v0,28,2

docs/API_ACCESS.md

@@ -1,4 +1,4 @@
-# Administration API access - 0.28.1
+# Administration API access - 0.28.2
 
 ## Sign-in boundary
 
@@ -101,15 +101,15 @@ by Swagger UI. Native logout/password writes can invalidate the browser session;
 sign in again afterward. Ordinary API mutations still require the administrator session,
 Origin/request marker and CSRF token.
 
-0.23.0 adds one deliberately narrow exception for certificate automation. An operator can
-create one or more **Certificate API Key ID + Bearer token** credentials in Settings -> Certificate API. Each credential may carry an operator comment and authorizes only:
+0.28.2 keeps the deliberately narrow Certificate API exception for automation and makes it least-privilege. An operator can create one or more **Certificate API Key ID + Bearer token** credentials in Settings -> Certificate API. Each new credential requires an explicit allowlist of 1-32 certificate IDs and is reload-only by default. Deploy access must be enabled separately.
 
-- `POST /api/certificates/deploy`
-- `POST /api/certificates/reload`
-- `POST /api/certificates/{certificate_id}/reload`
+A reload-only credential authorizes only:
 
-Both `Authorization: Bearer <token>` and `X-RustProxy-Certificate-Key: <key-id>` are required.
-The clear token is returned only on creation/rotation; the database stores its SHA-256 hash. Up to 32 Key IDs can coexist, and each can be revoked independently or all at once. The credential does not authorize configuration, logs, metrics, users or any other endpoint. Non-loopback use is accepted only on the configured HTTPS administration surface. Revocation from Settings invalidates that credential immediately.
+- `POST /api/certificates/{certificate_id}/reload` when that ID is allowlisted.
+
+`POST /api/certificates/reload` is administrator-session only and never accepts a Certificate API token. `POST /api/certificates/deploy` accepts a Certificate API token only when the credential has explicit deploy permission and the request's `certificate_id` is also allowlisted.
+
+Both `Authorization: Bearer <token>` and `X-RustProxy-Certificate-Key: <key-id>` are required. The clear token is returned only on creation/rotation; the database stores its SHA-256 hash. Up to 32 Key IDs can coexist, and each can be revoked independently or all at once. Credentials created before 0.28.2 migrate to reload-only compatibility access for all certificate IDs (`*`); rotate them to narrow the allowlist. The credential does not authorize configuration, logs, metrics, users or any other endpoint. Non-loopback use is accepted only on the configured HTTPS administration surface. Revocation from Settings invalidates that credential immediately.
 
 Local host automation does not need this token. The installed binary can run
 `rust-proxy tls deploy ...` or `rust-proxy tls reload` directly; it obtains short-lived local