refactor(coderd/apikey): say clone with slices.Clone and fix a comment

The test cloned params.Scopes with the pre-1.21 append idiom; the repo already uses slices.Clone in 59 other places, and it names the operation instead of leaving the reader to recognize it. The comment above the canonicalization loop said Generate leaves params as the caller passed it, which is not true: it also assigns ExpiresAt, LifetimeSeconds and AllowList on its local copy. State the property that actually matters, which is that params.Scopes shares a backing array with the caller, so canonicalizing in place would rewrite the caller's slice.
BobbyHo · Aug 26, 2026 · Aug 19, 2026 · Aug 24, 2026 · Aug 24, 2026 · Aug 24, 2026
commit 5add97a5af420c68eddecd1e6a432ef151eddd44
diff --git a/coderd/apikey/apikey.go b/coderd/apikey/apikey.go
@@ -96,9 +96,9 @@ func Generate(params CreateParams) (database.InsertAPIKeyParams, string, error)
 	}
 
 	// Callers may pass an alias spelling such as "all", which is not an
-	// api_key_scope enum member and so would fail the validity check. Build a new
-	// slice rather than canonicalizing in place, so params is left as the caller
-	// passed it.
+	// api_key_scope enum member and so would fail the validity check.
+	// params.Scopes shares its backing array with the caller, so canonicalize
+	// into a new slice rather than in place.
 	scopes := make(database.APIKeyScopes, 0, len(requested))
 	for _, s := range requested {
 		canonical := database.APIKeyScope(rbac.CanonicalScopeName(rbac.ScopeName(s)))

diff --git a/coderd/apikey/apikey_test.go b/coderd/apikey/apikey_test.go
@@ -1,6 +1,7 @@
 package apikey_test
 
 import (
+	"slices"
 	"strings"
 	"testing"
 	"time"
@@ -227,7 +228,7 @@ func TestGenerateScopeNames(t *testing.T) {
 			params.LoginType = database.LoginTypePassword
 			params.DefaultLifetime = time.Hour
 
-			requested := append(database.APIKeyScopes(nil), params.Scopes...)
+			requested := slices.Clone(params.Scopes)
 
 			key, _, err := apikey.Generate(params)
 			if tc.fail {