feat(settings): add personal token creation flow

[IvGolovach]

Summary

• Add a settings flow for creating personal tokens with optional expiry.
• Reveal the plain-text token once after creation and keep list and revoke actions on the same page.
• Keep duplicate-name handling and token storage rules in the shared personal token service.

Why

• Provide a direct path for CI and other non-interactive workflows to create personal tokens.
• Keep issuance, expiry validation, duplicate-name handling, and token hashing in one place.

Diff scope

• Base branch: main
• Head branch: feat-settings-create-personal-tokens
• Branch integrity: git rev-list --left-right --count origin/main...HEAD -> 0 4
• Ahead count: 4
• Behind count: 0
• Fast-forward safety: safe
• Merge-base SHA: 9fe2f2e658389f2000b67ff16ec42c93e452b74a
• Commits:
  • 51463d94fb6f6a26c8156454509be9a2c9ccac21 feat(settings): add personal token creation flow
  • 6c5f74cd8934e568ac8c76cd351a9b9d5d6b5c19 fix(settings): polish token revoke flow
  • 9992a37db01b1363249fe2e1d35b1f7591997f40 fix(settings): harden personal token flow states
  • 254a4394dbd850b4a7761ed704564d37ee0c5183 test(settings): cover token route failure states
• Areas touched:
  • packages/frontend/src/app/settings/SettingsClient.tsx
  • packages/frontend/src/app/api/settings/tokens/route.ts
  • packages/frontend/src/lib/auth/personalTokens.ts
  • packages/frontend/__tests__/api/settingsTokens.test.ts
  • packages/frontend/__tests__/lib/personalTokens.test.ts

Test proof

• npx vitest run __tests__/api/settingsTokens.test.ts __tests__/lib/personalTokens.test.ts __tests__/api/devicePoll.test.ts __tests__/api/submitAuth.test.ts
  • Result: 4 passed files, 34 passed tests
• npx eslint __tests__/api/settingsTokens.test.ts __tests__/lib/personalTokens.test.ts __tests__/api/devicePoll.test.ts __tests__/api/submitAuth.test.ts src/app/api/settings/tokens/route.ts src/app/settings/SettingsClient.tsx src/lib/auth/personalTokens.ts src/app/api/auth/device/poll/route.ts src/app/api/submit/route.ts
  • Result: pass
• Coverage: Not applicable - frontend-only change set

Verification-pack proof

Not applicable - no workflow, infrastructure, governance, replay, or migration changes.

Migration notes

Not applicable - no schema or migration changes.

CI context confirmation

CI context names unchanged.

Rollback plan

git revert --no-edit 51463d94fb6f6a26c8156454509be9a2c9ccac21^..254a4394dbd850b4a7761ed704564d37ee0c5183

Known residual risks

• npx tsc -p tsconfig.json --noEmit was not used as merge proof because it did not complete within the local validation window.
• Final browser review of the token reveal panel is still recommended.

[vercel]

@IvGolovach is attempting to deploy a commit to the Inevitable Team on Vercel.

A member of the Team first needs to authorize it.

[cubic-dev-ai]

2 issues found across 5 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="packages/frontend/src/app/settings/SettingsClient.tsx">

<violation number="1" location="packages/frontend/src/app/settings/SettingsClient.tsx:364">
P2: The cancellation flag isn’t checked before `setUser`, so if the component unmounts while `/api/auth/session` is in flight, `setUser` can still run and update state after unmount. Guard this update with the cancellation flag (as you already do for later state updates) to avoid React warnings and stale updates.</violation>
</file>

<file name="packages/frontend/src/app/api/settings/tokens/route.ts">

<violation number="1" location="packages/frontend/src/app/api/settings/tokens/route.ts:27">
P2: The API contract says `expiresAt` must be an ISO date string, but validation uses `new Date(value)` which accepts many non-ISO formats. This permits ambiguous/non-ISO inputs despite the stated requirement, potentially resulting in unexpected expiry times.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

1 issue found across 4 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="packages/frontend/src/app/settings/SettingsClient.tsx">

<violation number="1" location="packages/frontend/src/app/settings/SettingsClient.tsx:364">
P2: Unmount cancellation is incomplete: stale async branches can still call `router.push` after component unmount, causing unexpected redirects.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}