Migrate Remaining Norman Token Usage to Steve Tokens

[rak-phillip]

There are still several references to v3/token (Norman) in Rancher Dashboard that need to be replaced with the v1/ext.cattle.io.tokens (Steve) endpoint. The migration needs to maintain compatibility with Norman tokens until the API has been properly deprecated and support is removed.

Proposed solution

• Update affected components to work with both Norman and Steve tokens
• Migrate inactivity logic to use Steve tokens
• Any process that deletes/clears Norman tokens must also delete/clear equivalent Steve tokens
• Reintroduce PR replace creation of tokens from Norman to Steve #16674
  • API key visibility should be based on Steve tokens
  • Power API Keys list with new ext.cattle.io.tokens #12332

  • dashboard/shell/edit/token.vue

    Lines 135 to 139 in faf01fc

    	await this.$store.dispatch('rancher/find', {
    	type: NORMAN.TOKEN,
    	id: res.id,
    	opt: { force: true }
    	}, { root: true });

  • dashboard/shell/pages/account/index.vue

    Line 26 in faf01fc

    this.rows = await this.$store.dispatch('rancher/findAll', { type: NORMAN.TOKEN });

Acceptance Criteria

• All listed components support both Norman and Steve tokens
• Token-related flows do not regress (login, inactivity, password change, etc.)
• Cleanup and permission logic accounts for both token types

Additional details

We need to coordinate with team Collie on this change before bringing it in.

#16674 handled the migration of API Keys, but the change was later reverted via #16947. We need to reintroduce this change to complete the work.

Affected components

There are several areas confirmed to be using v3/token

dashboard/shell/config/types.js

Lines 12 to 38 in 6f7472d

	// Old APIs via Norman
	// Base: /v3
	export const NORMAN = {
	APP: 'app',
	AUTH_CONFIG: 'authconfig',
	CLUSTER: 'cluster',
	CLUSTER_TOKEN: 'clusterregistrationtoken',
	CLUSTER_ROLE_TEMPLATE_BINDING: 'clusterroletemplatebinding',
	CLOUD_CREDENTIAL: 'cloudcredential',
	FLEET_WORKSPACES: 'fleetworkspace',
	GLOBAL_ROLE: 'globalRole',
	GLOBAL_ROLE_BINDING: 'globalRoleBinding',
	NODE_POOL: 'nodePool',
	// Note - This allows access to node resources, not schema's or custom components (both are accessed via 'type' which clashes with kube node)
	NODE: 'node',
	PRINCIPAL: 'principal',
	PROJECT: 'project',
	PROJECT_ROLE_TEMPLATE_BINDING: 'projectroletemplatebinding',
	SETTING: 'setting',
	SPOOFED: { GROUP_PRINCIPAL: 'group.principal' },
	ROLE_TEMPLATE: 'roleTemplate',
	TOKEN: 'token',
	USER: 'user',
	KONTAINER_DRIVER: 'kontainerDriver',
	NODE_DRIVER: 'nodeDriver'
	};

These include:

• dashboard/shell/components/Inactivity.vue

  Line 127 in 6f7472d

  const tokens = await this.$store.dispatch('rancher/findAll', { type: NORMAN.TOKEN, opt: { watch: false } });

• dashboard/shell/components/form/ChangePassword.vue

  Lines 275 to 281 in faf01fc

  	const tokens = await this.$store.dispatch('rancher/findAll', {
  	type: NORMAN.TOKEN,
  	opt: {
  	// Ensure we have any new tokens since last fetched... and that we don't attempt to delete previously deleted tokens
  	force: true
  	}
  	});

• dashboard/shell/components/nav/Header.vue

  Line 172 in faf01fc

  const canSeeTokens = this.$store.getters['rancher/schemaFor'](NORMAN.TOKEN, false, false);

[richard-cox]

I've moved to backend block, we must get explicit agreement for each part from Collie before starting that part.

Also a candidate to push out, given deprecation cycle of norman token

[github-actions]

🤖 Issue grooming analysis

This issue meets all four primary grooming criteria and is ready for triage.

✅ Clear Problem Statement
The title and description clearly explain that several Rancher Dashboard components still reference the Norman token API (v3/token) and need to be migrated to Steve tokens (v1/ext.cattle.io.tokens), while maintaining backward compatibility until Norman is fully deprecated.

✅ Acceptance Criteria
Three testable acceptance criteria are explicitly defined:

• All listed components support both Norman and Steve tokens
• Token-related flows do not regress (login, inactivity, password change, etc.)
• Cleanup and permission logic accounts for both token types

✅ Technical Details
Specific files with line-level references are provided for all affected components (Inactivity.vue, ChangePassword.vue, Header.vue, token.vue, account/index.vue). Related PRs (#16674, #16947) are linked with context on why the previous migration was reverted, and the coordination requirement with team Collie is documented.

✅ Task Flow
The migration scope is well-defined with a proposed solution checklist, affected component list, and historical context. The requirement to maintain compatibility with Norman tokens until API deprecation is clearly stated.

This analysis was generated automatically based on the repository's grooming checklist.

Generated by Daily Issue Grooming · ◷