Add API token management: implement APIToken model, views, and templates for creating and revoking tokens

atlas/views.py

@@ -119,6 +119,7 @@ from .models import (
     UncategorisedDicom,
     UserReportAnswer,
     PrerequisiteRequired
+    , APIToken
 )
 from .models import Procedure
 from .models import NormalCase
@@ -519,6 +520,52 @@ def case_search_page(request):
         },
     )
 
+
+
+@login_required
+def api_tokens_page(request):
+    """Simple UI to create and revoke API tokens for the logged-in user."""
+    created_token = None
+
+    if request.method == "POST":
+        action = request.POST.get("action")
+        if action == "create":
+            name = request.POST.get("name", "")
+            scopes = request.POST.get("scopes", "")
+            expires_days = request.POST.get("expires_days")
+            expires = None
+            if expires_days:
+                try:
+                    expires = timezone.now() + timezone.timedelta(days=int(expires_days))
+                except Exception:
+                    expires = None
+
+            token, obj = APIToken.create_token(request.user, name=name, scopes=scopes, expires=expires)
+            created_token = token
+        elif action == "revoke":
+            revoke_id = request.POST.get("revoke_id")
+            try:
+                t = APIToken.objects.get(pk=revoke_id, user=request.user)
+                t.revoked = True
+                t.save(update_fields=["revoked"])
+            except APIToken.DoesNotExist:
+                pass
+
+    tokens_qs = APIToken.objects.filter(user=request.user).order_by("-created")
+    tokens = [
+        {
+            "id": t.id,
+            "name": t.name,
+            "scopes": t.scopes,
+            "created": t.created,
+            "expires": t.expires,
+            "revoked": t.revoked,
+        }
+        for t in tokens_qs
+    ]
+
+    return render(request, "atlas/api_tokens.html", {"tokens": tokens, "created_token": created_token})
+
 @login_required
 @user_has_case_view_access
 @require_http_methods(["GET", "POST"])