Personal access tokens (PATs)

curl -H "Authorization: Bearer pat_1abc..." https://your-api/...

CREATE TABLE personal_access_tokens (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  identity_id UUID NOT NULL,
  name TEXT NOT NULL,           -- "my-laptop CLI"
  token_hash TEXT NOT NULL,     -- SHA-256 of the actual token
  scopes JSONB NOT NULL,        -- array of scope strings
  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
  last_used_at TIMESTAMPTZ,
  expires_at TIMESTAMPTZ,       -- optional
  revoked_at TIMESTAMPTZ
);
CREATE INDEX ix_pat_hash ON personal_access_tokens(token_hash) WHERE revoked_at IS NULL;

async function createPat(identityId: string, name: string, scopes: string[]) {
  const raw = "pat_" + crypto.randomBytes(32).toString("base64url");
  const hash = sha256(raw);
  const id = crypto.randomUUID();
  await db.insert(pats).values({
    id,
    identity_id: identityId,
    name,
    token_hash: hash,
    scopes,
  });
  // Show `raw` to user ONCE; never again.
  return { id, token: raw };
}

const result = await createPat(...);
return (
  <div>
    <p>Your new token:</p>
    <pre>{result.token}</pre>
    <p>⚠️ Copy this now. You won't see it again.</p>
  </div>
);

async function validatePat(token: string) {
  if (!token.startsWith("pat_")) return null;
  const hash = sha256(token);
  const pat = await db`
    SELECT * FROM personal_access_tokens
    WHERE token_hash = ${hash}
      AND revoked_at IS NULL
      AND (expires_at IS NULL OR expires_at > NOW())
  `.first();
  if (!pat) return null;
  await db`UPDATE personal_access_tokens SET last_used_at = NOW() WHERE id = ${pat.id}`;
  return {
    identity_id: pat.identity_id,
    scopes: pat.scopes,
  };
}

app.use(async (req, res, next) => {
  const auth = req.headers.authorization?.slice(7);
  if (auth?.startsWith("pat_")) {
    const pat = await validatePat(auth);
    if (pat) {
      req.user = await kratos.getIdentity(pat.identity_id);
      req.scopes = pat.scopes;
      return next();
    }
  }
  // Fall through to OAuth2 bearer validation
  next();
});

<form action={createPat}>
  <input name="name" placeholder="Token name" />
  
  <fieldset>
    <legend>Permissions</legend>
    <label><input type="checkbox" name="scopes" value="repo:read" /> Read repos</label>
    <label><input type="checkbox" name="scopes" value="repo:write" /> Write repos</label>
    <label><input type="checkbox" name="scopes" value="admin:read" /> Read admin</label>
  </fieldset>
  
  <button>Create token</button>
</form>

// app/settings/tokens/page.tsx
const tokens = await db`SELECT id, name, scopes, created_at, last_used_at, expires_at FROM personal_access_tokens WHERE identity_id = ${userId} AND revoked_at IS NULL`;

async function revokePat(id: string, identityId: string) {
  await db`UPDATE personal_access_tokens SET revoked_at = NOW() WHERE id = ${id} AND identity_id = ${identityId}`;
}

ALTER TABLE personal_access_tokens ADD COLUMN expires_at TIMESTAMPTZ;

<select name="expires_in">
  <option value="30d">30 days</option>
  <option value="90d">90 days</option>
  <option value="1y" selected>1 year</option>
  <option value="never">No expiration</option>
</select>

// CLI tool
const expiresIn = (token.expires_at - new Date()) / 1000;
if (expiresIn < 7 * 86400) {  // < 7 days
  console.warn(`Your token expires in ${Math.floor(expiresIn / 86400)} days.`);
  console.warn(`Generate a new one at: https://your-app.com/settings/tokens`);
}

INSERT INTO security_audit (event_type, actor_id, identity_id, metadata)
VALUES (
  'pat_used',
  $pat_id,           -- which PAT
  $identity_id,
  '{"endpoint": "/api/...", "scopes_used": [...]}'
);