Epic Goal

• Allow org owners to take control of API tokens created by other users

Why is this important?

• Organization owners can create OAuth tokens and the tokens are assigned to the token creator. When the token is created for and used by some organization member, the action is logged to the token creator. In restricted environments, where only dedicated registry administrators are organization owners, this is undesirable due to inaccurate auditing. For accuracy, token ownership should be mutable and can be reassigned by a superuser

Scenarios

1. An API token created by an organization owner can be changed by the superuser
2. Audit logs properly reflect which member of an organization used the token, after token reassignment

Acceptance Criteria

• CI - MUST be running successfully with tests automated
• Release Technical Enablement - Provide necessary release enablement details and documents.
• ...

Dependencies (internal and external)

1. ...

Previous Work (Optional):

1. ...

Open questions::

1. ...

Done Checklist

• CI - CI is running, tests are automated and merged.
• Release Enablement <link to Feature Enablement Presentation>
• DEV - Upstream code and tests merged: <link to meaningful PR or GitHub Issue>
• DEV - Upstream documentation merged: <link to meaningful PR or GitHub Issue>
• DEV - Downstream build attached to advisory: <link to errata>
• QE - Test plans in Polarion: <link or reference to Polarion>
• QE - Automated tests merged: <link or reference to automated tests>
• DOC - Downstream documentation merged: <link to meaningful PR>