Add API token roles and separate them from users.

Replit-Commit-Author: Agent
Replit-Commit-Session-Id: 9111ef36-26c8-4085-84ca-a35dc1fec1b5
Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/7083d608-d6d3-4a6a-9a27-6286c5109627/960c4ce7-993c-4ccb-b1e1-47068c824af5.jpg

client/src/pages/api-tokens.tsx

@@ -68,6 +68,7 @@ import { formatDistanceToNow, format } from "date-fns";
 const tokenFormSchema = z.object({
   name: z.string().min(1, "Token name is required"),
   permissions: z.array(z.string()).min(1, "At least one permission is required"),
+  role: z.string().min(1, "Role is required"),
   expiresAt: z.string().optional(),
 });
 
@@ -94,6 +95,7 @@ export default function ApiTokensPage() {
     defaultValues: {
       name: "",
       permissions: ["readonly"],
+      role: "readonly",
       expiresAt: undefined,
     },
   });

server/storage.ts

@@ -438,6 +438,7 @@ export class MemStorage implements IStorage {
       token: token.token,
       organizationId: token.organizationId,
       permissions: token.permissions ?? null,
+      role: token.role || 'readonly',
       createdBy: token.createdBy,
       isActive: token.isActive ?? true,
       expiresAt: token.expiresAt ?? null,

shared/schema.ts

@@ -85,6 +85,7 @@ export const apiTokens = pgTable("api_tokens", {
   token: text("token").notNull().unique(),
   organizationId: uuid("organization_id").notNull().references(() => organizations.id, { onDelete: "cascade" }),
   permissions: text("permissions").array(),
+  role: text("role").default("readonly").notNull(), // Adding explicit role like users have
   createdBy: uuid("created_by").notNull().references(() => users.id, { onDelete: "cascade" }),
   isActive: boolean("is_active").default(true).notNull(),
   createdAt: timestamp("created_at").defaultNow().notNull(),
@@ -206,6 +207,7 @@ export const insertApiTokenSchema = createInsertSchema(apiTokens).pick({
   token: true,
   organizationId: true,
   permissions: true,
+  role: true,
   createdBy: true,
   isActive: true,
   expiresAt: true,