From 3603d0393c1593f8515ea68691e5c4f577f03e9e Mon Sep 17 00:00:00 2001
From: Thomas Camlong <thomas@ajnart.fr>
Date: Mon, 17 Aug 2026 17:18:24 +0200
Subject: [PATCH] fix: uncommitted review fixes

- Document app-modify-all requirement on API endpoints (docs/api)
- Skip implied hint rendering for admin category row
- Fix spotlight apps search group visibility for app-modify-all users
---
 apps/docs/docs/management/api/index.mdx                       | 4 ++++
 .../users/groups/[id]/permissions/_group-permission-form.tsx  | 4 ++++
 packages/spotlight/src/modes/app-integration-board/index.tsx  | 2 +-
 3 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/apps/docs/docs/management/api/index.mdx b/apps/docs/docs/management/api/index.mdx
index 82fde7057..472e472f2 100644
--- a/apps/docs/docs/management/api/index.mdx
+++ b/apps/docs/docs/management/api/index.mdx
@@ -63,6 +63,10 @@ curl -H 'ApiKey: <id>.<token>' http://localhost:7575/api/health/live
 curl -H 'ApiKey: <id>.<token>' http://localhost:7575/api/trpc/app.all
 ```
 
+### App Endpoint Permissions
+
+The app endpoints (`/api/apps/paginated`, `/api/apps`, `/api/apps/search` and the corresponding tRPC procedures and MCP tools) require the `app-modify-all` permission. API keys inherit the permissions of the user who created them, so a key can only list apps when its owner can manage apps. Endpoints that only read app metadata for board placement (`/api/apps/selectable`, `/api/apps/{id}`) remain available to signed-in users without this permission.
+
 ### Use Cases
 
 API key authentication enables programmatic access for:
diff --git a/apps/nextjs/src/app/[locale]/manage/users/groups/[id]/permissions/_group-permission-form.tsx b/apps/nextjs/src/app/[locale]/manage/users/groups/[id]/permissions/_group-permission-form.tsx
index e91ec1d02..1b88e2124 100644
--- a/apps/nextjs/src/app/[locale]/manage/users/groups/[id]/permissions/_group-permission-form.tsx
+++ b/apps/nextjs/src/app/[locale]/manage/users/groups/[id]/permissions/_group-permission-form.tsx
@@ -132,6 +132,10 @@ export const MatrixImpliedHint = ({ category, permissionLabels }: MatrixImpliedH
   const form = useFormContext();
   const tPermissions = useScopedI18n("group.permission");
 
+  if (category === "admin") {
+    return null;
+  }
+
   const level = getMatrixLevel(form.getValues(), category);
   if (level === 0) {
     return null;
diff --git a/packages/spotlight/src/modes/app-integration-board/index.tsx b/packages/spotlight/src/modes/app-integration-board/index.tsx
index 5578bb648..6ce2381fe 100644
--- a/packages/spotlight/src/modes/app-integration-board/index.tsx
+++ b/packages/spotlight/src/modes/app-integration-board/index.tsx
@@ -18,7 +18,7 @@ export const appIntegrationBoardMode = {
     }
 
     return groups.concat(
-      session.user.permissions.includes("board-modify-all")
+      session.user.permissions.includes("app-modify-all") || session.user.permissions.includes("board-modify-all")
         ? [appsSearchGroup, integrationsSearchGroup]
         : [integrationsSearchGroup],
     );