Add token management helpers for API credentials

apitokens/tokens_test.go

@@ -72,6 +72,60 @@ func TestEntriesFiltersOnlyAPITokens(t *testing.T) {
 	}
 }
 
+func TestUpsertCreatesAndUpdatesVaultTokenEntry(t *testing.T) {
+	t.Parallel()
+
+	model := vault.Model{}
+	token := Token{
+		ID:         "token-1",
+		Name:       "CLI",
+		ClientName: "grpc-cli",
+		SecretHash: "hash-1",
+		CreatedAt:  time.Date(2026, 3, 29, 12, 0, 0, 0, time.UTC),
+	}
+
+	Upsert(&model, token)
+	if len(model.Entries) != 1 {
+		t.Fatalf("len(model.Entries) = %d, want 1", len(model.Entries))
+	}
+	if got := model.ChildGroups([]string{"Root"}); !slices.Equal(got, []string{"API Tokens"}) {
+		t.Fatalf("ChildGroups(Root) = %v, want [API Tokens]", got)
+	}
+
+	token.ClientName = "rotated-client"
+	token.Disabled = true
+	Upsert(&model, token)
+
+	got, err := Find(model, "token-1")
+	if err != nil {
+		t.Fatalf("Find() error = %v", err)
+	}
+	if got.ClientName != "rotated-client" || !got.Disabled {
+		t.Fatalf("Find() = %#v, want updated client name and disabled state", got)
+	}
+}
+
+func TestDeleteRemovesTokenEntryByTokenID(t *testing.T) {
+	t.Parallel()
+
+	model := vault.Model{
+		Entries: []vault.Entry{
+			Token{ID: "token-1", Name: "CLI", SecretHash: "hash-1", CreatedAt: time.Date(2026, 3, 29, 12, 0, 0, 0, time.UTC)}.Entry(EntryPath),
+			{ID: "entry-1", Title: "Regular Entry"},
+		},
+	}
+
+	if err := Delete(&model, "token-1"); err != nil {
+		t.Fatalf("Delete() error = %v", err)
+	}
+	if len(model.Entries) != 1 || model.Entries[0].ID != "entry-1" {
+		t.Fatalf("model.Entries after Delete = %#v, want only regular entry", model.Entries)
+	}
+	if err := Delete(&model, "missing"); err != ErrTokenNotFound {
+		t.Fatalf("Delete(missing) error = %v, want %v", err, ErrTokenNotFound)
+	}
+}
+
 func TestIssueRotateDisableAndRevokeToken(t *testing.T) {
 	t.Parallel()