v0,28,2

src/admin/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.0.3",
   "info": {
     "title": "RustProxy Administration API",
-    "version": "0.28.1",
+    "version": "0.28.2",
     "description": "Administration API for the active panel origin. Sign in through the panel; the same-origin HttpOnly cookie authenticates all private operations. Mutations also require the exact Origin, X-RustProxy-Request: 1 and a session-bound X-CSRF-Token. Loopback HTTP is the default; Settings can enable HTTPS before using a non-loopback administration bind. This document contains no live configuration or credentials. Object schemas marked extensible are summaries: full configuration validation is authoritative in Rust."
   },
   "servers": [
@@ -34,7 +34,7 @@
         "type": "http",
         "scheme": "bearer",
         "bearerFormat": "opaque",
-        "description": "One of the scoped external certificate deployment/reload tokens configured in Settings > Certificate API. Tokens are identified by X-RustProxy-Certificate-Key and are accepted only for certificate deploy/reload operations."
+        "description": "Scoped external certificate automation token configured in Settings > Certificate API. New tokens are reload-only by default and are restricted to explicit certificate IDs; optional deploy permission must be granted explicitly. The token is identified by X-RustProxy-Certificate-Key."
       },
       "CertificateApiKey": {
         "type": "apiKey",
@@ -4457,8 +4457,25 @@
             "maxLength": 256,
             "nullable": true,
             "description": "Human-readable non-secret note identifying the automation or owner."
+          },
+          "certificate_ids": {
+            "type": "array",
+            "minItems": 1,
+            "maxItems": 32,
+            "items": {
+              "type": "string"
+            },
+            "description": "Certificate IDs this token may operate on. Wildcards are not accepted for newly created credentials."
+          },
+          "allow_deploy": {
+            "type": "boolean",
+            "default": false,
+            "description": "Also authorize certificate deploy for the allowlisted IDs. Leave false for renewal/reload hooks."
           }
-        }
+        },
+        "required": [
+          "certificate_ids"
+        ]
       },
       "CertificateApiRotateResult": {
         "type": "object",
@@ -4649,13 +4666,24 @@
           "last_used_at": {
             "type": "integer",
             "nullable": true
+          },
+          "allow_deploy": {
+            "type": "boolean"
+          },
+          "certificate_ids": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
           }
         },
         "required": [
           "key_id",
           "comment",
           "created_at",
-          "last_used_at"
+          "last_used_at",
+          "allow_deploy",
+          "certificate_ids"
         ]
       },
       "CertificateReloadOneResult": {
@@ -9270,7 +9298,7 @@
     "/api/certificates/reload": {
       "post": {
         "summary": "Reload configured certificate files from disk",
-        "description": "Rebuilds and hot-publishes the public TLS routing snapshot from the currently configured certificate/key files without changing the configuration revision. New public TLS/H2/H3 handshakes use the refreshed keys. Administration TLS remains startup-fixed and reports when a restart is required. The operation can be authenticated either by the normal administrator session+CSRF flow or by the scoped Certificate API Key ID + Bearer Token. External token use requires HTTPS unless the request originates from loopback.",
+        "description": "Rebuilds and hot-publishes the public TLS routing snapshot from the currently configured certificate/key files without changing the configuration revision. New public TLS/H2/H3 handshakes use the refreshed keys. Administration TLS remains startup-fixed and reports when a restart is required. The operation can be authenticated either by the normal administrator session+CSRF flow or by the scoped Certificate API Key ID + Bearer Token. External token use requires HTTPS unless the request originates from loopback. Certificate API tokens are intentionally not accepted here; automation must use the targeted per-certificate reload endpoint.",
         "tags": [
           "Certificates"
         ],
@@ -9331,10 +9359,6 @@
           {
             "AdminSession": [],
             "CsrfToken": []
-          },
-          {
-            "CertificateApiBearer": [],
-            "CertificateApiKey": []
           }
         ]
       }
@@ -9342,7 +9366,7 @@
     "/api/certificates/deploy": {
       "post": {
         "summary": "Reconcile an externally issued pair with a manual certificate id",
-        "description": "Maximum body 300 KiB. Convergently reconciles an externally issued PEM pair: creates a missing manual certificate id, atomically rotates an existing manual id through immutable generation-specific files, or returns a no-op when the selected RustProxy-owned generation already contains the exact pair. All vhosts already assigned to that id use changed material for new public TLS/H2/H3 handshakes. RustProxy-managed ACME ids are rejected. The operation can be authenticated either by the normal administrator session+CSRF flow or by the scoped Certificate API Key ID + Bearer Token. External token use requires HTTPS unless the request originates from loopback.",
+        "description": "Maximum body 300 KiB. Convergently reconciles an externally issued PEM pair for one manual certificate id. Administrator session+CSRF is always accepted. Certificate API authentication is accepted only when that credential explicitly grants deploy permission and allowlists the requested certificate ID. New Certificate API credentials default to reload-only.",
         "tags": [
           "Certificates"
         ],
@@ -9754,7 +9778,7 @@
     "/api/certificates/{certificate_id}/reload": {
       "post": {
         "summary": "Reload one manual/file-backed certificate from disk",
-        "description": "Targets one configured certificate ID that is not ACME-managed. RustProxy revalidates and atomically republishes its immutable TLS snapshot without changing the configuration revision. The scoped Certificate API token is accepted for this operation, making it suitable for external certificate renewal hooks. Managed ACME certificate IDs are rejected because their renewal pipeline owns those files.",
+        "description": "Targets one configured certificate ID that is not ACME-managed. RustProxy revalidates and atomically republishes its immutable TLS snapshot without changing the configuration revision. The scoped Certificate API token is accepted for this operation, making it suitable for external certificate renewal hooks. Managed ACME certificate IDs are rejected because their renewal pipeline owns those files. Certificate API tokens must be explicitly allowlisted for this certificate ID.",
         "tags": [
           "Certificates"
         ],