feat: add wildcard token support for allowed extensions and access token CLI commands

Introduce WILDCARD_TOKENS set in attachments.py to treat "*", ".*", "*.*" as wildcards that fall back to ALLOWED_UPLOAD_TYPES. Add cmd_token_issue and cmd_token_list CLI commands for issuing and listing DevPlace access tokens. Register access_tokens table in SOFT_DELETE_TABLES and initialize its columns and indexes in init_db. Replace Form() with Depends(json_or_form(...)) in admin backup, container, notification, settings, and user routers to support both JSON and form data.

devplacepy/routers/uploads.py

@@ -3,7 +3,7 @@
 import logging
 from pathlib import Path
 from typing import Annotated
-from fastapi import APIRouter, Form, Request
+from fastapi import Depends, APIRouter, Request
 from fastapi.responses import JSONResponse
 from devplacepy.database import get_table, get_int_setting
 from devplacepy.models import UploadUrlForm
@@ -17,11 +17,11 @@ from devplacepy.attachments import (
 )
 from urllib.parse import urlparse
 from devplacepy.services.audit import record as audit
+from devplacepy.dependencies import json_or_form
 
 logger = logging.getLogger(__name__)
 router = APIRouter()
 
-
 @router.post("/upload")
 async def upload_file(request: Request):
     user = require_user_api(request)
@@ -67,9 +67,8 @@ async def upload_file(request: Request):
     track_action(user["uid"], "upload")
     return JSONResponse(result, status_code=201)
 
-
 @router.post("/upload-url")
-async def upload_from_url(request: Request, data: Annotated[UploadUrlForm, Form()]):
+async def upload_from_url(request: Request, data: Annotated[UploadUrlForm, Depends(json_or_form(UploadUrlForm))]):
     user = require_user_api(request)
     try:
         result = await store_attachment_from_url(data.url, user["uid"], data.filename)
@@ -92,7 +91,6 @@ async def upload_from_url(request: Request, data: Annotated[UploadUrlForm, Form(
     )
     return JSONResponse(result, status_code=201)
 
-
 @router.delete("/delete/{attachment_uid}")
 async def delete_attachment_route(request: Request, attachment_uid: str):
     user = require_user_api(request)