Remediate the 2026-09-03 feature-test findings

shopdb/core/api/apitokens.py

@@ -163,7 +163,18 @@ def update_apitoken(tokenid: int):
             return error_response(ErrorCodes.VALIDATION_ERROR, 'name cannot be empty')
         token.name = newname
     if 'isactive' in data:
-        token.isactive = bool(data['isactive'])
+        # Revocation is ONE WAY. A revoked token's secret is out there - that
+        # is why it was revoked - and re-activating the row made the same
+        # secret work again, so "revoked" meant "paused until somebody flips it
+        # back". Deactivating through this route is still allowed; bringing one
+        # back is not, and the answer says to mint a new one.
+        wanted = bool(data['isactive'])
+        if wanted and not token.isactive:
+            return error_response(
+                ErrorCodes.VALIDATION_ERROR,
+                'A revoked token cannot be re-activated - its secret is '
+                'already out. Create a new token instead.')
+        token.isactive = wanted
     if 'scopes' in data:
         scopelist, scope_error = _validate_scopes(data.get('scopes'), token.user)
         if scope_error is not None: