Feature request: machine/API tokens (personal access tokens) for scripted access

Feature request: machine/API tokens (personal access tokens) for scripted access

Use case

We run MWS as the operations portal/wiki for a Kubernetes cluster. Besides humans, AI agents and CI jobs need to read and write tiddlers in specific recipes/bags from scripts:

• an agent that syncs service metadata from the GitOps repo / cluster API into wiki tiddlers;
• an agent that appends operational records (debug logs) after incident response;
• future automation that reads runbooks and checklists.

Current situation (verified in source)

• packages/mws/src/new-managers/sessions.ts only supports the interactive OPAQUE PAKE login (login1/login2) plus logout, authenticated via session cookie.
• There is no token issuance endpoint, no long-lived credential, and no way to scope a credential to a role/recipe/bag.
• Scripting therefore requires storing a username + password in agent environments (.env files, CI secrets) and performing the two-step PAKE dance before every run. This is inconvenient and widens the blast radius: the credential is a full user account password, usable interactively, and hard to rotate per-agent.

Request

Add an API-token / personal-access-token mechanism, e.g.:

1. Admin UI or CLI command to issue a token for a user (or a dedicated bot user), with:
   • optional expiry / rotation ("regenerate" invalidates the previous one);
   • optional scoping: restrict to specific roles, recipes, or bags (read vs write).
2. Token auth on the HTTP API: accept e.g. Authorization: Bearer <token> (or an X-...-Token header) as an alternative to the session cookie on the existing recipe/bag endpoints (/recipes/..., /bags/..., admin API). Keep the PAKE login unchanged for humans.
3. Auditability: record which token (name/id) performed each write, so agent edits can be attributed and revoked individually.

Why this matters

• Least privilege: a leaked agent token can be scoped read-only or to one bag, instead of being a full user password.
• Rotation: per-agent tokens can be rotated independently.
• Simplicity: agents can use plain curl/HTTP libraries with one header, no PAKE client implementation.

Happy to test an implementation against our deployment (MWS behind an nginx ingress, bots writing via PUT /bags/<bag>/tiddlers/<title>).

Thanks for MWS — the multi-recipe model fits our "one cluster portal, many services" setup really well.

Start with packages/mws/src/new-managers/sessions.ts, then trace authentication for the existing /recipes/... and /bags/... endpoints, including the PUT /bags//tiddlers/<title> path. The requested work covers token issuance, expiry or regeneration, role/recipe/bag scoping, HTTP authentication, and per-token write attribution; done means these requirements are implemented without changing PAKE login for humans.