v0.36.1

2026-11-07 13:56:11 +01:00
1 parent 672c84bc13
commit 6f52ac3d00
@@ -2,7 +2,7 @@
  "openapi": "3.0.3",
  "info": {
    "title": "RustProxy Administration API",
-    "version": "0.36.0",
+    "version": "0.36.1",
    "description": "Administration API for the active panel origin. Sign in through the panel; the same-origin HttpOnly cookie authenticates all private operations. Mutations also require the exact Origin, X-RustProxy-Request: 1 and a session-bound X-CSRF-Token. Loopback HTTP is the default; Settings can enable HTTPS before using a non-loopback administration bind. This document contains no live configuration or credentials. Object schemas marked extensible are summaries: full configuration validation is authoritative in Rust. The API also permits explicitly scoped GeneralApiBearer tokens on a narrow route allowlist, with RO/RW and source CIDR checks; API-token management and Prometheus-token management are browser-session-only."
  },
  "servers": [
@@ -443,10 +443,31 @@
        "type": "object",
        "description": "Optional explicit provider and integration method. Absent means infer the existing active Basic/Tinyauth/Authelia/authentik/OIDC configuration for backward compatibility. The selected method must match the one enabled legacy settings object; unknown, inconsistent or unsupported pairs are rejected.",
        "additionalProperties": false,
-        "required": ["provider", "method"],
+        "required": [
+          "provider",
+          "method"
+        ],
        "properties": {
-          "provider": {"type": "string", "enum": ["basic", "tinyauth", "authelia", "authentik", "pocket_id", "custom"]},
-          "method": {"type": "string", "enum": ["basic", "forward_auth", "oidc"], "description": "Basic supports basic only; Tinyauth/Authelia/authentik support forward_auth or oidc; Pocket ID/custom support oidc only."}
+          "provider": {
+            "type": "string",
+            "enum": [
+              "basic",
+              "tinyauth",
+              "authelia",
+              "authentik",
+              "pocket_id",
+              "custom"
+            ]
+          },
+          "method": {
+            "type": "string",
+            "enum": [
+              "basic",
+              "forward_auth",
+              "oidc"
+            ],
+            "description": "Basic supports basic only; Tinyauth/Authelia/authentik support forward_auth or oidc; Pocket ID/custom support oidc only."
+          }
        }
      },
      "OidcConfig": {
@@ -454,20 +475,76 @@
        "description": "Opt-in OpenID Connect Authorization Code integration method for an identity provider selected by authentication.provider. Uses issuer discovery, S256 PKCE, nonce/state cookies, JWKS RS256/ES256 ID token verification and encrypted host-only application sessions. Existing standalone oidc.enabled configurations remain supported.",
        "additionalProperties": false,
        "properties": {
-          "enabled": {"type": "boolean", "default": false},
-          "issuer_url": {"type": "string", "format": "uri", "description": "Exact HTTPS OIDC issuer; /.well-known/openid-configuration is discovered at this URL"},
-          "backend_url": {"type": "string", "format": "uri", "description": "Optional internal HTTP(S) origin for server-side discovery/token/JWKS/UserInfo requests; public issuer and JWT validation remain unchanged"},
-          "redirect_url": {"type": "string", "format": "uri", "description": "HTTPS URL for an exact hostname in this Vhost and path /_rustproxy/oidc/callback"},
-          "client_id": {"type": "string", "maxLength": 256},
-          "client_secret": {"type": "string", "maxLength": 2048, "description": "Confidential OIDC client secret; stored in Vhost configuration"},
-          "session_secret": {"type": "string", "minLength": 32, "maxLength": 4096, "description": "High-entropy secret for encrypted session and temporary state cookies"},
-          "scopes": {"type": "string", "default": "openid profile email"},
-          "allow_private": {"type": "boolean", "default": false},
-          "address_allowlist": {"type": "array", "items": {"type": "string"}},
-          "tls_ca_pem": {"type": "string", "nullable": true},
-          "connect_timeout_seconds": {"type": "integer", "minimum": 1, "maximum": 30, "default": 5},
-          "timeout_seconds": {"type": "integer", "minimum": 1, "maximum": 60, "default": 10},
-          "session_ttl_seconds": {"type": "integer", "minimum": 60, "maximum": 86400, "default": 3600}
+          "enabled": {
+            "type": "boolean",
+            "default": false
+          },
+          "issuer_url": {
+            "type": "string",
+            "format": "uri",
+            "description": "Exact HTTPS OIDC issuer; /.well-known/openid-configuration is discovered at this URL"
+          },
+          "backend_url": {
+            "type": "string",
+            "format": "uri",
+            "description": "Optional internal HTTP(S) origin for server-side discovery/token/JWKS/UserInfo requests; public issuer and JWT validation remain unchanged"
+          },
+          "redirect_url": {
+            "type": "string",
+            "format": "uri",
+            "description": "HTTPS URL for an exact hostname in this Vhost and path /_rustproxy/oidc/callback"
+          },
+          "client_id": {
+            "type": "string",
+            "maxLength": 256
+          },
+          "client_secret": {
+            "type": "string",
+            "maxLength": 2048,
+            "description": "Confidential OIDC client secret; stored in Vhost configuration"
+          },
+          "session_secret": {
+            "type": "string",
+            "minLength": 32,
+            "maxLength": 4096,
+            "description": "High-entropy secret for encrypted session and temporary state cookies"
+          },
+          "scopes": {
+            "type": "string",
+            "default": "openid profile email"
+          },
+          "allow_private": {
+            "type": "boolean",
+            "default": false
+          },
+          "address_allowlist": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "tls_ca_pem": {
+            "type": "string",
+            "nullable": true
+          },
+          "connect_timeout_seconds": {
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 30,
+            "default": 5
+          },
+          "timeout_seconds": {
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 60,
+            "default": 10
+          },
+          "session_ttl_seconds": {
+            "type": "integer",
+            "minimum": 60,
+            "maximum": 86400,
+            "default": 3600
+          }
        }
      },
      "ForwardAuthConfig": {
@@ -475,17 +552,70 @@
        "description": "Per-Vhost Authelia or authentik verification. Disabled by default. All other settings are optional and use RustProxy defaults; when enabled, url must identify an internal HTTP(S) origin (or expected verifier path). Authelia additionally requires a public HTTPS login_url. External addresses retain normal safe upstream validation, with TLS verification always enabled for HTTPS.",
        "additionalProperties": false,
        "properties": {
-          "enabled": {"type": "boolean", "default": false},
-          "url": {"type": "string", "maxLength": 2048, "description": "Internal service/outpost origin or the provider's verifier endpoint"},
-          "login_url": {"type": "string", "maxLength": 2048, "description": "Required public HTTPS portal URL for Authelia; ignored for authentik"},
-          "allow_private": {"type": "boolean", "default": false},
-          "address_allowlist": {"type": "array", "maxItems": 32, "items": {"type": "string"}},
-          "tls_ca_pem": {"type": "string", "nullable": true},
-          "connect_timeout_seconds": {"type": "integer", "minimum": 1, "maximum": 30, "default": 5},
-          "timeout_seconds": {"type": "integer", "minimum": 1, "maximum": 60, "default": 10},
-          "request_headers": {"type": "array", "maxItems": 32, "items": {"type": "string", "maxLength": 128}, "description": "Only cookie, authorization, user-agent, accept, accept-language and x-api-key are allowed"},
-          "response_headers": {"type": "array", "maxItems": 32, "items": {"type": "string", "maxLength": 128}, "description": "Allowed Remote-*, X-Auth-Request-* and X-Authentik-* identity headers; total injected identity data capped at 8 KiB"},
-          "redirect_forbidden": {"type": "boolean", "default": false, "description": "Authelia only: accept trusted portal Location on explicit 403 if provided"}
+          "enabled": {
+            "type": "boolean",
+            "default": false
+          },
+          "url": {
+            "type": "string",
+            "maxLength": 2048,
+            "description": "Internal service/outpost origin or the provider's verifier endpoint"
+          },
+          "login_url": {
+            "type": "string",
+            "maxLength": 2048,
+            "description": "Required public HTTPS portal URL for Authelia; ignored for authentik"
+          },
+          "allow_private": {
+            "type": "boolean",
+            "default": false
+          },
+          "address_allowlist": {
+            "type": "array",
+            "maxItems": 32,
+            "items": {
+              "type": "string"
+            }
+          },
+          "tls_ca_pem": {
+            "type": "string",
+            "nullable": true
+          },
+          "connect_timeout_seconds": {
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 30,
+            "default": 5
+          },
+          "timeout_seconds": {
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 60,
+            "default": 10
+          },
+          "request_headers": {
+            "type": "array",
+            "maxItems": 32,
+            "items": {
+              "type": "string",
+              "maxLength": 128
+            },
+            "description": "Only cookie, authorization, user-agent, accept, accept-language and x-api-key are allowed"
+          },
+          "response_headers": {
+            "type": "array",
+            "maxItems": 32,
+            "items": {
+              "type": "string",
+              "maxLength": 128
+            },
+            "description": "Allowed Remote-*, X-Auth-Request-* and X-Authentik-* identity headers; total injected identity data capped at 8 KiB"
+          },
+          "redirect_forbidden": {
+            "type": "boolean",
+            "default": false,
+            "description": "Authelia only: accept trusted portal Location on explicit 403 if provided"
+          }
        }
      },
      "Vhost": {
@@ -591,8 +721,13 @@
            "$ref": "#/components/schemas/ForwardAuthConfig",
            "description": "authentik single-application forward auth. The URL is the internal outpost origin; RustProxy proxies its reserved path on the protected host. Disabled by default; mutually exclusive with basic_auth, tinyauth and authelia."
          },
-          "oidc": {"$ref": "#/components/schemas/OidcConfig"},
-          "authentication": {"$ref": "#/components/schemas/AuthenticationChoice", "description": "Optional provider/method selector. Set to null or omit for legacy Vhost data. It does not replace the existing provider-specific settings objects."},
+          "oidc": {
+            "$ref": "#/components/schemas/OidcConfig"
+          },
+          "authentication": {
+            "$ref": "#/components/schemas/AuthenticationChoice",
+            "description": "Optional provider/method selector. Set to null or omit for legacy Vhost data. It does not replace the existing provider-specific settings objects."
+          },
          "cache": {
            "type": "object",
            "properties": {
@@ -3687,6 +3822,11 @@
            "default": false,
            "description": "Account-scoped optional X/Y scales on sampled time-series charts. Shows the same Y range used to draw each SVG and X sample indices rather than inferred elapsed time; does not change adaptive scaling."
          },
+          "interface_icons": {
+            "type": "boolean",
+            "default": false,
+            "description": "Account-scoped administration UI preference. When enabled, semantic inline SVG icons are added to navigation, actions, tabs and dialogs while preserving text labels and accessibility."
+          },
          "button_style": {
            "type": "string",
            "enum": [
@@ -10414,7 +10554,7 @@
    },
    "/api/events": {
      "get": {
-        "summary": "Live SSE status and log snapshots",
+        "summary": "Live SSE status snapshots with optional logs",
        "tags": [
          "Monitoring"
        ],
@@ -10471,7 +10611,7 @@
            }
          }
        },
-        "description": "SSE snapshot events contain compact volatile status and bounded logs. Session validity is checked before each event. Native reconnect and keepalive apply. Each viewer selects 1/2/3/5/10 second pacing; invalid values return 422.",
+        "description": "SSE snapshot events always contain compact volatile status. Bounded recent logs are included by default for backward compatibility and can be disabled per viewer with logs=false; the administration panel disables them until Live Logs is open/docked and polls /api/logs only while that view is active. Session validity is checked before each event. Native reconnect and keepalive apply. Each viewer selects 1/2/3/5/10 second pacing; invalid values return 422.",
        "parameters": [
          {
            "name": "interval",
@@ -10489,6 +10629,16 @@
              ],
              "default": 3
            }
+          },
+          {
+            "name": "logs",
+            "in": "query",
+            "required": false,
+            "description": "Include the bounded live log snapshot in each SSE event. Defaults to true for API compatibility; the panel uses false and fetches logs only while Live Logs is active.",
+            "schema": {
+              "type": "boolean",
+              "default": true
+            }
          }
        ]
      }
@@ -14446,4 +14596,4 @@
    }
  },
  "tags": []
-}
+}