organization_access_token: Add _sandbox to tokens when in sandbox env

Does the same for personal access tokens, but those are deprecated and
thus no longer being created (but are potentially still in use by
customers).

Author: malthejorgensen

server/polar/organization_access_token/service.py

@@ -32,6 +32,7 @@
 log: Logger = structlog.get_logger()
 
 TOKEN_PREFIX = "polar_oat_"
+TOKEN_PREFIX_SANDBOX = "polar_sandbox_oat_"
 
 
 class OrganizationAccessTokenService:
@@ -105,8 +106,14 @@ async def create(
         organization = await get_payload_organization(
             session, auth_subject, create_schema
         )
+
+        if settings.is_sandbox():
+            token_prefix = TOKEN_PREFIX_SANDBOX
+        else:
+            token_prefix = TOKEN_PREFIX
+
         token, token_hash = generate_token_hash_pair(
-            secret=settings.SECRET, prefix=TOKEN_PREFIX
+            secret=settings.SECRET, prefix=token_prefix
         )
         organization_access_token = OrganizationAccessToken(
             **create_schema.model_dump(

server/polar/personal_access_token/service.py

@@ -18,7 +18,13 @@
 
 log: Logger = structlog.get_logger()
 
-TOKEN_PREFIX = "polar_pat_"
+# We no longer allow the creation of Personal Access Tokens (PATs), so the
+# below prefix is now unused in active code. However, customers may still
+# actively be using PATs for API authentication and we continue to support
+# that.
+# The prefix is listed here for later reference.
+#
+# TOKEN_PREFIX = "polar_pat_"
 
 
 class PersonalAccessTokenService(ResourceServiceReader[PersonalAccessToken]):