senlinjun aab8a004ae feat(web): add API-key authentication for the REST API ...

- api_keys table + hashed key store (src/data/api-keys.ts), tsmb_-prefixed
  plaintext shown once, per-user cap of 20, lastUsedAt tracking
- requireAuth accepts Authorization: Bearer / X-API-Key headers as an
  alternative to the session cookie; key inherits the owner user's
  role/capabilities/bot scope
- csrf origin check skipped for key-only requests (no ambient credentials);
  requests that also carry the session cookie stay gated
- /api/keys management endpoints (session-only, guests excluded, keys
  themselves rejected) with audit logging
- user deletion / password reset cascade-revoke the user's keys
- Settings page: API key management section (create/copy-once/revoke)
- docs: README section + full endpoint reference in docs/API.md

2026-09-29 21:51:43 +08:00

..

api

feat(web): add API-key authentication for the REST API

2026-09-29 21:51:43 +08:00

auth

feat(web): add API-key authentication for the REST API

2026-09-29 21:51:43 +08:00

middleware

feat(web): add API-key authentication for the REST API

2026-09-29 21:51:43 +08:00

referrer-policy.test.ts

fix(web): referrer-policy same-origin so same-origin POSTs keep a real Origin

2026-05-29 21:25:20 +08:00

robots.test.ts

feat(web): keep deployed WebUI out of search-engine indexes

2026-07-16 23:31:31 +08:00

security-headers.test.ts

feat(auth): X-Frame-Options + CSP frame-ancestors clickjacking defence

2026-05-27 16:34:52 +08:00

server.ts

feat(web): add API-key authentication for the REST API

2026-09-29 21:51:43 +08:00

websocket-auth.test.ts

fix(guest): tear down guest WS on guest-mode config change

2026-06-25 16:05:14 +08:00

websocket.ts

fix(guest): tear down guest WS on guest-mode config change

2026-06-25 16:05:14 +08:00