[JacobStephens2]

Closes #1755

Summary

console token create/list/revoke
  → locked, owner-only SHA-256 token store
Authorization: Bearer <token>
  → HTTPS/direct-loopback check → authenticate → route scope → shared read JSON
console whoami --json ↔ GET /api/v1/whoami

Adds all five token scope names (default read), expiry, immediate revocation, last use and machine/caller identity. Documents the CLI and API in the guide and site. Security content filtering/actions, address scopes and rate limits remain the published sibling tickets #1756, #1757 and #1758.

Evidence

Execution evidence

Testing seams: token management through the binary; Console HTTP; route-table CLI parity.

Exact command	Before	After
cargo test --test console tokens::token_cli_shows_the_secret_once_and_lists_only_metadata	FAILED: usage: thirdshift console ...	1 passed; 0 failed
cargo test --test console tokens::bearer_read_updates_last_use_and_revoke_takes_effect_on_the_next_request	FAILED: left: 401, right: 200	1 passed; 0 failed
cargo test --test console tokens::route_scopes_refuse_a_token_missing_read_and_name_the_scope	FAILED: left: 200, right: 403	1 passed; 0 failed
cargo test --test console tokens::whoami_reports_the_machine_caller_scopes_and_local_cli_parity	FAILED: usage: thirdshift console ...	1 passed; 0 failed
cargo test --test command_surface help_is_a_compact_reference_with_a_link_to_the_details	FAILED: help should fit in a short reference, got 72 lines	Passed within cargo test --test command_surface: 20 passed; 0 failed; 1 ignored

• cargo test --test console tokens::: 6 passed, covering transport refusals, expiry, scopes, revocation, metadata and whoami parity.
• cargo test --test console accounts::api_requires_a_current_sign_in_and_returns_json_instead_of_redirecting: 1 passed, including session address/scopes in whoami.
• cargo test --bin thirdshift console::tests: 5 passed, including the assertion that token management has no HTTP routes.
• An isolated binary/storage check confirmed mode 0600, the exact SHA-256 digest and no plaintext token or hash in list output.
• cargo clippy --bin thirdshift -- -D warnings: passed after the review fix.
• NEXTEST_TEST_THREADS=8 /usr/bin/time -p scripts/affected-tests origin/issue-1753: final local selection passed 62 site checks, the locked build and 126 Console checks. Its Rust phase was stopped with SIGINT after successful CI covered the identical final head, following docs/testing.md's CI-reuse rule. Local Rust elapsed 874.25s, including compilation, before cancellation.
• CI on final head 7efc26fd: cargo fmt --check, cargo clippy --all-targets -- -D warnings, and cargo nextest run passed. Full Rust result: 3,755 passed, 82 skipped, 1008.797s execution plus 1m08s compilation. Site and Console CI checks also passed, as did both Linux platform builds.

Visual evidence

Console API documentation, desktop 1440×900:

Same documentation and state, mobile 390×844:

Merge Danger

Door: two-way

Rollback removes bearer authentication; token metadata lives in a separate private file beside the Credentials.

Blast Radius: Console

Adds an authentication path to the existing API. CLI-only issuance, transport checks and route scopes constrain access.

Review coverage

Reviewed against issue-1753, pinned to its remote commit d4b52b93187cc4c15e6eb0e74527832df26ef999. The local base ref was stale and checked out in another worktree.

Standards: 1 naming finding, addressed in 7315e9c1 by renaming Viewer.email to caller_label. Spec: 0 findings. Both axes read all 18 changed files, including generated site/docs/index.html. Changed files left unread: none. Generated-output exclusions: none.

Unaddressed findings

Standards

None.

Spec

None.

Security

None.

Built with codex codex-cli 0.164.0 · gpt-6.1-sol · xhigh

Security review outcome

No unaddressed introduced findings.