Add API token generation to the account settings page - #451
Open
l3x4 wants to merge 3 commits into
Open
Conversation
Users previously needed Rails console access to obtain an API token (issue #450). The account page now shows whether a token exists and offers a generate/regenerate button posting to a new session- authenticated Users::ApiTokensController. The plaintext token is rendered exactly once via an ivar into the registrations edit view (422 status so Turbo accepts the render) and is never placed in flash, params, or session — only its SHA256 digest is persisted. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Covers the auth redirect for unauthenticated posts, the one-time token display (exactly once, with warning copy), digest rotation invalidating the previous token, and that a plain visit to the account page never reveals a token. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Rendering the edit view with :unprocessable_entity was a workaround for Turbo's form-response contract (non-redirect HTML needs a 4xx), which mislabels a successful generation as a client error. The token section now lives in a partial and the controller replaces it via turbo_stream with an honest 200; the plaintext token still exists only in this single response. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Author
|
Reworked the success response after review feedback: the original Comment generated by Claude. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #450
What
An API token section on the account page (
/users/edit):api_token_digest?— nothing derived from the digest is ever displayed).turbo_confirmwarning that the old token stops working — POSTs to a new session-authenticatedUsers::ApiTokensController#create, which calls the existingUser#regenerate_api_token!.Authorization: Bearer <token>against/api/v1/.Security notes
@api_tokenivar) — it is never placed in the flash, session, cookies, params, or logs, and never persisted beyond its digest.AuthenticatedController) and authorized (UserPolicy#regenerate_token?).PATCH /api/v1/api_tokenuntouched.Tests
255 runs, 0 failures, 0 errors(full suite). New coverage: unauthenticated POST rejected; authenticated POST rotates the digest and shows the one-time token exactly once with the warning copy; regeneration invalidates the previous token; the edit page never displays a token on a plain visit. Locales added in bothenandnb. Rubocop clean.PR generated by Claude on behalf of @l3x4.