feat: allow client-based web tokens

server/api/v1/client/user/webtoken.post.ts

@@ -0,0 +1,31 @@
+import { APITokenMode } from "@prisma/client";
+import { DateTime } from "luxon";
+import { UserACL } from "~/server/internal/acls";
+import { defineClientEventHandler } from "~/server/internal/clients/event-handler";
+import prisma from "~/server/internal/db/database";
+
+export default defineClientEventHandler(
+  async (h3, { fetchUser, fetchClient, clientId }) => {
+    const user = await fetchUser();
+    const client = await fetchClient();
+
+    const acls: UserACL = [
+      "read",
+      "store:read",
+      "collections:read",
+      "object:read",
+    ];
+
+    const token = await prisma.aPIToken.create({
+      data: {
+        name: `${client.name} Web Access Token ${DateTime.now().toISO()}`,
+        clientId,
+        userId: user.id,
+        mode: APITokenMode.Client,
+        acls,
+      },
+    });
+
+    return token.token;
+  }
+);

server/api/v1/collection/index.get.ts

@@ -2,7 +2,7 @@ import aclManager from "~/server/internal/acls";
 import userLibraryManager from "~/server/internal/userlibrary";
 
 export default defineEventHandler(async (h3) => {
-  const userId = await aclManager.getUserIdACL(h3, ["collections:new"]);
+  const userId = await aclManager.getUserIdACL(h3, ["collections:read"]);
   if (!userId)
     throw createError({
       statusCode: 403,