4 Commits

Author	SHA1	Message	Date
YueGuobin	8ecc35193d	feat: API key lifecycle — revoke/restore/delete ... - POST /{id}/revoke: 吊销, revoked=True, 立即失效 - POST /{id}/restore: 恢复, revoked=False, 重新生效 - DELETE /{id}: 永久删除, 不可逆 - 列表接口显示所有 key 包括已吊销的 - 认证时过滤 revoked=False	2026-06-11 23:32:19 +08:00
YueGuobin	700d71d675	fix: Rename revoke_api_key → delete_api_key	2026-06-11 23:28:05 +08:00
YueGuobin	9d441517fd	fix: Hard-delete API keys instead of soft delete (revoked flag) ... Removing the soft-delete approach — revoked keys are now deleted from the database entirely via DELETE endpoint. This prevents the api_keys table from accumulating stale records.	2026-06-11 23:27:43 +08:00
YueGuobin	a79bc7dd20	feat: Add API Key support for MCP authentication ... - New db model: api_keys table with bcrypt-hashed keys - New API: POST/GET/DELETE /v3/access/api-keys endpoints - MCP _resolve_token: validates API keys, resolves to 5-min JWT - API keys inherit the creating user's RBAC permissions - MCP auth supports both JWT (24h) and API key (permanent) tokens	2026-06-11 22:54:03 +08:00