new-api

mirror of https://gh-proxy.org/https://github.com/klinsmaya/new-api.git synced 2026-11-09 01:47:07 +08:00

Files

T

CaIon 4924361aef feat(auth): edit the name and permissions of an access token

The token menu now opens an edit dialog instead of a rename prompt.
Renaming still needs no verification. Changing the permissions requires
step-up verification bound to the token id and the new grant, so a
proof cannot be replayed for another token or another set of
permissions; the grant is checked against what the owner can do, the
same as at creation. PATCH /api/user/access_tokens/:id takes an
optional scopes list and is rate limited like the other token routes.

A token that holds permissions the catalog no longer offers can still
be renamed and keeps them; a new grant only contains offered
permissions. Edit stays disabled until the permission catalog has
loaded.

Grant changes are audited as access_token.update with the previous and
new scopes, and audit details show both as permission names.

The permission picker for tokens and admin users now uses toggle
buttons. Token permissions are grouped by personal, administration and
system, each group collapsible with a selected count and select-all or
clear.

2026-09-30 20:52:36 +08:00

access_token_scope_test.go

feat(auth): replace the dashboard access token with scoped access tokens

2026-09-30 17:24:19 +08:00

api-router.go

feat(auth): edit the name and permissions of an access token

2026-09-30 20:52:36 +08:00

authz-router.go

feat: better admin permissions (#5755 )

2026-06-27 17:01:59 +08:00

channel_router_test.go

feat: vllm channel && sglang channel (#7332 )