fix: address review feedback — role restriction, locale parity, formatting

dnplkndll · claude · dnplkndll · commit ebdcb02be128 · 2026-03-26T22:34:09.000-04:00
- Restrict API token creation/revocation to AccountRole.User or higher
  (guests cannot use API tokens), per reviewer suggestion
- Add 5 missing translation keys (ApiTokenPermissions, ApiTokenScopePreset,
  ApiTokenScopeReadOnly, ApiTokenScopeReadWrite, ApiTokenScopeFullAccess)
  to all non-en locale files to fix locale parity CI test
- Fix prettier formatting in apiTokenScopes.test.ts
- Rename local `extra` to `tokenExtra` in createApiToken to avoid
  shadowing the decoded token's `extra` field

Co-Authored-By: Claude Opus 4.6 (1M context) &lt;noreply@anthropic.com&gt;
Signed-off-by: Don Kendall &lt;kendall@donkendall.com&gt;
diff --git a/foundations/core/packages/account-client/src/client.ts b/foundations/core/packages/account-client/src/client.ts
@@ -257,7 +257,12 @@ export interface AccountClient {
   getWorkspaceUsersWithPermission: (params: { permission: string }) => Promise<AccountUuid[]>
 
   verify2fa: (code: string) => Promise<LoginInfo>
-  createApiToken: (name: string, workspaceUuid: WorkspaceUuid, expiryDays: number, scopes?: string[]) => Promise<ApiTokenResult>
+  createApiToken: (
+    name: string,
+    workspaceUuid: WorkspaceUuid,
+    expiryDays: number,
+    scopes?: string[]
+  ) => Promise<ApiTokenResult>
   listApiTokens: () => Promise<ApiTokenInfo[]>
   revokeApiToken: (tokenId: string) => Promise<void>
   listWorkspaceApiTokens: (workspaceUuid: WorkspaceUuid) => Promise<ApiTokenInfo[]>
@@ -1232,7 +1237,12 @@ class AccountClientImpl implements AccountClient {
     await this.rpc(request)
   }
 
-  async createApiToken (name: string, workspaceUuid: WorkspaceUuid, expiryDays: number, scopes?: string[]): Promise<ApiTokenResult> {
+  async createApiToken (
+    name: string,
+    workspaceUuid: WorkspaceUuid,
+    expiryDays: number,
+    scopes?: string[]
+  ): Promise<ApiTokenResult> {
     const request = {
       method: 'createApiToken' as const,
       params: { name, workspaceUuid, expiryDays, scopes }
diff --git a/models/setting/src/index.ts b/models/setting/src/index.ts
@@ -121,7 +121,7 @@ export class TInviteSettings extends TConfiguration implements InviteSettings {
 @UX(setting.string.RoleCapabilitySettings)
 export class TRoleCapabilitySettings extends TConfiguration implements RoleCapabilitySettings {
   @Prop(TypeRecord(), setting.string.RoleCapabilitySettings)
-    roleByCapability!: Record<string, AccountRole[]>
+  roleByCapability!: Record<string, AccountRole[]>
 }
 
 @Model(setting.class.OfficeSettings, core.class.Configuration, DOMAIN_SETTING)
@@ -147,7 +147,7 @@ export class TSpaceTypeCreator extends TClass implements SpaceTypeCreator {
   extraComponent!: AnyComponent
 }
 
-export function createModel (builder: Builder): void {
+export function createModel(builder: Builder): void {
   builder.createModel(
     TIntegration,
     TIntegrationType,
diff --git a/plugins/setting-assets/lang/cs.json b/plugins/setting-assets/lang/cs.json
@@ -262,6 +262,11 @@
     "ApiTokenExpiry180Days": "180 days",
     "ApiTokenExpiry365Days": "365 days",
     "ApiTokenLoadError": "Failed to load API tokens",
-    "ApiTokenCreateError": "Failed to create token. Please try again."
+    "ApiTokenCreateError": "Failed to create token. Please try again.",
+    "ApiTokenPermissions": "Permissions",
+    "ApiTokenScopePreset": "Permissions",
+    "ApiTokenScopeReadOnly": "Read Only",
+    "ApiTokenScopeReadWrite": "Read & Write",
+    "ApiTokenScopeFullAccess": "Full Access"
   }
 }
diff --git a/plugins/setting-assets/lang/de.json b/plugins/setting-assets/lang/de.json
@@ -263,6 +263,11 @@
     "ApiTokenExpiry180Days": "180 days",
     "ApiTokenExpiry365Days": "365 days",
     "ApiTokenLoadError": "Failed to load API tokens",
-    "ApiTokenCreateError": "Failed to create token. Please try again."
+    "ApiTokenCreateError": "Failed to create token. Please try again.",
+    "ApiTokenPermissions": "Permissions",
+    "ApiTokenScopePreset": "Permissions",
+    "ApiTokenScopeReadOnly": "Read Only",
+    "ApiTokenScopeReadWrite": "Read & Write",
+    "ApiTokenScopeFullAccess": "Full Access"
   }
 }
diff --git a/plugins/setting-assets/lang/es.json b/plugins/setting-assets/lang/es.json
@@ -262,6 +262,11 @@
     "ApiTokenExpiry180Days": "180 days",
     "ApiTokenExpiry365Days": "365 days",
     "ApiTokenLoadError": "Failed to load API tokens",
-    "ApiTokenCreateError": "Failed to create token. Please try again."
+    "ApiTokenCreateError": "Failed to create token. Please try again.",
+    "ApiTokenPermissions": "Permissions",
+    "ApiTokenScopePreset": "Permissions",
+    "ApiTokenScopeReadOnly": "Read Only",
+    "ApiTokenScopeReadWrite": "Read & Write",
+    "ApiTokenScopeFullAccess": "Full Access"
   }
 }
diff --git a/plugins/setting-assets/lang/fr.json b/plugins/setting-assets/lang/fr.json
@@ -262,6 +262,11 @@
     "ApiTokenExpiry180Days": "180 days",
     "ApiTokenExpiry365Days": "365 days",
     "ApiTokenLoadError": "Failed to load API tokens",
-    "ApiTokenCreateError": "Failed to create token. Please try again."
+    "ApiTokenCreateError": "Failed to create token. Please try again.",
+    "ApiTokenPermissions": "Permissions",
+    "ApiTokenScopePreset": "Permissions",
+    "ApiTokenScopeReadOnly": "Read Only",
+    "ApiTokenScopeReadWrite": "Read & Write",
+    "ApiTokenScopeFullAccess": "Full Access"
   }
 }
diff --git a/plugins/setting-assets/lang/it.json b/plugins/setting-assets/lang/it.json
@@ -262,6 +262,11 @@
     "ApiTokenExpiry180Days": "180 days",
     "ApiTokenExpiry365Days": "365 days",
     "ApiTokenLoadError": "Failed to load API tokens",
-    "ApiTokenCreateError": "Failed to create token. Please try again."
+    "ApiTokenCreateError": "Failed to create token. Please try again.",
+    "ApiTokenPermissions": "Permissions",
+    "ApiTokenScopePreset": "Permissions",
+    "ApiTokenScopeReadOnly": "Read Only",
+    "ApiTokenScopeReadWrite": "Read & Write",
+    "ApiTokenScopeFullAccess": "Full Access"
   }
 }
diff --git a/plugins/setting-assets/lang/ja.json b/plugins/setting-assets/lang/ja.json
@@ -262,6 +262,11 @@
     "ApiTokenExpiry180Days": "180 days",
     "ApiTokenExpiry365Days": "365 days",
     "ApiTokenLoadError": "Failed to load API tokens",
-    "ApiTokenCreateError": "Failed to create token. Please try again."
+    "ApiTokenCreateError": "Failed to create token. Please try again.",
+    "ApiTokenPermissions": "Permissions",
+    "ApiTokenScopePreset": "Permissions",
+    "ApiTokenScopeReadOnly": "Read Only",
+    "ApiTokenScopeReadWrite": "Read & Write",
+    "ApiTokenScopeFullAccess": "Full Access"
   }
 }
diff --git a/plugins/setting-assets/lang/pt-br.json b/plugins/setting-assets/lang/pt-br.json
@@ -262,6 +262,11 @@
     "ApiTokenExpiry180Days": "180 days",
     "ApiTokenExpiry365Days": "365 days",
     "ApiTokenLoadError": "Failed to load API tokens",
-    "ApiTokenCreateError": "Failed to create token. Please try again."
+    "ApiTokenCreateError": "Failed to create token. Please try again.",
+    "ApiTokenPermissions": "Permissions",
+    "ApiTokenScopePreset": "Permissions",
+    "ApiTokenScopeReadOnly": "Read Only",
+    "ApiTokenScopeReadWrite": "Read & Write",
+    "ApiTokenScopeFullAccess": "Full Access"
   }
 }
diff --git a/plugins/setting-assets/lang/pt.json b/plugins/setting-assets/lang/pt.json
@@ -262,6 +262,11 @@
     "ApiTokenExpiry180Days": "180 days",
     "ApiTokenExpiry365Days": "365 days",
     "ApiTokenLoadError": "Failed to load API tokens",
-    "ApiTokenCreateError": "Failed to create token. Please try again."
+    "ApiTokenCreateError": "Failed to create token. Please try again.",
+    "ApiTokenPermissions": "Permissions",
+    "ApiTokenScopePreset": "Permissions",
+    "ApiTokenScopeReadOnly": "Read Only",
+    "ApiTokenScopeReadWrite": "Read & Write",
+    "ApiTokenScopeFullAccess": "Full Access"
   }
 }
diff --git a/plugins/setting-assets/lang/ru.json b/plugins/setting-assets/lang/ru.json
@@ -262,6 +262,11 @@
     "CreateApiToken": "Создать токен",
     "Created": "Создан",
     "Expires": "Истекает",
-    "TokenStatus": "Статус"
+    "TokenStatus": "Статус",
+    "ApiTokenPermissions": "Permissions",
+    "ApiTokenScopePreset": "Permissions",
+    "ApiTokenScopeReadOnly": "Read Only",
+    "ApiTokenScopeReadWrite": "Read & Write",
+    "ApiTokenScopeFullAccess": "Full Access"
   }
 }
diff --git a/plugins/setting-assets/lang/tr.json b/plugins/setting-assets/lang/tr.json
@@ -262,6 +262,11 @@
     "ApiTokenExpiry180Days": "180 days",
     "ApiTokenExpiry365Days": "365 days",
     "ApiTokenLoadError": "Failed to load API tokens",
-    "ApiTokenCreateError": "Failed to create token. Please try again."
+    "ApiTokenCreateError": "Failed to create token. Please try again.",
+    "ApiTokenPermissions": "Permissions",
+    "ApiTokenScopePreset": "Permissions",
+    "ApiTokenScopeReadOnly": "Read Only",
+    "ApiTokenScopeReadWrite": "Read & Write",
+    "ApiTokenScopeFullAccess": "Full Access"
   }
 }
diff --git a/plugins/setting-assets/lang/zh.json b/plugins/setting-assets/lang/zh.json
@@ -262,6 +262,11 @@
     "ApiTokenExpiry180Days": "180 days",
     "ApiTokenExpiry365Days": "365 days",
     "ApiTokenLoadError": "Failed to load API tokens",
-    "ApiTokenCreateError": "Failed to create token. Please try again."
+    "ApiTokenCreateError": "Failed to create token. Please try again.",
+    "ApiTokenPermissions": "Permissions",
+    "ApiTokenScopePreset": "Permissions",
+    "ApiTokenScopeReadOnly": "Read Only",
+    "ApiTokenScopeReadWrite": "Read & Write",
+    "ApiTokenScopeFullAccess": "Full Access"
   }
 }
diff --git a/plugins/setting-resources/src/components/ApiDocsSection.svelte b/plugins/setting-resources/src/components/ApiDocsSection.svelte
@@ -19,14 +19,14 @@
 
   let showApiDocs = false
 
-  function getBaseUrl (): string {
+  function getBaseUrl(): string {
     return window.location.origin
   }
 
   $: baseApiUrl = getBaseUrl() + '/_transactor/api/v1'
   $: curlExample = `curl -H "Authorization: Bearer YOUR_TOKEN" \\\n  "${baseApiUrl}/find-all/WORKSPACE_ID?class=tracker:class:Project"`
 
-  async function copySnippet (text: string): Promise<void> {
+  async function copySnippet(text: string): Promise<void> {
     await copyTextToClipboard(text)
   }
 </script>
diff --git a/plugins/setting-resources/src/components/ApiTokenCreatePopup.svelte b/plugins/setting-resources/src/components/ApiTokenCreatePopup.svelte
@@ -40,7 +40,7 @@
   let scopePresetItems: ListItem[] = scopePresets.map((p) => ({ _id: p._id, label: p.label }))
   let selectedScopePreset: ListItem = scopePresetItems[0]
 
-  async function resolveScopeLabels (): Promise<void> {
+  async function resolveScopeLabels(): Promise<void> {
     const lang = $themeStore.language
     const labels = await Promise.all([
       translate(setting.string.ApiTokenScopeReadOnly, {}, lang),
@@ -56,7 +56,7 @@
     selectedScopePreset = scopePresetItems.find((o) => o._id === prevId) ?? scopePresetItems[0]
   }
 
-  function getSelectedScopes (): string[] {
+  function getSelectedScopes(): string[] {
     const preset = scopePresets.find((p) => p._id === selectedScopePreset._id)
     return preset?.scopes ?? ['read:*']
   }
@@ -71,7 +71,7 @@
   let expiryOptions: ListItem[] = expiryKeys.map((k) => ({ _id: k._id, label: k._id + ' days' }))
   let selectedExpiry: ListItem = expiryOptions[1]
 
-  async function resolveExpiryLabels (): Promise<void> {
+  async function resolveExpiryLabels(): Promise<void> {
     const lang = $themeStore.language
     const prevId = selectedExpiry._id
     expiryOptions = await Promise.all(
@@ -88,15 +88,15 @@
     copied = false
   }
 
-  async function loadWorkspaces (): Promise<void> {
+  async function loadWorkspaces(): Promise<void> {
     const workspaces = await getAccountClient().getUserWorkspaces()
     wsItems = workspaces.map((w) => ({ _id: w.uuid, label: w.name ?? w.url }))
     if (wsItems.length > 0) {
       selectedWs = wsItems[0]
     }
   }
 
-  async function create (): Promise<void> {
+  async function create(): Promise<void> {
     if (selectedWs === undefined) return
     loading = true
     error = undefined
@@ -120,7 +120,7 @@
     }
   }
 
-  async function copyToken (): Promise<void> {
+  async function copyToken(): Promise<void> {
     if (createdToken === undefined || !window.isSecureContext) return
     await copyTextToClipboard(createdToken)
     copied = true
@@ -173,7 +173,11 @@
     </div>
     <div class="antiPopup-msg">
       <span class="label"><Label label={setting.string.ApiTokenScopePreset} /></span>
-      <Dropdown placeholder={setting.string.ApiTokenScopePreset} items={scopePresetItems} bind:selected={selectedScopePreset} />
+      <Dropdown
+        placeholder={setting.string.ApiTokenScopePreset}
+        items={scopePresetItems}
+        bind:selected={selectedScopePreset}
+      />
     </div>
     <div class="antiPopup-msg">
       <span class="label"><Label label={setting.string.ApiTokenExpiry} /></span>
diff --git a/plugins/setting-resources/src/components/ApiTokens.svelte b/plugins/setting-resources/src/components/ApiTokens.svelte
@@ -35,7 +35,7 @@
     expired: setting.string.ApiTokenStatusExpired
   } as const
 
-  function loadTokens (): void {
+  function loadTokens(): void {
     loading = true
     loadError = false
     getAccountClient()
@@ -52,15 +52,15 @@
       })
   }
 
-  function create (): void {
+  function create(): void {
     showPopup(ApiTokenCreatePopup, {}, 'top', (res) => {
       if (res === true) {
         loadTokens()
       }
     })
   }
 
-  function revoke (token: ApiTokenInfo): void {
+  function revoke(token: ApiTokenInfo): void {
     showPopup(MessageBox, {
       label: setting.string.ApiTokenRevoke,
       message: setting.string.ApiTokenRevokeConfirm,
@@ -76,7 +76,7 @@
     })
   }
 
-  function formatDate (ts: number): string {
+  function formatDate(ts: number): string {
     return new Date(ts).toLocaleDateString($themeStore.language ?? 'en', {
       month: 'short',
       day: 'numeric',
@@ -90,7 +90,7 @@
     fullAccess: 'Full Access'
   }
 
-  async function resolveScopeLabels (): Promise<void> {
+  async function resolveScopeLabels(): Promise<void> {
     const lang = $themeStore.language
     scopeLabels = {
       readOnly: await translate(setting.string.ApiTokenScopeReadOnly, {}, lang),
@@ -99,7 +99,7 @@
     }
   }
 
-  function getScopeLabel (token: ApiTokenInfo): string {
+  function getScopeLabel(token: ApiTokenInfo): string {
     const scopes = token.scopes
     if (scopes == null || scopes.length === 0) return scopeLabels.fullAccess
     const hasRead = scopes.includes('read:*')
@@ -111,7 +111,7 @@
     return `${scopes.length} scopes`
   }
 
-  function getStatus (token: ApiTokenInfo): 'active' | 'expiring' | 'revoked' | 'expired' {
+  function getStatus(token: ApiTokenInfo): 'active' | 'expiring' | 'revoked' | 'expired' {
     if (token.revoked) return 'revoked'
     const now = Date.now()
     if (token.expiresOn < now) return 'expired'
diff --git a/plugins/setting-resources/src/index.ts b/plugins/setting-resources/src/index.ts
@@ -98,7 +98,7 @@ export {
   IntegrationStateRow
 }
 
-async function DeleteMixin (object: Mixin<Class<Doc>>): Promise<void> {
+async function DeleteMixin(object: Mixin<Class<Doc>>): Promise<void> {
   const docs = await getClient().findAll(object._id, {}, { limit: 1 })
 
   showPopup(MessageBox, {
diff --git a/pods/server/src/rpc.ts b/pods/server/src/rpc.ts
diff --git a/server/account/src/__tests__/apiTokenScopes.test.ts b/server/account/src/__tests__/apiTokenScopes.test.ts
diff --git a/server/account/src/collections/postgres/migrations.ts b/server/account/src/collections/postgres/migrations.ts
diff --git a/server/account/src/operations.ts b/server/account/src/operations.ts

Original file line number	Diff line number	Diff line change
`@@ -262,6 +262,11 @@`
`262`	`262`	`"ApiTokenExpiry180Days": "180 days",`
`263`	`263`	`"ApiTokenExpiry365Days": "365 days",`
`264`	`264`	`"ApiTokenLoadError": "Failed to load API tokens",`
`265`		`- "ApiTokenCreateError": "Failed to create token. Please try again."`
	`265`	`+ "ApiTokenCreateError": "Failed to create token. Please try again.",`
	`266`	`+ "ApiTokenPermissions": "Permissions",`
	`267`	`+ "ApiTokenScopePreset": "Permissions",`
	`268`	`+ "ApiTokenScopeReadOnly": "Read Only",`
	`269`	`+ "ApiTokenScopeReadWrite": "Read & Write",`
	`270`	`+ "ApiTokenScopeFullAccess": "Full Access"`
`266`	`271`	`}`
`267`	`272`	`}`
Original file line number	Diff line number	Diff line change
`@@ -263,6 +263,11 @@`
`263`	`263`	`"ApiTokenExpiry180Days": "180 days",`
`264`	`264`	`"ApiTokenExpiry365Days": "365 days",`
`265`	`265`	`"ApiTokenLoadError": "Failed to load API tokens",`
`266`		`- "ApiTokenCreateError": "Failed to create token. Please try again."`
	`266`	`+ "ApiTokenCreateError": "Failed to create token. Please try again.",`
	`267`	`+ "ApiTokenPermissions": "Permissions",`
	`268`	`+ "ApiTokenScopePreset": "Permissions",`
	`269`	`+ "ApiTokenScopeReadOnly": "Read Only",`
	`270`	`+ "ApiTokenScopeReadWrite": "Read & Write",`
	`271`	`+ "ApiTokenScopeFullAccess": "Full Access"`
`267`	`272`	`}`
`268`	`273`	`}`