feat: #107 configuration - gestion des clés API & MCP (création/révocation, expiration 1j/1mois/6mois/1an/sans fin, une clé pour API REST + serveur MCP, dernière utilisation, store sans secret persisté; fix révocation longue durée) + script token MCP

backend/auth/router.py

@@ -17,10 +17,14 @@ from backend.services.net import get_client_ip
 
 from .jwt_handler import (
     ACCESS_TOKEN_EXPIRE_SECONDS,
+    API_TOKEN_EXPIRY_CHOICES,
     create_access_token,
+    create_api_token,
     create_refresh_token,
     decode_token,
+    delete_api_token,
     is_token_revoked,
+    list_api_tokens,
     revoke_token,
 )
 from .mfa import (
@@ -861,3 +865,58 @@ async def delete_user_endpoint(
         return {"message": f"Utilisateur '{username}' supprimé"}
     except ValueError as e:
         raise HTTPException(404, str(e))
+
+
+# ── API / MCP tokens (feature #107) ──────────────────────────────────
+# One long-lived token authenticates BOTH the REST API and the MCP
+# endpoint (/mcp): the MCP server resolves the caller through the same
+# get_current_user() dependency, so the same Bearer JWT works everywhere.
+
+class CreateApiTokenRequest(BaseModel):
+    name: str
+    expiry: str  # 1d | 30d | 180d | 365d | never
+
+
+@router.get("/tokens")
+async def list_user_tokens(current_user=Depends(require_auth)):
+    """List the caller's API/MCP tokens (metadata only — the secret is never stored)."""
+    return {
+        "tokens": list_api_tokens(current_user["username"]),
+        "expiry_choices": list(API_TOKEN_EXPIRY_CHOICES.keys()),
+    }
+
+
+@router.post("/tokens")
+async def create_user_token(
+    req: CreateApiTokenRequest,
+    request: Request,
+    current_user=Depends(require_auth),
+):
+    """Create a long-lived API/MCP token. The raw JWT is returned ONCE."""
+    try:
+        record, token = create_api_token(current_user, req.name.strip(), req.expiry)
+    except ValueError as e:
+        raise HTTPException(400, str(e))
+    from backend.audit import log_config_change
+    log_config_change(current_user["username"],
+                      {"action": "api_token_create", "name": record["name"],
+                       "expiry": record["expiry_key"]}, ip=get_client_ip(request))
+    return {"token": token, **record}
+
+
+@router.delete("/tokens/{jti}")
+async def delete_user_token(
+    jti: str,
+    request: Request,
+    current_user=Depends(require_auth),
+):
+    """Revoke + delete an API/MCP token (immediate effect on API and MCP)."""
+    try:
+        record = delete_api_token(jti, current_user["username"])
+    except KeyError:
+        raise HTTPException(404, "Token introuvable")
+    from backend.audit import log_config_change
+    log_config_change(current_user["username"],
+                      {"action": "api_token_revoke", "name": record["name"]},
+                      ip=get_client_ip(request))
+    return {"message": f"Token '{record['name']}' révoqué"}