3 Commits

Author	SHA1	Message	Date
Dave Kempe	a94b743d6c	Add user API tokens with role-based access and audit logging ... User API tokens allow OIDC users to authenticate via bearer token for automation and scripting. Powerusers and admins can create their own tokens; admins can create tokens for operators. Tokens use SHA-256 hashing, optional max_role caps, optional expiry, and full audit logging of create/revoke operations with client IPs. - DB schema: user_api_tokens and token_audit_log tables - Auth middleware: validates user tokens as fallback after admin keys - API: 7 new endpoints (self-service + admin token management) - UI: tokens.html (self-service) + admin.html token/audit sections - Nav: Tokens link added to all pages (visible for operator+) - Docs: API reference, security model, roles/access control updated - Background cleanup: expired tokens + 90-day audit log retention Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-02-07 15:02:54 +11:00
Dave Kempe	466ffd2d44	Upgrade openidconnect v3 -> v4, remove JumpCloud references ... - openidconnect 3.5.0 -> 4.0.1 (oauth2 4 -> 5) - Eliminates duplicate reqwest/hyper/http dependency chains - 386 -> 355 crate dependencies - Resolves rustls-pemfile 1.0.4 unmaintained warning - HTTP client now uses stateful reqwest::Client (no-redirect policy) - exchange_code returns Result for EndpointMaybeSet token URLs - Remove JumpCloud from provider examples, prefer Authentik Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-02-07 10:39:24 +11:00
Dave Kempe	67101e27ce	Initial public release ... Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-02-06 14:38:53 +11:00