New API app to handle upload with a bearer token

[charsbar]

This PR adds a new API application to the current PAUSE, as well as two new endpoints to the current web UI for generating and revoking tokens. It lacks proper documentation. A large portion of the code is taken from the files under lib/pause_2017, so there's a huge room to refactor.

If you have a working local PAUSE environment, you can 1) modify the authen_pause schema using one-off util, 2) launch app_2026.psgi (instead of app_2017.psgi), and then you can post a new distribution like this:

my $ua = LWP::UserAgent->new;
my $res = $ua->post(
    "http://your.local.pause/api/upload",
    Authorization => "Bearer $token",
    'Content-Type' => "multipart/form-data",
    Content => {
      file => [ $your_file ],
    },
);

[Leont]

Why add Crypt::PRNG when you're already using Crypt::URandom elsewhere? That seems double.

[charsbar]

Replaced PRNG with URandom

[charsbar]

Further reading:

• https://docs.npmjs.com/creating-and-viewing-access-tokens#creating-granular-access-tokens-on-the-website
• https://docs.npmjs.com/requiring-2fa-for-package-publishing-and-settings-modification
• https://docs.npmjs.com/about-access-tokens

and maybe more

[andk]

Thanks, applied and deployed