Robert Helewka
81426327bf
Replace plaintext token storage with SHA-256 hashes so leaked database contents cannot be used to authenticate. Plaintext is generated, shown once at creation time, and never persisted. - Add `hash_token()` helper and `MCPTokenManager.create_token()` that returns `(instance, plaintext)`. - Replace `token` field with indexed `token_hash`; look up bearers by hashing the incoming value. - Update dashboard, management command, and admin to surface plaintext only at creation. Disable admin "add" since it cannot reveal plaintext. - Migration drops the old `token` column and adds `token_hash`; pre-existing tokens are invalidated and must be reissued.
17 lines
697 B
Python
17 lines
697 B
Python
"""URL routes for the MCP token self-service dashboard."""
|
|
|
|
from django.urls import path
|
|
|
|
from . import views
|
|
|
|
app_name = "mcp_server"
|
|
|
|
urlpatterns = [
|
|
path("profile/mcp-tokens/", views.mcp_token_list, name="mcp-token-list"),
|
|
path("profile/mcp-tokens/add/", views.mcp_token_create, name="mcp-token-create"),
|
|
path("profile/mcp-tokens/<int:pk>/", views.mcp_token_detail, name="mcp-token-detail"),
|
|
path("profile/mcp-tokens/<int:pk>/edit/", views.mcp_token_edit, name="mcp-token-edit"),
|
|
path("profile/mcp-tokens/<int:pk>/revoke/", views.mcp_token_revoke, name="mcp-token-revoke"),
|
|
path("profile/mcp-tokens/<int:pk>/delete/", views.mcp_token_delete, name="mcp-token-delete"),
|
|
]
|