4 Commits

Author	SHA1	Message	Date
YueGuobin	0e8d0cb87b	Add stateless JWT refresh token mechanism ... - New config: Controller.jwt_refresh_token_expire_minutes (default 30 days) - New endpoint: POST /v3/access/users/refresh (public, unauthenticated) - Login/authenticate responses now include refresh_token - AuthService: _create_token helper, create_refresh_token, get_token_data now parses type claim (token_use) for token classification - Security: refresh tokens rejected on HTTP + WebSocket access paths; /refresh strictly requires type=='refresh' - Logout works for free via existing token_version mechanism - Tests: 9 new TestRefreshToken cases, all passing; 34 existing tests still pass (no regressions)	2026-06-23 22:39:11 +08:00
YueGuobin	a79bc7dd20	feat: Add API Key support for MCP authentication ... - New db model: api_keys table with bcrypt-hashed keys - New API: POST/GET/DELETE /v3/access/api-keys endpoints - MCP _resolve_token: validates API keys, resolves to 5-min JWT - API keys inherit the creating user's RBAC permissions - MCP auth supports both JWT (24h) and API key (permanent) tokens	2026-06-11 22:54:03 +08:00
UmmmAGoodName	4cf8b79692	Fix addressing issue #2005 including tests	2026-04-05 21:51:52 +02:00
grossmj	9c850e0f2b	Move schemas between compute and controller subpackages	2021-04-15 18:12:08 +09:30