PR #35457: fix: keep Add API Key modal outside popover lifecycle in authorized flow

• Repository: langgenius/dify
• Author: hjlarry
• State: open | merged: False
• Link: https://github.com/langgenius/dify/pull/35457

Description (problem / solution / changelog)

[!IMPORTANT]

1. Make sure you have read our contribution guidelines
2. Ensure there is an associated issue and you have been assigned to it
3. Use the correct syntax to link this PR: Fixes #<issue number>.

Summary

<!-- Please include a summary of the change and which issue is fixed. Please also include relevant motivation and context. List any dependencies that are required for this change. --> <!-- If this PR was created by an automated agent, add `From <Tool Name>` as the final line of the description. Example: `From Codex`. -->

fix https://github.com/langgenius/dify/issues/35456

Root Cause and Context

During the #35431 , Authorized was migrated from PortalToFollowElem to @langgenius/dify-ui/popover. That migration itself is correct, but it exposed a lifecycle issue in existing modal ownership.

In the authorized flow, the “Add API Key” button is rendered inside the Popover content (Authorized -> Authorize -> AddApiKeyButton). AddApiKeyButton previously owned its own isApiKeyModalOpen state and conditionally rendered ApiKeyModal in its own subtree.

When users clicked inside the modal input, the parent Popover treated that interaction as outside and closed. Once Popover closed, the Popover content subtree unmounted, including AddApiKeyButton, so its local modal state was lost and the modal closed immediately.

Why this happened

The issue is not in AuthForm or modal form logic. It is a UI state ownership problem: a modal with independent lifecycle was mounted under a transient Popover subtree.

Fix

We moved “Add API Key modal” ownership to Authorized (outside Popover content) and changed AddApiKeyButton to support an external open handler. Now, in authorized mode, clicking “Add API” triggers an outer state update, and the modal remains mounted independently of Popover open/close state.

Result

• Clicking/focusing the API key input no longer closes the modal unexpectedly.
• Existing edit modal behavior remains unchanged.
• Related plugin-auth tests pass after the change.

Screenshots

Checklist

• This change requires a documentation update, included: Dify Document
• I understand that this PR may be closed in case there was no previous discussion or issues. (This doesn't apply to typos!)
• I've added a test for each change that was introduced, and I tried as much as possible to make a single atomic change.
• I've updated the documentation accordingly.
• I ran make lint && make type-check (backend) and cd web && pnpm exec vp staged (frontend) to appease the lint gods

Changed files

• web/app/components/plugins/plugin-auth/authorize/add-api-key-button.tsx (modified, +11/-2)
• web/app/components/plugins/plugin-auth/authorize/index.tsx (modified, +4/-1)
• web/app/components/plugins/plugin-auth/authorized/index.tsx (modified, +16/-0)