add endpoint to create managed student oauth tokens

for TKS to make their students join regional teams

app/controllers/Clas.scala

@@ -221,6 +221,19 @@ final class Clas(env: Env, authC: Auth) extends LilaController(env):
       )
   }
 
+  def makeStudentOauthTokens(id: ClasId) = SecuredScopedBody(_.Teacher)(_.Team.Lead) { ctx ?=> me ?=>
+    WithClassAndStudents(id): (clas, students) =>
+      students
+        .filter(_.managed)
+        .sequentially: student =>
+          for
+            token <- env.oAuth.tokenApi.clasStudentToken(clas.name, student.userId)
+            user <- env.user.lightUserApi.asyncFallback(student.userId)
+          yield s"${user.name}, ${student.realName}, ${token.plain}"
+        .map: lines =>
+          Ok(lines.mkString("\n")).asAttachment(s"lichess-student-tokens.${clas.id}.csv")
+  }
+
   def students(id: ClasId) = Secure(_.Teacher) { ctx ?=> me ?=>
     WithClass(id): clas =>
       for

conf/clas.routes

@@ -37,3 +37,4 @@ POST  /class/$id<\w{8}>/student/:username/move/$to<\w{8}> controllers.clas.Clas.
 POST  /class/$id<\w{8}>/login          controllers.clas.Clas.loginCreate(id: ClasId)
 GET   /class/$id<\w{8}>/bulk-actions   controllers.clas.Clas.bulkActions(id: ClasId)
 POST  /class/$id<\w{8}>/bulk-actions   controllers.clas.Clas.bulkActionsPost(id: ClasId)
+POST  /class/$id<\w{8}>/oauth-tokens    controllers.clas.Clas.makeStudentOauthTokens(id: ClasId)

modules/oauth/src/main/AccessTokenApi.scala

@@ -105,6 +105,21 @@ final class AccessTokenApi(
         .map(user.id -> _)
   yield tokens.toMap
 
+  def clasStudentToken(clasName: String, student: UserId)(using UserAgent): Fu[AccessToken] =
+    given MyId = student.into(MyId)
+    val scopes = OAuthScopes(List(OAuthScope.Team.Read, OAuthScope.Team.Write))
+    findCompatiblePersonal(scopes).flatMap:
+      _.filter(_.description.contains(clasName)) match
+        case Some(token) => fuccess(token)
+        case None =>
+          create(
+            OAuthTokenForm.Data(
+              description = clasName,
+              scopes = scopes.value.map(_.key)
+            ),
+            isStudent = true
+          )
+
   def listPersonal(using me: MyId): Fu[List[AccessToken]] =
     coll
       .find: