WIP: feat(tokens): Preferences section "Access tokens" (phase 6d, draft until #1162 RC) #25

2026-10-14T03:10:59Z

KofTwentyTwo commented

2026-10-14 03:10:59 +00:00

(Migrated from github.com)

Self-service access tokens through the core Preferences contract (QRun-IO/qqq#1162). This is DESIGN.md §13, decisions 25 and 29.

The section is access-tokens (label "Access tokens"). It appears in the user menu (withShowInUserMenu) and needs no permission.
It lists the signed-in user's own app passwords, as metadata only.
Actions: Create token (section level), and Rotate, Extend and Revoke (row level, with confirmations).
Every action runs through AuthentikAdmin, so the guardrails, the broker exchange as the user and the audit apply exactly as for the record actions.
The key is returned once as a core OneTimeSecret with usage text. Next renders it in the show-once dialog.

Draft. This builds against the local 4.1.0-PREFS-SNAPSHOT (marked STAND-IN in pom.xml). Switch to the RC that ships #1162, then mark ready. The base is feature/token-management (#24).

Tests: AccessTokenPreferencesTest (8 tests) covers load showing own tokens only, create/rotate/extend/revoke, scoped rotation, refusals (protected user, missing broker, another user's row), and checks that the key is absent from local tables, the audit, reloaded section values, events and logs. ./mvnw -o verify -DskipITs: 253 tests, JaCoCo 91.48%.

🤖 Generated with Claude Code

Self-service access tokens through the core Preferences contract (QRun-IO/qqq#1162). This is DESIGN.md §13, decisions 25 and 29. - The section is `access-tokens` (label "Access tokens"). It appears in the user menu (`withShowInUserMenu`) and needs no permission. - It lists the signed-in user's **own** app passwords, as metadata only. - Actions: *Create token* (section level), and *Rotate*, *Extend* and *Revoke* (row level, with confirmations). - Every action runs through `AuthentikAdmin`, so the guardrails, the broker exchange as the user and the audit apply exactly as for the record actions. - The key is returned once as a core `OneTimeSecret` with usage text. Next renders it in the show-once dialog. **Draft.** This builds against the local `4.1.0-PREFS-SNAPSHOT` (marked STAND-IN in pom.xml). Switch to the RC that ships #1162, then mark ready. The base is `feature/token-management` (#24). Tests: `AccessTokenPreferencesTest` (8 tests) covers load showing own tokens only, create/rotate/extend/revoke, scoped rotation, refusals (protected user, missing broker, another user's row), and checks that the key is absent from local tables, the audit, reloaded section values, events and logs. `./mvnw -o verify -DskipITs`: 253 tests, JaCoCo 91.48%. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

This pull request has changes conflicting with the target branch.

pom.xml
src/main/java/com/kingsrook/qbits/authentik/AuthentikQBitProducer.java

This pull request is marked as a work in progress.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin feature/token-preferences:feature/token-preferences

git checkout feature/token-preferences

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: QRun-IO/qbit-authentik#25