WebAPITokenManager.get_or_create_client_token now filters by policy. That seems like something that we might want to have in the change description since it has a meaningful fix for the behavior of service accounts (if a new version of service account code updates the policy), and we'll want that in the release notes.

The new tests cover the manager, but not the registry, base class, built-in policies, extension hook, or form data.
At a minimum:


In test_token_policies:


check that get_token_policy('read-only') and get_token_policy('read-write') resolve.

Assert the built-in policy docs

Assert that unknown IDs return None.


Create a new hook test case (similar to the existing test_webapi_capabilities_hook)

This is iterating over the registry, but registries don't have a stable sort order. We should either sort these here, or have the registry inherit from OrderedRegistry instead.

Swap the order on these.

We should use xhr.errorPayload here.

If the save fails, the server still has the old data but we don't reset the UI back to it. Can we do:

const prevPolicyType = this.previous('policyType');

this.savePolicy(policyDoc).then(saved => {
    if (!saved) {
        this.set('policyType', prevPolicyType);
    }
});

Can we also say in here that "An empty policy and no policy are treated as equivalent"?

This parses as (norm_policy == token.policy) or None (and several manager tests are broken by this)

The comma ended up inside the string, so the list is 'GET' and 'HEAD,OPTIONS'

available as option -> available as an option