feat(auth): Add key previews to personal API keys

[mishushakov]

Problem

Fixes issue #22360

Changes

• Changes PersonalAPIKey data model
• Adds function to mask keys
• Returns masked value in API
• Displays the masked value in the frontend Settings > Personal API keys:

Does this work well for both Cloud and self-hosted?

Works on self-hosted.

How did you test this code?

Ran in codespaces on localhost.

[mishushakov]

The mask was inspired by OpenAI API keys page, let me know if you want this changed

[Twixes]

Ah @benjackwhite This is not is clear in the code, but the PersonalAPIKey.value field is not used. We no longer store non-hashed values of keys, to prevent a leak of the table's contents from granting any malicious actor access to user accounts. So we do need a migration to facilitate this

[mishushakov]

Hey @benjackwhite, I have updated the migration code 😄

[benjackwhite]

I could imagine some of the tests failing as they check the returned payload so that might be the final thing to get this over the line https://github.com/PostHog/posthog/blob/master/posthog/api/test/test_personal_api_keys.py#L27

[mishushakov]

Have updated the tests as you pointed out, just in case 👍