feat: add persistent API token lifecycle

This commit is contained in:
Sergey Antropoff
2026-07-13 01:35:01 +03:00
parent 8471bcdbac
commit 5934c567b5
10 changed files with 311 additions and 9 deletions
+2 -2
View File
@@ -9,8 +9,8 @@ Proxmox compatibility.
| Level | Methods | Contract share | Evidence |
|---|---:|---:|---|
| Declared and dynamically routed | 675 | 100% | Imported immutable API Viewer artifact |
| Stateful semantics implemented | 13 | 1.93% | Handler registry and unit/integration tests |
| Schema-only or explicitly unsupported | 662 | 98.07% | Default 501 fallback |
| Stateful semantics implemented on current main | 18 | 2.67% | Handler registry and unit/integration tests |
| Schema-only or explicitly unsupported | 657 | 97.33% | Default 501 fallback |
| proxmoxer smoke exercised | 9 | 1.33% | Unmodified proxmoxer 2.3 compatibility test |
The smoke set is `POST /access/ticket`, `GET /version`, `GET /nodes`,
+2 -2
View File
@@ -41,9 +41,9 @@ large seeding proves bounded batch operations rather than row-at-a-time inserts.
## G3 — authentication and authorization surface
- [ ] Expose API-token lifecycle and authenticate
- [x] Expose API-token lifecycle and authenticate
`PVEAPIToken=USER@REALM!TOKENID=SECRET` without CSRF.
- [ ] Complete pam, pve, and test realm behavior, ticket skew/expiry and
- [x] Complete pam, pve, and test realm behavior, ticket skew/expiry and
credential redaction.
- [ ] Wire users, groups, roles, ACL propagation, route-derived permissions and
token privilege separation into every semantic handler.