Description
routers/web/user/setting/applications.go still manages access tokens with the deprecated page-rerender pattern: ApplicationsPost answers validation and domain errors with ctx.Flash.Error + redirect (and the last renderPage-style attempt in PR #38966 was rejected in favor of the form-fetch-action + JSONError framework). The form in templates/shared/user/access_tokens.tmpl is a plain form submit, so a failed POST redirects away and wipes the token name the user just typed.
Proposal
Migrate the user-settings access-token flow onto the modern "form-fetch-action" + JSONError framework, the same way repo/setting/deploy_key.go already does:
- Add
form-fetch-action to the create form (regenerate/delete already answer ctx.JSONRedirect) and bind the handler with context.GetFetchActionForm instead of web.GetForm + ctx.HasError.
- Answer validation and domain errors (
ErrAccessTokenNoPermission, duplicate name, scope escalation) with ctx.JSONError / ctx.JSONErrorWithField so the client shows a toast and the submitted form state survives.
- Decide on a consistent way to display the one-time token value after a successful create (currently
ctx.Flash.Info), ideally with the existing clipboard affordance.
This extracts the settings-side half of the rework done in #38966 so the admin bot-token flow and the user-settings flow stay consistent.
Description
routers/web/user/setting/applications.gostill manages access tokens with the deprecated page-rerender pattern:ApplicationsPostanswers validation and domain errors withctx.Flash.Error+ redirect (and the last renderPage-style attempt in PR #38966 was rejected in favor of the form-fetch-action + JSONError framework). The form intemplates/shared/user/access_tokens.tmplis a plain form submit, so a failed POST redirects away and wipes the token name the user just typed.Proposal
Migrate the user-settings access-token flow onto the modern "form-fetch-action" + JSONError framework, the same way
repo/setting/deploy_key.goalready does:form-fetch-actionto the create form (regenerate/delete already answerctx.JSONRedirect) and bind the handler withcontext.GetFetchActionForminstead ofweb.GetForm+ctx.HasError.ErrAccessTokenNoPermission, duplicate name, scope escalation) withctx.JSONError/ctx.JSONErrorWithFieldso the client shows a toast and the submitted form state survives.ctx.Flash.Info), ideally with the existing clipboard affordance.This extracts the settings-side half of the rework done in #38966 so the admin bot-token flow and the user-settings flow stay consistent.