Mirrored_Repos/DarkflameServer
1
0
Fork 0
mirror of https://github.com/DarkflameUniverse/DarkflameServer.git synced 2026-10-13 16:23:44 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs: API keys, their scopes, limits and audit

Browse Source 
Also sends key creation, rotation and revocation to security webhooks.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Aaron Kimbrell
2026-09-27 08:51:53 -05:00
parent c29454dcd6
commit 3dd4ebf853
4 changed files with 58 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
dDashboardServer/notify/Alerts.cpp
View File

@@ -266,7 +266,7 @@ namespace Alerts {
"warn_account", "action_player_report", "chat_filter_allow", "chat_filter_block", "chat_filter_remove"
};
static const std::set<std::string> security{
"set_gm_level", "create_api_token", "reset_password", "create_account", "enable_2fa", "disable_2fa",
"set_gm_level", "create_api_token", "create_api_key", "rotate_api_key", "revoke_api_key", "reset_password", "create_account", "enable_2fa", "disable_2fa",
"reset_2fa", "regenerate_recovery_codes", "manage_webhook", "change_setting"
};
std::string event;

2
dDashboardServer/routes/OpenApi.h
View File

@@ -214,7 +214,7 @@ namespace OpenApi {
"`Authorization: Bearer <token>` with a token from your account page. Requests signed in with the session cookie must also "
"send `X-Requested-With` (this page does)."} }},
{"components", { {"securitySchemes", {
{"bearer", { {"type", "http"}, {"scheme", "bearer"}, {"description", "An API token from your account page"} }},
{"bearer", { {"type", "http"}, {"scheme", "bearer"}, {"description", "An API key from your account page"} }},
{"session", { {"type", "apiKey"}, {"in", "cookie"}, {"name", "dashboardToken"}, {"description", "Your dashboard sign-in"} }} }} }},
{"security", { { {"session", nlohmann::json::array()} }, { {"bearer", nlohmann::json::array()} } }},
{"paths", paths}

11
dDashboardServer/templates/api_docs.jinja2
View File

@@ -20,10 +20,13 @@
<div class="card mb-3">
<div class="card-header"><h5 class="mb-0">Signing in from scripts and bots</h5></div>
<div class="card-body small">
<p>Make an API token on <a href="/account">your account page</a> and send it with every request:</p>
<pre class="bg-body-tertiary p-2 rounded mb-2"><code>curl -H "Authorization: Bearer $TOKEN" http://localhost:2006/api/status</code></pre>
<p class="mb-2">A token acts as your account with its <em>current</em> GM level, so each request needs the same permission as the page it matches,
and changing the account's level or banning it takes effect straight away. Using the API at all needs the <code>api_access</code> permission.</p>
<p>Make an API key on <a href="/account">your account page</a> and send it with every request:</p>
<pre class="bg-body-tertiary p-2 rounded mb-2"><code>curl -H "Authorization: Bearer $KEY" http://localhost:2006/api/status</code></pre>
<p class="mb-2">A key can do what you picked for it (some of your permissions, or all of them), and never more than your account can do right
now: each request needs the permission for the page it matches, both on your account's <em>current</em> GM level and in the key.
Changing the account's level or banning it takes effect straight away. Keys can be read-only, limited to some addresses or paths, and
have a rate limit (answered with <code>429</code> and <code>Retry-After</code>; <code>X-RateLimit-Remaining</code> says what is left)
and a daily quota. Using the API at all needs the <code>api_access</code> permission.</p>
<p class="mb-2">Live updates: open a WebSocket to <code>/ws</code> (with the same <code>Authorization</code> header, or your sign-in cookie) and send
<code>{"event": "subscribe", "subscription": "chat_message"}</code> (or <code>table_changed</code>, <code>dashboard_update</code>, ...).</p>
<p class="mb-0 text-body-secondary">Tables take DataTables-style bodies: <code>{"start": 0, "length": 25, "search": "text"}</code>. Calls that act on