vyos-1x.git/src/services/vyos-http-api-server, branch rolling

http-api: T9453: wait for the API server to be ready after a reload

2026-10-10T19:24:16+00:00

A commit that changes an already running HTTP API only signals the server and returns at once. The server then restarts uvicorn asynchronously, and until it listens again requests through nginx fail. A fixed one-second sleep was meant to cover this but is too short on slow systems, making the https smoketest fail intermittently and API clients see errors right after a commit. The server now creates a readiness marker once it accepts requests. The commit clears the marker before reloading and waits for it to reappear, warning if that takes longer than 30 seconds.

http-api: T8989: address Copilot review comments

2026-09-02T00:35:35+00:00

- Remove fallback 'oidc-client' identity - tokens without sub/client_id are now rejected - Suppress OIDC validation error details from stdout - Cache discovered JWKS URI back to session to avoid per-request discovery - token_op now accepts X-API-Key header alongside form field - Reset REST/OIDC session attributes on SIGHUP reload to prevent stale config persisting after nodes are removed

http-api: T8989: address OIDC review comments

2026-09-02T00:35:35+00:00

- Use OpenID Connect discovery (/.well-known/openid-configuration) to resolve JWKS URI when jwks-url is not explicitly configured - Add optional audience validation via new oidc audience config node - Require exp claim in OIDC tokens - Reject jwks-url without issuer at commit time

http-api: T8989: add OAuth2/OIDC authentication for REST API

2026-09-02T00:35:25+00:00

Add support for validating OIDC Bearer tokens issued by external identity providers (Keycloak, Azure AD, Okta, Vault, etc.) against the configured JWKS endpoint. Configuration: set service https api rest authentication oidc issuer set service https api rest authentication oidc jwks-url If jwks-url is not set, it is derived from the issuer URL using the standard OpenID Connect discovery path. Auth priority: mTLS -> VyOS JWT -> OIDC -> API key

http-api: T8989: address review comments

2026-08-26T18:33:34+00:00

- Make ApiModel.key optional to allow Bearer/X-API-Key/mTLS auth without requiring a dummy key field in the request body - Add thread safety to REST token secret initialization - Cast rest_token_exp and rest_secret_len to int on load - Use defensive dict.get() for authentication config access

http-api: T8989: add REST Bearer token authentication

2026-08-26T18:33:34+00:00

Add JWT Bearer token support to the REST API, as an additional authentication method alongside the existing form-field key and X-API-Key header. - New POST /token endpoint mints a JWT for a valid API key - auth_required() accepts Authorization: Bearer alongside existing key/X-API-Key auth - New config nodes: service https api rest authentication {expiration, secret-length} (defaults: 3600s / 32 bytes) - REST tokens use an independent signing secret from GraphQL's, since GraphQL may not be enabled on all deployments and the two subsystems have different expiry requirements - nginx location regex updated to allow /token - service_https.py default-value merge generalized to also apply to the rest node, not just graphql, so REST authentication defaults populate correctly on commit

T8410: Fix typos and mistakes for operational and configuration commands

2026-03-24T17:02:56+00:00

Fix typos and mistakes in the commands and comments No functional changes

T7591: remove copyright years from source files

2025-06-28T21:16:52+00:00

The legal team says years are not necessary so we can go ahead with it, since it will simplify backporting. Automatically removed using: git ls-files | grep -v libvyosconfig | xargs sed -i -E \ 's/^# Copyright (19|20)[0-9]{2}(-[0-9]{4})? VyOS maintainers.*/# Copyright VyOS maintainers and contributors /g' In addition we will error-out during "make" if someone re-adds a legacy copyright notice

T4406: Add public API endpoint to display information

2025-03-06T12:46:40+00:00

http-api: T6736: regenerate openapi docs

2024-09-30T03:21:21+00:00