memodb-io
diff --git a/‎.github/workflows/e2e-test.yaml‎
Lines changed: 36 additions & 9 deletions b/‎.github/workflows/e2e-test.yaml‎
Lines changed: 36 additions & 9 deletions
diff --git a/‎AGENTS.md‎
Lines changed: 2 additions & 1 deletion b/‎AGENTS.md‎
Lines changed: 2 additions & 1 deletion
diff --git a/‎dashboard/.env.example‎
Lines changed: 1 addition & 1 deletion b/‎dashboard/.env.example‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎dashboard/app/project/[id]/api-keys/actions.ts‎
Lines changed: 10 additions & 3 deletions b/‎dashboard/app/project/[id]/api-keys/actions.ts‎
Lines changed: 10 additions & 3 deletions
diff --git a/‎dashboard/app/project/[id]/api-keys/api-keys-page-client.tsx‎
Lines changed: 129 additions & 1 deletion b/‎dashboard/app/project/[id]/api-keys/api-keys-page-client.tsx‎
Lines changed: 129 additions & 1 deletion
diff --git a/‎dashboard/app/project/[id]/settings/general/actions.ts‎
Lines changed: 56 additions & 0 deletions b/‎dashboard/app/project/[id]/settings/general/actions.ts‎
Lines changed: 56 additions & 0 deletions
@@ -32,10 +32,43 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd
 
-      - name: Build Images
+      - name: Build Docker Images (parallel)
         run: |
-          cd src/server
-          docker compose -f docker-compose.test.yml build
+          docker buildx build \
+            --load \
+            --cache-from type=gha,scope=e2e-core \
+            --cache-to type=gha,mode=max,scope=e2e-core \
+            -t acontext-e2e-test-core:latest \
+            ./src/server/core &
+          PID_CORE=$!
+
+          docker buildx build \
+            --load \
+            --cache-from type=gha,scope=e2e-api \
+            --cache-to type=gha,mode=max,scope=e2e-api \
+            -t acontext-e2e-test-api:latest \
+            ./src/server/api/go &
+          PID_API=$!
+
+          docker buildx build \
+            --load \
+            --file ./src/server/api/go/Dockerfile.admin \
+            --cache-from type=gha,scope=e2e-admin \
+            --cache-to type=gha,mode=max,scope=e2e-admin \
+            -t acontext-e2e-test-admin:latest \
+            ./src/server/api/go &
+          PID_ADMIN=$!
+
+          docker buildx build \
+            --load \
+            --cache-from type=gha,scope=e2e-runner \
+            --cache-to type=gha,mode=max,scope=e2e-runner \
+            -t acontext-e2e-test-runner:latest \
+            -f ./src/server/tests/Dockerfile.e2e \
+            ./src/server/tests &
+          PID_RUNNER=$!
+
+          wait $PID_CORE $PID_API $PID_ADMIN $PID_RUNNER
 
       - name: Run E2E Test
         run: |
@@ -47,9 +80,3 @@ jobs:
         run: |
           cd src/server
           docker compose -f docker-compose.test.yml logs
-
-      - name: Teardown
-        if: always()
-        run: |
-          cd src/server
-          docker compose -f docker-compose.test.yml down --timeout 10
 
@@ -98,4 +98,5 @@ All workflows create a GitHub Release with a path-scoped changelog generated by
 ### Update Dashboard and Dashboard OSS at the same time
 - **Dashboard** (`dashboard/`): The hosted/commercial dashboard with authentication (Supabase), organizations, projects, and a mixin-based `AcontextClient`. Routes are scoped under `/project/[id]/...`.
 - **Dashboard OSS** (`src/server/ui/`): The open-source, self-hosted dashboard.
-- When modifying UI features (types, server actions, page components), always apply the equivalent change to both dashboards.
+- When modifying UI features (types, server actions, page components), always apply the equivalent change to both dashboards.
+- **Exception:** Encryption features (encryption settings, API key localStorage, key rotation UI) are commercial-only and do NOT need to be added to Dashboard OSS.
@@ -4,7 +4,7 @@ NEXT_PUBLIC_BASE_PATH=""
 NEXT_PUBLIC_SUPABASE_URL=your-project-url
 NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY=sb_publishable_... or anon key
 
-ACONTEXT_API_BEARER_TOKEN=your-root-api-bearer-token
+ACONTEXT_API_BEARER_TOKEN=AaGyw9Tl9qe4ydDh8qO0xdZNkrobQvwHWFRsnp5a3QtfbaDSDJQeRHxXPr4bGpc0g130EqBSjRNF
 ACONTEXT_PROJECT_BEARER_TOKEN_PREFIX=sk-ac-
 
 NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY=xxx
@@ -59,7 +59,7 @@ export async function getSecretKeyHistory(projectId: string) {
  * Rotate (generate new) secret key for a project
  * Returns the full key for one-time display
  */
-export async function rotateSecretKey(projectId: string) {
+export async function rotateSecretKey(projectId: string, apiKey?: string) {
   // Get current user (will redirect if not authenticated)
   const user = await getCurrentUser();
 
@@ -85,9 +85,16 @@ export async function rotateSecretKey(projectId: string) {
   }
 
   try {
-    // Call API to generate new secret key
+    // When an API key is available, use the Bearer route (preserves master key
+    // for encrypted projects).  Otherwise fall back to the admin route, which
+    // will reject the request server-side if the project has encryption enabled.
     const client = new AcontextClient();
-    const fullSecretKey = await client.updateProjectSecretKey(projectId);
+    let fullSecretKey: string;
+    if (apiKey) {
+      fullSecretKey = await client.rotateProjectSecretKey(apiKey);
+    } else {
+      fullSecretKey = await client.rotateProjectSecretKeyAdmin(projectId);
+    }
 
     if (!fullSecretKey) {
       return { error: "Failed to generate secret key" };
 
@@ -8,6 +8,11 @@ import {
   RefreshCw,
   AlertTriangle,
   KeyRound,
+  Save,
+  Trash2,
+  Eye,
+  EyeOff,
+  Info,
 } from "lucide-react";
 import { toast } from "sonner";
 import { useTopNavStore } from "@/stores/top-nav";
@@ -54,6 +59,7 @@ import {
 import { rotateSecretKey } from "./actions";
 import { Tabs, TabsContent, TabsList, TabsTrigger } from "@/components/ui/tabs";
 import { CodeEditor } from "@/components/code-editor";
+import { useApiKeyStorage } from "@/lib/hooks/use-api-key-storage";
 
 const SERVICE_URL = "api.acontext.app/api/v1";
 
@@ -88,6 +94,11 @@ export function ApiKeysPageClient({
     "python"
   );
 
+  // Saved API key in localStorage
+  const { apiKey: savedApiKey, hasApiKey: hasSavedApiKey, saveApiKey, removeApiKey } = useApiKeyStorage(project.id);
+  const [apiKeyInput, setApiKeyInput] = useState("");
+  const [showSavedKey, setShowSavedKey] = useState(false);
+
   const isOwner = role === "owner";
   const hasExistingKey = keyRotations.length > 0;
   const latestRotation = keyRotations[0] || null;
@@ -153,12 +164,20 @@ console.log(await client.ping());`,
 
   const performKeyGeneration = () => {
     startTransition(async () => {
-      const result = await rotateSecretKey(project.id);
+      const result = await rotateSecretKey(
+        project.id,
+        savedApiKey ?? undefined,
+      );
       if (result.error) {
         toast.error(result.error);
       } else if (result.secretKey) {
         setNewlyGeneratedKey(result.secretKey);
         setShowKeyDialog(true);
+        // Auto-update localStorage if the user had a saved key
+        if (hasSavedApiKey) {
+          saveApiKey(result.secretKey);
+          toast.info("Saved API key in your browser has been updated with the new key.");
+        }
         router.refresh();
         toast.success(
           hasExistingKey
@@ -429,6 +448,115 @@ IMPORTANT: Store this key securely. It will not be shown again.
             </CardContent>
           </Card>
 
+          {/* Saved API Key Card */}
+          <Card>
+            <CardHeader>
+              <CardTitle className="flex items-center gap-2">
+                <Save className="h-5 w-5" />
+                Saved API Key
+              </CardTitle>
+              <CardDescription>
+                Save your API key in your browser for encryption features.
+                Your API key is stored only in your browser and is never sent to our servers.
+              </CardDescription>
+            </CardHeader>
+            <CardContent className="space-y-4">
+              {hasSavedApiKey ? (
+                <div className="space-y-3">
+                  <div className="space-y-2">
+                    <Label>Current Saved Key</Label>
+                    <div className="flex items-center gap-2">
+                      <Input
+                        value={showSavedKey ? (savedApiKey ?? "") : "****************************************"}
+                        readOnly
+                        className="font-mono text-sm"
+                      />
+                      <Button
+                        variant="outline"
+                        size="icon"
+                        onClick={() => setShowSavedKey(!showSavedKey)}
+                        title={showSavedKey ? "Hide key" : "Show key"}
+                      >
+                        {showSavedKey ? (
+                          <EyeOff className="h-4 w-4" />
+                        ) : (
+                          <Eye className="h-4 w-4" />
+                        )}
+                      </Button>
+                      <Button
+                        variant="outline"
+                        size="icon"
+                        onClick={() => {
+                          if (savedApiKey) {
+                            navigator.clipboard.writeText(savedApiKey);
+                            toast.success("Saved API key copied to clipboard");
+                          }
+                        }}
+                        title="Copy saved key"
+                      >
+                        <Copy className="h-4 w-4" />
+                      </Button>
+                      <Button
+                        variant="destructive"
+                        size="icon"
+                        onClick={() => {
+                          removeApiKey();
+                          setShowSavedKey(false);
+                          toast.success("Saved API key removed from browser");
+                        }}
+                        title="Remove saved key"
+                      >
+                        <Trash2 className="h-4 w-4" />
+                      </Button>
+                    </div>
+                  </div>
+                  <Alert>
+                    <Info className="h-4 w-4" />
+                    <AlertDescription>
+                      Your API key is stored only in your browser. It is used for encryption/decryption operations.
+                    </AlertDescription>
+                  </Alert>
+                </div>
+              ) : (
+                <div className="space-y-3">
+                  <div className="space-y-2">
+                    <Label htmlFor="api-key-input">API Key</Label>
+                    <div className="flex items-center gap-2">
+                      <Input
+                        id="api-key-input"
+                        type="password"
+                        value={apiKeyInput}
+                        onChange={(e) => setApiKeyInput(e.target.value)}
+                        placeholder="Paste your API key here"
+                        className="font-mono text-sm"
+                      />
+                      <Button
+                        onClick={() => {
+                          if (apiKeyInput.trim()) {
+                            saveApiKey(apiKeyInput.trim());
+                            setApiKeyInput("");
+                            toast.success("API key saved to browser");
+                          }
+                        }}
+                        disabled={!apiKeyInput.trim()}
+                      >
+                        <Save className="h-4 w-4" />
+                        Save
+                      </Button>
+                    </div>
+                  </div>
+                  <Alert>
+                    <Info className="h-4 w-4" />
+                    <AlertDescription>
+                      Your API key is stored only in your browser. It is used for encryption/decryption operations.
+                      Save your API key here after generating or rotating it.
+                    </AlertDescription>
+                  </Alert>
+                </div>
+              )}
+            </CardContent>
+          </Card>
+
           {/* Key History Card */}
           {hasExistingKey && (
             <Card>
 
@@ -146,6 +146,62 @@ export async function getProjectConfigs(
   }
 }
 
+async function toggleProjectEncryption(
+  projectId: string,
+  apiKey: string,
+  action: "encrypt" | "decrypt"
+): Promise<{ success?: boolean; error?: string }> {
+  try {
+    await getCurrentUser();
+
+    const project = await getProject(projectId);
+    if (!project) {
+      return { error: "Project not found" };
+    }
+
+    const membership = await getOrganizationMembershipForCurrentUser(
+      project.organization_id,
+      "role"
+    );
+    if (!membership) {
+      return { error: "Project not found or access denied" };
+    }
+    if (membership.role !== "owner") {
+      return { error: `Only organization owners can ${action === "encrypt" ? "enable" : "disable"} encryption` };
+    }
+
+    const client = new AcontextClient();
+    if (action === "encrypt") {
+      await client.encryptProject(projectId, apiKey);
+    } else {
+      await client.decryptProject(projectId, apiKey);
+    }
+
+    const encodedProjectId = encodeId(projectId);
+    revalidatePath(`/project/${encodedProjectId}`, "layout");
+
+    return { success: true };
+  } catch (error) {
+    return {
+      error: `Failed to ${action} project: ${error instanceof Error ? error.message : "Unknown error"}`,
+    };
+  }
+}
+
+export async function encryptProjectAction(
+  projectId: string,
+  apiKey: string
+): Promise<{ success?: boolean; error?: string }> {
+  return toggleProjectEncryption(projectId, apiKey, "encrypt");
+}
+
+export async function decryptProjectAction(
+  projectId: string,
+  apiKey: string
+): Promise<{ success?: boolean; error?: string }> {
+  return toggleProjectEncryption(projectId, apiKey, "decrypt");
+}
+
 export async function updateProjectConfigs(
   projectId: string,
   configs: Partial<ProjectConfig>