Split MCP and approval agent keys

apps/mcp-server/tests/integration/common.rs

@@ -16,8 +16,9 @@ use axum::{
 use base64::{Engine as _, engine::general_purpose::URL_SAFE_NO_PAD};
 use crank_core::{
     Agent, AgentId, AgentOperationBinding, AgentStatus, AgentVersion, ExecutionConfig, HttpMethod,
-    Operation, OperationId, OperationStatus, PlatformApiKey, PlatformApiKeyId, PlatformApiKeyScope,
-    PlatformApiKeyStatus, Protocol, RestTarget, Target, ToolDescription, WorkspaceId,
+    Operation, OperationId, OperationStatus, PlatformApiKey, PlatformApiKeyId, PlatformApiKeyKind,
+    PlatformApiKeyScope, PlatformApiKeyStatus, Protocol, RestTarget, Target, ToolDescription,
+    WorkspaceId,
 };
 use crank_mapping::{MappingRule, MappingSet};
 use crank_registry::{
@@ -236,17 +237,55 @@ pub(super) async fn create_platform_api_key(
     name: &str,
     scopes: &[PlatformApiKeyScope],
 ) -> String {
-    let secret = format!("crk_{}_{}", name, uuid::Uuid::now_v7().simple());
+    create_platform_api_key_with_kind(
+        registry,
+        agent_slug,
+        name,
+        PlatformApiKeyKind::McpClient,
+        scopes,
+        "crk",
+    )
+    .await
+}
+
+pub(super) async fn create_approval_platform_api_key(
+    registry: &PostgresRegistry,
+    agent_slug: &str,
+    name: &str,
+) -> String {
+    create_platform_api_key_with_kind(
+        registry,
+        agent_slug,
+        name,
+        PlatformApiKeyKind::Approval,
+        &[PlatformApiKeyScope::Approve, PlatformApiKeyScope::Deny],
+        "crk_appr",
+    )
+    .await
+}
+
+async fn create_platform_api_key_with_kind(
+    registry: &PostgresRegistry,
+    agent_slug: &str,
+    name: &str,
+    key_kind: PlatformApiKeyKind,
+    scopes: &[PlatformApiKeyScope],
+    prefix: &str,
+) -> String {
+    let secret = format!("{prefix}_{}_{}", name, uuid::Uuid::now_v7().simple());
     let api_key = PlatformApiKey {
         id: PlatformApiKeyId::new(format!("pk_{name}")),
         workspace_id: test_workspace_id(),
         agent_id: Some(test_agent_id(agent_slug)),
+        key_kind,
         name: name.to_owned(),
         prefix: secret.chars().take(16).collect(),
         scopes: scopes.to_vec(),
         status: PlatformApiKeyStatus::Active,
         created_at: OffsetDateTime::parse("2026-03-26T10:00:00Z", &Rfc3339).unwrap(),
         last_used_at: None,
+        expires_at: None,
+        allowed_origins: Vec::new(),
     };
 
     registry