http-api: T8989: add REST Bearer token authentication

Add JWT Bearer token support to the REST API, as an additional
authentication method alongside the existing form-field key and
X-API-Key header.

- New POST /token endpoint mints a JWT for a valid API key
- auth_required() accepts Authorization: Bearer <token> alongside
  existing key/X-API-Key auth
- New config nodes: service https api rest authentication
  {expiration, secret-length} (defaults: 3600s / 32 bytes)
- REST tokens use an independent signing secret from GraphQL's,
  since GraphQL may not be enabled on all deployments and the two
  subsystems have different expiry requirements
- nginx location regex updated to allow /token
- service_https.py default-value merge generalized to also apply
  to the rest node, not just graphql, so REST authentication
  defaults populate correctly on commit

1 files changed, 1 insertions, 1 deletions

diff --git a/data/templates/https/nginx.default.j2 b/data/templates/https/nginx.default.j2
index e0ebe79fc..1074a997a 100644
--- a/data/templates/https/nginx.default.j2
+++ b/data/templates/https/nginx.default.j2
@@ -49,7 +49,7 @@ server {
     ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK';
 
     # proxy settings for HTTP API, if enabled; 503, if not
-    location ~ ^/(retrieve|configure|config-file|image|import-pki|container-image|generate|show|reboot|reset|poweroff|ping|traceroute|info|docs|openapi.json|redoc|graphql|renew) {
+    location ~ ^/(retrieve|configure|config-file|image|import-pki|container-image|generate|show|reboot|reset|poweroff|ping|traceroute|info|docs|openapi.json|redoc|graphql|renew|token) {
 {% if api is vyos_defined %}
         proxy_pass http://unix:/run/api.sock;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;