Marc-André BombeckandClaude Opus 4.7 54f689247e feat(auth): accept Bearer tokens for headless API clients ...

`requireAuth()` keeps the existing cookie-session path as the primary check;
when no session cookie is present it now falls back to validating
`Authorization: Bearer hlk_*` against the existing `ApiToken` table
(HMAC-SHA-256 hash, expiry + revocation enforced).

Behaviour for browser clients is unchanged — the cookie path runs first
and short-circuits before the header lookup. `requireAdmin()` stays
cookie-only by design.

Wide-Event annotation tags `auth_method: "bearer"` so the source is
distinguishable in Loki. `auth.bearer.success` and `auth.bearer.failure`
audit entries record the token id + reason.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-03 21:51:54 +02:00

..

background.ts

Initial release v1.0.0

2026-03-10 20:14:33 +01:00

config.ts

Initial release v1.0.0

2026-03-10 20:14:33 +01:00

context.ts

Initial release v1.0.0

2026-03-10 20:14:33 +01:00

event-builder.ts

Initial release v1.0.0

2026-03-10 20:14:33 +01:00

index.ts

Initial release v1.0.0

2026-03-10 20:14:33 +01:00

sampler.ts

Initial release v1.0.0

2026-03-10 20:14:33 +01:00

transports.ts

Initial release v1.0.0

2026-03-10 20:14:33 +01:00

types.ts

feat(auth): accept Bearer tokens for headless API clients

2026-05-03 21:51:54 +02:00