spaces
@@ -159,8 +187,43 @@ function showPasskeys(items){const root=$('passkey-items');root.textContent='';i
function showAppPasswords(items){const root=$('app-password-items');root.textContent='';if(!items.length)return empty(root,'No app passwords are active for this account.');for(const item of items){const view=credentialRow(item.name,`created ${item.createdAt}${item.privileged?' · privileged':''}`);const revoke=document.createElement('button');revoke.type='button';revoke.className='danger';revoke.textContent='revoke';revoke.onclick=async()=>{if(!confirm(`Revoke app password "${item.name}"?`))return;await xrpc('/xrpc/com.atproto.server.revokeAppPassword',{}, {method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify({name:item.name})});generatedAppPassword.classList.remove('on');generatedAppPassword.textContent='';await loadAccountData()};view.actions.append(revoke);root.append(view.row)}}
const methodLabel=(s)=>s.appPasswordName?`app password: ${s.appPasswordName}`:s.authMethod==='password'?'account password token':s.authMethod==='app_password'?'app password token':s.authMethod==='app_password_privileged'?'privileged app password token':s.authMethod;
const oauthAuthMethod=(g)=>g.authMethod==='passkey'?'passkey':g.authMethod==='password'?'password':'unknown method';
-function card(item,isGrant){const active=item.active?'active':'inactive';const title=isGrant?item.clientId:methodLabel(item);const sub=isGrant?`${oauthAuthMethod(item)} authorization · ${item.scope}`:(item.controllerDid?`controller ${item.controllerDid}`:'com.atproto.server.createSession token family');const grid=isGrant?stamp('authorized',item.createdAt)+stamp('access token expires',item.expiresAt)+stamp('revoked',item.revokedAt):stamp('created',item.createdAt)+stamp('last used',item.lastUsedAt)+stamp('refresh token expires',item.refreshExpiresAt);return`${grid}
No OAuth app access rows.
';$('session-items').innerHTML=sessions.length?sessions.map(s=>card(s,false)).join(''):'No direct API token rows.
'}
+// Access-card presentation stays separate from session/authentication behavior.
+function clientLabel(clientId){
+ try { const url=new URL(clientId); if(url.protocol==='https:'||url.protocol==='http:')return url.host; } catch {}
+ return clientId||'Unknown app';
+}
+function accessDate(value){const t=time(value);return `${esc(t.short)} `}
+function accessField(label,value,technical=false){
+ if(!value)return '';
+ return `
${esc(label)} ${technical?`${esc(value)}`:esc(value)} `;
+}
+function accessCard(item,isGrant){
+ const title=isGrant?clientLabel(item.clientId):(item.appPasswordName||'Account password');
+ const status=item.active?'Active':item.revokedAt?'Revoked':'Expired';
+ const scopes=isGrant?item.scope.split(/\s+/).filter(Boolean):[];
+ const permissions=scopes.filter(scope=>scope!=='atproto');
+ const broad=permissions.includes('transition:generic');
+ const description=isGrant?(broad?'Broad account access':permissions.length?`${permissions.length} permission${permissions.length===1?'':'s'}`:'Account identity'):(item.appPasswordName?'App password':'Password sign-in');
+ const dateLabel=item.revokedAt?'Revoked':!isGrant&&item.lastUsedAt?'Last used':'Connected';
+ const date=item.revokedAt||(!isGrant&&item.lastUsedAt)||item.createdAt;
+ const fields=isGrant?accessField('Client ID',item.clientId,true)+accessField('Signed in with',oauthAuthMethod(item)):
+ accessField('Sign-in method',methodLabel(item))+accessField('Controller',item.controllerDid,true)+accessField('Session ID',item.id,true);
+ const dates=stamp('Connected',item.createdAt)+(isGrant?stamp('Connection expires',item.expiresAt):stamp('Last used',item.lastUsedAt)+stamp('Refresh token expires',item.refreshExpiresAt))+(item.revokedAt?stamp('Revoked',item.revokedAt):'');
+ const scopeDetails=isGrant?`Granted permissions ${scopes.map(scope=>`${esc(scope)} ${esc(Array.from(title)[0].toUpperCase())} ${esc(title)} ${esc(description)}
${status} ${dateLabel} ${accessDate(date)}
Connection details for ${esc(title)} ${fields} ${scopeDetails}
${dates}
${isGrant?'No apps currently have access.':'No active password sessions.'}
`;
+ return current+(past.length?`Past connections ${past.length} ${past.map(item=>accessCard(item,isGrant)).join('')}No permissioned spaces found for this account.
';return} spaces.forEach((space,idx)=>{const p=spaceParts(space.uri);const btn=document.createElement('button');btn.type='button';btn.className='tab';btn.role='tab';btn.ariaSelected=idx===0?'true':'false';btn.textContent=p.type+' / '+p.skey;btn.onclick=()=>selectSpace(space.uri);box.appendChild(btn)});selectSpace(spaces[0].uri)}
function selectSpace(uri){selectedSpace=uri;cursor=null;$('records').innerHTML='';$('record-detail').className='empty';$('record-detail').textContent='Choose a record.';for(const btn of $('spaces').querySelectorAll('.tab'))btn.ariaSelected=btn.textContent===spaceParts(uri).type+' / '+spaceParts(uri).skey?'true':'false';$('repo').value=account.did}