mirror of
https://github.com/navidrome/navidrome.git
synced 2026-10-10 03:17:27 +02:00
8789561b60
- GrantRepository keeps three deletes: DeleteForUser, DeleteStaleEpochs
(replaces DeleteOtherEpochs and DeleteIfEpoch) and DeleteIdle. Delete(id)
is gone; the idle path in ResolveGrant now calls DeleteIdle, so a grant
renewed by another node between the read and the delete survives.
settleEpoch deletes the user's grants below the snapshot's epoch, which
is safe outside the transaction because epochs only move forward.
- The "dead grants on an older epoch are only deleted when presented"
policy note moves from the repository to core ListGrants.
- SQL trace logging no longer prints the args of property writes (signing
keys) or user password writes, both encrypted with a key that may be the
public default. The SQL statement is still logged.
- The spec gate rejects JSON body keys that differ from a declared property
only in case. kin-openapi validates exact names while encoding/json
decodes case-insensitively, so {"scopes":[],"Scopes":null} minted a
token with every scope and a "Client" key skipped maxLength.
It also rejects data after the first JSON value, which the handlers'
decoder ignores and which let a body skip the alias check.
- The liveness cache trims its eviction log on evict, not only on put, so
evict-only traffic stays bounded; the floor still drops stale fills.
- createAccessToken, login and setupFirstAdmin declare Cache-Control:
no-store on their success responses.
222 lines
7.1 KiB
YAML
222 lines
7.1 KiB
YAML
token:
|
|
post:
|
|
operationId: createAccessToken
|
|
x-module: core
|
|
x-stability-level: alpha
|
|
tags: [auth]
|
|
summary: Mint an access token
|
|
description: "Turns a grant into a short-lived access token, optionally narrowed to a subset of the grant's scopes. Send the grant secret as the Bearer credential."
|
|
security: [{grantAuth: []}]
|
|
requestBody:
|
|
description: Scopes to narrow the token to. Optional.
|
|
required: false
|
|
content:
|
|
application/json:
|
|
schema:
|
|
$ref: ../components/schemas/TokenRequest.yaml
|
|
responses:
|
|
'200':
|
|
description: The new access token.
|
|
headers:
|
|
Cache-Control:
|
|
$ref: ../components/headers/CacheControlNoStore.yaml
|
|
content:
|
|
application/json:
|
|
schema:
|
|
$ref: ../components/schemas/AccessToken.yaml
|
|
'400':
|
|
$ref: ../components/responses/BadRequest.yaml
|
|
'401':
|
|
$ref: ../components/responses/Unauthorized.yaml
|
|
'413':
|
|
$ref: ../components/responses/PayloadTooLarge.yaml
|
|
'500':
|
|
$ref: ../components/responses/InternalError.yaml
|
|
grants:
|
|
get:
|
|
operationId: listGrants
|
|
x-module: core
|
|
x-scope: read
|
|
x-stability-level: alpha
|
|
tags: [auth]
|
|
summary: List my grants
|
|
description: "The caller's grants, most recently used first. Grants idle long enough to have expired are not listed."
|
|
security: [{bearerAuth: []}]
|
|
parameters:
|
|
- $ref: ../components/parameters/offset.yaml
|
|
- $ref: ../components/parameters/limit.yaml
|
|
responses:
|
|
'200':
|
|
description: A page of grants.
|
|
content:
|
|
application/json:
|
|
schema:
|
|
$ref: ../components/schemas/GrantList.yaml
|
|
'400':
|
|
$ref: ../components/responses/BadRequest.yaml
|
|
'401':
|
|
$ref: ../components/responses/Unauthorized.yaml
|
|
'403':
|
|
$ref: ../components/responses/Forbidden.yaml
|
|
'500':
|
|
$ref: ../components/responses/InternalError.yaml
|
|
grant:
|
|
delete:
|
|
operationId: revokeGrant
|
|
x-module: core
|
|
x-scope: read
|
|
x-stability-level: alpha
|
|
tags: [auth]
|
|
summary: Revoke one of my grants
|
|
description: "Revokes the grant and every token minted from it. Another user's grant id answers 404."
|
|
security: [{bearerAuth: []}]
|
|
parameters:
|
|
- name: id
|
|
in: path
|
|
required: true
|
|
description: Grant id.
|
|
schema:
|
|
type: string
|
|
maxLength: 64
|
|
responses:
|
|
'204':
|
|
description: Revoked.
|
|
'400':
|
|
$ref: ../components/responses/BadRequest.yaml
|
|
'401':
|
|
$ref: ../components/responses/Unauthorized.yaml
|
|
'403':
|
|
$ref: ../components/responses/Forbidden.yaml
|
|
'404':
|
|
$ref: ../components/responses/NotFound.yaml
|
|
'500':
|
|
$ref: ../components/responses/InternalError.yaml
|
|
logout:
|
|
post:
|
|
operationId: logout
|
|
x-module: core
|
|
x-scope: read
|
|
x-stability-level: alpha
|
|
tags: [auth]
|
|
summary: Log out
|
|
description: Revokes the grant that made this request.
|
|
security: [{bearerAuth: []}]
|
|
responses:
|
|
'200':
|
|
description: Logged out.
|
|
content:
|
|
application/json:
|
|
schema:
|
|
$ref: ../components/schemas/LogoutResponse.yaml
|
|
'401':
|
|
$ref: ../components/responses/Unauthorized.yaml
|
|
'403':
|
|
$ref: ../components/responses/Forbidden.yaml
|
|
'500':
|
|
$ref: ../components/responses/InternalError.yaml
|
|
login:
|
|
post:
|
|
operationId: login
|
|
x-module: password
|
|
x-stability-level: alpha
|
|
tags: [auth]
|
|
summary: Log in with a password
|
|
description: Checks the username and password and returns a new grant. Unknown user and wrong password fail the same way.
|
|
security: []
|
|
requestBody:
|
|
description: The credentials and a description of the client.
|
|
required: true
|
|
content:
|
|
application/json:
|
|
schema:
|
|
$ref: ../components/schemas/CredentialsRequest.yaml
|
|
responses:
|
|
'200':
|
|
description: The new grant.
|
|
headers:
|
|
Cache-Control:
|
|
$ref: ../components/headers/CacheControlNoStore.yaml
|
|
content:
|
|
application/json:
|
|
schema:
|
|
$ref: ../components/schemas/GrantCreated.yaml
|
|
'400':
|
|
$ref: ../components/responses/BadRequest.yaml
|
|
'401':
|
|
$ref: ../components/responses/Unauthorized.yaml
|
|
'413':
|
|
$ref: ../components/responses/PayloadTooLarge.yaml
|
|
'429':
|
|
$ref: ../components/responses/TooManyRequests.yaml
|
|
'500':
|
|
$ref: ../components/responses/InternalError.yaml
|
|
setup:
|
|
post:
|
|
operationId: setupFirstAdmin
|
|
x-module: password
|
|
x-stability-level: alpha
|
|
tags: [auth]
|
|
summary: Create the first admin
|
|
description: "Creates the first administrator while `setupRequired` is true and returns a grant for it. Answers 409 `setup_complete` once any user exists. A server with no setup step always answers 409."
|
|
security: []
|
|
requestBody:
|
|
description: The credentials and a description of the client.
|
|
required: true
|
|
content:
|
|
application/json:
|
|
schema:
|
|
$ref: ../components/schemas/CredentialsRequest.yaml
|
|
responses:
|
|
'201':
|
|
description: The admin was created.
|
|
headers:
|
|
Cache-Control:
|
|
$ref: ../components/headers/CacheControlNoStore.yaml
|
|
content:
|
|
application/json:
|
|
schema:
|
|
$ref: ../components/schemas/GrantCreated.yaml
|
|
'400':
|
|
$ref: ../components/responses/BadRequest.yaml
|
|
'409':
|
|
$ref: ../components/responses/Conflict.yaml
|
|
'413':
|
|
$ref: ../components/responses/PayloadTooLarge.yaml
|
|
'429':
|
|
$ref: ../components/responses/TooManyRequests.yaml
|
|
'500':
|
|
$ref: ../components/responses/InternalError.yaml
|
|
password:
|
|
post:
|
|
operationId: changePassword
|
|
x-module: password
|
|
x-scope: password
|
|
x-stability-level: alpha
|
|
tags: [auth]
|
|
summary: Change my password
|
|
description: "Changes the caller's password. By default every other grant of the user is revoked; the calling grant survives. On Navidrome the change also ends the user's sessions on its other APIs, regardless of `revokeOtherGrants`, which only covers API v1 grants. Answers 409 `password_managed_externally` when the password is not stored by this server."
|
|
security: [{bearerAuth: []}]
|
|
requestBody:
|
|
description: The current and the new password.
|
|
required: true
|
|
content:
|
|
application/json:
|
|
schema:
|
|
$ref: ../components/schemas/PasswordChangeRequest.yaml
|
|
responses:
|
|
'204':
|
|
description: Password changed.
|
|
'400':
|
|
$ref: ../components/responses/BadRequest.yaml
|
|
'401':
|
|
$ref: ../components/responses/Unauthorized.yaml
|
|
'403':
|
|
$ref: ../components/responses/Forbidden.yaml
|
|
'409':
|
|
$ref: ../components/responses/Conflict.yaml
|
|
'413':
|
|
$ref: ../components/responses/PayloadTooLarge.yaml
|
|
'429':
|
|
$ref: ../components/responses/TooManyRequests.yaml
|
|
'500':
|
|
$ref: ../components/responses/InternalError.yaml
|