Fixes #25903: Refactor API tokens after clear-text removal

[amousset]

https://issues.rudder.io/issues/25903

A similar change needs to be done in the api-authorizations plugins for user tokens.

Backend

• Since Fixes #25902: Remove support for clear-text API tokens #6030 the old tokens are not usable anymore, this pull request takes advantage of this to refactor this part.

Data types

Split the ApiToken type, which used to contain both clear-text and hashed values into two separate types to prevent confusions and prevent misusage as much as possible:

• ApiTokenSecret: The token value, to be sent to the creator and not stored on the server
• ApiTokenHash: The token hash, as stored (either in LDAP or memory)
  • Make no effort to prepare for a v3 (appart from storage), it would only be needed in case sha2 is not considered safe anymore. Future changes to the API access would likely be for something quite different (OAUTH/JWT/...), with a different architecture.

Also modifying the account types:

• ApiAccount now contains a ApiTokenHash
• A new NewApiAccount is created, to be used after creation, and contains a ApiTokenSecret

Notes:

• The system token now also uses a hash, and the clear text value is not kept after the token files creation.
• Make the access to the secret and hash values explicit with expose() methods (and make the value private)

Usage

The JSON serialization of the accounts, used by the API tokens Web interface, is modified:

• For new accounts, the token value is sent
• For existing account, the token hash version only is sent

Frontend

• Display the list of unsupported tokens along with a global warning
• Hide the enable/disable button for unsupported tokens (as it could not be actionnable)

[amousset]

Commit modified

[amousset]

Commit modified

[amousset]

Commit modified

[amousset]

Commit modified

[amousset]

Commit modified