mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-08-04 22:32:12 +03:00
78c4ef33ee
`omniroute connect <host>` logs in (management password → scoped access token, or paste one with --key) and saves it as the active context, so every CLI command then targets that remote server. One CLI, local or remote. Access tokens (oma_): - new cli_access_tokens table + src/lib/db/accessTokens.ts (sha-256 hashed, plaintext shown once, prefix, revoke by id/prefix, expiry, last_used) - 3-level scopes read ⊂ write ⊂ admin (src/lib/accessTokens/scopes.ts) Enforcement: - shared evaluateAccessTokenAuth used by BOTH the central managementPolicy (proxy.ts gate) and requireManagementAuth — no drift - required scope inferred from HTTP method + admin allowlist (accessScopes.ts) - loopback-only routes stay unreachable by remote tokens (hard rules #15/#17) Endpoints: POST /api/cli/connect (public, password+lockout), GET /api/cli/whoami, GET/POST /api/cli/tokens, DELETE /api/cli/tokens/:id. CLI: connect, tokens create/list/revoke/scopes, configure <cli> (interactive provider+model → local profile from the remote catalog); unified context resolution now reads baseUrl AND accessToken from the active context. Dashboard: Settings → Access Tokens (create / copy-once / revoke). Docs: docs/guides/REMOTE-MODE.md, README section + index, openapi entries. Tests: 63 unit/integration (scopes, token store, inference, auth gate, helpers).