Add token rotation

jarl token rotate, a Rotate button in the web UI and
POST /api/v1/tokens/{id}/rotate give a token a new secret while it keeps
its ID, name, user and grants. The old secret stops at once or after a
grace period of up to 7 days, during which jarld logs who still uses it.
A token that expires gets its lifetime again. --save writes the new
secret where the CLI got the old one (its configuration or --token @FILE),
--write FILE to any file, and --current picks the token the CLI runs
with, so a restricted token can renew itself. A restricted token can't
rotate a wider token of its user.

Also fixes token create --save for named servers, and future times
(token expiry) shown as "just now" in the web UI.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/store/store.go

@@ -213,6 +213,13 @@ CREATE TABLE deployed_files (
 	written_at TEXT NOT NULL,
 	changeset_id INTEGER NOT NULL DEFAULT 0
 );
+`,
+	// 2: token rotation. A rotated token gets a new secret; the previous
+	// one may stay valid for a grace period.
+	`
+ALTER TABLE tokens ADD COLUMN rotated_at TEXT;
+ALTER TABLE tokens ADD COLUMN prev_secret_hash TEXT NOT NULL DEFAULT '';
+ALTER TABLE tokens ADD COLUMN prev_expires_at TEXT;
 `,
 }
 

internal/store/users.go

@@ -139,13 +139,13 @@ func (s *Store) DeleteUser(ctx context.Context, id int64) error {
 	return nil
 }
 
-const tokenCols = `t.id, t.user_id, u.username, t.name, t.public_id, t.secret_hash, t.grants, t.expires_at, t.created_at, t.last_used_at, t.last_used_ip, t.revoked_at`
+const tokenCols = `t.id, t.user_id, u.username, t.name, t.public_id, t.secret_hash, t.grants, t.expires_at, t.created_at, t.last_used_at, t.last_used_ip, t.revoked_at, t.rotated_at, t.prev_secret_hash, t.prev_expires_at`
 
 func scanToken(sc interface{ Scan(...any) error }) (*model.Token, error) {
 	t := &model.Token{}
-	var grants, exp, lu, rev sql.NullString
+	var grants, exp, lu, rev, rot, pexp sql.NullString
 	var ca string
-	if err := sc.Scan(&t.ID, &t.UserID, &t.Username, &t.Name, &t.PublicID, &t.SecretHash, &grants, &exp, &ca, &lu, &t.LastUsedIP, &rev); err != nil {
+	if err := sc.Scan(&t.ID, &t.UserID, &t.Username, &t.Name, &t.PublicID, &t.SecretHash, &grants, &exp, &ca, &lu, &t.LastUsedIP, &rev, &rot, &t.PrevSecretHash, &pexp); err != nil {
 		return nil, err
 	}
 	if grants.Valid {
@@ -157,6 +157,7 @@ func scanToken(sc interface{ Scan(...any) error }) (*model.Token, error) {
 		}
 	}
 	t.ExpiresAt, t.LastUsedAt, t.RevokedAt = parseTSPtr(exp), parseTSPtr(lu), parseTSPtr(rev)
+	t.RotatedAt, t.PrevExpiresAt = parseTSPtr(rot), parseTSPtr(pexp)
 	t.CreatedAt = parseTS(ca)
 	return t, nil
 }
@@ -235,6 +236,25 @@ func (s *Store) RevokeToken(ctx context.Context, id int64) error {
 	return nil
 }
 
+// RotateToken gives a token a new secret and expiry. With prevUntil set,
+// the old secret keeps working until then; otherwise it stops at once. A
+// revoked token can't be rotated (ErrNotFound).
+func (s *Store) RotateToken(ctx context.Context, id int64, secretHash string, expiresAt, prevUntil *time.Time) error {
+	prevHash := `''`
+	if prevUntil != nil {
+		prevHash = `secret_hash`
+	}
+	res, err := s.db.ExecContext(ctx, `UPDATE tokens SET prev_secret_hash = `+prevHash+`, prev_expires_at = ?, secret_hash = ?, expires_at = ?, rotated_at = ? WHERE id = ? AND revoked_at IS NULL`,
+		tsPtr(prevUntil), secretHash, tsPtr(expiresAt), ts(time.Now()), id)
+	if err != nil {
+		return err
+	}
+	if n, _ := res.RowsAffected(); n == 0 {
+		return ErrNotFound
+	}
+	return nil
+}
+
 // TouchToken records a token's use. It is best-effort and cheap.
 func (s *Store) TouchToken(ctx context.Context, id int64, ip string) error {
 	_, err := s.db.ExecContext(ctx, `UPDATE tokens SET last_used_at = ?, last_used_ip = ? WHERE id = ?`, ts(time.Now()), ip, id)