Add Internal v2 API Access Token Generation for Users by aaronskiba · Pull Request #3597 · DMPRoadmap/roadmap

aaronskiba · 2026-02-09T21:16:30Z

Changes proposed in this PR:

Summary

This PR introduces support for issuing internal, user-scoped v2 API access tokens, managed entirely within the application (first-party tokens) for internal users.

Key Changes

Create internal Doorkeeper app via rake task

Executed via bundle exec rake doorkeeper:ensure_internal_app
Creates a first-party Doorkeeper client for issuing internal v2 API tokens
Ensures the internal application exists in all environments before token service is used

Create Api::V2::InternalUserAccessTokenService

This service manages user-scoped v2 API access tokens for internal app users.
- Tokens are equivalent to first-party Personal Access Tokens (PATs) and are issued directly to authenticated users, bypassing the full OAuth 2.0 authorization_code flow.
- Supports token creation, rotation, and revocation.
- Uses Doorkeeper::AccessToken records for consistent scoping, expiry, and revocation handling.
- Designed strictly for internal usage; third-party OAuth clients are not supported.

Add "POST /api/v2/internal_user_access_token" action & route

Adds Api::V2::InternalUserAccessTokensController#create with Pundit authorization and routing. Also reuses the existing users/refresh_token.js.erb response to update the UI via JS.
@success is read by app/views/users/refresh_token.js.erb (similar approach as UsersController#refresh_token)

Add API v2 section to /users/edit#api-details

This change updates app/views/devise/registrations/_api_token.html.erb to include support for the v2 API access token. Existing v0/v1 token support is retained.
- Introduce V2 token lookup via Api::V2::InternalUserAccessTokenService
- Display a dedicated V2 API access token section with its own regeneration action

Expose API Access tab to all users / restrict legacy token rendering

The API Access tab is now visible to all users to support the new v2 API token,
which is accessible to everyone.

Add test coverage for internal v2 token generation

Add request specs for InternalUserAccessTokensController
- Include both authenticated & unauthenticated user scenarios
- Include both present & absent internal OAuth app scenarios
Add service specs for InternalUserAccessTokenService
- Test token retrieval, rotation, and OAuth app presence
- Verify old token revocation when rotating
Add view specs for API token partials
- Test legacy partial rendering based on user.can_use_api?
- Test OAuth application availability scenarios

github-actions · 2026-02-09T21:17:37Z

</tr>

	1 Error
🚫	Please include a CHANGELOG entry. `You can find it at [CHANGELOG.md](https://github.com/DMPRoadmap/roadmap/blob/main/CHANGELOG.md).`

	1 Warning
⚠️	There are code changes, but no corresponding tests. Please include tests if this PR introduces any modifications in behavior. \n Ignore this warning if the PR ONLY contains translation.io synced updates.

Generated by 🚫 Danger

app/controllers/api/v2/internal_user_access_tokens_controller.rb

app/services/api/v2/internal_user_access_token_service.rb

momo3404 · 2026-02-11T20:33:20Z

There's two documentation related Rubocop errors

app/controllers/api/v2/internal_user_access_tokens_controller.rb:5:5: C: Style/Documentation: Missing top-level documentation comment for class Api::V2::InternalUserAccessTokensController.
app/services/api/v2/internal_user_access_token_service.rb:23:5: C: Style/Documentation: Missing top-level documentation comment for class Api::V2::InternalUserAccessTokenService.

- Creates a first-party Doorkeeper client for issuing internal v2 API tokens - Sets redirect_uri to OOB, scopes to 'read', and marks it as confidential - Ensures the internal application exists in all environments before token service is used

This service manages user-scoped v2 API access tokens for internal app users. - Tokens are equivalent to first-party Personal Access Tokens (PATs) and are issued directly to authenticated users, bypassing the full OAuth 2.0 authorization_code flow. - Supports token creation, rotation, and revocation. - Uses Doorkeeper::AccessToken records for consistent scoping, expiry, and revocation handling. - Designed strictly for internal usage; third-party OAuth clients are not supported.

Adds `Api::V2::InternalUserAccessTokensController#create` with Pundit authorization and routing. Also reuses the existing `users/refresh_token.js.erb` response to update the UI via JS. `@success` is read by `app/views/users/refresh_token.js.erb` (similar approach as `UsersController#refresh_token`)

This change updates `app/views/devise/registrations/_api_token.html.erb` to include support for the v2 API access token. Existing v0/v1 token support is retained. - Introduce V2 token lookup via `Api::V2::InternalUserAccessTokenService` - Display a dedicated V2 API access token section with its own regeneration action

This change breaks refactors `_api_token.html.erb` into additional separate partials: 1) app/views/devise/registrations/_legacy_api_token.html.erb 2) app/views/devise/registrations/_v2_api_token.html.erb In addition to the refactor, the following changes have been made: - `<div id="api-token"` has been renamed to `<div id="legacy-api-token"` - A `<div id="api-tokens">` wrapper has been added in app/views/devise/registrations/_api_token.html.erb. - `app/views/users/refresh_token.js.erb` now references the '#api-tokens' wrapper.

The API Access tab is now visible to all users to support the new v2 API token, which is accessible to everyone. The existing v0/v1 legacy token remains restricted and continues to use the previous authorization and rendering logic within the tab.

Styling changes can be viewed at /users/edit#api-details

`InternalUserAccessTokenService`: add `application!` (lookup + raise) and `application_present?` (safe check with logging) `_v2_api_token.html.erb`: gate token UI on `application_present?` and show a warning when missing.

Add request specs for InternalUserAccessTokensController - Include both authenticated & unauthenticated user scenarios - Include both present & absent internal OAuth app scenarios Add service specs for InternalUserAccessTokenService - Test token retrieval, rotation, and OAuth app presence - Verify old token revocation when rotating Add view specs for API token partials - Test legacy partial rendering based on `user.can_use_api?` - Test OAuth application availability scenarios

Add `defaults: { format: :js }` to the internal_user_access_token route, allowing callers to omit the explicit format parameter.

…nternal-users

Commit 6e7c21c allows us to have a NULL `redirect_uri`. Previously, this value was merely a placeholder due to the NOT NULL constraint.

…nternal-users

With `hash_token_secrets` enabled, `token.plaintext_token` is only available at creation or rotation time and cannot be retrieved later. This change ensures secure handling of API tokens in line with best practices for hashed token storage. - Update `InternalUserAccessTokenService#rotate!` to return `token.plaintext_token` at creation time - Pass the plaintext token from InternalUserAccessTokensController#create to `app/views/devise/registrations/_v2_api_token.html.erb` - In `_v2_api_token.html.erb`, render the plaintext token when available and display a warning to users to copy and store the token securely, as it will not be shown again after leaving or refreshing the page. - Updated all affected Spec files as well. - The `context 'when user is not authenticated' do` test has been updated. It now enables CSRF protection, enabling the test to accurately capture the behaviour that will be captured in production.

Replace the "Regenerate token" link with a real `<button>` for improved accessibility and native disabled styling. The button is disabled when a token is present, preventing users from generating multiple tokens in rapid succession. This change improves user experience and prevents token spamming.

update html

- The button initially displays 'Copy', then a check mark after it is clicked for two seconds

- 'code' was replaced by `api-token-val`

momo3404 reviewed Feb 11, 2026

View reviewed changes

aaronskiba force-pushed the aaron/feature/v2-api-token-for-internal-users branch 3 times, most recently from a5c24c6 to 23a2230 Compare February 13, 2026 21:26

aaronskiba force-pushed the aaron/feature/v2-api-token-for-internal-users branch 2 times, most recently from ad94297 to 5c24cdf Compare February 17, 2026 17:03

aaronskiba added 9 commits February 17, 2026 10:34

Improve styling for v2 + legacy API displays

b4fc307

Styling changes can be viewed at /users/edit#api-details

Add handling for missing internal OAuth app

5436190

`InternalUserAccessTokenService`: add `application!` (lookup + raise) and `application_present?` (safe check with logging) `_v2_api_token.html.erb`: gate token UI on `application_present?` and show a warning when missing.

Set default format for internal_user_access_token route

6a54ad5

Add `defaults: { format: :js }` to the internal_user_access_token route, allowing callers to omit the explicit format parameter.

aaronskiba force-pushed the aaron/feature/v2-api-token-for-internal-users branch from 5c24cdf to 6a54ad5 Compare February 17, 2026 17:34

aaronskiba changed the title ~~Aaron/feature/v2 api token for internal users~~ Add Internal v2 API Access Token Generation for Users Feb 17, 2026

aaronskiba marked this pull request as ready for review February 17, 2026 18:31

Fix string typo in refresh_token.js.erb

6fd8a06

aaronskiba mentioned this pull request Feb 17, 2026

Add Internal v2 API Access Token Generation for Users portagenetwork/roadmap#1279

Merged

aaronskiba added 2 commits February 19, 2026 12:29

Merge branch 'api_v2_dmponline' into aaron/feature/v2-api-token-for-i…

e315749

…nternal-users

Remove redirect_uri from internal OAuth app

9904d76

Commit 6e7c21c allows us to have a NULL `redirect_uri`. Previously, this value was merely a placeholder due to the NOT NULL constraint.

This comment was marked as outdated.

Sign in to view

aaronskiba marked this pull request as draft February 19, 2026 21:47

aaronskiba closed this Mar 12, 2026

aaronskiba reopened this Mar 12, 2026

Merge branch 'api_v2_dmponline' into aaron/feature/v2-api-token-for-i…

fdae153

…nternal-users

aaronskiba added 2 commits March 12, 2026 13:14

aaronskiba force-pushed the aaron/feature/v2-api-token-for-internal-users branch from 01cf821 to 1928d53 Compare March 12, 2026 19:14

momo3404 added 5 commits March 12, 2026 14:11

Add copy button to v2 api API Access

d06523e

update html

Add copyToken.js to allow for copying token

f98d79c

- The button initially displays 'Copy', then a check mark after it is clicked for two seconds

Fix breaking tests in _v2_api_token.html.erb_spec.rb

af44c49

- 'code' was replaced by `api-token-val`

Add v2 API documentation to API Access page

b3bd4d8

Update documentation links for legacy APIs

41f1f15

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add Internal v2 API Access Token Generation for Users#3597

Add Internal v2 API Access Token Generation for Users#3597
aaronskiba wants to merge 21 commits intoapi_v2_dmponlinefrom
aaron/feature/v2-api-token-for-internal-users

aaronskiba commented Feb 9, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Feb 9, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

momo3404 commented Feb 11, 2026

Uh oh!

This comment was marked as outdated.

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

aaronskiba commented Feb 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes proposed in this PR:

Summary

Key Changes

Uh oh!

github-actions bot commented Feb 9, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

momo3404 commented Feb 11, 2026

Uh oh!

This comment was marked as outdated.

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

aaronskiba commented Feb 9, 2026 •

edited

Loading