output masked.
Protect pending and unconfirmed credentials `apps/dashboard/src/app/(app)/team/[team_slug]/[project_slug]/(sidebar)/vault/components/rotate-admin-key.client.tsx`	Dialog dismissal, escape, backdrop interaction, pointer-outside interaction, and browser unload remain blocked while rotation is pending or credentials are unconfirmed.
Render rotation completion and recovery states `apps/dashboard/src/app/(app)/team/[team_slug]/[project_slug]/(sidebar)/vault/components/rotate-admin-key.client.tsx`	The dialog displays returned ejected credentials, shows managed-vault masked keys, and reports unrecoverable ejected rotations without credentials.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to af35c

The dialog now keeps newly returned credentials protected during rotation and confirmation, with explicit handling for missing values; no actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the Dashboard change and explains that the vault rotation dialog prevents loss of new keys.
Description check	✅ Passed	The description explains the problem, lists the implemented changes, states that the API contract is unchanged, and records verification results. It does not use the template headings exactly, but it …
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description explains the problem, lists the implemented changes, states that the API contract is unchanged, and records verification results. It does not use the template headings exactly, but it provides the required information.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch dashboard/vault-rotation-dialog-guard

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-08-27T03:57:20Z

size-limit report 📦

Path	Size
@thirdweb-dev/nexus (esm)	105.66 KB (0%)
@thirdweb-dev/nexus (cjs)	319.47 KB (0%)

Closing the dialog discards the response, and for an ejected vault that response is the only copy of the new keys. Blocking Escape, the backdrop and the close control left the confirm checkbox as the only way out, so an impatient click could still drop them. The checkbox is now disabled until the keys have actually left the screen: either downloaded, or both values copied. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

0xFirekeeper requested review from a team as code owners August 27, 2026 03:50

github-actions Bot assigned 0xFirekeeper Aug 27, 2026

github-actions Bot added the Dashboard Involves changes to the Dashboard. label Aug 27, 2026

vercel Bot deployed to Preview – thirdweb-www August 27, 2026 03:58 View deployment

vercel Bot temporarily deployed to Preview – wallet-ui August 27, 2026 04:09 Inactive

vercel Bot temporarily deployed to Preview – nebula August 27, 2026 04:09 Inactive

vercel Bot temporarily deployed to Preview – thirdweb_playground August 27, 2026 04:09 Inactive

vercel Bot temporarily deployed to Preview – docs-v2 August 27, 2026 04:09 Inactive

0xFirekeeper merged commit 4f53d4a into main Aug 27, 2026
17 of 20 checks passed

0xFirekeeper deleted the dashboard/vault-rotation-dialog-guard branch August 27, 2026 04:10

vercel Bot deployed to Preview – thirdweb-www August 27, 2026 04:15 View deployment

Navigation Menu

Uh oh!

[Dashboard] Guard the vault rotation dialog against losing new keys - #8921

[Dashboard] Guard the vault rotation dialog against losing new keys#8921
0xFirekeeper merged 2 commits into
mainfrom
dashboard/vault-rotation-dialog-guard

0xFirekeeper commented Aug 27, 2026 •

edited by pr-codex Bot

Loading

Uh oh!

changeset-bot Bot commented Aug 27, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Aug 27, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Aug 27, 2026 •

edited

Loading

Review limit reached

❌ Failed checks (1 warning)

Uh oh!

github-actions Bot commented Aug 27, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

0xFirekeeper commented Aug 27, 2026 • edited by pr-codex Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Verification

PR-Codex overview

Detailed summary

Summary by CodeRabbit

Uh oh!

changeset-bot Bot commented Aug 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

vercel Bot commented Aug 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Aug 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

github-actions Bot commented Aug 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

size-limit report 📦

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

0xFirekeeper commented Aug 27, 2026 •

edited by pr-codex Bot

Loading

changeset-bot Bot commented Aug 27, 2026 •

edited

Loading

vercel Bot commented Aug 27, 2026 •

edited

Loading

coderabbitai Bot commented Aug 27, 2026 •

edited

Loading

github-actions Bot commented Aug 27, 2026 •

edited

Loading