vyos-1x.git/src/services/vyos-http-api-server, branch fix/T8955-http-api-verify-tls

http-api: T8989: address Copilot review comments

2026-09-02T00:35:35+00:00

- Remove fallback 'oidc-client' identity - tokens without sub/client_id are now rejected - Suppress OIDC validation error details from stdout - Cache discovered JWKS URI back to session to avoid per-request discovery - token_op now accepts X-API-Key header alongside form field - Reset REST/OIDC session attributes on SIGHUP reload to prevent stale config persisting after nodes are removed

http-api: T8989: address OIDC review comments

2026-09-02T00:35:35+00:00

- Use OpenID Connect discovery (/.well-known/openid-configuration) to resolve JWKS URI when jwks-url is not explicitly configured - Add optional audience validation via new oidc audience config node - Require exp claim in OIDC tokens - Reject jwks-url without issuer at commit time

http-api: T8989: add OAuth2/OIDC authentication for REST API

2026-09-02T00:35:25+00:00

Add support for validating OIDC Bearer tokens issued by external identity providers (Keycloak, Azure AD, Okta, Vault, etc.) against the configured JWKS endpoint. Configuration: set service https api rest authentication oidc issuer set service https api rest authentication oidc jwks-url If jwks-url is not set, it is derived from the issuer URL using the standard OpenID Connect discovery path. Auth priority: mTLS -> VyOS JWT -> OIDC -> API key

http-api: T8989: address review comments

2026-08-26T18:33:34+00:00

- Make ApiModel.key optional to allow Bearer/X-API-Key/mTLS auth without requiring a dummy key field in the request body - Add thread safety to REST token secret initialization - Cast rest_token_exp and rest_secret_len to int on load - Use defensive dict.get() for authentication config access

http-api: T8989: add REST Bearer token authentication

2026-08-26T18:33:34+00:00

Add JWT Bearer token support to the REST API, as an additional authentication method alongside the existing form-field key and X-API-Key header. - New POST /token endpoint mints a JWT for a valid API key - auth_required() accepts Authorization: Bearer alongside existing key/X-API-Key auth - New config nodes: service https api rest authentication {expiration, secret-length} (defaults: 3600s / 32 bytes) - REST tokens use an independent signing secret from GraphQL's, since GraphQL may not be enabled on all deployments and the two subsystems have different expiry requirements - nginx location regex updated to allow /token - service_https.py default-value merge generalized to also apply to the rest node, not just graphql, so REST authentication defaults populate correctly on commit

T8410: Fix typos and mistakes for operational and configuration commands

2026-03-24T17:02:56+00:00

Fix typos and mistakes in the commands and comments No functional changes

T7591: remove copyright years from source files

2025-06-28T21:16:52+00:00

The legal team says years are not necessary so we can go ahead with it, since it will simplify backporting. Automatically removed using: git ls-files | grep -v libvyosconfig | xargs sed -i -E \ 's/^# Copyright (19|20)[0-9]{2}(-[0-9]{4})? VyOS maintainers.*/# Copyright VyOS maintainers and contributors /g' In addition we will error-out during "make" if someone re-adds a legacy copyright notice

T4406: Add public API endpoint to display information

2025-03-06T12:46:40+00:00

http-api: T6736: regenerate openapi docs

2024-09-30T03:21:21+00:00

http-api: T6736: remove routes on config delete

2024-09-30T03:21:21+00:00

Avoid duplicate entries in the list of routes when adding/deleting endpoints.