From 9e9e60cceca736b4db58365cfe32141a175f9ddf Mon Sep 17 00:00:00 2001
From: obervinov <bervinov.ob@gmail.com>
Date: Tue, 30 Jun 2026 01:02:54 +0400
Subject: [PATCH] fix: copy the raw API token from the input value

The copy button passed the token through Django's escapejs filter into the
hyperscript writeText() call, which turns every "-" into -. hyperscript
does not decode \u escapes, so any token containing "-" (common with
token_urlsafe) was copied corrupted and failed auth on paste. Copy from the
input's value instead, which holds the unescaped raw token.
---
 app/templates/users/fragments/api_tokens.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/templates/users/fragments/api_tokens.html b/app/templates/users/fragments/api_tokens.html
index c2b217e..702a173 100644
--- a/app/templates/users/fragments/api_tokens.html
+++ b/app/templates/users/fragments/api_tokens.html
@@ -24,7 +24,7 @@
                _="on focus call me.select()" />
         <button type="button"
                 class="btn btn-sm btn-secondary join-item"
-                _="on click call navigator.clipboard.writeText('{{ raw_token|escapejs }}')
+                _="on click call navigator.clipboard.writeText(#raw-token-value.value)
                      then put 'Copied!' into me
                      then wait 1.5s
                      then put 'Copy' into me">