API Key Management

[MSeal]

Goals

1. Ability to generate a new key for use in template generation
2. Ability to import or replace a full key via a user command (by manual entry into a form)
3. Ability for the extension to track where I am using keys in projects created by the extension
4. Tracked key selection option from template generation menu
5. Labeling of added keys for recalling intended or prior use of key

Non-Goals

1. The extension is not intended to become a source of truth for keys, simply to have keys generated by the tool or added by a user to be tracked for easy resuse
2. Managing their lifecycle externally would be out of scope
3. Extension would be expected to be an provider JIT to applications, simple as a host for placement of keys into new projects at creation time

Background

Copy pasting keys is annoying and error prone. Automating the basic of key management for a project initialization would be convenient and reduce friction for new users. Additionally the tooling being aware of where the key was placed could help with search or AI assistant actions later on. Security risk is low unless the extension were saving the key values outside of it's secured store beyond project expected key locations.

Proposal

Using the SecretStorage API, which uses Electron API ontop of platform specific keystores, record key contents for local machine reuse. Recall those on demand for placement into project templates or file content rotations through VS Code commands. Template generation would need to tag key variables and create a new UX for key selection when keys are available and present to store. Additionally we'd want to enable a key generation request pattern for CCloud keys from a logged in user session to be directly stored in this new system via another command implementation.

Given the use of the VS Code store system, we'd likely not want to use the sidecar APIs for storage or recall.

[derek1ee]

I would also like us to consider the ability to generate additional configs for existing project.

• As someone who's writing a client app, one should be able to generate a project and point it to the local Kafka for the initial test.
• Then, they should be able to generate a new config (or configs, for different environments) pointing to CCloud to test it further, without having to generate a brand new project.
• Initially, I may have to manually update the code to switch between using different configs.
• In the future, as we invest more in devops support, we may have better support in this regards.