harden CSV import reconciliation and preserve saved model selections

Default fuzzy reconcile threshold to 0 and refuse merges when digit runs differ so numbered labels like Bay 311 never bind to Bay 310. Keep edit forms from clearing saved model fields when category filtering hides untyped rows. Includes in-progress computers policy and endpoints command feature work.

shopdb/utils/apitoken_auth.py

@@ -107,6 +107,82 @@ def authorized_service_token(scope):
     return token
 
 
+def mint_service_token(scope, name, owner_userid, revoke_existing=True):
+    """Mint a managed service token scoped to exactly ONE permission.
+
+    The contract-surface way for a plugin to provision an unattended service
+    credential (an endpoint agent key, a collector key) without importing core
+    token internals. The returned secret is the ONLY time the full secret is
+    available - callers reveal it once and store only the prefix afterwards.
+
+    scope           the single permission the token authorizes (e.g.
+                    collector.ingest.endpoints). The owner must hold it.
+    name            human label shown in the token list UI.
+    owner_userid    the acting admin who owns (and can be audited for) the key.
+    revoke_existing when True (default), every currently-active token scoped to
+                    EXACTLY this one permission is deactivated first, so
+                    regenerating is a hard cutover: the old agent key stops
+                    working the instant the new one is minted.
+
+    Returns (token, secret). Commits.
+    """
+    from shopdb.core.models import User
+
+    owner = db.session.get(User, owner_userid)
+    if owner is None or not owner.isactive or not owner.haspermission(scope):
+        raise PermissionError(
+            'Token owner must be an active user holding ' + scope)
+
+    if revoke_existing:
+        for existing in list_service_tokens(scope):
+            existing.isactive = False
+
+    secret = ApiToken.generate_secret()
+    token = ApiToken(
+        userid=owner_userid,
+        name=name,
+        tokenprefix=ApiToken.prefix_of(secret),
+        tokenhash=ApiToken.hash_secret(secret),
+    )
+    token.scopelist = [scope]
+    db.session.add(token)
+    db.session.commit()
+    return token, secret
+
+
+def list_service_tokens(scope, active_only=True):
+    """Return managed tokens scoped to EXACTLY the single permission `scope`.
+
+    Used by a plugin settings page to render the current agent-key state
+    (prefix, created, last-used) without exposing token internals. Filters in
+    Python because scopes are stored as a JSON blob, not a queryable column.
+    """
+    query = ApiToken.query
+    if active_only:
+        query = query.filter_by(isactive=True)
+    matches = []
+    for token in query.order_by(ApiToken.createddate.desc()).all():
+        scopelist = token.scopelist
+        if scopelist and len(scopelist) == 1 and scopelist[0] == scope:
+            matches.append(token)
+    return matches
+
+
+def revoke_service_tokens(scope):
+    """Deactivate every active managed token scoped to EXACTLY `scope`.
+
+    The kill switch: revoking the endpoint agent key stops all endpoint-agent
+    traffic authorized by a managed token. Returns the count revoked. Commits.
+    """
+    revoked = 0
+    for token in list_service_tokens(scope):
+        token.isactive = False
+        revoked += 1
+    if revoked:
+        db.session.commit()
+    return revoked
+
+
 def service_token_authorized(scope):
     """True when the current request carries a managed token scoped for `scope`
     whose owner is active and holds that permission. Accepts X-API-Key or a