kw/verdande
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(api): personal API tokens, and let people change their own profile

Browse Source 
docs/api.md has told people to make a token under Settings since it was
written. The store has held CreateAPIToken, ListAPITokens and
DeleteAPIToken since the first migration. There were no routes: nothing
between the two, and no way to make one.

GET, POST and DELETE under /tokens, all behind a new requireSession
middleware. A bearer token is refused there with 403 even though it is
accepted everywhere else — otherwise a leaked token is permanent, because
whoever has it issues a second one and revoking the first changes
nothing. The plaintext comes back from POST and never again; only the
hash is stored, so the interface has to say so at that moment rather than
offering a reveal that cannot work.

PATCH /auth/me alongside it. Name, timezone and language could not be
changed anywhere — not through the API and not through the interface —
and an account created from an invite inherits a default timezone. That
is not cosmetic: every date in the app is resolved in it, so somebody in
another country had every due date land an hour out with no way to say
so. The zone is validated against the running system's database rather
than a list kept here, which is the same database the dates are resolved
with. The email address stays read-only: it identifies the account and is
what invites were sent to.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Kristian Wind
2026-08-17 10:56:33 +02:00
committed by Kristian Wind
co-authored by Claude Opus 5
parent 06ab10a276
commit 68d82a1cb6
6 changed files with 419 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/api.md
+16
View File
@@ -118,6 +118,22 @@ curl -X POST https://todo.example.dk/api/v1/tasks/quick-add \
| `GET` | `/export/projects/{id}.csv` | Todoist-compatible. |
| `GET` | `/export/projects/{id}.ics` | A calendar file. |
### API tokens
| Method | Path | |
|---|---|---|
| `GET` `POST` | `/tokens` | List, or mint one. `name` is required; `expires_in_days` is optional, and `0` means it never expires. |
| `DELETE` | `/tokens/{id}` | Revoked immediately. |
The plaintext token comes back from `POST` and never again — only its hash is
stored. The listing shows a `prefix`, which is enough to tell two of your own
tokens apart.
!!! warning "These three need a signed-in session"
A bearer token is refused here with `403`, even though it is accepted
everywhere else. Otherwise a leaked token would be permanent: whoever had it
could issue a second one, and revoking the first would change nothing.
### Everything else
| Method | Path | |