feat: personal API tokens

Browse Source

Tokens for scripts, made, listed and revoked on the account page. Each grants some of the person's own permissions
at chosen places (a product of theirs, a catalog whose team they're on, or the hub for moderators); every check is
the intersection with what they hold now. Tokens work only on routes that check a permission (session-only routes
answer token_not_allowed), are shown once and stored as hashes, note their last use, and mark the audit entries of
what they do.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

...

This commit is contained in:

dhkatzandClaude Opus 5.5 committed 2026-11-05 14:58:58 -08:00

1 parent 58a3e70a63

commit 2b88a52bcb

17 files changed

+4358 -98

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

packages/db/drizzle/meta/0014_snapshot.json

+3500

File diff suppressed because it is too large. Load diff