 Kristoffer Dalby
|
bba7252ec5
|
db: keep at most 1000 access tokens per OAuth client
Minting needs only the client secret, whatever its scopes, and
added one row per mint. Each mint now ends tokens past the newest 1000.
|
2026-10-28 18:28:23 +00:00 |
|
|
Kristoffer Dalby
|
7f9ad511a4
|
api/v2: bound every request body
huma gives RawBody no limit, and validates a whole body before
the handler runs. The token form is parsed before the secret check.
|
2026-10-28 18:28:23 +00:00 |
|
|
Kristoffer Dalby
|
fab5833a6a
|
api/v2: keep a tagged all-scope client's tokens inside its tags
Only an untagged all-scope client may mint tokens for any tag, so a
tagged token may not create one.
|
2026-10-28 18:28:23 +00:00 |
|
|
Kristoffer Dalby
|
84715e976c
|
api/v2: add OAuth client-credentials auth and scope enforcement
|
2026-06-26 09:18:06 +02:00 |
|