test(cli): use new api keys in live e2e (#7459)

## TL;DR

fixes live e2e setup on projects with legacy api keys disabled by
picking the publishable and secret keys the same way the cli does

## ref

- spotted in the last 9 runs:
https://github.com/supabase/cli/actions/workflows/live-e2e.yml
- fixed now (tested):
https://github.com/supabase/cli/actions/runs/41609496013

Author: 7ttp

apps/cli/tests/helpers/live-project.integration.test.ts

@@ -7,7 +7,7 @@ import * as HttpClientResponse from "effect/http/HttpClientResponse";
 import { afterEach, describe, expect, it, vi } from "vitest";
 
 import { cliConfigProviderLayer } from "../../src/shared/config/cli-config-provider.layer.ts";
-import { provisionLiveEnvironment } from "./live-project.ts";
+import { cleanupLiveEnvironment, provisionLiveEnvironment } from "./live-project.ts";
 
 const ref = "abcdefghijklmnopqrst";
 function jsonResponse(
@@ -137,4 +137,111 @@ describe("live project provisioning", () => {
       ),
     );
   });
+
+  it("provisions with the new API keys when the project's legacy keys are disabled", () => {
+    vi.stubEnv("SUPABASE_LIVE_API_URL", "https://api.supabase.green");
+    vi.stubEnv("SUPABASE_ACCESS_TOKEN", "test-token");
+    vi.stubEnv("SUPABASE_LIVE_ORG_ID", "org-slug");
+    vi.stubEnv("SUPABASE_LIVE_REGION", "us-east-1");
+    vi.stubEnv("SUPABASE_LIVE_KEEP_PROJECT", "0");
+
+    const bucketApiKeys: Array<string | undefined> = [];
+    const ownedProjects = new Set<string>();
+    const platformApi = Layer.succeed(
+      HttpClient.HttpClient,
+      HttpClient.make((request) => {
+        const url = new URL(request.url);
+        if (request.method === "GET" && url.pathname === "/v1/organizations") {
+          return Effect.succeed(
+            jsonResponse(request, 200, [{ id: "org-id", slug: "org-slug", name: "Test" }]),
+          );
+        }
+        if (request.method === "POST" && url.pathname === "/v1/projects") {
+          ownedProjects.add(ref);
+          return Effect.succeed(jsonResponse(request, 201, { ...project, database: undefined }));
+        }
+        if (request.method === "GET" && url.pathname === `/v1/projects/${ref}`) {
+          return Effect.succeed(jsonResponse(request, 200, project));
+        }
+        if (request.method === "GET" && url.pathname === `/v1/projects/${ref}/api-keys`) {
+          return Effect.succeed(
+            jsonResponse(request, 200, [
+              { name: "anon", type: "legacy", api_key: "legacy-anon-jwt" },
+              { name: "service_role", type: "legacy", api_key: "legacy-service-role-jwt" },
+              { name: "default", type: "publishable", api_key: "sb_publishable_live" },
+              {
+                name: "default",
+                type: "secret",
+                api_key: "sb_secret_live",
+                secret_jwt_template: { role: "service_role" },
+              },
+            ]),
+          );
+        }
+        if (
+          request.method === "GET" &&
+          url.pathname === `/v1/projects/${ref}/config/database/pooler`
+        ) {
+          return Effect.succeed(
+            jsonResponse(request, 200, [
+              {
+                identifier: "primary",
+                database_type: "PRIMARY",
+                is_using_scram_auth: false,
+                db_user: `postgres.${ref}`,
+                db_host: "aws-0-us-east-1.pooler.supabase.green",
+                db_port: 6543,
+                db_name: "postgres",
+                connection_string: `postgresql://postgres.${ref}:[YOUR-PASSWORD]@aws-0-us-east-1.pooler.supabase.green:6543/postgres`,
+                connectionString: "",
+                default_pool_size: null,
+                max_client_conn: null,
+                pool_mode: "transaction",
+              },
+            ]),
+          );
+        }
+        if (
+          request.method === "POST" &&
+          url.href === `https://${ref}.supabase.green/storage/v1/bucket`
+        ) {
+          const apiKey = request.headers["apikey"];
+          bucketApiKeys.push(apiKey);
+          return Effect.succeed(
+            apiKey === "sb_secret_live"
+              ? jsonResponse(request, 200, { name: "supabase-cli-live-bucket" })
+              : jsonResponse(request, 401, { message: "Legacy API keys are disabled" }),
+          );
+        }
+        if (request.method === "DELETE" && url.pathname === `/v1/projects/${ref}`) {
+          ownedProjects.delete(ref);
+          return Effect.succeed(jsonResponse(request, 200, { id: 1, ref, name: "live-test" }));
+        }
+        return Effect.die(`unexpected request ${request.method} ${url.href}`);
+      }),
+    );
+
+    return Effect.runPromise(
+      Effect.gen(function* () {
+        const client = yield* makeApiClient({
+          baseUrl: "https://api.supabase.green",
+          accessToken: "test-token",
+        });
+
+        const environment = yield* provisionLiveEnvironment(client);
+        yield* cleanupLiveEnvironment(client, environment);
+
+        expect(environment.project).toMatchObject({
+          anonKey: "sb_publishable_live",
+          serviceRoleKey: "sb_secret_live",
+        });
+        expect(bucketApiKeys).toEqual(["sb_secret_live"]);
+        expect(ownedProjects).toEqual(new Set());
+      }).pipe(
+        Effect.provide(
+          Layer.mergeAll(platformApi, BunFileSystem.layer, BunPath.layer, cliConfigProviderLayer),
+        ),
+      ),
+    );
+  });
 });

apps/cli/tests/helpers/live-project.ts

@@ -19,6 +19,8 @@ import * as HttpClientError from "effect/http/HttpClientError";
 import * as HttpClientRequest from "effect/http/HttpClientRequest";
 import { getDomain } from "tldts";
 
+import { kongAuthHeaders } from "../../src/command-internal/kong-auth.ts";
+import { extractServiceKeys } from "../../src/command-internal/tenant-keys.ts";
 import {
   deriveLiveProjectHost,
   keepLiveProject,
@@ -37,7 +39,6 @@ const POLL_TIMEOUT = "5 minutes";
 
 type Project = OperationOutput<"v1GetProject">;
 type Organization = OperationOutput<"v1ListAllOrganizations">[number];
-type ApiKey = OperationOutput<"v1GetProjectApiKeys">[number];
 export type PoolerConfig = OperationOutput<"v1GetPoolerConfig">[number];
 type LiveApi = Effect.Success<ReturnType<typeof makeApiClient>>;
 type Region =
@@ -386,18 +387,12 @@ function keysReadiness(
   return api.v1.getProjectApiKeys({ ref, reveal: true }).pipe(
     Effect.mapError((cause) => classifyPollError("project API keys", cause)),
     Effect.flatMap((keys) => {
-      const keyValue = (key: ApiKey): string | undefined => key.api_key ?? undefined;
-      const anonKey = keys.find((key) => key.name === "anon");
-      const serviceRoleKey =
-        keys.find((key) => key.name === "service_role") ??
-        keys.find((key) => key.api_key?.startsWith("sb_secret_"));
-      const anon = anonKey === undefined ? undefined : keyValue(anonKey);
-      const service = serviceRoleKey === undefined ? undefined : keyValue(serviceRoleKey);
-      return anon === undefined || service === undefined
+      const { anon, serviceRole } = extractServiceKeys(keys);
+      return anon === "" || serviceRole === ""
         ? Effect.fail(
             new LiveTransientPoll({ phase: "project API keys", cause: "keys incomplete" }),
           )
-        : Effect.succeed({ anonKey: anon, serviceRoleKey: service });
+        : Effect.succeed({ anonKey: anon, serviceRoleKey: serviceRole });
     }),
   );
 }
@@ -495,7 +490,7 @@ function createStorageBucket(
         `https://${ref}.${host}/storage/v1/bucket`,
       ).pipe(
         HttpClientRequest.setHeaders({
-          Authorization: `Bearer ${serviceRoleKey}`,
+          ...kongAuthHeaders(serviceRoleKey),
           "Content-Type": "application/json",
         }),
         HttpClientRequest.bodyJson({ id: bucket, name: bucket, public: false }),