Add httpTokens end points for Devices

[knolleary]

Closes #7564

REVIEW - BUT DO NOT MERGE YET

• Refactors the httpTokens route code to handle both project and device level access.
• Adds a new http:device ownerType for access tokens
• Updates the token validation endpoint to handle http:device ownerType

Not to be merged until

• Add httpToken UI to device/settings/security #7566
• Update httpNodeAuth middleware to support http bearer tokens device-agent#655
• Device Agent v4 is published

[codecov]

Codecov Report

❌ Patch coverage is 81.18812% with 19 lines in your changes missing coverage. Please review.
✅ Project coverage is 76.95%. Comparing base (525a175) to head (b8f853c).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
forge/ee/routes/httpTokens/index.js	81.08%	14 Missing ⚠️
forge/db/models/AccessToken.js	0.00%	3 Missing ⚠️
forge/db/controllers/AccessToken.js	86.66%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #7568      +/-   ##
==========================================
- Coverage   76.95%   76.95%   -0.01%     
==========================================
  Files         410      410              
  Lines       21002    21084      +82     
  Branches     5117     5138      +21     
==========================================
+ Hits        16162    16225      +63     
- Misses       4840     4859      +19     

Flag	Coverage Δ
backend	76.95% <81.18%> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Steve-Mcl]

Gave it a good looking over. I notice the root registration changed from /api/v1/projects/:projectId/httpTokens to /api/v1 but that the existing child paths and new device/ child paths have been implemented in forge/ee/routes/httpTokens/index.js for all 4 verbs - all looks good - happy to approve.

NOTE Since this will be called by/for Insights on devices (my current work tasks) - I would hope to see this merged sooner rather than later so I can incorporate my changes atop it. Is there anything blocking merge? I realised merging it would create backend functionality that has no FE component but that should be ok right?

PS: Will FE offering of token creation for devices be gated by device agent version?

nitpick

the 404 failure path in the pre-handler is not covered (for regression purposes) for existing instances and new devices requests.

[knolleary]

NOTE Since this will be called by/for Insights on devices (my current work tasks) - I would hope to see this merged sooner rather than later so I can incorporate my changes atop it. Is there anything blocking merge?

I don't think there's a real issue merging sooner. The api will be discoverable, but the device tokens won't be usable until the device agent release.

The UI will notify the user it requires DA v4 or later.

[knolleary]

Going to add a couple more tests then this is GTM