Unleash / unleash / 31502921600

87%

master: 91%

Build Type

push

github

Committed by web-flow

Commit Message

feat: securely store personal and service account tokens

## Summary

Extends secure storage to personal access tokens (PATs) and
service-account tokens behind the dedicated `secureAccountTokenStorage`
flag.

## Why this is safe to roll out

PAT and service-account secrets are shown only in the one-time creation
dialog. Their list APIs do not return the secret and their UI tables do
not provide a copy action. Secure storage therefore preserves the
established behaviour: the secret cannot be retrieved after creation.

## Storage and authentication

`personal_access_tokens` remains the backing table. The migration
permits exactly one credential shape per row:

- legacy: raw `secret`, retaining the existing storage behaviour. It
remains indexed for lookup, but is intentionally not made newly unique
so an instance with historic or manually altered duplicate data can
still migrate.
- secure: `selector` + `verifier`, with a unique selector; the raw
secret is never persisted.

Secure authentication looks up by selector in the store and verifies the
credential in `AccountService`; after successful authentication, only
the selector is added to the batched last-seen state.

## Deliberate difference from API token v2

This does not introduce a separate account-token-v2 store/service. API
tokens have a distinct lifecycle and management API, whereas PATs and
service-account tokens already share the account-token lifecycle,
ownership model, storage table, and authorization outcome.

The trade-off is mixed v1/v2 persistence at the account-token edge. A
separate service/table would make that split more explicit but would
duplicate the account-token domain and force merging two shapes further
into the system. We instead contain version-specific persistence and
verification at the boundary, then treat verified credentials as account
access.

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Coverage Stats

1994 of 2198 branches covered (90.72%)

26 of 49 new or added lines in 5 files covered. (53.06%)

4 existing lines in 4 files now uncovered.

15756 of 18029 relevant lines covered (87.39%)

825.69 hits per line