mirror of
https://github.com/navidrome/navidrome.git
synced 2026-10-08 18:37:09 +02:00
d1b876097f
API v1 no longer mints short-lived JWT access tokens. Clients send the grant secret from POST /auth/login or /auth/setup as `Authorization: Bearer` on every request. Every request already looked the grant up in the database, so the JWT gave no speed or revocation benefit and only added a refresh loop, which early client authors pushed back on. The grant already is an API key: one per client sign-in, scoped and revocable. Revocation is now immediate on every node; the contract promises "within one minute". Removed: POST /auth/token, the grantAuth scheme, the TokenRequest and AccessToken schemas, the token_expired problem code, the API v1 JWT signer and its signing key, the grant liveness cache, and PropertyRepository.PutIfAbsent. ResolveGrant is now Authenticate. Short-lived tokens return later only as narrow media tokens for ?access_token= on media URLs, together with the media endpoints. Signed-off-by: Deluan <deluan@navidrome.org>
58 lines
2 KiB
YAML
58 lines
2 KiB
YAML
openapi: 3.0.3
|
|
info:
|
|
title: Navidrome API
|
|
version: 1.0.0
|
|
description: |
|
|
Navidrome API v1. Spec-first, additive within v1. Clients discover implemented
|
|
capability modules through `GET /capabilities` and never sniff versions.
|
|
|
|
Enums are open: new values may be added to any enum within v1. Clients must
|
|
accept values they do not recognise instead of failing.
|
|
|
|
Every operation declares `x-stability-level`: `alpha` operations may change or
|
|
disappear without notice, `beta` and `stable` operations only change additively.
|
|
A level is only ever raised, never lowered.
|
|
|
|
`HEAD` is accepted wherever `GET` is. A `405` response lists the allowed methods
|
|
in its `Allow` header.
|
|
|
|
Operations that need a grant declare `security: [{bearerAuth: []}]` and the scope they need in
|
|
`x-scope` (OpenAPI 3.0 does not allow scopes on bearer schemes). Clients send the grant secret as
|
|
`Authorization: Bearer <secret>`. A revoked grant stops working within one minute at most.
|
|
license:
|
|
name: GPL-3.0
|
|
url: https://www.gnu.org/licenses/gpl-3.0.html
|
|
servers:
|
|
- url: /api/v1
|
|
tags:
|
|
- name: server
|
|
description: Server discovery and the published OpenAPI document.
|
|
- name: auth
|
|
description: Grants and login methods.
|
|
paths:
|
|
/server:
|
|
$ref: ./paths/server.yaml
|
|
/capabilities:
|
|
$ref: ./paths/capabilities.yaml
|
|
/openapi.json:
|
|
$ref: ./paths/openapi.yaml#/json
|
|
/openapi.yaml:
|
|
$ref: ./paths/openapi.yaml#/yaml
|
|
/auth/grants:
|
|
$ref: ./paths/auth.yaml#/grants
|
|
/auth/grants/{id}:
|
|
$ref: ./paths/auth.yaml#/grant
|
|
/auth/logout:
|
|
$ref: ./paths/auth.yaml#/logout
|
|
/auth/login:
|
|
$ref: ./paths/auth.yaml#/login
|
|
/auth/setup:
|
|
$ref: ./paths/auth.yaml#/setup
|
|
/auth/password:
|
|
$ref: ./paths/auth.yaml#/password
|
|
components:
|
|
securitySchemes:
|
|
bearerAuth:
|
|
type: http
|
|
scheme: bearer
|
|
description: "Grant secret from a login method (`POST /auth/login`, `POST /auth/setup`). Opaque. The required scope is in each operation's `x-scope`."
|