Admin name at init, token rotation, read-only forms, token role presets

- stewardd init asks for the first administrator's name on a terminal.
- Tokens can be rotated (steward token rotate, POST /tokens/{id}/rotate,
  Rotate in the web UI), with a grace period for the old secret, as in
  Jarl. Schema migration 2 adds the token columns.
- Read-only users see the settings and a subnet's settings locked,
  instead of editable fields without a Save button.
- The New token dialog only offers roles within what the user may do.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/api/types.go

@@ -30,12 +30,14 @@ type ErrorInfo struct {
 
 // Whoami describes the caller.
 type Whoami struct {
-	User        *model.User   `json:"user"`
-	Admin       bool          `json:"admin"`
-	Method      string        `json:"method"`
-	Permissions []string      `json:"permissions"`
-	CSRFToken   string        `json:"csrf_token,omitempty"`
-	Build       version.Build `json:"build"`
+	User        *model.User `json:"user"`
+	Admin       bool        `json:"admin"`
+	Method      string      `json:"method"`
+	Permissions []string    `json:"permissions"`
+	// TokenID is the token the caller authenticated with (0: none).
+	TokenID   int64         `json:"token_id,omitempty"`
+	CSRFToken string        `json:"csrf_token,omitempty"`
+	Build     version.Build `json:"build"`
 }
 
 // Login is the login request.
@@ -184,6 +186,15 @@ type TokenInput struct {
 	ExpiresAt *time.Time `json:"expires_at,omitempty"`
 }
 
+// TokenRotation gives a token a new secret. Grace keeps the old secret
+// working for a while (up to 7d). The token gets its lifetime again,
+// counted from now, unless ExpiresIn or NoExpiry says otherwise.
+type TokenRotation struct {
+	Grace     string `json:"grace,omitempty"`
+	ExpiresIn string `json:"expires_in,omitempty"`
+	NoExpiry  bool   `json:"no_expiry,omitempty"`
+}
+
 // Token is a token; Secret is only set when it is created.
 type Token struct {
 	*model.Token

internal/auth/auth.go

@@ -108,6 +108,12 @@ func NewToken() (token, publicID, secretHash string) {
 	return TokenPrefix + publicID + "_" + secret, publicID, HashSecret(secret)
 }
 
+// RotateToken makes a new secret for a token's public ID.
+func RotateToken(publicID string) (token, secretHash string) {
+	secret := RandomString(20)
+	return TokenPrefix + publicID + "_" + secret, HashSecret(secret)
+}
+
 // ParseToken splits a token into its public ID and secret.
 func ParseToken(token string) (publicID, secret string, err error) {
 	rest, ok := strings.CutPrefix(strings.TrimSpace(token), TokenPrefix)

internal/model/auth.go

@@ -43,6 +43,21 @@ type Token struct {
 	LastUsedAt *time.Time `json:"last_used_at,omitempty"`
 	LastUsedIP string     `json:"last_used_ip,omitempty"`
 	RevokedAt  *time.Time `json:"revoked_at,omitempty"`
+	// RotatedAt is when the token last got a new secret (nil: never).
+	RotatedAt *time.Time `json:"rotated_at,omitempty"`
+	// After a rotation with a grace period, the previous secret keeps
+	// working until PrevExpiresAt.
+	PrevSecretHash string     `json:"-"`
+	PrevExpiresAt  *time.Time `json:"previous_secret_valid_until,omitempty"`
+}
+
+// IssuedAt is when the token's current secret was made: its last
+// rotation, or its creation.
+func (t *Token) IssuedAt() time.Time {
+	if t.RotatedAt != nil {
+		return *t.RotatedAt
+	}
+	return t.CreatedAt
 }
 
 // Session is a web UI login.

internal/server/authn.go

@@ -150,13 +150,21 @@ func (s *Server) tokenPrincipal(ctx context.Context, tok, ip, agent string) (*au
 	if err != nil {
 		return nil, err
 	}
+	now := time.Now()
 	if !auth.CheckSecret(secret, t.SecretHash) {
-		return nil, errors.New("wrong token secret")
+		// After a rotation with a grace period the old secret works until
+		// the grace period ends.
+		if t.PrevSecretHash == "" || t.PrevExpiresAt == nil || !auth.CheckSecret(secret, t.PrevSecretHash) {
+			return nil, errors.New("wrong token secret")
+		}
+		if now.After(*t.PrevExpiresAt) {
+			return nil, errors.New("this is the token's old secret, from before it was rotated; its grace period has ended")
+		}
+		s.log.Warn("token used with its old secret; give this client the new one before the grace period ends", "token_id", t.ID, "token", t.Username+"/"+t.Name, "ip", ip, "valid_until", t.PrevExpiresAt.Format(time.RFC3339))
 	}
 	if t.RevokedAt != nil {
 		return nil, errors.New("the token was revoked")
 	}
-	now := time.Now()
 	if t.ExpiresAt != nil && now.After(*t.ExpiresAt) {
 		return nil, errors.New("the token has expired")
 	}
@@ -271,6 +279,9 @@ func (s *Server) whoamiOf(p *auth.Principal, se *model.Session) api.Whoami {
 	if se != nil {
 		out.CSRFToken = se.CSRFToken
 	}
+	if p.Token != nil {
+		out.TokenID = p.Token.ID
+	}
 	return out
 }
 

internal/server/h_users.go

@@ -200,6 +200,86 @@ func (s *Server) revokeToken(w http.ResponseWriter, r *http.Request, p *auth.Pri
 	return nil
 }
 
+// maxRotationGrace is the longest an old secret may keep working.
+const maxRotationGrace = 7 * 24 * time.Hour
+
+// rotateToken: POST /tokens/{id}/rotate gives a token a new secret. It
+// keeps its ID, name, user and grants, so only the programs that use it
+// need the new secret. The old secret stops at once, or after the grace
+// period. A token that expires gets its lifetime again, from now.
+func (s *Server) rotateToken(w http.ResponseWriter, r *http.Request, p *auth.Principal) error {
+	id, err := pathID(r, "id")
+	if err != nil {
+		return err
+	}
+	var in api.TokenRotation
+	if err := decodeOptional(r, &in); err != nil {
+		return err
+	}
+	t, err := s.store.GetToken(r.Context(), id)
+	if err != nil || t.UserID != p.User.ID && !p.IsAdmin() {
+		return notFound("token %d not found", id)
+	}
+	// A restricted token may rotate itself and tokens no wider than
+	// itself, but not a wider one: it would learn that token's secret.
+	if !p.IsAdmin() && p.Token != nil && p.Token.Grants != nil && p.Token.ID != t.ID && (t.Grants == nil || !auth.Narrower(t.Grants, p.Token.Grants)) {
+		return forbidden("a restricted token can only rotate itself and tokens with a subset of its own grants")
+	}
+	if t.RevokedAt != nil {
+		return conflict("token %d is revoked; make a new one", id)
+	}
+	now := time.Now()
+	var exp *time.Time
+	switch {
+	case in.ExpiresIn != "":
+		if in.NoExpiry {
+			return badRequest("no_expiry can't be combined with expires_in")
+		}
+		d, err := config.ParseDuration(in.ExpiresIn)
+		if err != nil || d <= 0 {
+			return badRequest("invalid expires_in %q (use e.g. 90d or 720h)", in.ExpiresIn)
+		}
+		e := now.Add(d)
+		exp = &e
+	case in.NoExpiry:
+	case t.ExpiresAt != nil:
+		if life := t.ExpiresAt.Sub(t.IssuedAt()); life > 0 {
+			e := now.Add(life)
+			exp = &e
+		}
+	}
+	var prevUntil *time.Time
+	if in.Grace != "" {
+		g, err := config.ParseDuration(in.Grace)
+		if err != nil || g < 0 || g > maxRotationGrace {
+			return badRequest("invalid grace %q: use a duration up to 7d, e.g. 30m, 24h or 2d", in.Grace)
+		}
+		until := now.Add(g)
+		if t.ExpiresAt != nil && t.ExpiresAt.Before(until) {
+			until = *t.ExpiresAt // the old secret never outlives its token
+		}
+		if g > 0 && until.After(now) {
+			prevUntil = &until
+		}
+	}
+	secret, hash := auth.RotateToken(t.PublicID)
+	if err := s.store.RotateToken(r.Context(), t.ID, hash, exp, prevUntil); err != nil {
+		return err
+	}
+	if t, err = s.store.GetToken(r.Context(), id); err != nil {
+		return err
+	}
+	detail := "the old secret stops now"
+	if prevUntil != nil {
+		detail = "the old secret works until " + prevUntil.UTC().Format(time.RFC3339)
+	}
+	s.eng.Audit(r.Context(), p, "token.rotate", "token "+t.Username+"/"+t.Name, "success", detail)
+	out := presentToken(t)
+	out.Secret = secret
+	writeJSON(w, http.StatusOK, out)
+	return nil
+}
+
 func presentUser(u *model.User) api.User {
 	return api.User{User: u, GrantStrings: grantStrings(u.Grants)}
 }

internal/server/routes.go

@@ -28,6 +28,7 @@ func (s *Server) routes() {
 	m.HandleFunc("POST "+p+"/me/tokens", s.authed(s.createOwnToken))
 	m.HandleFunc("GET "+p+"/tokens", s.authed(s.listAllTokens))
 	m.HandleFunc("DELETE "+p+"/tokens/{id}", s.authed(s.revokeToken))
+	m.HandleFunc("POST "+p+"/tokens/{id}/rotate", s.authed(s.rotateToken))
 	m.HandleFunc("GET "+p+"/users", s.authed(s.listUsers))
 	m.HandleFunc("POST "+p+"/users", s.authed(s.createUser))
 	m.HandleFunc("PATCH "+p+"/users/{id}", s.authed(s.updateUser))

internal/server/server_test.go

@@ -335,3 +335,48 @@ func TestImportKea(t *testing.T) {
 		t.Errorf("import over a named subnet: %d %+v", code, third)
 	}
 }
+
+func TestTokenRotation(t *testing.T) {
+	e := newEnv(t)
+	var tok api.Token
+	e.call(e.token, "POST", "/me/tokens", api.TokenInput{Name: "script", ExpiresIn: "30d"}, &tok)
+	var rot api.Token
+	if code := e.call(e.token, "POST", "/tokens/"+itoa(tok.ID)+"/rotate", api.TokenRotation{Grace: "1h"}, &rot); code != 200 || rot.Secret == "" || rot.Secret == tok.Secret || rot.PrevExpiresAt == nil {
+		t.Fatalf("rotate: %d %+v", code, rot)
+	}
+	if rot.ID != tok.ID || rot.Name != "script" || rot.ExpiresAt == nil || rot.ExpiresAt.Sub(*tok.ExpiresAt) < 0 {
+		t.Errorf("rotated token %+v", rot)
+	}
+	if code := e.call(rot.Secret, "GET", "/auth/whoami", nil, nil); code != 200 {
+		t.Errorf("new secret: %d", code)
+	}
+	if code := e.call(tok.Secret, "GET", "/auth/whoami", nil, nil); code != 200 {
+		t.Errorf("old secret in its grace period: %d", code)
+	}
+	var me api.Whoami
+	e.call(rot.Secret, "GET", "/auth/whoami", nil, &me)
+	if me.TokenID != tok.ID {
+		t.Errorf("whoami token id %d, want %d", me.TokenID, tok.ID)
+	}
+	// Without a grace period the old secret stops at once.
+	var rot2 api.Token
+	e.call(e.token, "POST", "/tokens/"+itoa(tok.ID)+"/rotate", nil, &rot2)
+	if code := e.call(rot.Secret, "GET", "/auth/whoami", nil, nil); code != 401 {
+		t.Errorf("old secret without grace: %d", code)
+	}
+	if code := e.call(rot2.Secret, "GET", "/auth/whoami", nil, nil); code != 200 {
+		t.Errorf("newest secret: %d", code)
+	}
+	if code := e.call(e.token, "POST", "/tokens/"+itoa(tok.ID)+"/rotate", api.TokenRotation{Grace: "30d"}, nil); code != 400 {
+		t.Errorf("a grace over 7 days: %d", code)
+	}
+	// A restricted token can't rotate a wider one.
+	var narrow api.Token
+	e.call(e.token, "POST", "/me/tokens", api.TokenInput{Name: "narrow", Role: "leases"}, &narrow)
+	if code := e.call(narrow.Secret, "POST", "/tokens/"+itoa(tok.ID)+"/rotate", nil, nil); code != 403 {
+		t.Errorf("narrow token rotating a wider one: %d", code)
+	}
+	if code := e.call(narrow.Secret, "POST", "/tokens/"+itoa(narrow.ID)+"/rotate", nil, nil); code != 200 {
+		t.Errorf("a token rotating itself: %d", code)
+	}
+}

internal/store/store.go

@@ -187,6 +187,12 @@ CREATE TABLE audit (
 	detail TEXT NOT NULL DEFAULT ''
 );
 CREATE INDEX audit_time ON audit (time);
+`,
+	// 2: token rotation: a new secret, the old one working for a grace period.
+	`
+ALTER TABLE tokens ADD COLUMN rotated_at TEXT;
+ALTER TABLE tokens ADD COLUMN prev_secret_hash TEXT NOT NULL DEFAULT '';
+ALTER TABLE tokens ADD COLUMN prev_expires_at TEXT;
 `,
 }
 

internal/store/users.go

@@ -132,13 +132,13 @@ func (s *Store) DeleteUser(ctx context.Context, id int64) error {
 	return nil
 }
 
-const tokenCols = `t.id, t.user_id, u.username, t.name, t.public_id, t.secret_hash, t.grants, t.expires_at, t.created_at, t.last_used_at, t.last_used_ip, t.revoked_at`
+const tokenCols = `t.id, t.user_id, u.username, t.name, t.public_id, t.secret_hash, t.grants, t.expires_at, t.created_at, t.last_used_at, t.last_used_ip, t.revoked_at, t.rotated_at, t.prev_secret_hash, t.prev_expires_at`
 
 func scanToken(sc interface{ Scan(...any) error }) (*model.Token, error) {
 	t := &model.Token{}
-	var grants, exp, lu, rev sql.NullString
+	var grants, exp, lu, rev, rot, pexp sql.NullString
 	var ca string
-	if err := sc.Scan(&t.ID, &t.UserID, &t.Username, &t.Name, &t.PublicID, &t.SecretHash, &grants, &exp, &ca, &lu, &t.LastUsedIP, &rev); err != nil {
+	if err := sc.Scan(&t.ID, &t.UserID, &t.Username, &t.Name, &t.PublicID, &t.SecretHash, &grants, &exp, &ca, &lu, &t.LastUsedIP, &rev, &rot, &t.PrevSecretHash, &pexp); err != nil {
 		return nil, err
 	}
 	if grants.Valid {
@@ -150,6 +150,7 @@ func scanToken(sc interface{ Scan(...any) error }) (*model.Token, error) {
 		}
 	}
 	t.ExpiresAt, t.LastUsedAt, t.RevokedAt = parseTSPtr(exp), parseTSPtr(lu), parseTSPtr(rev)
+	t.RotatedAt, t.PrevExpiresAt = parseTSPtr(rot), parseTSPtr(pexp)
 	t.CreatedAt = parseTS(ca)
 	return t, nil
 }
@@ -228,6 +229,25 @@ func (s *Store) RevokeToken(ctx context.Context, id int64) error {
 	return nil
 }
 
+// RotateToken gives a token a new secret and expiry. With prevUntil set,
+// the old secret keeps working until then; otherwise it stops at once. A
+// revoked token can't be rotated (ErrNotFound).
+func (s *Store) RotateToken(ctx context.Context, id int64, secretHash string, expiresAt, prevUntil *time.Time) error {
+	prevHash := `''`
+	if prevUntil != nil {
+		prevHash = `secret_hash`
+	}
+	res, err := s.db.ExecContext(ctx, `UPDATE tokens SET prev_secret_hash = `+prevHash+`, prev_expires_at = ?, secret_hash = ?, expires_at = ?, rotated_at = ? WHERE id = ? AND revoked_at IS NULL`,
+		tsPtr(prevUntil), secretHash, tsPtr(expiresAt), ts(time.Now()), id)
+	if err != nil {
+		return err
+	}
+	if n, _ := res.RowsAffected(); n == 0 {
+		return ErrNotFound
+	}
+	return nil
+}
+
 // TouchToken records a token's use.
 func (s *Store) TouchToken(ctx context.Context, id int64, ip string) error {
 	_, err := s.db.ExecContext(ctx, `UPDATE tokens SET last_used_at = ?, last_used_ip = ? WHERE id = ?`, ts(time.Now()), ip, id)

internal/web/static/assets/pages/account.js

@@ -1,8 +1,8 @@
 // Your account: password and API tokens.
 import { h, mount, table, time, modal, input, field, select, errorBox, toast, copyBox } from "../ui.js";
-import { get, api, state, catalog } from "../api.js";
+import { get, api, state, catalog, can } from "../api.js";
 import { rerender } from "../app.js";
-import { revoke } from "./users.js";
+import { revoke, rotateDialog } from "./users.js";
 
 export async function render(el) {
   const me = state.me;
@@ -36,13 +36,21 @@ export async function render(el) {
         { label: "May", render: (t) => h("span", { class: "mono small" }, t.grant_strings.join(" ")) },
         { label: "Expires", render: (t) => t.expires_at ? time(t.expires_at) : "never" },
         { label: "Last used", render: (t) => t.last_used_at ? time(t.last_used_at) : "never" },
-        { label: "", tdClass: "actions-cell", render: (t) => h("button", { class: "small reveal", onclick: () => revoke(t) }, "Revoke") },
+        { label: "", tdClass: "actions-cell", render: (t) => [
+          h("button", { class: "small reveal", onclick: () => rotateDialog(t) }, "Rotate"), " ",
+          h("button", { class: "small reveal", onclick: () => revoke(t) }, "Revoke")] },
       ], tokens, { empty: "No tokens." })));
 }
 
 async function newToken(cat) {
   const name = input({ placeholder: "laptop, backup script…" });
-  const role = select([["", "everything you may do"], ...Object.keys(cat.roles).map((r) => [r, r + ": " + cat.roles[r].join(" ")])], "");
+  // Only roles within what the user may do: a token can never do more
+  // than its user, so offering more would only mislead.
+  const roles = Object.keys(cat.roles).filter((r) => cat.roles[r].every((g) => {
+    const [res, acc] = g.split(":");
+    return can(res, acc === "write");
+  }));
+  const role = select([["", "everything you may do"], ...roles.map((r) => [r, r + ": " + cat.roles[r].join(" ")])], "");
   const expires = select([["", "never"], ["30d", "30 days"], ["90d", "90 days"], ["365d", "a year"]], "90d");
   const err = h("div");
   await modal("New API token", h("div", null, h("div", { class: "form-grid" }, field("Name", name), field("May do", role), field("Expires", expires)), err), [

internal/web/static/assets/pages/settings.js

@@ -1,6 +1,6 @@
 // Settings: the default lease time, conflict checks, authority, and the
 // options every subnet gets.
-import { h, mount, input, field, checkbox, errorBox } from "../ui.js";
+import { h, mount, input, field, checkbox, errorBox, readOnly } from "../ui.js";
 import { get, change, can } from "../api.js";
 import { optionsEditor, fmtSeconds, parseSeconds } from "../widgets.js";
 import { rerender } from "../app.js";
@@ -27,6 +27,7 @@ export async function render(el) {
     } catch (e) { mount(err, errorBox(e)); }
   };
   mount(el,
+    write ? null : h("div", { class: "msg info" }, "You can see the settings but not change them (that needs config:write)."),
     h("div", { class: "page-head" }, h("div", { class: "grow" }, h("h1", null, "Settings and options"),
       h("div", { class: "muted" }, "Server-wide settings, and the options every subnet sends. A subnet's or a reservation's own option of the same name wins."))),
     h("div", { class: "panel" },
@@ -40,4 +41,5 @@ export async function render(el) {
       write ? h("div", { class: "actions", style: { marginTop: "14px" } },
         h("button", { class: "primary", onclick: () => save(false) }, "Save"),
         h("button", { onclick: () => save(true), title: "Check without saving" }, "Check")) : null));
+  if (!write) readOnly(el.querySelector(".panel"));
 }

internal/web/static/assets/pages/subnet.js

@@ -1,5 +1,5 @@
 // A subnet's page: its leases, its reservations and its settings.
-import { h, mount, badge, errorBox, confirmDialog, modal, input, debounce } from "../ui.js";
+import { h, mount, badge, errorBox, confirmDialog, modal, input, debounce, readOnly } from "../ui.js";
 import { get, change, can } from "../api.js";
 import { usageBar, subnetForm, fmtSeconds, subnetLabel } from "../widgets.js";
 import { leasesTable } from "./leases.js";
@@ -53,11 +53,11 @@ async function reservationsTab(el, s) {
 
 async function settingsTab(el, s) {
   const settings = await get("/settings");
+  const form = await subnetForm(s, settings);
   if (!can("config", true)) {
-    mount(el, h("div", { class: "panel" }, h("pre", null, JSON.stringify(s, null, 2))));
+    mount(el, h("div", { class: "msg info" }, "You can see the subnet's settings but not change them (that needs config:write)."), readOnly(h("div", { class: "panel" }, form)));
     return;
   }
-  const form = await subnetForm(s, settings);
   const err = h("div");
   const save = async (dry) => {
     mount(err);

internal/web/static/assets/pages/users.js

@@ -1,5 +1,5 @@
 // Users and everyone's tokens (administrators).
-import { h, mount, table, time, modal, input, field, checkbox, select, errorBox, confirmDialog, toast, badge } from "../ui.js";
+import { h, mount, table, time, fmtTime, modal, input, field, checkbox, select, errorBox, confirmDialog, toast, badge, copyBox } from "../ui.js";
 import { get, api, catalog } from "../api.js";
 import { rerender } from "../app.js";
 
@@ -26,10 +26,46 @@ export async function render(el) {
       { label: "May", render: (t) => h("span", { class: "mono small" }, t.grant_strings.join(" ")) },
       { label: "Expires", render: (t) => t.expires_at ? time(t.expires_at) : "never" },
       { label: "Last used", render: (t) => t.last_used_at ? [time(t.last_used_at), h("span", { class: "muted small" }, " from " + t.last_used_ip)] : "never" },
-      { label: "", tdClass: "actions-cell", render: (t) => h("button", { class: "small reveal", onclick: () => revoke(t) }, "Revoke") },
+      { label: "", tdClass: "actions-cell", render: (t) => [
+        h("button", { class: "small reveal", onclick: () => rotateDialog(t) }, "Rotate"), " ",
+        h("button", { class: "small reveal", onclick: () => revoke(t) }, "Revoke")] },
     ], tokens, { empty: "No tokens." })));
 }
 
+// rotateDialog gives a token a new secret. It keeps its name, ID and
+// permissions; only the programs that use it need the new secret.
+export async function rotateDialog(t) {
+  const grace = select([["", "stops working now"], ["10m", "keeps working for 10 minutes"], ["1h", "keeps working for 1 hour"], ["1d", "keeps working for 1 day"], ["7d", "keeps working for 7 days"]], "");
+  const expOpts = [["", t.expires_at ? "the same lifetime again, from now" : "never expires (as now)"], ["30d", "30 days from now"], ["90d", "90 days from now"], ["365d", "1 year from now"]];
+  if (t.expires_at) expOpts.push(["never", "never expires"]);
+  const exp = select(expOpts, "");
+  const err = h("div");
+  const box = h("div");
+  const go = h("button", { class: "primary", onclick: async () => {
+    mount(err);
+    const body = {};
+    if (grace.value) body.grace = grace.value;
+    if (exp.value === "never") body.no_expiry = true;
+    else if (exp.value) body.expires_in = exp.value;
+    go.disabled = true;
+    try {
+      const r = await api("POST", "/tokens/" + t.id + "/rotate", { body });
+      mount(box, h("div", { class: "msg ok" },
+        h("p", null, "New secret for " + t.name + ". Copy it now: it is not shown again."),
+        copyBox(r.secret),
+        h("p", { class: "small" }, r.previous_secret_valid_until ? ["The old secret keeps working until ", fmtTime(r.previous_secret_valid_until), "."] : "The old secret no longer works.")));
+      rerender();
+    } catch (ex) { go.disabled = false; mount(err, errorBox(ex)); }
+  } }, "Rotate");
+  mount(box,
+    h("p", null, "Gives ", h("strong", null, t.name), " a new secret. It keeps its name, ID and permissions, so only the programs that use it need updating."),
+    h("div", { class: "form-grid" },
+      field("Old secret", grace, "A grace period lets you update the programs without an outage. If the token may have leaked, let it stop now."),
+      field("Expires", exp)),
+    err, h("div", { class: "actions mt" }, go));
+  await modal("Rotate token " + t.name, box, [{ label: "Close", value: null }], { sticky: true });
+}
+
 export async function revoke(t) {
   if (!await confirmDialog("Revoke token", "Revoke " + t.username + "'s token “" + t.name + "”? Anything using it is refused from now on.", "Revoke", "danger")) return;
   try {

internal/web/static/assets/style.css

@@ -351,3 +351,5 @@ table.activity td.detail { white-space: normal; color: var(--muted); }
 .type-NAK, .type-DECLINE, .type-CONFLICT, .type-NO { color: var(--err); }
 .type-RELEASE { color: var(--muted); }
 td.mono, span.mono { font-family: var(--mono); font-size: 13px; }
+.mt { margin-top: 10px; }
+input:disabled, select:disabled, textarea:disabled { background: var(--info-soft); color: var(--muted); cursor: not-allowed; opacity: 1; }

internal/web/static/assets/ui.js

@@ -226,3 +226,11 @@ export function backLink(label, href) {
 export function safeBack(v) {
   return v && /^#\/[A-Za-z0-9\/?=&%._~+-]*$/.test(v) ? v : null;
 }
+
+// readOnly locks a form for someone who may look but not change: every
+// control is disabled, and the editors' add and remove buttons hidden.
+export function readOnly(el) {
+  for (const c of el.querySelectorAll("input, select, textarea")) c.disabled = true;
+  for (const b of el.querySelectorAll("button")) b.classList.add("hidden");
+  return el;
+}