feat: add management token permissions

crates/aether-data/src/repository/management_tokens/mysql.rs

@@ -42,6 +42,7 @@ SELECT
   description,
   token_prefix,
   allowed_ips,
+  permissions,
   expires_at AS expires_at_unix_secs,
   last_used_at AS last_used_at_unix_secs,
   last_used_ip,
@@ -62,6 +63,7 @@ SELECT
   mt.description,
   mt.token_prefix,
   mt.allowed_ips,
+  mt.permissions,
   mt.expires_at AS expires_at_unix_secs,
   mt.last_used_at AS last_used_at_unix_secs,
   mt.last_used_ip,
@@ -96,6 +98,7 @@ SELECT
   mt.description,
   mt.token_prefix,
   mt.allowed_ips,
+  mt.permissions,
   mt.expires_at AS expires_at_unix_secs,
   mt.last_used_at AS last_used_at_unix_secs,
   mt.last_used_ip,
@@ -121,6 +124,7 @@ SELECT
   mt.description,
   mt.token_prefix,
   mt.allowed_ips,
+  mt.permissions,
   mt.expires_at AS expires_at_unix_secs,
   mt.last_used_at AS last_used_at_unix_secs,
   mt.last_used_ip,
@@ -211,8 +215,8 @@ impl ManagementTokenWriteRepository for MysqlManagementTokenRepository {
             r#"
 INSERT INTO management_tokens (
   id, user_id, token_hash, token_prefix, name, description, allowed_ips,
-  expires_at, is_active, created_at, updated_at
-) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+  permissions, expires_at, is_active, created_at, updated_at
+) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
 "#,
         )
         .bind(&record.id)
@@ -222,6 +226,7 @@ INSERT INTO management_tokens (
         .bind(&record.name)
         .bind(record.description.as_deref())
         .bind(json_to_string(record.allowed_ips.as_ref())?)
+        .bind(json_to_string(record.permissions.as_ref())?)
         .bind(
             record
                 .expires_at_unix_secs
@@ -262,6 +267,7 @@ INSERT INTO management_tokens (
         } else {
             record.allowed_ips.as_ref().or(current.allowed_ips.as_ref())
         };
+        let permissions = record.permissions.as_ref().or(current.permissions.as_ref());
         let expires_at = if record.clear_expires_at {
             None
         } else {
@@ -276,6 +282,7 @@ UPDATE management_tokens
 SET name = ?,
     description = ?,
     allowed_ips = ?,
+    permissions = ?,
     expires_at = ?,
     is_active = ?,
     updated_at = ?
@@ -285,6 +292,7 @@ WHERE id = ?
         .bind(name)
         .bind(description)
         .bind(json_to_string(allowed_ips)?)
+        .bind(json_to_string(permissions)?)
         .bind(expires_at.and_then(|value| i64::try_from(value).ok()))
         .bind(is_active)
         .bind(now as i64)
@@ -438,6 +446,7 @@ fn map_token_row(row: &MySqlRow) -> Result<StoredManagementToken, DataLayerError
         row.try_get("token_prefix").map_sql_err()?,
         json_from_string(row.try_get("allowed_ips").map_sql_err()?)?,
     )
+    .with_permissions(json_from_string(row.try_get("permissions").map_sql_err()?)?)
     .with_runtime_fields(
         optional_unix_secs(row.try_get("expires_at_unix_secs").map_sql_err()?),
         optional_unix_secs(row.try_get("last_used_at_unix_secs").map_sql_err()?),