From 5ed4ff509d2162b6896d17a46cdf24cb92482948 Mon Sep 17 00:00:00 2001
From: eyjhb <eyjhbb@gmail.com>
Date: Sun, 17 May 2026 16:09:15 +0200
Subject: [PATCH 1/5] feat(webapp): move hint from RRSetType into variable

Makes it easier to ovrride
---
 www/webapp/src/components/Field/RRSetType.vue | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/www/webapp/src/components/Field/RRSetType.vue b/www/webapp/src/components/Field/RRSetType.vue
index ed63b1a35..35c0da60d 100644
--- a/www/webapp/src/components/Field/RRSetType.vue
+++ b/www/webapp/src/components/Field/RRSetType.vue
@@ -3,7 +3,7 @@
     :label="label"
     :disabled="disabled || readonly"
     :error-messages="errorMessages"
-    hint="You can also enter other types. For a full list, check the documentation."
+    :hint="hint"
     :persistent-hint="!readonly"
     :value="value"
     :items="types"
@@ -33,6 +33,10 @@ export default {
       type: Boolean,
       required: false,
     },
+    hint: {
+      type: String,
+      default: 'You can also enter other types. For a full list, check the documentation.',
+    },
     required: {
       type: Boolean,
       default: false,

From 63f5afa95c2f3d916e807ce615537451f8150bb6 Mon Sep 17 00:00:00 2001
From: eyjhb <eyjhbb@gmail.com>
Date: Sun, 17 May 2026 16:11:43 +0200
Subject: [PATCH 2/5] feat(webapp): makes RRSetType emit dirty on change

---
 www/webapp/src/components/Field/RRSetType.vue | 1 +
 1 file changed, 1 insertion(+)

diff --git a/www/webapp/src/components/Field/RRSetType.vue b/www/webapp/src/components/Field/RRSetType.vue
index 35c0da60d..469fae533 100644
--- a/www/webapp/src/components/Field/RRSetType.vue
+++ b/www/webapp/src/components/Field/RRSetType.vue
@@ -67,6 +67,7 @@ export default {
   methods: {
     input(event) {
       this.$emit('input', event);
+      this.$emit('dirty');
     },
   },
 };

From 68dbe38d15ebcb148ff855f9d58814ebd71d8f38 Mon Sep 17 00:00:00 2001
From: eyjhb <eyjhbb@gmail.com>
Date: Sun, 17 May 2026 16:12:44 +0200
Subject: [PATCH 3/5] feat(webapp): adds basic support for managing token
 policies

---
 www/webapp/src/router/index.js               |   6 ++
 www/webapp/src/views/CrudListToken.vue       |  13 +++
 www/webapp/src/views/CrudListTokenPolicy.vue | 106 +++++++++++++++++++
 3 files changed, 125 insertions(+)
 create mode 100644 www/webapp/src/views/CrudListTokenPolicy.vue

diff --git a/www/webapp/src/router/index.js b/www/webapp/src/router/index.js
index 123fb6429..0ef2cf03a 100644
--- a/www/webapp/src/router/index.js
+++ b/www/webapp/src/router/index.js
@@ -125,6 +125,12 @@ const routes = [
     component: () => import('@/views/CrudListToken.vue'),
     meta: {guest: false},
   },
+  {
+    path: '/tokens/:tokenId/policies',
+    name: 'tokenPolicies',
+    component: () => import('@/views/CrudListTokenPolicy.vue'),
+    meta: {guest: false},
+  },
   {
     path: '/domains',
     name: 'domains',
diff --git a/www/webapp/src/views/CrudListToken.vue b/www/webapp/src/views/CrudListToken.vue
index ca50b712d..cc3536ec1 100644
--- a/www/webapp/src/views/CrudListToken.vue
+++ b/www/webapp/src/views/CrudListToken.vue
@@ -6,10 +6,23 @@ import GenericCheckbox from "@/components/Field/GenericCheckbox.vue";
 import RecordList from "@/components/Field/RecordList.vue";
 import GenericSwitchbox from "@/components/Field/GenericSwitchbox.vue";
 import TimeAgo from "@/components/Field/TimeAgo.vue";
+import {mdiShieldLock} from "@mdi/js";
 
 export default {
   name: 'CrudListToken',
   extends: CrudList,
+  computed: {
+    actions() {
+      return {
+        policies: {
+          go: (item) => this.$router.push({ name: 'tokenPolicies', params: { tokenId: item.id }, query: item.name ? { name: item.name } : {} }),
+          if: this.showAdvanced,
+          icon: mdiShieldLock,
+          tooltip: 'Policies',
+        },
+      };
+    },
+  },
   data() {
     return {
         creatable: true,
diff --git a/www/webapp/src/views/CrudListTokenPolicy.vue b/www/webapp/src/views/CrudListTokenPolicy.vue
new file mode 100644
index 000000000..eaca8a557
--- /dev/null
+++ b/www/webapp/src/views/CrudListTokenPolicy.vue
@@ -0,0 +1,106 @@
+<script>
+import CrudList from './CrudList.vue';
+import GenericText from '@/components/Field/GenericText.vue';
+import GenericSwitchbox from '@/components/Field/GenericSwitchbox.vue';
+
+export default {
+  name: 'CrudListTokenPolicy',
+  extends: CrudList,
+  data() {
+    const self = this;
+    return {
+      creatable: true,
+      updatable: true,
+      destroyable: true,
+      headlines: {
+        table: `Policies for token ${self.$route.query.name ? `${self.$route.query.name} (${self.$route.params.tokenId})` : self.$route.params.tokenId}`,
+        create: 'Add Policy',
+        destroy: 'Delete Policy',
+      },
+      texts: {
+        banner: () => (
+          'Policies restrict DNS write access for this token. A default policy (all fields empty) must exist before specific policies can be added. ' +
+          '<a href="https://desec.readthedocs.io/en/latest/auth/tokens.html#token-scoping-policies" target="_blank">Documentation</a>'
+        ),
+        create: () => 'Add a policy. Leave domain, subname, and type empty to create the default (deny-all) policy.',
+        destroy: p => {
+          const domain = p.domain || 'any domain';
+          const subname = p.subname || 'any subname';
+          const type = p.type || 'any type';
+          const write = p.perm_write ? 'write allowed' : 'write denied';
+          return `Delete policy (${domain}, ${subname}, ${type}, ${write})?`;
+        },
+      },
+      columns: {
+        domain: {
+          name: 'item.domain',
+          text: 'Domain',
+          align: 'left',
+          sortable: true,
+          value: 'domain',
+          readonly: false,
+          required: false,
+          writeOnCreate: true,
+          datatype: GenericText.name,
+          searchable: true,
+          fieldProps: () => ({ placeholder: '(any domain)' }),
+        },
+        subname: {
+          name: 'item.subname',
+          text: 'Subname',
+          align: 'left',
+          sortable: true,
+          value: 'subname',
+          readonly: false,
+          required: false,
+          writeOnCreate: true,
+          datatype: GenericText.name,
+          searchable: true,
+          fieldProps: () => ({ placeholder: '(any subname)' }),
+        },
+        type: {
+          name: 'item.type',
+          text: 'Type',
+          align: 'left',
+          sortable: true,
+          value: 'type',
+          readonly: false,
+          required: false,
+          writeOnCreate: true,
+          datatype: 'RRSetType',
+          searchable: true,
+          fieldProps: (item) => ({ value: item.type || '', hint: 'Leave empty to match any record type. You can also enter types not listed.' }),
+        },
+        perm_write: {
+          name: 'item.perm_write',
+          text: 'Write',
+          align: 'left',
+          sortable: true,
+          value: 'perm_write',
+          readonly: false,
+          writeOnCreate: true,
+          datatype: GenericSwitchbox.name,
+          searchable: false,
+        },
+      },
+      paths: {
+        list: 'auth/tokens/::{tokenId}/policies/rrsets/',
+        create: 'auth/tokens/::{tokenId}/policies/rrsets/',
+        delete: 'auth/tokens/::{tokenId}/policies/rrsets/:{id}/',
+        update: 'auth/tokens/::{tokenId}/policies/rrsets/:{id}/',
+      },
+      itemDefaults: () => ({ domain: '', subname: '', type: '', perm_write: false }),
+      precreate() {
+        this.createDialogItem.domain = this.createDialogItem.domain || null;
+        this.createDialogItem.subname = this.createDialogItem.subname || null;
+        this.createDialogItem.type = this.createDialogItem.type || null;
+      },
+      preupdate(item) {
+        item.domain = item.domain || null;
+        item.subname = item.subname || null;
+        item.type = item.type || null;
+      },
+    };
+  },
+};
+</script>

From e93e365ae9e076f0803ed26c2df1db5bcbacb31f Mon Sep 17 00:00:00 2001
From: eyjhb <eyjhbb@gmail.com>
Date: Sun, 17 May 2026 16:35:29 +0200
Subject: [PATCH 4/5] feat(webapp): adds placeholder property to RRSetType

---
 www/webapp/src/components/Field/RRSetType.vue | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/www/webapp/src/components/Field/RRSetType.vue b/www/webapp/src/components/Field/RRSetType.vue
index 469fae533..bee39a1e7 100644
--- a/www/webapp/src/components/Field/RRSetType.vue
+++ b/www/webapp/src/components/Field/RRSetType.vue
@@ -4,6 +4,7 @@
     :disabled="disabled || readonly"
     :error-messages="errorMessages"
     :hint="hint"
+    :placeholder="placeholder"
     :persistent-hint="!readonly"
     :value="value"
     :items="types"
@@ -37,6 +38,10 @@ export default {
       type: String,
       default: 'You can also enter other types. For a full list, check the documentation.',
     },
+    placeholder: {
+      type: String,
+      default: undefined,
+    },
     required: {
       type: Boolean,
       default: false,

From bde726325427112b5fd02eadb7d71922cf588330 Mon Sep 17 00:00:00 2001
From: eyjhb <eyjhbb@gmail.com>
Date: Sun, 17 May 2026 16:35:49 +0200
Subject: [PATCH 5/5] feat(webapp): adds hints for token policy in table

---
 www/webapp/src/views/CrudListTokenPolicy.vue | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/www/webapp/src/views/CrudListTokenPolicy.vue b/www/webapp/src/views/CrudListTokenPolicy.vue
index eaca8a557..e7578100d 100644
--- a/www/webapp/src/views/CrudListTokenPolicy.vue
+++ b/www/webapp/src/views/CrudListTokenPolicy.vue
@@ -43,7 +43,7 @@ export default {
           writeOnCreate: true,
           datatype: GenericText.name,
           searchable: true,
-          fieldProps: () => ({ placeholder: '(any domain)' }),
+          fieldProps: () => ({ placeholder: '(any domain)', hint: 'Leave empty to match any domain.' }),
         },
         subname: {
           name: 'item.subname',
@@ -56,7 +56,7 @@ export default {
           writeOnCreate: true,
           datatype: GenericText.name,
           searchable: true,
-          fieldProps: () => ({ placeholder: '(any subname)' }),
+          fieldProps: () => ({ placeholder: '(any subname)', hint: 'Leave empty to match any subname.' }),
         },
         type: {
           name: 'item.type',
@@ -69,7 +69,7 @@ export default {
           writeOnCreate: true,
           datatype: 'RRSetType',
           searchable: true,
-          fieldProps: (item) => ({ value: item.type || '', hint: 'Leave empty to match any record type. You can also enter types not listed.' }),
+          fieldProps: (item) => ({ value: item.type || '', placeholder: '(any type)', hint: 'Leave empty to match any record type. You can also enter types not listed.' }),
         },
         perm_write: {
           name: 'item.perm_write',