Problem
The REST API (/api/v1/*, Bearer auth) is great — but there is currently no way for a user to obtain a token without server console access:
- The README's bootstrap is
user.regenerate_api_token! via Rails console.
PATCH /api/v1/api_token can only rotate a token you already have (it sits behind Bearer auth itself).- The API deliberately rejects session-cookie auth, and there is no token section anywhere in the web UI.
So on a hosted instance (e.g. stemplin.no), ordinary users cannot start using the API at all.
Desired outcome
A small "API token" section on the account page (/users/edit):
- Shows whether a token exists (
api_token_digest?) — never the token itself after creation.
- A Generate / Regenerate button (with a confirm when regenerating — the old token stops working) that calls the existing
User#regenerate_api_token! and shows the new token once, with a copy-friendly presentation, mirroring the README's "save this — it's only shown once" semantics.
- Session-authenticated controller action (this is the web UI, not the API), covered by tests.
No changes to the API itself — the digest storage model and PATCH /api/v1/api_token stay as they are.
Issue created by Claude on behalf of @l3x4.
Problem
The REST API (
/api/v1/*, Bearer auth) is great — but there is currently no way for a user to obtain a token without server console access:user.regenerate_api_token!via Rails console.PATCH /api/v1/api_tokencan only rotate a token you already have (it sits behind Bearer auth itself).So on a hosted instance (e.g. stemplin.no), ordinary users cannot start using the API at all.
Desired outcome
A small "API token" section on the account page (
/users/edit):api_token_digest?) — never the token itself after creation.User#regenerate_api_token!and shows the new token once, with a copy-friendly presentation, mirroring the README's "save this — it's only shown once" semantics.No changes to the API itself — the digest storage model and
PATCH /api/v1/api_tokenstay as they are.Issue created by Claude on behalf of @l3x4.