first version

accounts/models.py

@@ -0,0 +1,42 @@
+import secrets
+
+from django.conf import settings
+from django.contrib.auth.models import AbstractUser
+from django.db import models
+from django.utils import timezone
+
+
+class User(AbstractUser):
+    """Plain Django user. Accounts are created with `manage.py createsuperuser`."""
+
+    def __str__(self):
+        return self.username
+
+
+class ApiToken(models.Model):
+    """Bearer token for the Flutter app (the web admin uses session auth)."""
+
+    key = models.CharField(max_length=64, unique=True, editable=False)
+    user = models.ForeignKey(
+        settings.AUTH_USER_MODEL, on_delete=models.CASCADE, related_name="api_tokens"
+    )
+    name = models.CharField(
+        max_length=100, blank=True, help_text="Which device this token is for."
+    )
+    created_at = models.DateTimeField(auto_now_add=True)
+    last_used_at = models.DateTimeField(null=True, blank=True)
+
+    class Meta:
+        ordering = ["-created_at"]
+
+    def __str__(self):
+        return f"{self.user} — {self.name or 'unnamed device'}"
+
+    def save(self, *args, **kwargs):
+        if not self.key:
+            self.key = secrets.token_urlsafe(32)
+        return super().save(*args, **kwargs)
+
+    def touch(self):
+        self.last_used_at = timezone.now()
+        self.save(update_fields=["last_used_at"])