feat(pat): authenticate personal access tokens

Browse Source

handle_auth resolves a dgpt_pat_ bearer against the database instead of
decoding it as a JWT, for both the Flask and the ASGI routes. Scopes and the
resource filter always come from the token row, and the claims that mark a
PAT are stripped from decoded JWTs so a session token cannot pose as one.
ASGI routes reject tokens unless they name the scope that admits them, and
/api/user/me reports what the calling token may do.

...

This commit is contained in:

arc53-machine committed 2026-09-19 23:39:58 +01:00

1 parent 22ecc0aee3

commit 174130607a

8 files changed

+604 -3

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

docsgpt/api/pat/__init__.py

Whitespace-only changes.