mirror of
https://github.com/MHSanaei/3x-ui.git
synced 2026-10-23 06:15:01 +03:00
libmur-dev
a8d0700bf2
* feat(auth): add node-admin API token scope Keep ordinary node-sync credentials unable to self-update a remote panel while allowing explicitly elevated node administrators to inherit synchronization access and invoke updatePanel. * style(docs): format API scope table * fix(auth): preserve mTLS node-sync semantics Allow only an explicit node-admin bearer to elevate a verified mTLS request. Existing admin, monitor, and node-sync bearer values continue to use the historical node-sync identity on mTLS connections. * chore(ci): rerun flaky checks --------- Co-authored-by: libmur-dev <333915961+libmur-dev@users.noreply.github.com>
56 lines
3.0 KiB
Plaintext
56 lines
3.0 KiB
Plaintext
---
|
|
title: API Tokens
|
|
description: Manage scoped Bearer tokens for programmatic auth. admin grants the
|
|
full panel API; monitor is read-only for status and metrics; node-sync manages
|
|
node configuration without panel updates; node-admin adds panel self-update to
|
|
node-sync. Tokens may expire and are stored as SHA-256 hashes. The plaintext
|
|
is returned only once at creation.
|
|
full: true
|
|
_openapi:
|
|
preload:
|
|
- ./public/openapi.json
|
|
toc:
|
|
- depth: 2
|
|
title: List every API token, enabled or not. The token value is never returned —
|
|
only metadata.
|
|
url: '#list-every-api-token-enabled-or-not-the-token-value-is-never-returned--only-metadata'
|
|
- depth: 2
|
|
title: Mint a scoped API token. The server-generated plaintext is returned only
|
|
once and stored as a hash.
|
|
url: '#mint-a-scoped-api-token-the-server-generated-plaintext-is-returned-only-once-and-stored-as-a-hash'
|
|
- depth: 2
|
|
title: Permanently delete a token. Any caller using it stops authenticating
|
|
immediately.
|
|
url: '#permanently-delete-a-token-any-caller-using-it-stops-authenticating-immediately'
|
|
- depth: 2
|
|
title: Toggle a token enabled/disabled without deleting it. Disabled tokens are
|
|
rejected by checkAPIAuth on the next request.
|
|
url: '#toggle-a-token-enableddisabled-without-deleting-it-disabled-tokens-are-rejected-by-checkapiauth-on-the-next-request'
|
|
structuredData:
|
|
headings:
|
|
- content: List every API token, enabled or not. The token value is never returned
|
|
— only metadata.
|
|
id: list-every-api-token-enabled-or-not-the-token-value-is-never-returned--only-metadata
|
|
- content: Mint a scoped API token. The server-generated plaintext is returned
|
|
only once and stored as a hash.
|
|
id: mint-a-scoped-api-token-the-server-generated-plaintext-is-returned-only-once-and-stored-as-a-hash
|
|
- content: Permanently delete a token. Any caller using it stops authenticating
|
|
immediately.
|
|
id: permanently-delete-a-token-any-caller-using-it-stops-authenticating-immediately
|
|
- content: Toggle a token enabled/disabled without deleting it. Disabled tokens
|
|
are rejected by checkAPIAuth on the next request.
|
|
id: toggle-a-token-enableddisabled-without-deleting-it-disabled-tokens-are-rejected-by-checkapiauth-on-the-next-request
|
|
contents: []
|
|
---
|
|
|
|
{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}
|
|
|
|
export default function Layout(props) {
|
|
const { OpenAPIPage } = props.components ?? {};
|
|
return (
|
|
<>
|
|
{props.children}
|
|
<OpenAPIPage document="./public/openapi.json" webhooks={[]} operations={[{"path":"/panel/api/setting/apiTokens","method":"get"},{"path":"/panel/api/setting/apiTokens/create","method":"post"},{"path":"/panel/api/setting/apiTokens/delete/{id}","method":"post"},{"path":"/panel/api/setting/apiTokens/setEnabled/{id}","method":"post"}]} showTitle />
|
|
</>
|
|
);
|
|
} |