6 Commits

Author	SHA1	Message	Date
YueGuobin	59e5f8dd2f	Fix review issues: key_prefix length, count validation, WAL log, timeout comment, pointless temp var	2026-06-16 22:50:22 +08:00
YueGuobin	f522c947bc	Optimize API key auth: O(1) lookup via UUID-embedded key format ... New format: gns3_<api_key_id>_<random_secret> - Auth extracts api_key_id from token → single DB query by UUID → one bcrypt - No more scanning all keys (was O(n) with bcrypt per key) - bcrypt.checkpw offloaded to thread pool to prevent event loop blocking - Legacy gns3_<random> format removed (compatibility break)	2026-06-15 23:56:36 +08:00
YueGuobin	8ecc35193d	feat: API key lifecycle — revoke/restore/delete ... - POST /{id}/revoke: 吊销, revoked=True, 立即失效 - POST /{id}/restore: 恢复, revoked=False, 重新生效 - DELETE /{id}: 永久删除, 不可逆 - 列表接口显示所有 key 包括已吊销的 - 认证时过滤 revoked=False	2026-06-11 23:32:19 +08:00
YueGuobin	700d71d675	fix: Rename revoke_api_key → delete_api_key	2026-06-11 23:28:05 +08:00
YueGuobin	9d441517fd	fix: Hard-delete API keys instead of soft delete (revoked flag) ... Removing the soft-delete approach — revoked keys are now deleted from the database entirely via DELETE endpoint. This prevents the api_keys table from accumulating stale records.	2026-06-11 23:27:43 +08:00
YueGuobin	a79bc7dd20	feat: Add API Key support for MCP authentication ... - New db model: api_keys table with bcrypt-hashed keys - New API: POST/GET/DELETE /v3/access/api-keys endpoints - MCP _resolve_token: validates API keys, resolves to 5-min JWT - API keys inherit the creating user's RBAC permissions - MCP auth supports both JWT (24h) and API key (permanent) tokens	2026-06-11 22:54:03 +08:00