authentication rework

ninjdai commented

2026-02-10 15:35:54 +01:00

Owner

This PR reworks the authentication system to lay the groundwork for session management (including allowing disconnecting other connected devices), and slightly better security by reducing the token lifespan to only 7 days and allowing them to be refreshed.

This system makes sessions differentiable from each other using a unique UUID for each. With this, only users who connected using username+password are able to share tokens to allow connection using QR codes.

Features :

POST /auth/refresh, which returns a new token linked to the same session with a refreshed 7 days expiry time
POST /auth/share, which is usable only by users who connected via username+password or that were given the auth_share permission, that returns a token to a new session with either the specified permissions or default permissions
GET /auth/perms, which returns your permissions
Permission System

This PR reworks the authentication system to lay the groundwork for session management (including allowing disconnecting other connected devices), and slightly better security by **reducing the token lifespan to only 7 days** and allowing them to be refreshed. This system makes sessions differentiable from each other using a unique UUID for each. With this, only users who connected using username+password are able to share tokens to allow connection using QR codes. Features : - [x] POST /auth/refresh, which returns a new token linked to the same session with a refreshed 7 days expiry time - [x] POST /auth/share, which is usable only by users who connected via username+password or that were given the auth_share permission, that returns a token to a new session with either the specified permissions or default permissions - [x] GET /auth/perms, which returns your permissions - [x] Permission System

ninjdai added 1 commit

2026-02-10 15:35:55 +01:00