From f3012e652edef614d4f0ed169b320106a85d83b3 Mon Sep 17 00:00:00 2001
From: omnom62 <omnom62@outlook.com>
Date: Wed, 5 Aug 2026 09:14:32 +1000
Subject: http-api: T8989: add REST Bearer token authentication

Add JWT Bearer token support to the REST API, as an additional
authentication method alongside the existing form-field key and
X-API-Key header.

- New POST /token endpoint mints a JWT for a valid API key
- auth_required() accepts Authorization: Bearer <token> alongside
  existing key/X-API-Key auth
- New config nodes: service https api rest authentication
  {expiration, secret-length} (defaults: 3600s / 32 bytes)
- REST tokens use an independent signing secret from GraphQL's,
  since GraphQL may not be enabled on all deployments and the two
  subsystems have different expiry requirements
- nginx location regex updated to allow /token
- service_https.py default-value merge generalized to also apply
  to the rest node, not just graphql, so REST authentication
  defaults populate correctly on commit
---
 interface-definitions/service_https.xml.in | 33 ++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)

(limited to 'interface-definitions/service_https.xml.in')

diff --git a/interface-definitions/service_https.xml.in b/interface-definitions/service_https.xml.in
index 7bb63fa5a..f576444e9 100644
--- a/interface-definitions/service_https.xml.in
+++ b/interface-definitions/service_https.xml.in
@@ -50,6 +50,39 @@
                       <hidden/>
                     </properties>
                   </leafNode>
+                  <node name="authentication">
+                    <properties>
+                      <help>REST authentication</help>
+                    </properties>
+                    <children>
+                      <leafNode name="expiration">
+                        <properties>
+                          <help>Token time to expire in seconds</help>
+                          <valueHelp>
+                            <format>u32:60-31536000</format>
+                            <description>Token lifetime in seconds</description>
+                          </valueHelp>
+                          <constraint>
+                            <validator name="numeric" argument="--range 60-31536000"/>
+                          </constraint>
+                        </properties>
+                        <defaultValue>3600</defaultValue>
+                      </leafNode>
+                      <leafNode name="secret-length">
+                        <properties>
+                          <help>Length of shared secret in bytes</help>
+                          <valueHelp>
+                            <format>u32:16-65535</format>
+                            <description>Byte length of generated shared secret</description>
+                          </valueHelp>
+                          <constraint>
+                            <validator name="numeric" argument="--range 16-65535"/>
+                          </constraint>
+                        </properties>
+                        <defaultValue>32</defaultValue>
+                      </leafNode>
+                    </children>
+                  </node>
                 </children>
               </node>
               <node name="graphql">
-- 
cgit v1.2.3