Part of #525. From the BYOK security audit.
Zero tests reference AiReviewSettings / MaintainerPanel (apps/gittensory-ui has no test runner). The write-only key flow, the 'key is never rendered' invariant, the configured/last4 status, save/replace/remove transitions, and the maintainer-only role gate are untested at the UI layer.
Fix: add vitest + @testing-library/react + jsdom to the UI workspace; test (1) MaintainerPanel renders the 'Maintainer access required' state for a non-maintainer session and the dashboard for a maintainer; (2) AiReviewSettings key input is type=password and never receives the stored key back; saveKey posts then clears + shows last4; provider/key mismatch shows an inline error; Remove only appears when configured.
Severity: medium.
Part of #525. From the BYOK security audit.
Zero tests reference
AiReviewSettings/MaintainerPanel(apps/gittensory-ui has no test runner). The write-only key flow, the 'key is never rendered' invariant, the configured/last4 status, save/replace/remove transitions, and the maintainer-only role gate are untested at the UI layer.Fix: add vitest + @testing-library/react + jsdom to the UI workspace; test (1) MaintainerPanel renders the 'Maintainer access required' state for a non-maintainer session and the dashboard for a maintainer; (2) AiReviewSettings key input is type=password and never receives the stored key back; saveKey posts then clears + shows last4; provider/key mismatch shows an inline error; Remove only appears when configured.
Severity: medium.