The /api/v1/tokens and /api/v1/sessions routes move out of src/http/api.ts into src/http/api/tokens.ts, unchanged #7482

The five sign-in and token routes move out of src/http/api.ts into a new src/http/api/tokens.ts as tokenRoutes(router), in the shape of src/http/api/labels.ts. The routes are POST and DELETE /api/v1/sessions, POST and GET /api/v1/tokens, and DELETE /api/v1/tokens/:id. api.ts calls tokenRoutes(router) once, where the sessions routes used to be, and drops the eight imports only they used.

The moved handler bodies are byte-identical to what was removed (I checked with a diff). The token routes are now registered a little earlier than before. The router uses the first route that matches, but no wildcard pattern sits over /api/v1/…, so that changes nothing. /api/v1/first-admin… and /api/v1/users/:username/signins|sessions stay in api.ts: they are a different door and are not in the issue.

One test changed. test/cookie-flags.test.ts counts the places that set a cookie, file by file and by path. The four set-cookie sites (password sign-in and sign-out) moved with the code, so their entry moves from src/http/api.ts to src/http/api/tokens.ts at the same count of 4. The test was not wrong; it names files, and a move changes the name. I also corrected the entry's comment, which said it counted an import; the import line never matched.

Checked: bun x tsc --noEmit is clean. scripts/fast.ts named 927 files (about 81 minutes), so I ran the ones that cover this change instead, and all pass:

• the 67 files that call /api/v1/tokens or /api/v1/sessions, plus the openapi, route and session test files
• the 13 files that read src/http/api.ts by path

To review, read src/http/api/tokens.ts on its own. The diff to api.ts is only deletions, the new import and the one call.

🤖 Generated with Claude Code

Closes #7447

The five sign-in and token routes move out of src/http/api.ts into a new src/http/api/tokens.ts as tokenRoutes(router), in the shape of src/http/api/labels.ts. The routes are POST and DELETE /api/v1/sessions, POST and GET /api/v1/tokens, and DELETE /api/v1/tokens/:id. api.ts calls tokenRoutes(router) once, where the sessions routes used to be, and drops the eight imports only they used.

The moved handler bodies are byte-identical to what was removed (I checked with a diff). The token routes are now registered a little earlier than before. The router uses the first route that matches, but no wildcard pattern sits over /api/v1/…, so that changes nothing. /api/v1/first-admin… and /api/v1/users/:username/signins|sessions stay in api.ts: they are a different door and are not in the issue.

One test changed. test/cookie-flags.test.ts counts the places that set a cookie, file by file and by path. The four set-cookie sites (password sign-in and sign-out) moved with the code, so their entry moves from src/http/api.ts to src/http/api/tokens.ts at the same count of 4. The test was not wrong; it names files, and a move changes the name. I also corrected the entry's comment, which said it counted an import; the import line never matched.

Checked: bun x tsc --noEmit is clean. scripts/fast.ts named 927 files (about 81 minutes), so I ran the ones that cover this change instead, and all pass:

• the 67 files that call /api/v1/tokens or /api/v1/sessions, plus the openapi, route and session test files
• the 13 files that read src/http/api.ts by path

To review, read src/http/api/tokens.ts on its own. The diff to api.ts is only deletions, the new import and the one call.

🤖 Generated with Claude Code

The five sign-in and token routes move out of src/http/api.ts into a new src/http/api/tokens.ts as tokenRoutes(router), in the shape of src/http/api/labels.ts. The routes are POST and DELETE /api/v1/sessions, POST and GET /api/v1/tokens, and DELETE /api/v1/tokens/:id. api.ts calls tokenRoutes(router) once, where the sessions routes used to be, and drops the eight imports only they used.

The moved handler bodies are byte-identical to what was removed. The token routes are now registered a little earlier than before. The router uses the first route that matches, but no wildcard pattern sits over /api/v1/…, so that changes nothing. /api/v1/first-admin… and /api/v1/users/:username/signins|sessions stay in api.ts: they are a different door and are not in the issue.

One test changed. test/cookie-flags.test.ts counts the places that set a cookie, file by file and by path. The four set-cookie sites (password sign-in and sign-out) moved with the code, so their entry moves from src/http/api.ts to src/http/api/tokens.ts at the same count of 4. The test was not wrong; it names files, and a move changes the name. I also corrected the entry's comment, which said it counted an import; the import line never matched.

Merged with main. The only conflict was two neighbouring import lines in api.ts: this branch's tokenRoutes and main's issueRoutes, labelsHandler. Both are kept. main made no changes to the moved routes, and none of the files it changed set cookies, so the cookie census still holds.

Checked after the merge: bun x tsc --noEmit is clean, and 771 tests pass with 0 failures. They come from every test file that:

• calls /api/v1/tokens or /api/v1/sessions
• reads src/http/api… by path
• covers openapi, routes, cookies or sessions

To review, read src/http/api/tokens.ts on its own. The diff to api.ts is only deletions, the new import and the one call.

🤖 Generated with Claude Code

I merged main into this branch and pushed it. The only conflict was src/http/api.ts, in two places. bun x tsc --noEmit is clean. I ran 20 token, admin and team test files (134 tests) and all pass. I didn't run the whole suite. scripts/fast.ts said this diff reaches 937 of 1638 test files, about 82 minutes, so I left the full run to the forge's check.

• Imports: I kept both. tokenRoutes is the import this pull adds, and accountAdmin and adminRoutes come from ./api/admin.ts, which main added.
• Route bodies: I kept neither side's inline copy. This pull had moved the /api/v1/tokens handlers into ./api/tokens.ts. main had moved the admin and teams routes into ./api/admin.ts. Both sets of routes are still registered, and api.ts no longer defines them inline.

One test run printed a sandbox denial for maria--forge.test:443. It did not affect the result.

The full gate on land was red; the pull is open again. Red tests:

• verify an email from the People screen > an admin verifies the person under the cursor and the row changes
• verify an email from the People screen > listPeople says who is verified

The gate's log: /api/v1/repos/trevato/forge/gates/1793153236478-0a613910557d/log

Steward tick: this pull is red on its own merge with current main (gated alone, failed) and was held out of the landing queue so the others can land. Rebase on main, fix the failing test, push - then the hold comes off.

The full suite on this head squashed onto main (accaa65) was red, so the pull has not joined the merge queue.

Red tests:

• a real roll of two forge processes on one data directory > an old forge that lingers past a probe period refuses nobody
• a push in flight on the old forge completes across the roll, and no connection is refused
• model budget: zero, an own subscription, a capped grant > a capped grant runs, and stops being offered at the cap

The gate's log: /api/v1/repos/trevato/forge/gates/1793194002391-245a44baff0c/log

It is proved again on a push.

The /api/v1/tokens and /api/v1/sessions routes move out of src/http/api.ts into their own module, src/http/api/tokens.ts. Behaviour is unchanged. api.ts now hands those paths to the new module, so it loses about 115 lines. One test changes: test/cookie-flags.test.ts now reads the session cookie flags from the file the routes live in. Its assertions are the same.

About the red gate on accaa65: this branch is now merged with current main (852034dd, which includes accaa65). On that head, bun x tsc --noEmit passes, and so do the three tests the gate named and the cookie-flags test: test/model-grant.test.ts, test/rehearsal.test.ts, test/release-handover.test.ts, test/cookie-flags.test.ts. That is 23 passing and 0 failing, and model-grant also passed on two more runs. None of the three red tests uses the tokens or sessions routes; they cover rolling one forge process over to another and model grant budgets. They look timing-sensitive when the whole suite runs together, not broken by this move, so I changed no code or tests for them. The gate log at /api/v1/repos/trevato/forge/gates/1793194002391-245a44baff0c/log answered not_found to my token, so I could not read the actual failures. If the gate goes red again with a reason that points at these routes, I will fix it here.

To try it: sign in and create a token, list it and revoke it at /api/v1/tokens, or list and end a session at /api/v1/sessions. They answer exactly as they do on main.

🤖 Generated with Claude Code

The /api/v1/tokens and /api/v1/sessions routes move out of src/http/api.ts into src/http/api/tokens.ts with no change in what they do (#7447). api.ts registers them with tokenRoutes(router). The handlers, their order, and every refusal (cross-origin, admin confirm, throttling, scope) are the same as before.

This push merges main back in. main had added POST /api/v1/conversation-tokens (#7648) directly after the POST /api/v1/tokens handler, which is the code this branch moved, so api.ts conflicted. I kept main's new route where main put it, in api.ts, and removed the copy of POST /api/v1/tokens that came back with the merge. That handler now lives only in tokens.ts. I chose not to move the conversation-token route into tokens.ts as well: it is new behaviour from another pull, and moving it would make this refactor bigger than its issue.

What to look at: src/http/api.ts has the conversation-tokens route between the crew scorecard and first-admin routes, and no second POST /api/v1/tokens. createToken is still imported in api.ts because the first-admin route uses it.

Checks run here: bun scripts/gate.ts and bun x tsc --noEmit pass. scripts/fast.ts said the diff was too broad to pick tests (forge.json changed in the merge), so I ran the files that cover these routes myself: via-token, tokens, token-admin-scope, cookie-flags, signin-throttle, signins, session-refusals, web-tokens-edge, forge-signin and origin-no-token. All 69 tests pass; the forge's check runs the full suite on this push.

To try it: sign in, then mint, list and revoke a token on the preview with POST, GET and DELETE on /api/v1/tokens. They should answer exactly as they do in production.

🤖 Generated with Claude Code