j3d1/webvirtcloud
1
0
Fork 0
mirror of https://github.com/retspen/webvirtcloud synced 2026-11-10 20:26:48 +00:00
Code Issues Projects Releases Wiki Activity

feat(accounts): API tokens for scripts and tools

Browse source 
The REST API took only the login session, so a script could not use it
without a browser. A user now makes API tokens on the profile page (API
Tokens tab): a name, and an expiry of 30, 90 or 365 days or none. The
token is shown once, on a page that is not cached, and then kept only as
a SHA-512 digest; the list shows its name, first characters, creation
and expiry, and a token is deleted there. Tools send it as
"Authorization: Token wvc_...", and act as its user, with that user's
permissions. Making and deleting a token is logged, without the token.

A password alone (HTTP Basic) still does not reach the API, as it would
skip the OTP second factor: a token is made in a session that passed the
login and its OTP. The token class comes first, so a refused request gets
401 with its challenge instead of 403.

django-rest-knox 5.1.0 provides the tokens (accounts.ApiToken adds the
name); settings.py takes "knox", KNOX_TOKEN_MODEL and REST_KNOX from the
template.
This commit is contained in:
catborise 2026-10-24 23:05:27 +03:00
parent ba51b3e4d6
commit 1c60696ea1
14 changed files with 290 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

7
README.md
View file

@ -629,11 +629,16 @@ See [doc/permissions.md](doc/permissions.md).
### REST API
The REST API (Django REST Framework, documented with `drf-spectacular`) uses the login session. After logging in:
The REST API (Django REST Framework, documented with `drf-spectacular`) takes the login session or an API token. After logging in:
* **Swagger UI:** `http://<server>/swagger/`
* **ReDoc UI:** `http://<server>/redoc/`
* **OpenAPI 3.0 schema:** `http://<server>/api/schema/` (JSON or YAML)
* **API tokens**, for scripts and tools: **Profile → API Tokens**. A token acts as its user and is shown once; send it as a header:
```bash
curl -H "Authorization: Token wvc_..." https://<server>/api/v1/instances/
```
### Screenshots