Token Management CLI Commands

[Furisto]

Summary

Implements construct daemon token command group with create, list, and revoke subcommands for managing authentication tokens. Completes the CLI interface for the token-based authentication system.

Context

With the authentication backend merged, administrators need CLI tools to manage tokens for remote daemon access. These commands provide the full lifecycle: creation, auditing, and revocation.

Changes

Commands Added

• construct daemon token create <name> - Generate authentication tokens
• construct daemon token create-setup <name> - Generate single-use setup codes
• construct daemon token list - Display token metadata
• construct daemon token revoke <id> - Invalidate tokens by UUID

Utilities

• duration.go - Custom parser supporting day notation (30d, 90d) with validation
• time_format.go - Relative time formatting ("2 days ago", "in 88 days")

Key Features

• Token creation with configurable expiry (default 90d, max 365d)
• Setup codes for secure distribution (default 5m expiry, max 72h)
• Security warnings when displaying tokens
• Confirmation prompts before revocation
• Multiple output formats (table, card, json, yaml)
• Relative timestamps in list view

Examples

Create token for developer

# Admin generates setup code on server
construct daemon token create-setup dev-laptop --code-expires 30m

# Output: ABCD-1234 (expires in 30 minutes)

# Developer uses code on their machine
construct context add my-server \
  --endpoint https://construct.example.com:8443 \
  --setup-code ABCD-1234

CI/CD token management

# Create long-lived token for CI
construct daemon token create github-actions \
  --description "GitHub Actions deployment" \
  --expires 365d \
  --output json > token.json

# Token saved to CI secrets

Audit and rotate tokens

# Review all tokens
construct daemon token list

# Filter by environment
construct daemon token list --name-prefix prod

# Revoke old token
construct daemon token revoke a1b2c3d4-5678-90ab-cdef-123456789012

# Create replacement
construct daemon token create laptop-token-new --expires 90d

Testing

Manual verification

# Build and test help output
cd frontend/cli && go build
./construct daemon token --help

# Test each command
./construct daemon token create test-token --expires 30d
./construct daemon token list
./construct daemon token revoke <id-from-list> --force

Key scenarios to verify

• Token creation with valid/invalid expiry durations
• Setup code generation with custom expiry
• List filtering by name prefix
• Revoke with/without confirmation prompt
• Output format switching (json, yaml, table, card)