http-api: T8989: add REST Bearer token authentication

Add JWT Bearer token support to the REST API, as an additional
authentication method alongside the existing form-field key and
X-API-Key header.

- New POST /token endpoint mints a JWT for a valid API key
- auth_required() accepts Authorization: Bearer <token> alongside
  existing key/X-API-Key auth
- New config nodes: service https api rest authentication
  {expiration, secret-length} (defaults: 3600s / 32 bytes)
- REST tokens use an independent signing secret from GraphQL's,
  since GraphQL may not be enabled on all deployments and the two
  subsystems have different expiry requirements
- nginx location regex updated to allow /token
- service_https.py default-value merge generalized to also apply
  to the rest node, not just graphql, so REST authentication
  defaults populate correctly on commit

1 files changed, 3 insertions, 0 deletions

diff --git a/src/services/vyos-http-api-server b/src/services/vyos-http-api-server
index 94697ed4d..4039d17a2 100755
--- a/src/services/vyos-http-api-server
+++ b/src/services/vyos-http-api-server
@@ -184,6 +184,9 @@ def initialization(session: SessionState, app: FastAPI = app):
     rest_config = server_config.get('rest', {})
     session.debug = bool('debug' in rest_config)
     session.strict = bool('strict' in rest_config)
+    if isinstance(rest_config, dict) and 'authentication' in rest_config:
+        session.rest_token_exp = rest_config['authentication']['expiration']
+        session.rest_secret_len = rest_config['authentication']['secret_length']
 
     graphql_config = server_config.get('graphql', {})
     session.origins = graphql_config.get('cors', {}).get('allow_origin', [])