Epicure

arnaudne/Epicure

Fork 0

Commit Graph

Author	SHA1	Message	Date
Arnaud	0062220d8e	feat: read-only API key scoping New keys can be created as "Full access" (default, unchanged) or "Read-only" — read-only keys can only make GET/HEAD/OPTIONS requests, enforced once in requireSessionOrApiKey (lib/api-auth.ts) rather than in every route, since a route has no way to know a request came from a scoped key without that check. Existing keys default to full access — no behavior change for anyone who doesn't opt in. Also included in this migration: the chat_messages table for the next commit (chat history persistence) — generated together since both touched packages/db/src/schema/users.ts in the same pass. Verified locally: created both a read-only and a full-access key, confirmed GET succeeds and POST 403s on the read-only key, confirmed POST still works on the full-access key, and checked the scope badges render correctly in the real Settings → API Keys UI.	2026-07-12 22:37:14 +02:00
Arnaud	8b57a3fd87	Update features and dependencies	2026-07-01 11:10:37 +02:00
Arnaud	3f96d1ea41	feat(webhooks): outbound webhooks with HMAC-SHA256 signing and API key auth Webhook registration/management. HMAC-signed delivery with retry. Events: recipe.created/updated, comment.created, follower.new. REST API key creation for programmatic access.	2026-07-01 08:11:19 +02:00

Author

SHA1

Message

Date

Arnaud

0062220d8e

feat: read-only API key scoping

New keys can be created as "Full access" (default, unchanged) or
"Read-only" — read-only keys can only make GET/HEAD/OPTIONS requests,
enforced once in requireSessionOrApiKey (lib/api-auth.ts) rather than in
every route, since a route has no way to know a request came from a
scoped key without that check. Existing keys default to full access —
no behavior change for anyone who doesn't opt in.

Also included in this migration: the chat_messages table for the
next commit (chat history persistence) — generated together since both
touched packages/db/src/schema/users.ts in the same pass.

Verified locally: created both a read-only and a full-access key,
confirmed GET succeeds and POST 403s on the read-only key, confirmed
POST still works on the full-access key, and checked the scope badges
render correctly in the real Settings → API Keys UI.

2026-07-12 22:37:14 +02:00

Arnaud

8b57a3fd87

Update features and dependencies

2026-07-01 11:10:37 +02:00

Arnaud

3f96d1ea41

feat(webhooks): outbound webhooks with HMAC-SHA256 signing and API key auth

Webhook registration/management. HMAC-signed delivery with retry.
Events: recipe.created/updated, comment.created, follower.new.
REST API key creation for programmatic access.

2026-07-01 08:11:19 +02:00

3 Commits