From f57a2e4e6d87f39aa6f75272f7d29ab541cff1f0 Mon Sep 17 00:00:00 2001
From: alphaeusmote <41258468-alphaeusmote@users.noreply.replit.com>
Date: Fri, 11 Apr 2025 16:14:44 +0000
Subject: [PATCH] Add API token roles and separate them from users.

Replit-Commit-Author: Agent
Replit-Commit-Session-Id: 9111ef36-26c8-4085-84ca-a35dc1fec1b5
Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/7083d608-d6d3-4a6a-9a27-6286c5109627/960c4ce7-993c-4ccb-b1e1-47068c824af5.jpg
---
 client/src/pages/api-tokens.tsx | 2 ++
 server/storage.ts               | 1 +
 shared/schema.ts                | 2 ++
 3 files changed, 5 insertions(+)

diff --git a/client/src/pages/api-tokens.tsx b/client/src/pages/api-tokens.tsx
index 58bdddc..1d576d7 100644
--- a/client/src/pages/api-tokens.tsx
+++ b/client/src/pages/api-tokens.tsx
@@ -68,6 +68,7 @@ import { formatDistanceToNow, format } from "date-fns";
 const tokenFormSchema = z.object({
   name: z.string().min(1, "Token name is required"),
   permissions: z.array(z.string()).min(1, "At least one permission is required"),
+  role: z.string().min(1, "Role is required"),
   expiresAt: z.string().optional(),
 });
 
@@ -94,6 +95,7 @@ export default function ApiTokensPage() {
     defaultValues: {
       name: "",
       permissions: ["readonly"],
+      role: "readonly",
       expiresAt: undefined,
     },
   });
diff --git a/server/storage.ts b/server/storage.ts
index aabf0dd..34305b2 100644
--- a/server/storage.ts
+++ b/server/storage.ts
@@ -438,6 +438,7 @@ export class MemStorage implements IStorage {
       token: token.token,
       organizationId: token.organizationId,
       permissions: token.permissions ?? null,
+      role: token.role || 'readonly',
       createdBy: token.createdBy,
       isActive: token.isActive ?? true,
       expiresAt: token.expiresAt ?? null,
diff --git a/shared/schema.ts b/shared/schema.ts
index 6a7bd37..5e6a41f 100644
--- a/shared/schema.ts
+++ b/shared/schema.ts
@@ -85,6 +85,7 @@ export const apiTokens = pgTable("api_tokens", {
   token: text("token").notNull().unique(),
   organizationId: uuid("organization_id").notNull().references(() => organizations.id, { onDelete: "cascade" }),
   permissions: text("permissions").array(),
+  role: text("role").default("readonly").notNull(), // Adding explicit role like users have
   createdBy: uuid("created_by").notNull().references(() => users.id, { onDelete: "cascade" }),
   isActive: boolean("is_active").default(true).notNull(),
   createdAt: timestamp("created_at").defaultNow().notNull(),
@@ -206,6 +207,7 @@ export const insertApiTokenSchema = createInsertSchema(apiTokens).pick({
   token: true,
   organizationId: true,
   permissions: true,
+  role: true,
   createdBy: true,
   isActive: true,
   expiresAt: true,