fix(auth): deploy auth config with workspace keys

[yoavf]

Note

Description

When deploying with a workspace API key (BASE44_API_KEY), the auth config was being pushed through the generic app-update endpoint (PUT api/apps/:id), which workspace keys are not authorized to use. This PR routes auth-config pushes through the dedicated deployment endpoint (PUT api/apps/:id/deployment/auth-configuration) whenever workspace API key auth is in effect, so auth config deploys correctly in CI/automation contexts.

Related Issue

None

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Refactoring (no functional changes)
• Other (please describe):

Changes Made

• pushAuthConfigToApi now checks hasWorkspaceApiKeyAuth() and, when true, sends the auth-config payload to the deployment/auth-configuration endpoint instead of the generic api/apps/:id update route.
• Extracted the payload transform into a single payload variable reused across both code paths.
• Preserved existing behavior (generic app-update endpoint with { auth_config: ... }) for non-workspace-key auth.
• Added an integration test verifying that with a workspace API key the auth config goes through the deployment endpoint (with the api_key header), the payload is snake_cased and not wrapped in auth_config, and the generic app-update route is never called.

Testing

• I have tested these changes locally
• I have added/updated tests as needed
• All tests pass (`npm test`)

Checklist

• My code follows the project's style guidelines
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation (if applicable)
• My changes generate no new warnings
• I have updated `docs/` (AGENTS.md) if I made architectural changes

Additional Notes

The workspace-key path returns the original config object (not the API response) since the deployment endpoint returns a lightweight status payload rather than the full auth config. Error handling mirrors the existing path via `ApiError.fromHttpError`.

---

_{🤖 Generated by Claude | 2026-07-13 08:06 UTC | 21ee30e}

[github-actions]

🚀 Package Preview Available!

---

Install this PR's preview build with npm:

npm i @base44-preview/cli@0.1.3-pr.565.21ee30e

Prefer not to change any import paths? Install using npm alias so your code still imports base44:

npm i "base44@npm:@base44-preview/cli@0.1.3-pr.565.21ee30e"

Or add it to your package.json dependencies:

{
  "dependencies": {
    "base44": "npm:@base44-preview/cli@0.1.3-pr.565.21ee30e"
  }
}

• 📦 Preview Package: @base44-preview/cli@0.1.3-pr.565.21ee30e
• 🔗 View this commit on GitHub

---

_{Preview published to npm registry — try new features instantly!}