[Dashboard] Create vault service accounts through api-server (#8918)

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: 0xFirekeeper

apps/dashboard/src/@/actions/vault.ts

@@ -45,6 +45,11 @@ type RotateVaultServiceAccountResult = {
   walletAccessToken?: string;
 };
 
+type CreateVaultServiceAccountResult = RotateVaultServiceAccountResult & {
+  /** The project's default server wallet, null when none was created. */
+  projectWalletAddress: string | null;
+};
+
 /**
  * Credentials the caller supplies to unlock a vault. A managed vault takes the
  * project secret key, an ejected one takes the vault admin key.
@@ -153,6 +158,38 @@ export async function setVaultProjectWallet(params: {
   return res.data.data;
 }
 
+/**
+ * Creates the project's vault service account and its access tokens.
+ *
+ * A managed vault seals its admin key and wallet token with the project secret
+ * key and returns neither. An ejected vault returns both, once.
+ */
+export async function createVaultServiceAccount(params: {
+  project: ProjectRef;
+  mode: "managed" | "ejected";
+  projectSecretKey?: string;
+  skipWalletCreation?: boolean;
+}): Promise<CreateVaultServiceAccountResult> {
+  const res = await apiServerProxy<{
+    data: CreateVaultServiceAccountResult;
+  }>({
+    body: JSON.stringify({
+      mode: params.mode,
+      projectSecretKey: params.projectSecretKey,
+      skipWalletCreation: params.skipWalletCreation,
+    }),
+    headers: { "Content-Type": "application/json" },
+    method: "POST",
+    pathname: vaultPath(params.project, "/service-account"),
+  });
+
+  if (!res.ok) {
+    throw new Error(errorMessage(res.error, "Failed to create vault"));
+  }
+
+  return res.data.data;
+}
+
 export async function rotateVaultServiceAccount(params: {
   project: ProjectRef;
   projectSecretKey?: string;

apps/dashboard/src/@/components/project/create-project-modal/index.tsx

@@ -7,6 +7,7 @@ import { useState } from "react";
 import { useForm } from "react-hook-form";
 import { toast } from "sonner";
 import { z } from "zod";
+import { createVaultServiceAccount } from "@/actions/vault";
 import type { Project } from "@/api/project/projects";
 import { Alert, AlertDescription, AlertTitle } from "@/components/ui/alert";
 import { Button } from "@/components/ui/button";
@@ -38,7 +39,6 @@ import { createProjectClient } from "@/hooks/useApi";
 import { useDashboardRouter } from "@/lib/DashboardRouter";
 import { projectDomainsSchema, projectNameSchema } from "@/schema/validations";
 import { toArrFromList } from "@/utils/string";
-import { createVaultAccountAndAccessToken } from "../../../../app/(app)/team/[team_slug]/[project_slug]/(sidebar)/transactions/lib/vault.client";
 
 const ALL_PROJECT_SERVICES = SERVICES.filter(
   (srv) => srv.name !== "relayer" && srv.name !== "chainsaw",
@@ -64,8 +64,12 @@ const CreateProjectDialog = (props: CreateProjectDialogProps) => {
     <CreateProjectDialogUI
       createProject={async (params) => {
         const res = await createProjectClient(props.teamId, params);
-        const vaultTokens = await createVaultAccountAndAccessToken({
-          project: res.project,
+        await createVaultServiceAccount({
+          mode: "managed",
+          project: {
+            projectId: res.project.id,
+            teamId: res.project.teamId,
+          },
           projectSecretKey: res.secret,
         }).catch((error) => {
           console.error(
@@ -75,12 +79,6 @@ const CreateProjectDialog = (props: CreateProjectDialogProps) => {
           throw error;
         });
 
-        const managementAccessToken = vaultTokens.managementToken?.accessToken;
-
-        if (!managementAccessToken) {
-          throw new Error("Missing management access token for project wallet");
-        }
-
         return {
           project: res.project,
           secret: res.secret,

apps/dashboard/src/app/(app)/get-started/team/[team_slug]/create-project/_components/create-project-form.tsx

@@ -8,6 +8,7 @@ import { useState } from "react";
 import { useForm } from "react-hook-form";
 import { toast } from "sonner";
 import { z } from "zod";
+import { createVaultServiceAccount } from "@/actions/vault";
 import { reportOnboardingCompleted } from "@/analytics/report";
 import type { Project } from "@/api/project/projects";
 import type { CreateProjectPrefillOptions } from "@/components/project/create-project-modal";
@@ -33,7 +34,6 @@ import { createProjectClient } from "@/hooks/useApi";
 import { useDashboardRouter } from "@/lib/DashboardRouter";
 import { projectDomainsSchema, projectNameSchema } from "@/schema/validations";
 import { toArrFromList } from "@/utils/string";
-import { createVaultAccountAndAccessToken } from "../../../../../team/[team_slug]/[project_slug]/(sidebar)/transactions/lib/vault.client";
 
 const ALL_PROJECT_SERVICES = SERVICES.filter(
   (srv) => srv.name !== "relayer" && srv.name !== "chainsaw",
@@ -55,8 +55,12 @@ export function CreateProjectFormOnboarding(props: {
           <CreateProjectForm
             createProject={async (params) => {
               const res = await createProjectClient(props.teamId, params);
-              const vaultTokens = await createVaultAccountAndAccessToken({
-                project: res.project,
+              await createVaultServiceAccount({
+                mode: "managed",
+                project: {
+                  projectId: res.project.id,
+                  teamId: res.project.teamId,
+                },
                 projectSecretKey: res.secret,
               }).catch((error) => {
                 console.error(
@@ -66,15 +70,6 @@ export function CreateProjectFormOnboarding(props: {
                 throw error;
               });
 
-              const managementAccessToken =
-                vaultTokens.managementToken?.accessToken;
-
-              if (!managementAccessToken) {
-                throw new Error(
-                  "Missing management access token for project wallet",
-                );
-              }
-
               return {
                 project: res.project,
                 secret: res.secret,