"""Personal access tokens for AI agent / external tool authentication.

A user calls ``POST /api/v1/auth/me/tokens`` from a logged-in browser
session and receives a one-time plaintext secret (``helix_pat_<rand>``).
Pasting that secret into Claude Desktop / Cursor / a custom MCP client
lets the tool authenticate against the same Helix API the user can
reach in the UI — same JWT-equivalent permissions, same audit chain,
same RBAC checks. There is no separate scope / read-only flag: a PAT
can do exactly what its owner can do.

The plaintext is never persisted; only the SHA-256 hash + a 12-char
prefix (for UI display) live in ``auth_personal_access_tokens``. A
compromised database row therefore does not yield a usable token.

See DECISIONS.md "PAT-only auth for AI agents" (2026-04-27) for the
product reasoning behind not adding service accounts / AK/SK in this
iteration.
"""
from app.auth.tokens.models import PersonalAccessToken
from app.auth.tokens.service import (
    MAX_TOKENS_PER_USER,
    PAT_PREFIX,
    PersonalAccessTokenService,
)

__all__ = [
    "MAX_TOKENS_PER_USER",
    "PAT_PREFIX",
    "PersonalAccessToken",
    "PersonalAccessTokenService",
]