[snyaggarwal]

Refs OpenConceptLab/ocl_online#201. The Mapper side is OpenConceptLab/oclmap#130.

Map projects stored endpoint tokens inside algorithms and lookup_config, and every map project response returned them.

Changes

• Storage. A new MapProject.credentials field holds the tokens, keyed by endpoint URL. No serializer includes it, so it can't be read or written through the API; plain lists defer it, and CSV exports, plain and verbose, leave it out (get_readable_field_names() skips WRITE_ONLY_FIELDS).
• Saving. clean_tokens() (from clean()) moves tokens out on every save, PUT and PATCH alike. PATCH now saves through persist_changes, so it runs full model validation too.
  • A missing token keeps the stored one for the same URL; a token that is empty, blank or null clears it.
  • A changed URL or a removed algorithm drops its token. An algorithm without a URL keeps no token.
  • Algorithms on one URL share one token; different new tokens for one URL are a 400.
  • Nested token keys are removed too.
  • A new token for an OCL API lookup isn't stored: one with no URL, a path, or a URL on API_BASE_URL's origin. Only http(s)://, in any case, is absolute, as in the Mapper.
  • lookup_config and each algorithm must be objects.
  • Stored tokens are read under a row lock. The logs and input-file saves write only their own fields, so a concurrent save can't drop a new token or bring back a removed one.
• Reading. Responses show has_token: true in place of a token, never for an OCL API lookup. Tokens are stripped on read from algorithms, lookup_config (whatever its shape), logs and auto-match run snapshots.
• Logs and snapshots. save() strips token from logs, and run snapshots drop it when created.
• Errors. A save that hits a database integrity error returns a generic message, since the database's text can quote the failing row. A save of a project deleted meanwhile returns a 400.
• Migration 0041:
  • Moves existing tokens into credentials and strips them from algorithms, lookup_config, logs and run snapshots.
  • OCL lookup tokens are kept (not flagged or used) so they can be found and revoked. So are tokens found only in a project's logs, under credentials['logs']. A cleanup can remove both later.
  • Stops before changing anything, naming each project and URL, if algorithms on one URL hold different tokens. Production has none.
  • Reverse: puts algorithm and lookup tokens back on their entries. Tokens stripped from logs and run snapshots, including the log-only ones kept in credentials['logs'], aren't restored and go with the column. Roll back the image rather than the migration.
• Helpers in core/common/utils.py: drop_key_deep, get_url_origin.

Not in this PR

• Encrypting credentials at rest.
• Removing the kept OCL lookup and log-only tokens once they're revoked.

Tests

• core/map_projects/tests/test_tokens.py:
  • No response or CSV export contains a token.
  • Saving: PUT and PATCH, OCL lookups, shared URLs, shapes, stale and deleted saves, logs.
  • Run snapshots.
  • Migration forward and back, including the conflict stop.
• Run in GitHub Actions (Pylint, Tests).

🤖 Generated with Claude Code

[snyaggarwal]

Review of the token split: 9 inline comments. The first two are the ones I'd address before merge: nested token keys stay stored and leave in the verbose CSV, and migrated OCL lookup tokens are kept and reported as has_token.

[snyaggarwal]

Reviewed with OpenConceptLab/oclmap#130 at the current heads. One migration finding below. I did not run tests or pylint locally, per request.

[snyaggarwal]

Rereviewed with OpenConceptLab/oclmap#130. The earlier P2 is addressed: 0041 now checks for conflicting tokens on one URL before changing project rows, and covers conflict and same-token cases. I found no further actionable findings or nits in this pass. I did not run tests or pylint locally, per request.