fix(access): 修正 API Key 可分配模型范围

apps/web/src/api.test.ts

@@ -10,6 +10,7 @@ import {
   getCurrentUser,
   getOpsManagementSkillMetadata,
   loginLocalAccount,
+  listApiKeyAssignableModels,
   OIDC_BROWSER_SESSION_CREDENTIAL,
   startIdentityPairing,
   retireIdentityPairingSecurityEventConflict,
@@ -231,6 +232,26 @@ describe('OIDC browser session transport', () => {
   });
 });
 
+describe('API Key permission resources', () => {
+  afterEach(() => {
+    vi.unstubAllGlobals();
+  });
+
+  it('loads the user-owned resource pool independently from playable models', async () => {
+    const fetchMock = vi.fn().mockResolvedValue(new Response(JSON.stringify({ items: [] }), {
+      status: 200,
+      headers: { 'Content-Type': 'application/json' },
+    }));
+    vi.stubGlobal('fetch', fetchMock);
+
+    await listApiKeyAssignableModels('user-token');
+
+    const [url, init] = fetchMock.mock.calls[0] as [string, RequestInit];
+    expect(url).toContain('/api/v1/api-keys/assignable-models');
+    expect(new Headers(init.headers).get('Authorization')).toBe('Bearer user-token');
+  });
+});
+
 describe('Public Agent resources', () => {
   afterEach(() => {
     vi.unstubAllGlobals();