feat: let administrators view and copy encrypted integration credentials

internal/transport/httpserver/console_applications.go

@@ -102,4 +102,25 @@ func RegisterConsoleApplications(server *http.Server, consoleAuth consoleauth.St
 		}
 		writeConsoleJSON(w, 200, map[string]any{"data": out})
 	})
+	if secrets, ok := store.(consoleauth.CredentialTokens); ok {
+		for _, action := range []string{"reveal", "import"} {
+			mux.HandleFunc("POST /console/applications/{namespace}/credentials/{credential}/token/"+action, func(w http.ResponseWriter, r *http.Request) {
+				token, ok := check(w, r)
+				if !ok {
+					return
+				}
+				var in consoleauth.CredentialTokenInput
+				if err := decodeBody(r, &in); err != nil {
+					writeError(w, "", err)
+					return
+				}
+				out, err := secrets.AccessCredentialToken(r.Context(), token, core.ID(r.PathValue("namespace")), core.ID(r.PathValue("credential")), in, action == "import")
+				if err != nil {
+					writeError(w, "", err)
+					return
+				}
+				writeConsoleJSON(w, 200, map[string]any{"data": out})
+			})
+		}
+	}
 }