Personal access token management UI: create, list, revoke #38

Open
opened 2026-07-20 23:15:32 +02:00 by Sirttas · 0 comments
Owner

Summary

Frontend UI for managing the generic personal access tokens backed by mammon #80. Lets a logged-in user mint a token, copy the one-time secret, see their existing tokens (metadata only), and revoke them. Tokens are general-purpose (usable for MCP and any other programmatic access), not MCP-specific.

Scope

  • A settings/account view listing the user's personal access tokens (label, created, last-used?, expiry) via the generated mammon client.
  • Create flow: prompt for a label (+ optional expiry), then surface the raw secret exactly once with a copy control and a clear "you won't see this again" warning.
  • Revoke action per token with confirmation.
  • Wire through the existing auth/session store; no direct ESI calls.

Explicitly out of scope

  • Backend token store and endpoints (mammon #80).
  • /mcp authentication (mammon #81).

Acceptance criteria

  • User can create a token and copy the secret once; it is not retrievable afterward.
  • User can list and revoke their tokens; the secret is never displayed in the list.
  • UI uses the regenerated mammon client (no hand-rolled endpoints).
  • Test coverage per project conventions.

Related

Depends on mammon #80 (endpoints + regenerated OpenAPI client). Related consumer: mammon #81 (/mcp auth).

## Summary Frontend UI for managing the generic personal access tokens backed by `mammon #80`. Lets a logged-in user mint a token, copy the one-time secret, see their existing tokens (metadata only), and revoke them. Tokens are general-purpose (usable for MCP and any other programmatic access), not MCP-specific. ## Scope - A settings/account view listing the user's personal access tokens (label, created, last-used?, expiry) via the generated mammon client. - Create flow: prompt for a label (+ optional expiry), then surface the raw secret exactly once with a copy control and a clear "you won't see this again" warning. - Revoke action per token with confirmation. - Wire through the existing auth/session store; no direct ESI calls. ## Explicitly out of scope - Backend token store and endpoints (`mammon #80`). - `/mcp` authentication (`mammon #81`). ## Acceptance criteria - [ ] User can create a token and copy the secret once; it is not retrievable afterward. - [ ] User can list and revoke their tokens; the secret is never displayed in the list. - [ ] UI uses the regenerated mammon client (no hand-rolled endpoints). - [ ] Test coverage per project conventions. ## Related Depends on `mammon #80` (endpoints + regenerated OpenAPI client). Related consumer: `mammon #81` (`/mcp` auth).
Sirttas added the Kind/Feature
Priority
Medium
3
Status
To Refine
labels 2026-07-20 23:15:32 +02:00
Sirttas changed title from MCP token management UI: create, list, revoke to Personal access token management UI: create, list, revoke 2026-07-20 23:16:28 +02:00
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: eveal/gemory#38