This allows users to create tokens to be used with the API.
The goal is to use those for the API that will allow users to upload new
versions of an extension.

The Tokens can be created/managed on the user profile.

Note: There are still no API entries that can use these tokens.

@@ -275,1 +276,4 @@
     'DEFAULT_SCHEMA_CLASS': 'drf_spectacular.openapi.AutoSchema',
+    'DEFAULT_AUTHENTICATION_CLASSES': (
+        'rest_framework.authentication.SessionAuthentication',
+        'rest_framework.authentication.BasicAuthentication',

@@ -0,0 +3,4 @@
+
+class TokensConfig(AppConfig):
+    default_auto_field = 'django.db.models.BigAutoField'
+    name = 'tokens'

@@ -0,0 +7,4 @@
+
+
+class UserToken(models.Model):
+    id = models.AutoField(primary_key=True)

@@ -0,0 +26,4 @@
+          {% for token in tokens %}
+            <tr>
+              <td>{{token.name}}</td>
+              <td>{{token.token}}</td>

@@ -0,0 +22,4 @@
+            return None
+
+        try:
+            token_hash = hashlib.sha256(token_key.encode()).hexdigest()

@@ -0,0 +29,4 @@
+
+        token.ip_address_last_access = clean_ip_address(request)
+        token.date_last_access = datetime.datetime.now()
+

@@ -0,0 +7,4 @@
+class UserToken(models.Model):
+    user = models.ForeignKey(User, on_delete=models.CASCADE, related_name='tokens')
+    name = models.CharField(max_length=255)
+    token_begin = models.CharField(max_length=5, editable=False)

@@ -0,0 +34,4 @@
+              <td>
+                {% if token.date_last_access %}
+                {{token.date_last_access}}
+                {% else %}

@@ -0,0 +62,4 @@
+    def form_valid(self, form):
+        form.instance.user = self.request.user
+
+        token = secrets.token_urlsafe(32)

@@ -0,0 +63,4 @@
+        form.instance.user = self.request.user
+
+        token = secrets.token_urlsafe(32)
+        token_hash = hashlib.sha256(token.encode()).hexdigest()

@@ -0,0 +68,4 @@
+        form.instance.token_hash = token_hash
+        form.instance.token_begin = token[:5]
+
+        messages.info(self.request, f'{token}')

@@ -0,0 +56,4 @@
+        self.assertContains(response, str(token.token_prefix))
+        self.assertNotContains(response, str(token_key))
+
+    def test_list_page_shows_last_access_time(self):