feat!: capabilities replace API token scopes; every admin endpoint declares one, with a picker UI [CI]

web/shared/api/schema.ts

@@ -738,7 +738,7 @@ export interface paths {
         /** API tokens */
         get: operations["api_tokens_list"];
         put?: never;
-        /** Create an API token (scope read or admin); the plaintext is returned only once */
+        /** Create an API token with the chosen capabilities (a subset of your own); the plaintext is returned only once */
         post: operations["api_tokens_create"];
         delete?: never;
         options?: never;
@@ -763,6 +763,23 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/admin/capabilities": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** The capability catalog: groups, which ones change trust, which are reserved, and the presets */
+        get: operations["capabilities_list"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/admin/settings": {
         parameters: {
             query?: never;
@@ -943,7 +960,7 @@ export interface paths {
             path?: never;
             cookie?: never;
         };
-        /** Prometheus metrics (admin token) */
+        /** Prometheus metrics (requires ops.metrics) */
         get: operations["metrics_get"];
         put?: never;
         post?: never;
@@ -1069,12 +1086,14 @@ export interface components {
         ApiTokenDto: {
             id: string;
             name: string;
-            scope: string;
+            capabilities: string[];
             /** Format: date-time */
             created_at: unknown;
             /** Format: date-time */
             last_used_at: unknown;
             /** Format: date-time */
+            expires_at: unknown;
+            /** Format: date-time */
             revoked_at: unknown;
         };
         BackendUpdateDto: {
@@ -1104,6 +1123,24 @@ export interface components {
             nodes: components["schemas"]["NodeBuildDto"][];
             backend_update?: null | components["schemas"]["BackendUpdateDto"];
         };
+        CapabilityCatalogDto: {
+            groups: components["schemas"]["CapabilityGroupDto"][];
+            presets: components["schemas"]["CapabilityPresetDto"][];
+        };
+        CapabilityDto: {
+            id: string;
+            trust: boolean;
+            reserved: boolean;
+            implies: string[];
+        };
+        CapabilityGroupDto: {
+            id: string;
+            capabilities: components["schemas"]["CapabilityDto"][];
+        };
+        CapabilityPresetDto: {
+            id: string;
+            capabilities: string[];
+        };
         ChangePasswordRequest: {
             password: string;
         };
@@ -1146,7 +1183,9 @@ export interface components {
         };
         CreateApiTokenRequest: {
             name: string;
-            scope: string;
+            capabilities: string[];
+            /** Format: int32 */
+            expires_in_days?: null | number | string;
         };
         CreateJoinTokenRequest: {
             note: null | string;
@@ -1407,7 +1446,7 @@ export interface components {
         };
         MeDto: {
             kind: string;
-            scope: string;
+            capabilities: string[];
             user_id: null | string;
             username: null | string;
             csrf_token: null | string;
@@ -4485,6 +4524,44 @@ export interface operations {
             };
         };
     };
+    capabilities_list: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["CapabilityCatalogDto"];
+                };
+            };
+            /** @description Unauthorized */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ProblemDto"];
+                };
+            };
+            /** @description Forbidden */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ProblemDto"];
+                };
+            };
+        };
+    };
     settings_list: {
         parameters: {
             query?: never;

web/shared/api/types.ts

@@ -39,6 +39,8 @@ export type JoinTokenDto = Narrow<S['JoinTokenDto']>
 export type CreatedJoinTokenDto = Narrow<S['CreatedJoinTokenDto']>
 export type ApiTokenDto = Narrow<S['ApiTokenDto']>
 export type CreatedApiTokenDto = Narrow<S['CreatedApiTokenDto']>
+export type CapabilityCatalogDto = Narrow<S['CapabilityCatalogDto']>
+export type MeDto = Narrow<S['MeDto']>
 export type SettingDto = Narrow<S['SettingDto']>
 export type UserDto = Narrow<S['UserDto']>
 export type EventDto = Narrow<S['EventDto']>
@@ -46,7 +48,6 @@ export type GapDto = Narrow<S['GapDto']>
 export type RecomputeDto = Narrow<S['RecomputeDto']>
 export type RawChunkMetaDto = Narrow<S['RawChunkMetaDto']>
 export type LoginResponse = Narrow<S['LoginResponse']>
-export type MeDto = Narrow<S['MeDto']>
 
 export interface Page<T> {
   items: T[]