auth-tokens: add scope and show consitent token UI for my account and admin.

rhodecode/model/auth_token.py

@@ -1,97 +1,98 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2013-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 """
 authentication tokens model for RhodeCode
 """
 
 import time
 import logging
 import traceback
 from sqlalchemy import or_
 
 from rhodecode.model import BaseModel
 from rhodecode.model.db import UserApiKeys
 from rhodecode.model.meta import Session
 
 log = logging.getLogger(__name__)
 
 
 class AuthTokenModel(BaseModel):
     cls = UserApiKeys
 
     def create(self, user, description, lifetime=-1, role=UserApiKeys.ROLE_ALL):
         """
         :param user: user or user_id
         :param description: description of ApiKey
         :param lifetime: expiration time in minutes
         :param role: role for the apikey
         """
         from rhodecode.lib.auth import generate_auth_token
 
         user = self._get_user(user)
 
         new_auth_token = UserApiKeys()
         new_auth_token.api_key = generate_auth_token(user.username)
         new_auth_token.user_id = user.user_id
         new_auth_token.description = description
         new_auth_token.role = role
-        new_auth_token.expires = time.time() + (lifetime * 60) if lifetime != -1 else -1
+        new_auth_token.expires = time.time() + (lifetime * 60) \
+            if lifetime != -1 else -1
         Session().add(new_auth_token)
 
         return new_auth_token
 
     def delete(self, api_key, user=None):
         """
         Deletes given api_key, if user is set it also filters the object for
         deletion by given user.
         """
         api_key = UserApiKeys.query().filter(UserApiKeys.api_key == api_key)
 
         if user:
             user = self._get_user(user)
             api_key = api_key.filter(UserApiKeys.user_id == user.user_id)
 
         api_key = api_key.scalar()
         try:
             Session().delete(api_key)
         except Exception:
             log.error(traceback.format_exc())
             raise
 
     def get_auth_tokens(self, user, show_expired=True):
         user = self._get_user(user)
         user_auth_tokens = UserApiKeys.query()\
             .filter(UserApiKeys.user_id == user.user_id)
         if not show_expired:
             user_auth_tokens = user_auth_tokens\
                 .filter(or_(UserApiKeys.expires == -1,
                             UserApiKeys.expires >= time.time()))
         return user_auth_tokens
 
     def get_auth_token(self, auth_token):
         auth_token = UserApiKeys.query().filter(
             UserApiKeys.api_key == auth_token)
         auth_token = auth_token \
             .filter(or_(UserApiKeys.expires == -1,
                         UserApiKeys.expires >= time.time()))\
             .first()
 
         return auth_token

rhodecode/templates/admin/my_account/my_account_auth_tokens.mako

@@ -1,80 +1,95 b''
 <div class="panel panel-default">
   <div class="panel-heading">
     <h3 class="panel-title">${_('Authentication Tokens')}</h3>
   </div>
   <div class="panel-body">
       <p>
-         ${_('Each token can have a role. VCS tokens can be used together with the authtoken auth plugin for git/hg/svn operations.')}
+         ${_('Each token can have a role. Token with a role can be used only in given context, '
+         'e.g. VCS tokens can be used together with the authtoken auth plugin for git/hg/svn operations only.')}
+          ${_('Additionally scope for VCS type token can narrow the use to chosen repository.')}
       </p>
       <table class="rctable auth_tokens">
         %if c.user_auth_tokens:
+            <tr>
+                <th>${_('Token')}</th>
+                <th>${_('Scope')}</th>
+                <th>${_('Description')}</th>
+                <th>${_('Role')}</th>
+                <th>${_('Expiration')}</th>
+                <th>${_('Action')}</th>
+            </tr>
             %for auth_token in c.user_auth_tokens:
               <tr class="${'expired' if auth_token.expired else ''}">
-                <td class="truncate-wrap td-authtoken"><div class="user_auth_tokens truncate autoexpand"><code>${auth_token.api_key}</code></div></td>
+                <td class="truncate-wrap td-authtoken">
+                    <div class="user_auth_tokens truncate autoexpand">
+                    <code>${auth_token.api_key}</code>
+                    </div>
+                </td>
+                <td class="td">${auth_token.scope_humanized}</td>
                 <td class="td-wrap">${auth_token.description}</td>
                 <td class="td-tags">
                     <span class="tag disabled">${auth_token.role_humanized}</span>
                 </td>
                 <td class="td-exp">
                      %if auth_token.expires == -1:
-                      ${_('expires')}: ${_('never')}
+                      ${_('never')}
                      %else:
                         %if auth_token.expired:
-                            ${_('expired')}: ${h.age_component(h.time_to_utcdatetime(auth_token.expires))}
+                            <span style="text-decoration: line-through">${h.age_component(h.time_to_utcdatetime(auth_token.expires))}</span>
                         %else:
-                            ${_('expires')}: ${h.age_component(h.time_to_utcdatetime(auth_token.expires))}
+                            ${h.age_component(h.time_to_utcdatetime(auth_token.expires))}
                         %endif
                      %endif
                 </td>
                 <td class="td-action">
                     ${h.secure_form(url('my_account_auth_tokens'),method='delete')}
                         ${h.hidden('del_auth_token',auth_token.api_key)}
                         <button class="btn btn-link btn-danger" type="submit"
                                 onclick="return confirm('${_('Confirm to remove this auth token: %s') % auth_token.api_key}');">
                             ${_('Delete')}
                         </button>
                     ${h.end_form()}
                 </td>
               </tr>
             %endfor
         %else:
         <tr><td><div class="ip">${_('No additional auth token specified')}</div></td></tr>
         %endif
       </table>
 
         <div class="user_auth_tokens">
             ${h.secure_form(url('my_account_auth_tokens'), method='post')}
             <div class="form form-vertical">
                 <!-- fields -->
                 <div class="fields">
                      <div class="field">
                         <div class="label">
                             <label for="new_email">${_('New authentication token')}:</label>
                         </div>
                         <div class="input">
                             ${h.text('description', placeholder=_('Description'))}
                             ${h.select('lifetime', '', c.lifetime_options)}
                             ${h.select('role', '', c.role_options)}
                         </div>
                      </div>
                     <div class="buttons">
                       ${h.submit('save',_('Add'),class_="btn")}
                       ${h.reset('reset',_('Reset'),class_="btn")}
                     </div>
                 </div>
             </div>
             ${h.end_form()}
         </div>
     </div>
 </div>
     <script>
         $(document).ready(function(){
             var select2Options = {
                 'containerCssClass': "drop-menu",
                 'dropdownCssClass': "drop-menu-dropdown",
                 'dropdownAutoWidth': true
             };
             $("#lifetime").select2(select2Options);
             $("#role").select2(select2Options);
         });
     </script>

rhodecode/templates/admin/users/user_edit_auth_tokens.mako

@@ -1,83 +1,97 b''
 <div class="panel panel-default">
     <div class="panel-heading">
         <h3 class="panel-title">${_('Authentication Access Tokens')}</h3>
     </div>
     <div class="panel-body">
         <div class="apikeys_wrap">
+          <p>
+             ${_('Each token can have a role. Token with a role can be used only in given context, '
+             'e.g. VCS tokens can be used together with the authtoken auth plugin for git/hg/svn operations only.')}
+              ${_('Additionally scope for VCS type token can narrow the use to chosen repository.')}
+          </p>
           <table class="rctable auth_tokens">
+            <tr>
+                <th>${_('Token')}</th>
+                <th>${_('Scope')}</th>
+                <th>${_('Description')}</th>
+                <th>${_('Role')}</th>
+                <th>${_('Expiration')}</th>
+                <th>${_('Action')}</th>
+            </tr>
             %if c.user_auth_tokens:
                 %for auth_token in c.user_auth_tokens:
                   <tr class="${'expired' if auth_token.expired else ''}">
                     <td class="truncate-wrap td-authtoken"><div class="user_auth_tokens truncate autoexpand"><code>${auth_token.api_key}</code></div></td>
+                    <td class="td">${auth_token.scope_humanized}</td>
                     <td class="td-wrap">${auth_token.description}</td>
                     <td class="td-tags">
                         <span class="tag">${auth_token.role_humanized}</span>
                     </td>
                     <td class="td-exp">
                          %if auth_token.expires == -1:
-                          ${_('expires')}: ${_('never')}
+                          ${_('never')}
                          %else:
                             %if auth_token.expired:
-                                ${_('expired')}: ${h.age_component(h.time_to_utcdatetime(auth_token.expires))}
+                                <span style="text-decoration: line-through">${h.age_component(h.time_to_utcdatetime(auth_token.expires))}</span>
                             %else:
-                                ${_('expires')}: ${h.age_component(h.time_to_utcdatetime(auth_token.expires))}
+                                ${h.age_component(h.time_to_utcdatetime(auth_token.expires))}
                             %endif
                          %endif
                     </td>
                     <td>
                         ${h.secure_form(url('edit_user_auth_tokens', user_id=c.user.user_id),method='delete')}
                             ${h.hidden('del_auth_token',auth_token.api_key)}
                             <button class="btn btn-link btn-danger" type="submit"
                                     onclick="return confirm('${_('Confirm to remove this auth token: %s') % auth_token.api_key}');">
                                 ${_('Delete')}
                             </button>
                         ${h.end_form()}
                     </td>
                   </tr>
                 %endfor
             %else:
             <tr><td><div class="ip">${_('No additional auth tokens specified')}</div></td></tr>
             %endif
           </table>
         </div>
 
         <div class="user_auth_tokens">
             ${h.secure_form(url('edit_user_auth_tokens', user_id=c.user.user_id), method='put')}
             <div class="form form-vertical">
                 <!-- fields -->
                 <div class="fields">
                      <div class="field">
                         <div class="label">
-                            <label for="new_email">${_('New auth token')}:</label>
+                            <label for="new_email">${_('New authentication token')}:</label>
                         </div>
                         <div class="input">
                             ${h.text('description', class_='medium', placeholder=_('Description'))}
                             ${h.select('lifetime', '', c.lifetime_options)}
                             ${h.select('role', '', c.role_options)}
                         </div>
                      </div>
                     <div class="buttons">
                       ${h.submit('save',_('Add'),class_="btn btn-small")}
                       ${h.reset('reset',_('Reset'),class_="btn btn-small")}
                     </div>
                 </div>
             </div>
             ${h.end_form()}
         </div>
     </div>
 </div>
 
 <script>
     $(document).ready(function(){
         $("#lifetime").select2({
             'containerCssClass': "drop-menu",
             'dropdownCssClass': "drop-menu-dropdown",
             'dropdownAutoWidth': true
         });
         $("#role").select2({
             'containerCssClass': "drop-menu",
             'dropdownCssClass': "drop-menu-dropdown",
             'dropdownAutoWidth': true
         });
     })
 </script>