Merge pull request #1836 from ryanpetrello/hands-off-my-tokens

filter `/api/v2/users/N/tokens/` to only show tokens for _that_ user

awx/api/urls/user.py

@@ -15,7 +15,7 @@ from awx.api.views import (
     UserActivityStreamList,
     UserAccessList,
     OAuth2ApplicationList,
-    OAuth2TokenList,
+    OAuth2UserTokenList,
     OAuth2PersonalTokenList,
     UserAuthorizedTokenList,
 )
@@ -32,7 +32,7 @@ urls = [
     url(r'^(?P<pk>[0-9]+)/activity_stream/$', UserActivityStreamList.as_view(), name='user_activity_stream_list'),
     url(r'^(?P<pk>[0-9]+)/access_list/$', UserAccessList.as_view(), name='user_access_list'),
     url(r'^(?P<pk>[0-9]+)/applications/$', OAuth2ApplicationList.as_view(), name='o_auth2_application_list'),
-    url(r'^(?P<pk>[0-9]+)/tokens/$', OAuth2TokenList.as_view(), name='o_auth2_token_list'),
+    url(r'^(?P<pk>[0-9]+)/tokens/$', OAuth2UserTokenList.as_view(), name='o_auth2_token_list'),
     url(r'^(?P<pk>[0-9]+)/authorized_tokens/$', UserAuthorizedTokenList.as_view(), name='user_authorized_token_list'),
     url(r'^(?P<pk>[0-9]+)/personal_tokens/$', OAuth2PersonalTokenList.as_view(), name='o_auth2_personal_token_list'),
     

awx/api/views.py

@@ -1598,6 +1598,18 @@ class OAuth2TokenList(ListCreateAPIView):
     model = OAuth2AccessToken
     serializer_class = OAuth2TokenSerializer
     swagger_topic = 'Authentication'
+
+
+class OAuth2UserTokenList(SubListCreateAPIView):
+
+    view_name = _("OAuth2 User Tokens")
+
+    model = OAuth2AccessToken
+    serializer_class = OAuth2TokenSerializer
+    parent_model = User
+    relationship = 'main_oauth2accesstoken'
+    parent_key = 'user'
+    swagger_topic = 'Authentication'
     
     
 class OAuth2AuthorizedTokenList(SubListCreateAPIView):

awx/main/tests/functional/api/test_oauth.py

@@ -172,3 +172,12 @@ def test_oauth_application_delete(oauth_application, post, delete, admin):
     assert Application.objects.filter(client_id=oauth_application.client_id).count() == 0
     assert RefreshToken.objects.filter(application=oauth_application).count() == 0
     assert AccessToken.objects.filter(application=oauth_application).count() == 0
+
+
+@pytest.mark.django_db
+def test_oauth_list_user_tokens(oauth_application, post, get, admin, alice):
+    for user in (admin, alice):
+        url = reverse('api:o_auth2_token_list', kwargs={'pk': user.pk})
+        post(url, {'scope': 'read'}, user, expect=201)
+        response = get(url, admin, expect=200)
+        assert response.data['count'] == 1