From f3012e652edef614d4f0ed169b320106a85d83b3 Mon Sep 17 00:00:00 2001 From: omnom62 Date: Wed, 5 Aug 2026 09:14:32 +1000 Subject: http-api: T8989: add REST Bearer token authentication Add JWT Bearer token support to the REST API, as an additional authentication method alongside the existing form-field key and X-API-Key header. - New POST /token endpoint mints a JWT for a valid API key - auth_required() accepts Authorization: Bearer alongside existing key/X-API-Key auth - New config nodes: service https api rest authentication {expiration, secret-length} (defaults: 3600s / 32 bytes) - REST tokens use an independent signing secret from GraphQL's, since GraphQL may not be enabled on all deployments and the two subsystems have different expiry requirements - nginx location regex updated to allow /token - service_https.py default-value merge generalized to also apply to the rest node, not just graphql, so REST authentication defaults populate correctly on commit --- src/conf_mode/service_https.py | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) (limited to 'src/conf_mode/service_https.py') diff --git a/src/conf_mode/service_https.py b/src/conf_mode/service_https.py index 4a9311bfb..28985ead9 100755 --- a/src/conf_mode/service_https.py +++ b/src/conf_mode/service_https.py @@ -77,9 +77,13 @@ def get_config(config=None): # We have gathered the dict representation of the CLI, but there are default # options which we need to update into the dictionary retrieved. default_values = conf.get_config_defaults(**https.kwargs, recursive=True) - if 'api' not in https or 'graphql' not in https['api']: + if 'api' in https: + if 'graphql' not in https['api']: + del default_values['api']['graphql'] + if 'rest' not in https['api']: + del default_values['api']['rest'] + else: del default_values['api'] - # merge CLI and default dictionary https = config_dict_merge(default_values, https) -- cgit v1.2.3