Merge ~ltrager/maas:lp1870171_2.6 into maas:2.6

[Lee Trager]

Backport of d0653c9 LP: #1870171 - Remove the token column from the Node table.

The token column is only used by the API when allocating and machine and
listing allocated machines. When a User Token is deleted this association
causes the Node to be deleted as well. Allocated machines are already
filtered by owner and status so the token column isn't needed.

In the backport Node.token is no longer used but the column remains to
avoid creating a migration.

[Lee Trager (ltrager)]

Approved in https://code.launchpad.net/~ltrager/maas/+git/maas/+merge/381876

review: Approve

diff --git a/src/maasserver/api/account.py b/src/maasserver/api/account.py
index 5a5e1f5..cf9ea03 100644
--- a/src/maasserver/api/account.py
+++ b/src/maasserver/api/account.py
@@ -1,4 +1,4 @@
-# Copyright 2014-2018 Canonical Ltd.  This software is licensed under the
+# Copyright 2014-2020 Canonical Ltd.  This software is licensed under the
 # GNU Affero General Public License version 3 (see the file LICENSE).
 
 """API handler: `Account`."""
diff --git a/src/maasserver/api/machines.py b/src/maasserver/api/machines.py
index ab5ab67..6e6d001 100644
--- a/src/maasserver/api/machines.py
+++ b/src/maasserver/api/machines.py
@@ -1,4 +1,4 @@
-# Copyright 2015-2019 Canonical Ltd.  This software is licensed under the
+# Copyright 2015-2020 Canonical Ltd.  This software is licensed under the
 # GNU Affero General Public License version 3 (see the file LICENSE).
 
 __all__ = [
@@ -46,7 +46,6 @@ from maasserver.api.support import (
 )
 from maasserver.api.utils import (
     get_mandatory_param,
-    get_oauth_token,
     get_optional_list,
     get_optional_param,
 )
@@ -708,8 +707,9 @@ class MachineHandler(NodeHandler, OwnerDataMixin, PowerMixin):
                     "Request from user %s to acquire machine: %s (%s)",
                     request.user.username, machine.fqdn, machine.system_id)
                 machine.acquire(
-                    request.user, get_oauth_token(request),
-                    agent_name=options.agent_name, comment=options.comment,
+                    request.user,
+                    agent_name=options.agent_name,
+                    comment=options.comment,
                     bridge_all=options.bridge_all,
                     bridge_stp=options.bridge_stp, bridge_fd=options.bridge_fd)
         if NODE_STATUS.DEPLOYING not in NODE_TRANSITIONS[machine.status]:
@@ -2004,7 +2004,7 @@ class MachinesHandler(NodesHandler, PowersMixin):
     @operation(idempotent=True)
     def list_allocated(self, request):
         """@description-title List allocated
-        @description List machines that were allocated to the User/oauth token.
+        @description List machines that were allocated to the User.
 
         @success (http-status-code) "200" 200
         @success (json) "success-json" A JSON object containing a list of
@@ -2014,8 +2014,10 @@ class MachinesHandler(NodesHandler, PowersMixin):
         """
         # limit to machines that the user can view
         machines = Machine.objects.get_nodes(request.user, NodePermission.view)
-        machines = machines.filter(token=get_oauth_token(request))
-        system_ids = get_optional_list(request.GET, 'id')
+        machines = machines.filter(
+            owner=request.user, status=NODE_STATUS.ALLOCATED
+        )
+        system_ids = get_optional_list(request.GET, "id")
         if system_ids:
             machines = machines.filter(system_id__in=system_ids)
         return machines.order_by('id')
@@ -2320,8 +2322,9 @@ class MachinesHandler(NodesHandler, PowersMixin):
                 raise NodesNotAvailable(message)
             if not dry_run:
                 machine.acquire(
-                    request.user, get_oauth_token(request),
-                    agent_name=options.agent_name, comment=options.comment,
+                    request.user,
+                    agent_name=options.agent_name,
+                    comment=options.comment,
                     bridge_all=options.bridge_all,
                     bridge_stp=options.bridge_stp, bridge_fd=options.bridge_fd)
             machine.constraint_map = storage.get(machine.id, {})
diff --git a/src/maasserver/api/tests/test_api.py b/src/maasserver/api/tests/test_api.py
index c918ff8..55f4368 100644
--- a/src/maasserver/api/tests/test_api.py
+++ b/src/maasserver/api/tests/test_api.py
@@ -1,4 +1,4 @@
-# Copyright 2012-2019 Canonical Ltd.  This software is licensed under the
+# Copyright 2012-2020 Canonical Ltd.  This software is licensed under the
 # GNU Affero General Public License version 3 (see the file LICENSE).
 
 """Test maasserver API."""
@@ -50,7 +50,10 @@ from maasserver.testing.testclient import MAASSensibleOAuthClient
 from maasserver.utils.converters import json_load_bytes
 from maasserver.utils.django_urls import reverse
 from maasserver.utils.keys import ImportSSHKeysError
-from maasserver.utils.orm import get_one
+from maasserver.utils.orm import (
+    get_one,
+    reload_object,
+)
 from maastesting.matchers import (
     MockCalledOnce,
     MockCalledOnceWith,
@@ -328,6 +331,16 @@ class AccountAPITest(APITestCase.ForUser):
         self.assertEqual(http.client.BAD_REQUEST, response.status_code)
         self.assertThat(mock_create_audit_event, MockNotCalled())
 
+    def test_delete_authorisation_token_doesnt_delete_node(self):
+        token = self.user.tokens.first()
+        node = factory.make_Node(owner=self.user, token=token)
+        response = self.client.post(
+            reverse("account_handler"),
+            {"op": "delete_authorisation_token", "token_key": token.key},
+        )
+        self.assertEqual(http.client.NO_CONTENT, response.status_code)
+        self.assertIsNotNone(reload_object(node))
+
     def test_update_authorisation_token(self):
         token_name_orig = 'Test_Token'
         token_name_updated = 'Test_Token update'
diff --git a/src/maasserver/api/tests/test_machine.py b/src/maasserver/api/tests/test_machine.py
index 6eb2cd6..e3ed7e9 100644
--- a/src/maasserver/api/tests/test_machine.py
+++ b/src/maasserver/api/tests/test_machine.py
@@ -797,10 +797,16 @@ class TestMachineAPI(APITestCase.ForUser):
         }
         self.client.post(self.get_machine_uri(machine), request)
         self.assertThat(
-            machine_method, MockCalledOnceWith(
-                ANY, ANY, agent_name=ANY,
-                bridge_all=False, bridge_fd=False,
-                bridge_stp=False, comment=request['comment']))
+            machine_method,
+            MockCalledOnceWith(
+                ANY,
+                agent_name=ANY,
+                bridge_all=False,
+                bridge_fd=0,
+                bridge_stp=False,
+                comment=request["comment"],
+            ),
+        )
 
     def test_POST_deploy_passes_bridge_settings(self):
         self.patch(node_module.Node, "_start")
@@ -821,10 +827,16 @@ class TestMachineAPI(APITestCase.ForUser):
         }
         self.client.post(self.get_machine_uri(machine), request)
         self.assertThat(
-            machine_method, MockCalledOnceWith(
-                ANY, ANY, agent_name=ANY,
-                bridge_all=True, bridge_fd=7,
-                bridge_stp=True, comment=None))
+            machine_method,
+            MockCalledOnceWith(
+                ANY,
+                agent_name=ANY,
+                bridge_all=True,
+                bridge_fd=7,
+                bridge_stp=True,
+                comment=None,
+            ),
+        )
 
     def test_POST_deploy_stores_vcenter_registration_by_default(self):
         self.become_admin()
@@ -1148,10 +1160,16 @@ class TestMachineAPI(APITestCase.ForUser):
             reverse('machines_handler'),
             {'op': 'allocate', 'comment': comment})
         self.assertThat(
-            machine_method, MockCalledOnceWith(
-                ANY, ANY, agent_name=ANY,
-                bridge_all=False, bridge_fd=False,
-                bridge_stp=False, comment=comment))
+            machine_method,
+            MockCalledOnceWith(
+                ANY,
+                agent_name=ANY,
+                bridge_all=False,
+                bridge_fd=False,
+                bridge_stp=False,
+                comment=comment,
+            ),
+        )
 
     def test_POST_allocate_handles_missing_comment(self):
         factory.make_Node(
@@ -1161,10 +1179,16 @@ class TestMachineAPI(APITestCase.ForUser):
         self.client.post(
             reverse('machines_handler'), {'op': 'allocate'})
         self.assertThat(
-            machine_method, MockCalledOnceWith(
-                ANY, ANY, agent_name=ANY,
-                bridge_all=False, bridge_fd=False,
-                bridge_stp=False, comment=None))
+            machine_method,
+            MockCalledOnceWith(
+                ANY,
+                agent_name=ANY,
+                bridge_all=False,
+                bridge_fd=0,
+                bridge_stp=False,
+                comment=None,
+            ),
+        )
 
     def test_POST_release_frees_hwe_kernel(self):
         self.patch(node_module.Machine, '_stop')
diff --git a/src/maasserver/api/tests/test_machines.py b/src/maasserver/api/tests/test_machines.py
index 7849678..9199cce 100644
--- a/src/maasserver/api/tests/test_machines.py
+++ b/src/maasserver/api/tests/test_machines.py
@@ -1,4 +1,4 @@
-# Copyright 2015-2019 Canonical Ltd.  This software is licensed under the
+# Copyright 2015-2020 Canonical Ltd.  This software is licensed under the
 # GNU Affero General Public License version 3 (see the file LICENSE).
 
 """Tests for the machines API."""
@@ -43,10 +43,6 @@ from maasserver.models import (
     node as node_module,
 )
 from maasserver.models.node import RELEASABLE_STATUSES
-from maasserver.models.user import (
-    create_auth_token,
-    get_auth_tokens,
-)
 from maasserver.node_constraint_filter_forms import AcquireNodeForm
 from maasserver.rpc.testing.fixtures import MockLiveRegionToClusterRPCFixture
 from maasserver.testing.api import (
@@ -634,29 +630,11 @@ class TestMachinesAPI(APITestCase.ForUser):
             [machine.system_id for machine in machines],
             extract_system_ids(parsed_result))
 
-    def test_GET_list_allocated_returns_only_allocated_with_user_token(self):
-        # If the user's allocated machines have different session tokens,
-        # list_allocated should only return the machines that have the
-        # current request's token on them.
-        machine_1 = factory.make_Node(
-            status=NODE_STATUS.ALLOCATED, owner=self.user,
-            token=get_auth_tokens(self.user)[0])
-        second_token = create_auth_token(self.user)
-        factory.make_Node(
-            owner=self.user, status=NODE_STATUS.ALLOCATED,
-            token=second_token)
-
-        user_2 = factory.make_User()
-        create_auth_token(user_2)
-        factory.make_Node(
-            owner=self.user, status=NODE_STATUS.ALLOCATED,
-            token=second_token)
-
-        # At this point we have two machines owned by the same user but
-        # allocated with different tokens, and a third machine allocated to
-        # someone else entirely.  We expect list_allocated to
-        # return the machine with the same token as the one used in
-        # self.client, which is the one we set on machine_1 above.
+    def test_GET_list_allocated_returns_only_allocated_with_user(self):
+        machine = factory.make_Node(
+            status=NODE_STATUS.ALLOCATED, owner=self.user
+        )
+        factory.make_Node(status=NODE_STATUS.ALLOCATED)
 
         response = self.client.get(reverse('machines_handler'), {
             'op': 'list_allocated'})
@@ -664,17 +642,17 @@ class TestMachinesAPI(APITestCase.ForUser):
         parsed_result = json.loads(
             response.content.decode(settings.DEFAULT_CHARSET))
         self.assertItemsEqual(
-            [machine_1.system_id], extract_system_ids(parsed_result))
+            [machine.system_id], extract_system_ids(parsed_result)
+        )
 
     def test_GET_list_allocated_filters_by_id(self):
-        # list_allocated takes an optional list of 'id' parameters to
-        # filter returned results.
-        current_token = get_auth_tokens(self.user)[0]
         machines = []
         for _ in range(3):
-            machines.append(factory.make_Node(
-                status=NODE_STATUS.ALLOCATED,
-                owner=self.user, token=current_token))
+            machines.append(
+                factory.make_Node(
+                    status=NODE_STATUS.ALLOCATED, owner=self.user
+                )
+            )
 
         required_machine_ids = [machines[0].system_id, machines[1].system_id]
         response = self.client.get(reverse('machines_handler'), {
@@ -700,15 +678,19 @@ class TestMachinesAPI(APITestCase.ForUser):
         rbac.store.add_pool(pool)
         rbac.store.allow(self.user.username, pool, 'view')
 
-        token = get_auth_tokens(self.user)[0]
         factory.make_Node(
-            hostname='viewable', owner=self.user, token=token, pool=pool,
-            status=NODE_STATUS.ALLOCATED)
-        # a machine with the same token but not accesssible to the user (not in
+            hostname="viewable",
+            owner=self.user,
+            pool=pool,
+            status=NODE_STATUS.ALLOCATED,
+        )
+        # a machine with the same user but not accesssible to the user (not in
         # the allowed pool)
         factory.make_Node(
-            hostname='not-accessible', owner=self.user, token=token,
-            status=NODE_STATUS.ALLOCATED)
+            hostname="not-accessible",
+            owner=self.user,
+            status=NODE_STATUS.ALLOCATED,
+        )
         # a machine owned by another user in the accessible pool
         factory.make_Node(
             hostname='other-user', owner=factory.make_User(),
@@ -1933,19 +1915,6 @@ class TestMachinesAPI(APITestCase.ForUser):
             response.content.decode(settings.DEFAULT_CHARSET))['system_id']
         self.assertEqual(node2.system_id, system_id)
 
-    def test_POST_allocate_sets_a_token(self):
-        # "acquire" should set the Token being used in the request on
-        # the Machine that is allocated.
-        available_status = NODE_STATUS.READY
-        machine = factory.make_Node(
-            status=available_status, owner=None, with_boot_disk=True)
-        response = self.client.post(
-            reverse('machines_handler'), {'op': 'allocate'})
-        self.assertThat(response, HasStatusCode(http.client.OK))
-        machine = Machine.objects.get(system_id=machine.system_id)
-        oauth_key = self.client.token.key
-        self.assertEqual(oauth_key, machine.token.key)
-
     def test_POST_accept_gets_machine_out_of_declared_state(self):
         # This will change when we add provisioning.  Until then,
         # acceptance gets a machine straight to Ready state.
diff --git a/src/maasserver/models/node.py b/src/maasserver/models/node.py
index e810045..2a42679 100644
--- a/src/maasserver/models/node.py
+++ b/src/maasserver/models/node.py
@@ -2810,11 +2810,17 @@ class Node(CleanSave, TimestampedModel):
                     "s" if len(missing_packages) > 1 else ""))
 
     def acquire(
-            self, user, token=None, agent_name='', comment=None,
-            bridge_all=False, bridge_stp=None, bridge_fd=None):
-        """Mark commissioned node as acquired by the given user and token."""
+        self,
+        user,
+        agent_name="",
+        comment=None,
+        bridge_all=False,
+        bridge_type=None,
+        bridge_stp=None,
+        bridge_fd=None,
+    ):
+        """Mark commissioned node as acquired by the given user."""
         assert self.owner is None or self.owner == user
-        assert token is None or token.user == user
 
         self._create_acquired_filesystems()
         self._register_request_event(
@@ -2823,7 +2829,6 @@ class Node(CleanSave, TimestampedModel):
         self.status = NODE_STATUS.ALLOCATED
         self.owner = user
         self.agent_name = agent_name
-        self.token = token
         if bridge_all:
             self._create_acquired_bridges(
                 bridge_stp=bridge_stp, bridge_fd=bridge_fd)
@@ -3095,8 +3100,7 @@ class Node(CleanSave, TimestampedModel):
             finalize_release = True
 
         self.status = NODE_STATUS.RELEASING
-        self.token = None
-        self.agent_name = ''
+        self.agent_name = ""
         self.set_netboot()
         self.set_ephemeral_deploy()
         self.osystem = ''
diff --git a/src/maasserver/models/tests/test_node.py b/src/maasserver/models/tests/test_node.py
index 3dd51f0..b8b54c6 100644
--- a/src/maasserver/models/tests/test_node.py
+++ b/src/maasserver/models/tests/test_node.py
@@ -1,4 +1,4 @@
-# Copyright 2012-2019 Canonical Ltd.  This software is licensed under the
+# Copyright 2012-2020 Canonical Ltd.  This software is licensed under the
 # GNU Affero General Public License version 3 (see the file LICENSE).
 
 """Test maasserver models."""
@@ -119,7 +119,6 @@ from maasserver.models.partitiontable import PARTITION_TABLE_EXTRA_SPACE
 from maasserver.models.resourcepool import ResourcePool
 from maasserver.models.signals import power as node_query
 from maasserver.models.timestampedmodel import now
-from maasserver.models.user import create_auth_token
 from maasserver.node_status import (
     COMMISSIONING_LIKE_STATUSES,
     get_node_timeout,
@@ -1245,12 +1244,6 @@ class TestNode(MAASServerTestCase):
         node = factory.make_Node(bios_boot_method=factory.make_name("boot"))
         self.assertEqual("pxe", node.get_bios_boot_method())
 
-    def test_add_node_with_token(self):
-        user = factory.make_User()
-        token = create_auth_token(user)
-        node = factory.make_Node(token=token)
-        self.assertEqual(token, node.token)
-
     def test_add_physical_interface(self):
         mac = factory.make_mac_address()
         node = factory.make_Node()
@@ -1715,9 +1708,8 @@ class TestNode(MAASServerTestCase):
     def test_acquire(self):
         node = factory.make_Node(status=NODE_STATUS.READY, with_boot_disk=True)
         user = factory.make_User()
-        token = create_auth_token(user)
-        agent_name = factory.make_name('agent-name')
-        node.acquire(user, token, agent_name)
+        agent_name = factory.make_name("agent-name")
+        node.acquire(user, agent_name)
         self.assertEqual(
             (user, NODE_STATUS.ALLOCATED, agent_name),
             (node.owner, node.status, node.agent_name))
@@ -1725,36 +1717,44 @@ class TestNode(MAASServerTestCase):
     def test_acquire_calls__create_acquired_filesystems(self):
         node = factory.make_Node(status=NODE_STATUS.READY, with_boot_disk=True)
         user = factory.make_User()
-        token = create_auth_token(user)
-        agent_name = factory.make_name('agent-name')
+        agent_name = factory.make_name("agent-name")
         mock_create_acquired_filesystems = self.patch_autospec(
-            node, "_create_acquired_filesystems")
-        node.acquire(user, token, agent_name)
+            node, "_create_acquired_filesystems"
+        )
+        node.acquire(user, agent_name)
         self.assertThat(mock_create_acquired_filesystems, MockCalledOnceWith())
 
     def test_acquire_logs_user_request(self):
         node = factory.make_Node(status=NODE_STATUS.READY, with_boot_disk=True)
         user = factory.make_User()
-        token = create_auth_token(user)
-        agent_name = factory.make_name('agent-name')
-        register_event = self.patch(node, '_register_request_event')
-        node.acquire(user, token, agent_name)
-        self.assertThat(register_event, MockCalledOnceWith(
-            user, EVENT_TYPES.REQUEST_NODE_ACQUIRE, action='acquire',
-            comment=None))
+        agent_name = factory.make_name("agent-name")
+        register_event = self.patch(node, "_register_request_event")
+        node.acquire(user, agent_name)
+        self.assertThat(
+            register_event,
+            MockCalledOnceWith(
+                user,
+                EVENT_TYPES.REQUEST_NODE_ACQUIRE,
+                action="acquire",
+                comment=None,
+            ),
+        )
 
     def test_acquire_calls__create_acquired_bridges(self):
         node = factory.make_Node(status=NODE_STATUS.READY, with_boot_disk=True)
         user = factory.make_User()
-        token = create_auth_token(user)
-        agent_name = factory.make_name('agent-name')
+        agent_name = factory.make_name("agent-name")
         mock_create_acquired_bridges = self.patch_autospec(
             node, "_create_acquired_bridges")
         bridge_stp = factory.pick_bool()
         bridge_fd = random.randint(0, 500)
         node.acquire(
-            user, token, agent_name,
-            bridge_all=True, bridge_stp=bridge_stp, bridge_fd=bridge_fd)
+            user,
+            agent_name,
+            bridge_all=True,
+            bridge_stp=bridge_stp,
+            bridge_fd=bridge_fd,
+        )
         self.assertThat(
             mock_create_acquired_bridges,
             MockCalledOnceWith(bridge_stp=bridge_stp, bridge_fd=bridge_fd))
@@ -2266,8 +2266,7 @@ class TestNode(MAASServerTestCase):
             MockCalledOnceWith(node.system_id, NODE_STATUS.RELEASING))
         self.expectThat(node.status, Equals(NODE_STATUS.RELEASING))
         self.expectThat(node.owner, Equals(owner))
-        self.expectThat(node.agent_name, Equals(''))
-        self.expectThat(node.token, Is(None))
+        self.expectThat(node.agent_name, Equals(""))
         self.expectThat(node.netboot, Is(True))
         self.expectThat(node.ephemeral_deploy, Is(False))
         self.expectThat(node.osystem, Equals(''))
@@ -2306,8 +2305,7 @@ class TestNode(MAASServerTestCase):
         self.expectThat(Node._set_status_expires, MockNotCalled())
         self.expectThat(node.status, Equals(NODE_STATUS.RELEASING))
         self.expectThat(node.owner, Equals(owner))
-        self.expectThat(node.agent_name, Equals(''))
-        self.expectThat(node.token, Is(None))
+        self.expectThat(node.agent_name, Equals(""))
         self.expectThat(node.netboot, Is(True))
         self.expectThat(node.ephemeral_deploy, Is(False))
         self.expectThat(node.osystem, Equals(''))
@@ -2338,8 +2336,7 @@ class TestNode(MAASServerTestCase):
         self.expectThat(Node._set_status_expires, MockNotCalled())
         self.expectThat(node.status, Equals(NODE_STATUS.READY))
         self.expectThat(node.owner, Equals(None))
-        self.expectThat(node.agent_name, Equals(''))
-        self.expectThat(node.token, Is(None))
+        self.expectThat(node.agent_name, Equals(""))
         self.expectThat(node.netboot, Is(True))
         self.expectThat(node.ephemeral_deploy, Is(False))
         self.expectThat(node.osystem, Equals(''))
diff --git a/src/maasserver/models/tests/test_userprofile.py b/src/maasserver/models/tests/test_userprofile.py
index 9fa2ba1..1a9bdc3 100644
--- a/src/maasserver/models/tests/test_userprofile.py
+++ b/src/maasserver/models/tests/test_userprofile.py
@@ -1,4 +1,4 @@
-# Copyright 2012-2016 Canonical Ltd.  This software is licensed under the
+# Copyright 2012-2020 Canonical Ltd.  This software is licensed under the
 # GNU Affero General Public License version 3 (see the file LICENSE).
 
 """Tests for the UserProfile model."""
@@ -85,6 +85,14 @@ class UserProfileTest(MAASServerTestCase):
         self.assertFalse(Consumer.objects.filter(id__in=consumer_ids).exists())
         self.assertFalse(Token.objects.filter(id__in=token_ids).exists())
 
+    def test_delete_doesnt_delete_node(self):
+        user = factory.make_User()
+        profile = user.userprofile
+        _, token = profile.create_authorisation_token()
+        node = factory.make_Node(owner=user, token=token)
+        profile.delete_authorisation_token(token.key)
+        self.assertIsNotNone(reload_object(node))
+
     def test_delete_deletes_related_filestorage_objects(self):
         # Deleting a profile deletes the related filestorage objects.
         profile = factory.make_User().userprofile
diff --git a/src/maasserver/models/userprofile.py b/src/maasserver/models/userprofile.py
index e87b484..be6a208 100644
--- a/src/maasserver/models/userprofile.py
+++ b/src/maasserver/models/userprofile.py
@@ -1,4 +1,4 @@
-# Copyright 2012-2016 Canonical Ltd.  This software is licensed under the
+# Copyright 2012-2020 Canonical Ltd.  This software is licensed under the
 # GNU Affero General Public License version 3 (see the file LICENSE).
 
 """UserProfile model."""
@@ -20,6 +20,7 @@ from django.db.models import (
 from django.shortcuts import get_object_or_404
 from maasserver import DefaultMeta
 from maasserver.exceptions import CannotDeleteUserException
+from maasserver.models import Node
 from maasserver.models.cleansave import CleanSave
 from piston3.models import Token
 
@@ -145,7 +146,11 @@ class UserProfile(CleanSave, Model):
 
         """
         token = get_object_or_404(
-            Token, user=self.user, token_type=Token.ACCESS, key=token_key)
+            Token, user=self.user, token_type=Token.ACCESS, key=token_key,
+        )
+        # LP:1870171 - Make sure the key being deleted isn't assoicated with
+        # any node. In MAAS 2.8+ Node.token has been removed.
+        Node.objects.filter(token=token).update(token=None)
         token.consumer.delete()
         token.delete()
 
diff --git a/src/maasserver/node_action.py b/src/maasserver/node_action.py
index a64cf57..60232d7 100644
--- a/src/maasserver/node_action.py
+++ b/src/maasserver/node_action.py
@@ -418,7 +418,7 @@ class Acquire(NodeAction):
         """See `NodeAction.execute`."""
         with locks.node_acquire:
             try:
-                self.node.acquire(self.user, token=None)
+                self.node.acquire(self.user)
             except ValidationError as e:
                 raise NodeActionError(e)
 
@@ -450,7 +450,7 @@ class Deploy(NodeAction):
         if self.node.owner is None:
             with locks.node_acquire:
                 try:
-                    self.node.acquire(self.user, token=None)
+                    self.node.acquire(self.user)
                 except ValidationError as e:
                     raise NodeActionError(e)
         if install_kvm:
diff --git a/src/maasserver/tests/test_node_action.py b/src/maasserver/tests/test_node_action.py
index 06f80f7..8aa8373 100644
--- a/src/maasserver/tests/test_node_action.py
+++ b/src/maasserver/tests/test_node_action.py
@@ -724,8 +724,7 @@ class TestDeployAction(MAASServerTestCase):
         Deploy(node, user, request).execute(**extra)
         self.expectThat(mock_get_curtin_config, MockCalledOnceWith(ANY, node))
         # Make sure we set bridge_all when we acquire the Node.
-        self.expectThat(
-            mock_node_acquire, MockCalledOnceWith(user, token=None))
+        self.expectThat(mock_node_acquire, MockCalledOnceWith(user))
         self.expectThat(mock_node_start, MockCalledOnceWith(user))
         # Make sure ubuntu/bionic is selected if KVM pod deployment has been
         # selected.
diff --git a/src/maasserver/websockets/handlers/tests/test_token.py b/src/maasserver/websockets/handlers/tests/test_token.py
new file mode 100644
index 0000000..26e79f2
--- /dev/null
+++ b/src/maasserver/websockets/handlers/tests/test_token.py
@@ -0,0 +1,115 @@
+# Copyright 2019-2020 Canonical Ltd.  This software is licensed under the
+# GNU Affero General Public License version 3 (see the file LICENSE).
+
+"""Tests for `maasserver.websockets.handlers.token`"""
+
+__all__ = []
+
+from maasserver.models.event import Event
+from maasserver.models.user import (
+    create_auth_token,
+    get_auth_tokens,
+)
+from maasserver.testing.factory import factory
+from maasserver.testing.testcase import MAASServerTestCase
+from maasserver.utils.orm import (
+    get_one,
+    reload_object,
+)
+from maasserver.websockets.base import HandlerDoesNotExistError
+from maasserver.websockets.handlers.token import TokenHandler
+from provisioningserver.events import AUDIT
+from testtools.matchers import KeysEqual
+
+
+class TestTokenHandler(MAASServerTestCase):
+    def dehydrate_token(self, token):
+        return {
+            "id": token.id,
+            "key": token.key,
+            "secret": token.secret,
+            "consumer": {
+                "key": token.consumer.key,
+                "name": token.consumer.name,
+            },
+        }
+
+    def test_get(self):
+        user = factory.make_User()
+        handler = TokenHandler(user, {}, None)
+        token = create_auth_token(user)
+        self.assertEqual(
+            self.dehydrate_token(token), handler.get({"id": token.id})
+        )
+
+    def test_get_doesnt_work_if_not_owned(self):
+        user = factory.make_User()
+        handler = TokenHandler(user, {}, None)
+        not_owned_token = create_auth_token(factory.make_User())
+        self.assertRaises(
+            HandlerDoesNotExistError, handler.get, {"id": not_owned_token.id}
+        )
+
+    def test_list(self):
+        user = factory.make_User()
+        handler = TokenHandler(user, {}, None)
+        create_auth_token(user)
+        expected_tokens = [
+            self.dehydrate_token(token) for token in get_auth_tokens(user)
+        ]
+        self.assertItemsEqual(expected_tokens, handler.list({}))
+
+    def test_create_no_name(self):
+        user = factory.make_User()
+        handler = TokenHandler(user, {}, None)
+        new_token = handler.create({})
+        self.assertThat(
+            new_token, KeysEqual("id", "key", "secret", "consumer")
+        )
+        event = Event.objects.get(type__level=AUDIT)
+        self.assertIsNotNone(event)
+        self.assertEqual(event.description, "Created token.")
+
+    def test_create_with_name(self):
+        user = factory.make_User()
+        handler = TokenHandler(user, {}, None)
+        name = factory.make_name("name")
+        new_token = handler.create({"name": name})
+        self.assertThat(
+            new_token, KeysEqual("id", "key", "secret", "consumer")
+        )
+        self.assertEqual(name, new_token["consumer"]["name"])
+        event = Event.objects.get(type__level=AUDIT)
+        self.assertIsNotNone(event)
+        self.assertEqual(event.description, "Created token.")
+
+    def test_update(self):
+        user = factory.make_User()
+        handler = TokenHandler(user, {}, None)
+        name = factory.make_name("name")
+        token = create_auth_token(user, name)
+        new_name = factory.make_name("name")
+        updated_token = handler.update({"id": token.id, "name": new_name})
+        self.assertThat(
+            updated_token, KeysEqual("id", "key", "secret", "consumer")
+        )
+        self.assertEqual(new_name, updated_token["consumer"]["name"])
+        event = Event.objects.get(type__level=AUDIT)
+        self.assertIsNotNone(event)
+        self.assertEqual(event.description, "Modified consumer name of token.")
+
+    def test_delete(self):
+        user = factory.make_User()
+        token = create_auth_token(user)
+        handler = TokenHandler(user, {}, None)
+        handler.delete({"id": token.id})
+        self.assertIsNone(get_one(get_auth_tokens(user).filter(id=token.id)))
+
+    def test_delete_doesnt_delete_node(self):
+        user = factory.make_User()
+        token = create_auth_token(user)
+        node = factory.make_Node(owner=user, token=token)
+        handler = TokenHandler(user, {}, None)
+        handler.delete({"id": token.id})
+        self.assertIsNone(get_one(get_auth_tokens(user).filter(id=token.id)))
+        self.assertIsNotNone(reload_object(node))
diff --git a/src/maasserver/websockets/handlers/token.py b/src/maasserver/websockets/handlers/token.py
new file mode 100644
index 0000000..f450d36
--- /dev/null
+++ b/src/maasserver/websockets/handlers/token.py
@@ -0,0 +1,96 @@
+# Copyright 2019-2020 Canonical Ltd.  This software is licensed under the
+# GNU Affero General Public License version 3 (see the file LICENSE).
+
+"""The Token handler for the WebSocket connection."""
+
+__all__ = ["TokenHandler"]
+
+from django.http import HttpRequest
+from maasserver.audit import create_audit_event
+from maasserver.enum import ENDPOINT
+from maasserver.models import Node
+from maasserver.models.user import (
+    create_auth_token,
+    get_auth_tokens,
+)
+from maasserver.websockets.base import (
+    Handler,
+    HandlerDoesNotExistError,
+)
+from piston3.models import Token
+from provisioningserver.events import EVENT_TYPES
+
+
+class TokenHandler(Handler):
+    class Meta:
+        queryset = Token.objects.none()  # Overridden in `get_querset`.
+        allowed_methods = ["list", "get", "create", "update", "delete"]
+        listen_channels = ["token"]
+
+    def get_queryset(self, for_list=False):
+        """Return `QuerySet` for `Token` owned by `user`."""
+        return get_auth_tokens(self.user)
+
+    def get_object(self, params, permission=None):
+        """Only allow getting keys owned by the user."""
+        obj = super(TokenHandler, self).get_object(
+            params, permission=permission
+        )
+        if obj.user != self.user:
+            raise HandlerDoesNotExistError(params[self._meta.pk])
+        else:
+            return obj
+
+    def full_dehydrate(self, obj, for_list=False):
+        """Return the representation for the object."""
+        return {
+            "id": obj.id,
+            "key": obj.key,
+            "secret": obj.secret,
+            "consumer": {"key": obj.consumer.key, "name": obj.consumer.name},
+        }
+
+    def create(self, params):
+        """Create a Token."""
+        token = create_auth_token(self.user, params.get("name"))
+        request = HttpRequest()
+        request.user = self.user
+        create_audit_event(
+            EVENT_TYPES.AUTHORISATION,
+            ENDPOINT.UI,
+            request,
+            None,
+            "Created token.",
+        )
+        return self.full_dehydrate(token)
+
+    def update(self, params):
+        """Update a Token.
+
+        Only the name can be updated.
+        """
+        token = self.get_object(params)
+        name = params.get("name")
+        if name != token.consumer.name:
+            token.consumer.name = params.get("name")
+            token.consumer.save()
+            request = HttpRequest()
+            request.user = self.user
+            create_audit_event(
+                EVENT_TYPES.AUTHORISATION,
+                ENDPOINT.UI,
+                request,
+                None,
+                "Modified consumer name of token.",
+            )
+        return self.full_dehydrate(token)
+
+    def delete(self, params):
+        """Delete a token."""
+        # LP:1870171 - Make sure the key being deleted isn't assoicated with
+        # any node. In MAAS 2.8+ Node.token has been removed.
+        token = self.get_object(
+            params, permission=self._meta.delete_permission
+        )
+        Node.objects.filter(token=token).update(token=None)
+        token.delete()