fix(integrations): fix API key ref handling

Author: bchrobot

src/server/api/external-system.ts

@@ -28,7 +28,11 @@ export const resolvers = {
       "syncedAt"
     ]),
     type: (system: ExternalSystem) => system.type.toUpperCase(),
-    apiKey: async (system: ExternalSystem) => system.api_key_ref,
+    apiKey: async (system: ExternalSystem) => {
+      // Backwards compatibility for API keys added before organization ID was prepended
+      const components = system.api_key_ref.split("|");
+      return components.length === 1 ? components[0] : components[1];
+    },
     lists: async (system: ExternalSystem, { after, first }: RelayPageArgs) => {
       const query = r.reader("external_list").where({ system_id: system.id });
       return formatPage(query, { after, first, primaryColumn: "created_at" });

src/server/api/schema.js

@@ -3167,7 +3167,14 @@ const rootMutations = {
 
       if (!externalSystem.apiKey.includes("*")) {
         const truncatedKey = externalSystem.apiKey.slice(0, 5) + "********";
-        const apiKeyRef = graphileSecretRef(organizationId, truncatedKey);
+        const apiKeyRef = graphileSecretRef(
+          savedSystem.organization_id,
+          truncatedKey
+        );
+        await r
+          .knex("graphile_secrets.secrets")
+          .where({ ref: savedSystem.api_key_ref })
+          .del();
         await getWorker().then(worker =>
           worker.setSecret(apiKeyRef, externalSystem.apiKey)
         );