[Feature] Developer personal access tokens and API keys #3333

Confirmations

• I have read and agree to AGPL-3.0 Section 15. The program is provided "as is" without any warranties; you bear all risks of using it.
• I have read and agree to AGPL-3.0 Section 16. The copyright holders and distributors are not liable for any damages resulting from the use or inability to use the program.
• I confirm my description is clear, polite, helps developers quickly locate the issue, and complies with community rules.
• I have read the Open-Box documentation.
• I confirm there are no duplicate issues or discussions.
• I believe this issue must be handled by Open-Box and not by a third party.
• I confirm this feature has not been implemented yet.
• I confirm this feature is reasonable and has general demand, not just my personal need.

Feature Description

Open-Box currently offers only two credential types for machine access: the single global admin site token (shared, all-powerful) and per-user login JWTs (short-lived, tied to password logins). There is no way for a user to issue a scoped, revocable personal access token (PAT) for scripts, AI agents (Claude, ChatGPT plugins), Composio toolkits, or open-connect connectors.

This is the foundational credential layer for using Open-Box as a personal/family data warehouse connected to external tooling.

Suggested Solution

• New AccessToken model (user-scoped): id, user_id, name, prefix (for display, e.g. obk_a1b2...), token_hash (sha256, never store raw), scopes (e.g. fs:read, fs:write, fs:list, share:read, task:read), expires_at, last_used_at, revoked_at, timestamps.
• Raw token shown once at creation (obk_<random>), stored hashed.
• Auth middleware: accept Authorization: Bearer obk_..., resolve to user + scopes, attach to context; enforce scope checks on /api/fs/* (read vs write) and MCP tool calls.
• Admin self-service API under /api/me/token/*: create (with scopes + expiry), list, revoke. Users can only manage their own tokens.
• Rate-limit and audit last_used_at updates (throttled).
• Admin site token behavior unchanged for backward compatibility.

Additional Information

Survey of current code (main @ 1efa7f9): JWT issuance in server/handles/auth.go (loginHash -> common.GenerateToken), process-local invalidation in server/common/auth.go, auth middleware in server/middlewares/auth.go (Auth/Authn), MCP auth in server/mcp/oauth.go. No PAT model exists; internal/db/db.go AutoMigrate list has no token table.

AI Generated Content (optional)

Drafted with AI assistance (Qoder); no chat log attached.