fix(settings): normalize API token timestamps (#5599)

* fix(settings): normalize API token timestamps

* refactor(api-token): share timestamp threshold

---------

Co-authored-by: Tomilla <5007859+Tomilla@users.noreply.github.com>

internal/web/service/panel/api_token.go

@@ -24,6 +24,13 @@ type ApiTokenView struct {
 	CreatedAt int64  `json:"createdAt" example:"1736000000"`
 }
 
+func apiTokenCreatedAtSeconds(createdAt int64) int64 {
+	if createdAt >= model.ApiTokenUnixMillisecondsThreshold {
+		return createdAt / 1000
+	}
+	return createdAt
+}
+
 // toView builds the metadata view returned by List. It never carries the
 // token value: only a SHA-256 hash is stored, and the plaintext is shown
 // exactly once at creation time.
@@ -32,7 +39,7 @@ func toView(t *model.ApiToken) *ApiTokenView {
 		Id:        t.Id,
 		Name:      t.Name,
 		Enabled:   t.Enabled,
-		CreatedAt: t.CreatedAt,
+		CreatedAt: apiTokenCreatedAtSeconds(t.CreatedAt),
 	}
 }
 

internal/web/service/panel/api_token_test.go

@@ -0,0 +1,23 @@
+package panel
+
+import "testing"
+
+func TestApiTokenCreatedAtSeconds(t *testing.T) {
+	tests := []struct {
+		name string
+		in   int64
+		want int64
+	}{
+		{name: "seconds", in: 1_782_485_394, want: 1_782_485_394},
+		{name: "legacy milliseconds", in: 1_782_485_394_270, want: 1_782_485_394},
+		{name: "unset", in: 0, want: 0},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := apiTokenCreatedAtSeconds(tt.in); got != tt.want {
+				t.Fatalf("apiTokenCreatedAtSeconds(%d) = %d, want %d", tt.in, got, tt.want)
+			}
+		})
+	}
+}